chore(governance): enable duplicate-detection advisory mode and adopt pm-cli 2026.7.25

[unbraind]

Why

pm-cli 2026.7.25 added create-time near-duplicate detection, but it ships disabled by default (governance.duplicate_detection_mode = "off"). Without this setting, agents filing items in our packages create exact-title duplicates silently. The companion hub tracker already runs advisory mode and it is verified working.

advisory mode is non-blocking by design: it appends a likely_duplicates:<id> warning and never fails a create. That is intentional — strict mode is not used.

This change also bumps the @unbrained/pm-cli devDependency to ^2026.7.25, where the similarity SDK module lives.

Changes

• Enabled governance.duplicate_detection_mode = "advisory" in .agents/pm/settings.json
• Bumped @unbrained/pm-cli in devDependencies (^2026.7.22 → ^2026.7.25). peerDependencies left at >=2026.7.20 (intentionally wider).

Observed warning (probe verification)

The setting was verified in a throwaway workspace seeded with the repo's real settings.json. The second identical pm create returned:

"warnings": ["likely_duplicates:pm-github-x9et"]

Gate results

• npm run typecheck: ✅ pass
• npm test: ✅ 168/168 pass
• npm run changelog:full: ✅ ok
• npm run changelog:check: ✅ ok

pm item

Resolves: https://github.com/unbraind/pm-github/blob/main/.agents/pm/chores/pm-github-suxt.toon

---

Summary by cubic

Enable near-duplicate detection for PM item creation in advisory mode so agents see non-blocking "likely_duplicates:" warnings. Also bump @unbrained/pm-cli to ^2026.7.25; restore validation.parent_reference to warn and pin governance preset to custom to avoid a silent flip to strict_error.

^{Written for commit 5487389. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[sourcery-ai]

Sorry @unbraind, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Warning

Review limit reached

@unbraind, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2e2b659d-a9ca-4a90-950b-b923a72d79ef

📥 Commits

Reviewing files that changed from the base of the PR and between 57830b1 and 5487389.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• .agents/pm/chores/pm-github-suxt.toon
• .agents/pm/history/_workspace.jsonl
• .agents/pm/history/pm-github-suxt.jsonl
• .agents/pm/settings.json
• CHANGELOG.md
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/duplicate-detection-advisory-pm-cli-2026-7-25

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[unbraind]

Follow-up commit: restored parent_reference=warn

Pushed a second commit to this branch. Reviewers should know why the settings diff is larger than a one-key change.

Enabling advisory mode with pm config set had an unintended side effect: the settings rewrite re-derived validation.parent_reference from the governance preset and silently discarded the stored warn, flipping it to strict_error. Nothing warned — the command reported only changed: true for the key requested, and the tightening arrived buried in a rewrite that also materialized newly-added default keys.

Greptile caught this on pm-presets#29. I then isolated the mechanism on a clean 2026.7.25 workspace: it happens under any named preset — minimal, default and strict all confirmed — and only preset: "custom" preserves a stored value. Filed upstream as pm-cli#710.

warn is the correct policy for this fleet: these repos are worked by multiple agents on parallel branches where an item legitimately references a parent that exists only on another branch until the merge lands. Under strict_error that pm create --parent hard-fails.

Because a stored value is not authoritative under a named preset, the value is set through pm config set parent_reference_policy warn, which pins governance explicitly as custom. That is the durable form and it also prevents any future CLI default change from silently altering this policy. Verified the promotion materializes this repo's own preset values, so parent_reference is the only behavioural key that differs from main.

Two repos were deliberately left alone because main already had strict_error and nothing changed for them: pm-changelog and pm-ops.