Fix import ownership, closeout rules and release timeout diagnostics

.agents/pm/issues/pm-github-b141.toon

@@ -0,0 +1,27 @@
+id: pm-github-b141
+title: Reject malformed effective-rule discriminators before closeout
+description: "Fix GitHub issue #141: malformed rule type cannot establish readable-empty or declared policy; require zero durable writes on refusal."
+type: Issue
+status: in_progress
+priority: 1
+tags[2]: changelog-unreleased,"gh:unbraind/pm-github#141"
+created_at: "2026-10-18T04:05:25.251Z"
+updated_at: "2026-10-18T10:42:30.410Z"
+author: codex-agent
+comments[8]{created_at,author,text}:
+  "2026-10-18T04:05:38.030Z",codex-agent,"Round 1: issue read in full; searched existing tracker and no issue-specific import exists. Implement in fix/import-and-release-issues from origin/main; add behavioral revert proof and run unchanged npm and Bun release gates with isolated CI identity."
+  "2026-10-18T04:09:09.240Z",codex-agent,"Validate each effective rule type as a nonempty string before accepting it as unrelated policy. New real-tracker matrix reproduces unsafe closure for missing/null/numeric/object/empty types and a hidden required-check row, in both readable-empty and declared-policy modes: baseline fails 12/12. Fixed refusals must retain byte-identical durable tracker state; valid deletion rules retain fallback."
+  "2026-10-18T04:09:56.876Z",codex-agent,"Isolated revert proof: restore only closeout.ts to origin/main with all new tests retained; the missing-type/readable-empty regression fails because closed=1. Restore the fix: all 12 malformed discriminator cases refuse with byte-identical durable files and the unrelated-rule control passes. Combined real-tracker acceptance passes 23/23, zero skips."
+  "2026-10-18T04:57:10.354Z",codex-agent,"Issue #141: 13/13 real-SDK policy fixtures pass with zero durable writes on all 12 malformed refusals; the isolated closeout.ts revert fails 1/1. Both full CI release commands PASS at 956ae58201a9058f19fab2ca6e265b7426374639: npm run release:check and bun run release:check each pass 824/824, zero failures/skips/cancellations/todos, exact 100/100/100/100 coverage across 14 authored modules. Isolated HOME and global/system Git identity were enforced. Receipts: https://github.com/unbraind/pm-github/actions/runs/39098074518/job/117588542763 and https://github.com/unbraind/pm-github/actions/runs/39098074518/job/117588542909 . Remove the temporary validation workflow; implementation/tests remain unchanged. Regenerate the changelog after ALL final tracker writes. Item remains in progress and unclaimed for orchestrator verification."
+  "2026-10-18T06:51:49.425Z",codex-agent,"PR #148 follow-up after merging current main: no unresolved review threads or substantive CodeRabbit review are present. Existing implementation and behavioral revert proofs are unchanged. Re-run this item's linked real regression command and collect both exact isolated npm/Bun release receipts; retain Fixes links and leave closure to the orchestrator."
+  "2026-10-18T06:58:50.345Z",codex-agent,"PR #148 integration validation: the linked malformed-rule and valid-unrelated-rule command passes 13/13. Exact npm run release:check and bun run release:check both pass 836/836 at 762285d94e90e645927b90e8032292c191772b49, zero failures/skips/cancellations/todos, all 14 authored modules at exact 100/100/100/100. Existing behavioral revert proof and implementation remain unchanged. Fresh-clone strict health passes. Full gate receipts: actions/runs/39105101037. No CodeRabbit review is available yet; final CI will be recorded in the PR body."
+  "2026-10-18T09:38:08.612Z",codex-agent,"PR #148 review round: merged current main (#146/#147). No new malformed-policy finding in the complete review or open issues. Original #141 fix and revert evidence retained; repeat linked regression and both complete release gates after the ownership fix."
+  "2026-10-18T10:42:28.446Z",codex-agent,"PR #148 final review receipt: original malformed-policy fix retained after merging #146/#147. Linked malformed-rule/valid-unrelated real-SDK regressions PASS 13/13. Original production-only revert proof remains recorded. Exact isolated npm run release:check and bun run release:check both PASS: 893/893 tests, zero failures/skips/cancellations/todos, exact 100/100/100/100 coverage across 14 authored modules, unchanged thresholds. Hosted receipts: https://github.com/unbraind/pm-github/actions/runs/39119457879 (npm job 117651896197; Bun job 117651896368). Validation commit 059e4f0ed9308c9970ee4af6df941fcda8afe804 differs from source commit 0b6d7cb3eef2d056adecd4c44fa47817b177e6c3 only by a temporary validation workflow. Final-head CI will be reported in the PR. Claims released without closing items; orchestrator owns closure."
+files[2]{path,scope}:
+  closeout.ts,project
+  test/closeout.test.ts,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  node --test --test-name-pattern='malformed rule discriminator|valid unrelated effective rule' test/closeout.test.ts,project,codex-agent,"2026-10-18T04:07:29.618Z",local_mutation,fix/import-and-release-issues
+docs[1]{path,scope}:
+  README.md,project
+body: ""

.agents/pm/issues/pm-github-b143.toon

@@ -0,0 +1,31 @@
+id: pm-github-b143
+title: Preserve legacy GitHub ownership across copied provider examples
+description: Fix GitHub issue #143 with real plain and atomic SDK import migration regressions; preserve authoritative external provider ownership.
+type: Issue
+status: in_progress
+priority: 1
+tags[2]: changelog-unreleased,"gh:unbraind/pm-github#143"
+created_at: "2026-10-18T04:05:23.678Z"
+updated_at: "2026-10-18T10:42:34.458Z"
+author: codex-agent
+comments[11]{created_at,author,text}:
+  "2026-10-18T04:05:33.037Z",codex-agent,"Round 1: issue read in full; searched existing tracker and no issue-specific import exists. Implement in fix/import-and-release-issues from origin/main; add behavioral revert proof and run unchanged npm and Bun release gates with isolated CI identity."
+  "2026-10-18T04:09:03.582Z",codex-agent,"Legacy gh provenance now excludes copied body/label provider hints while explicit provider identities, descriptors and exporter description provenance stay authoritative. Baseline with new tests: 4/4 plain/atomic copied-body/label migrations fail. Each fixture checks native title/status/lifetime and GitHub ownership on retry; six external-owner controls preserve their owner."
+  "2026-10-18T04:09:51.096Z",codex-agent,"Isolated revert proof: restore only import-fidelity.ts to origin/main with new tests unchanged; all 4/4 copied-body/label migration tests fail on stale native title. Restore the fix: combined real-tracker acceptance passes 23/23 (10 legacy ownership/control cases plus 13 closeout cases), zero skips."
+  "2026-10-18T04:57:07.381Z",codex-agent,"Issue #143: 10/10 real-SDK legacy/control fixtures pass; reverting only import-fidelity.ts fails all 4/4 migration cases. Both full CI release commands PASS at 956ae58201a9058f19fab2ca6e265b7426374639: npm run release:check and bun run release:check each pass 824/824, zero failures/skips/cancellations/todos, exact 100/100/100/100 coverage across 14 authored modules. Isolated HOME and global/system Git identity were enforced. Receipts: https://github.com/unbraind/pm-github/actions/runs/39098074518/job/117588542763 and https://github.com/unbraind/pm-github/actions/runs/39098074518/job/117588542909 . Remove the temporary validation workflow; implementation/tests remain unchanged. Regenerate the changelog after ALL final tracker writes. Item remains in progress and unclaimed for orchestrator verification."
+  "2026-10-18T06:53:56.244Z",codex-agent,"PR #148 follow-up after merging current main: no unresolved review threads or substantive CodeRabbit review are present. Existing implementation and behavioral revert proofs are unchanged. Re-run this item's linked real regression command and collect both exact isolated npm/Bun release receipts; retain Fixes links and leave closure to the orchestrator."
+  "2026-10-18T06:58:59.229Z",codex-agent,"PR #148 integration validation: the linked legacy GitHub ownership command passes 10/10. Both exact isolated-identity npm/Bun release gates pass 836/836 at 762285d94e90e645927b90e8032292c191772b49, with complete 100/100/100/100 coverage across 14 modules. Existing behavioral revert proof and implementation remain unchanged. Fresh-clone strict health passes. Full gate receipts: actions/runs/39105101037. No CodeRabbit review is available yet; final CI will be recorded in the PR body."
+  "2026-10-18T09:36:33.654Z",codex-agent,"PR #148 review round: merged origin/main including #146 and #147 before implementation. Read the one unresolved CodeRabbit thread and latest complete review; all open issues inspected, with #141/#143/#145 retaining body closing links. Confirmed provider-only descriptor is omitted from ownership text. Add plain/atomic real-tracker retry regressions without external_url, prove failure with only the fix reverted, then run isolated npm and Bun release gates."
+  "2026-10-18T09:39:34.311Z",codex-agent,"CodeRabbit thread PRRT_kwDOTbN4pM6to9nE: include declared provider in providerProvenance ownership text. New plain/atomic real-SDK cases omit external_url and github_link_only, preserve native title/status/lifecycle/release/body/tags and one owner over two retries. Behavioral revert proof: restored only the changed providerProvenance predicate with tests retained; 2/2 cases failed on overwritten native title (exit 1). Restoring the fix passes both; combined legacy/provider matrix passes 12/12. Command: node --test --test-name-pattern=\"provider-only descriptor\" test/import-fidelity.test.ts. No history rewrite or receipt reconciliation was needed; this merge generated no receipts."
+  "2026-10-18T10:21:24.132Z",codex-agent,"Validation moved to isolated GitHub-hosted runners after shared-host contention made workflow acceptance cases take minutes each. Temporary validation branch commit 4790a23983261583055791ad951ed47211d69770 differs from PR source commit 0b6d7cb3eef2d056adecd4c44fa47817b177e6c3 only by its validation workflow; implementation/tests/tracker/dependency pins are identical. Exact isolated npm run release:check and bun run release:check are running at actions/runs/39118834540; strict tracker health passed in both jobs. Duplicate local full runs were stopped as incomplete, without observed failures; they are not passing gate evidence."
+  "2026-10-18T10:29:47.237Z",codex-agent,"First hosted validation attempt exposed an error in the temporary validation workflow: the attestation auditor correctly rejects a matrix expression in command position. npm completed 893 tests with 892 passes and only the own-workflows attestation test failing; source coverage remained exactly 100/100/100/100. Replaced the temporary workflow command with literal npm and bun invocations and verified it with the canonical auditor locally. Validation head is now 059e4f0ed9308c9970ee4af6df941fcda8afe804; only the temporary workflow differs from source commit 0b6d7cb3eef2d056adecd4c44fa47817b177e6c3. No PR production code or tests changed. Superseded validation is not approval or passing gate evidence."
+  "2026-10-18T10:42:32.509Z",codex-agent,"PR #148 final review receipt: CodeRabbit provider-only descriptor finding fixed in 0b6d7cb3eef2d056adecd4c44fa47817b177e6c3. Linked legacy ownership cases PASS 10/10 and provider-only cases PASS 2/2, preserving native fields/tags and one owner on retry. Reverting only the changed providerProvenance predicate makes both new tests fail; restoring it passes. Thread will receive sha/test reply after pushing and remain unresolved as requested. Exact isolated npm run release:check and bun run release:check both PASS: 893/893 tests, zero failures/skips/cancellations/todos, exact 100/100/100/100 coverage across 14 authored modules, unchanged thresholds. Hosted receipts: https://github.com/unbraind/pm-github/actions/runs/39119457879 (npm job 117651896197; Bun job 117651896368). Validation commit 059e4f0ed9308c9970ee4af6df941fcda8afe804 differs from source commit 0b6d7cb3eef2d056adecd4c44fa47817b177e6c3 only by a temporary validation workflow. Final-head CI will be reported in the PR. Claims released without closing items; orchestrator owns closure."
+files[2]{path,scope}:
+  import-fidelity.ts,project
+  test/import-fidelity.test.ts,project
+tests[2]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  node --test --test-name-pattern='legacy GitHub' test/import-fidelity.test.ts,project,codex-agent,"2026-10-18T04:07:16.280Z",local_mutation,fix/import-and-release-issues
+  node --test --test-name-pattern='provider-only descriptor' test/import-fidelity.test.ts,project,codex-agent,"2026-10-18T09:38:04.909Z",local_mutation,fix/import-and-release-issues
+docs[1]{path,scope}:
+  README.md,project
+body: ""

.agents/pm/issues/pm-github-b145.toon

@@ -0,0 +1,28 @@
+id: pm-github-b145
+title: Release timeout must report current workflow approval state
+description: "Fix GitHub issue #145: stale approval state and unavailable workflow-run reads misdiagnose release timeouts. Preserve protected merge and publication boundaries."
+type: Issue
+status: in_progress
+priority: 1
+tags[2]: changelog-unreleased,"gh:unbraind/pm-github#145"
+created_at: "2026-10-18T04:05:21.907Z"
+updated_at: "2026-10-18T10:42:39.792Z"
+author: codex-agent
+comments[9]{created_at,author,text}:
+  "2026-10-18T04:05:29.333Z",codex-agent,"Round 1: issue read in full; searched existing tracker and no issue-specific import exists. Implement in fix/import-and-release-issues from origin/main; add behavioral revert proof and run unchanged npm and Bun release gates with isolated CI identity."
+  "2026-10-18T04:08:58.091Z",codex-agent,"Implemented current-poll approval state with a separate unavailable state; successful empty reads clear old approval observations. Actual release-loop shell regressions cover pending-to-running timeout, still-pending timeout with run URL, API read failure, and subsequent verified merge. Reverting only release.yml with tests retained fails 2/4; restored shell passes 4/4. No live merge or publication was performed."
+  "2026-10-18T04:21:53.302Z",codex-agent,Run the unchanged npm and Bun release gates on isolated GitHub runners using a temporary read-only validation workflow while local gates continue. Remove the workflow after collecting exact source-head receipts.
+  "2026-10-18T04:43:04.458Z",codex-agent,"CI at 7a1b616 passed 824/824 tests and exact 100/100/100/100 coverage across 14 authored modules in both npm and Bun release commands, then refused the stale generated changelog ordering. The temporary validation note changed item ordering after generation. Regenerate after every tracker write, verify changelog:check, and rerun both full gates; these runs are failed gate evidence, not acceptance."
+  "2026-10-18T04:57:04.097Z",codex-agent,"Issue #145: actual release-loop shell passes 4/4; reverting only release.yml fails 2/4. Pending-to-running, current pending approval, unavailable reads and later successful merge are covered. Both full CI release commands PASS at 956ae58201a9058f19fab2ca6e265b7426374639: npm run release:check and bun run release:check each pass 824/824, zero failures/skips/cancellations/todos, exact 100/100/100/100 coverage across 14 authored modules. Isolated HOME and global/system Git identity were enforced. Receipts: https://github.com/unbraind/pm-github/actions/runs/39098074518/job/117588542763 and https://github.com/unbraind/pm-github/actions/runs/39098074518/job/117588542909 . Remove the temporary validation workflow; implementation/tests remain unchanged. Regenerate the changelog after ALL final tracker writes. Item remains in progress and unclaimed for orchestrator verification."
+  "2026-10-18T06:38:48.739Z",codex-agent,"PR #148 review follow-up: no review threads and no CodeRabbit review are present. Read all reviews and all open repository issues; #141/#143/#145 remain linked in the PR body. Merged current main attestation compatibility, with no tracker overlap or merge receipts. Revalidate isolated npm and Bun release checks and fresh-clone strict health, and check review threads again after PR #146."
+  "2026-10-18T06:59:08.205Z",codex-agent,"PR #148 integration validation: linked approval-state regressions pass 4/4. Exact npm and Bun release commands pass 836/836 each at 762285d94e90e645927b90e8032292c191772b49, zero failures/skips/cancellations/todos, all 14 authored modules at exact 100/100/100/100. Fresh-clone strict health passes. Gate receipts: https://github.com/unbraind/pm-github/actions/runs/39105101037 (npm job 117609117351, Bun job 117609117576). Remove the temporary validation workflow; final code, tests, scripts, docs and dependency pins remain identical. No unresolved review threads or substantive CodeRabbit review are present; absent review is not approval. Final-head CI will be recorded in the PR body. No merge or release performed."
+  "2026-10-18T09:38:12.757Z",codex-agent,"PR #148 review round: merged current main (#146/#147). No new approval-state finding in the complete review or open issues. Original #145 fix and revert evidence retained; repeat linked regression and both complete release gates after the ownership fix."
+  "2026-10-18T10:42:36.521Z",codex-agent,"PR #148 final review receipt: original current-approval-state diagnostic fix retained after merging #146/#147. Linked approval transition regressions PASS 4/4. Original production-only revert proof remains recorded. Exact isolated npm run release:check and bun run release:check both PASS: 893/893 tests, zero failures/skips/cancellations/todos, exact 100/100/100/100 coverage across 14 authored modules, unchanged thresholds. Hosted receipts: https://github.com/unbraind/pm-github/actions/runs/39119457879 (npm job 117651896197; Bun job 117651896368). Validation commit 059e4f0ed9308c9970ee4af6df941fcda8afe804 differs from source commit 0b6d7cb3eef2d056adecd4c44fa47817b177e6c3 only by a temporary validation workflow. Final-head CI will be reported in the PR. Claims released without closing items; orchestrator owns closure."
+files[2]{path,scope}:
+  .github/workflows/release.yml,project
+  test/release-approval.test.ts,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  node --test test/release-approval.test.ts,project,codex-agent,"2026-10-18T04:07:04.437Z",local_mutation,fix/import-and-release-issues
+docs[1]{path,scope}:
+  README.md,project
+body: ""