Close 28 tracker items already delivered on main

.agents/pm/chores/pm-github-6vcq.toon

@@ -2,13 +2,16 @@ id: pm-github-6vcq
 title: Certify pm-github with PM CLI SDK 2026.9.26
 description: "Refresh the extension development SDK and release tools to current published PM CLI, pm-changelog, and pm-ops versions. Preserve the supported host compatibility floor unless a real API incompatibility requires a change. Verify the canonical merge-driver launcher, full release gate, and real GitHub issue import contract."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags: []
 created_at: "2026-09-26T16:33:06.566Z"
-updated_at: "2026-10-02T23:36:02.502Z"
+updated_at: "2026-10-21T19:04:08.971Z"
+closed_at: "2026-10-21T19:04:05.099Z"
+completed_at: "2026-10-21T19:04:05.099Z"
 author: codex
 acceptance_criteria: "Manifest and lockfile exact-pin the current developer SDK and release-tool versions; installed package readback matches; canonical pm-ops launcher is copied byte for byte; release:check, strict PM health, and a real issue-import dry run pass; source and hosted user data stay outside the public diff."
+resolution: "Reverified main eebda9277e52 (unchanged since audit): [PR #99](https://github.com/unbraind/pm-github/pull/99) (31072de) delivered the dated certification. Current package.json/lockfile have subsequent toolchain updates; historical certification is not a claim of current exact-head acceptance. Retained evidence: scripts/prepare-merge-driver.ts, test/prepare-merge-driver.test.ts."
 actual_result: "npm ci and npm run release:check PASS: 308/308 tests, zero skipped; configured lines/branches/functions 92.57/82.94/92.27 across two measured sources, retaining existing 88/79/89 floors. Typecheck/build/docstrings/privacy/production audit/pack/changelog/attestation pass; all-dependency audit zero; Bun install and strict CI health pass. Reviewed/acknowledged linked-test provenance; actual launcher run passes 7/7, correcting the preceding receipt count through appended history. pm validate retains existing advisory metadata/link findings. Exact 100 percent all-source coverage remains open in pm-github-9cjx. Historical issue-35 completion retained. Final-head CI and substantive review remain separate; item released in_progress, no closure or publication."
 comments[8]:
   - created_at: "2026-09-28T05:54:00.603Z"
@@ -51,4 +54,5 @@ tests[2]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,
   node --test test/prepare-merge-driver.test.ts,project,120,codex,"2026-09-26T16:55:15.403Z",local_mutation,chore/pm-github-sdk-2026-9-26
 docs[1]{path,scope}:
   README.md,project
+close_reason: "Reverified main eebda9277e52 (unchanged since audit): [PR #99](https://github.com/unbraind/pm-github/pull/99) (31072de) delivered the dated certification. Current package.json/lockfile have subsequent toolchain updates; historical certification is not a claim of current exact-head acceptance. Retained evidence: scripts/prepare-merge-driver.ts, test/prepare-merge-driver.test.ts."
 body: ""

.agents/pm/chores/pm-github-julo.toon

@@ -2,13 +2,16 @@ id: pm-github-julo
 title: Certify pm-github on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates
 description: "Raise the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops 2026.10.4 (pm-changelog already at 2026.9.25); consolidate Dependabot #101 (pm-cli), #102 (@types/node), #103 (pm-ops) and #104 (codeql-action pinned SHA group 2892aa5); keep the canonical pm-ops merge-driver launcher byte-identical; certify with the full release gate plus isolated real-tracker dogfooding of the read-only GitHub surfaces via npm and Bun."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags[4]: cli,dependencies,release-readiness,sdk
 created_at: "2026-10-04T10:20:50.548Z"
-updated_at: "2026-10-18T04:13:47.598Z"
+updated_at: "2026-10-21T19:00:18.811Z"
+closed_at: "2026-10-21T19:00:15.092Z"
+completed_at: "2026-10-21T19:00:15.092Z"
 author: pi-glm
 acceptance_criteria: "npm run release:check passes (privacy, docstring, coverage gates intact); pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises validate/import/export-preview/sync-preview against a real repo read-only via npx @unbrained/pm-cli@2026.10.4 and bunx with zero GitHub mutation"
+resolution: "Reverified main eebda9277e52 (unchanged since audit): [PR #106](https://github.com/unbraind/pm-github/pull/106) (888b29f) delivered the dated certification. Current package.json/lockfile have subsequent toolchain updates; historical certification is not a claim of current exact-head acceptance. Retained evidence: scripts/prepare-merge-driver.ts, test/prepare-merge-driver.test.ts."
 actual_result: "Exact CLI/ops/changelog 2026.10.4 and development pins; canonical launcher unchanged; isolated lookup-loop suite 8/8. Clean npm ci and serialized release:check PASS 309/309, zero skips, unchanged coverage and privacy gate passed; both audit scopes 0, no open alerts. Packed own-tracker npx/bunx read-only commands pass (108 create + 1 update export preview, sync planned 1 / wouldSync 0 / skipped 1), no GitHub writes; scratch removed. Health exits 0 with stale_in_progress_items:2 advisory and no gate-failing findings, correcting the earlier zero-warning text. CodeRabbit and Greptile substantive reviews find no new actionable issues; other required reviews unavailable/pending. Leave item and PR open."
 comments[8]{created_at,author,text}:
   "2026-10-04T10:21:00.651Z",pi-glm,"Starting at 2daff95 (Release pm-github v2026.10.04). Plan: pm-cli 2026.9.26->2026.10.4, pm-ops 2026.9.28->2026.10.4, @types/node ->26.6.4 in range, codeql-action SHA group 1c5b6756->2892aa5 from #104; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood (validate/import/export dry-run/sync dry-run) + previews."
@@ -79,4 +82,5 @@ tests[6]:
       created_at: "2026-10-04T11:19:02.787Z"
       source_kind: local_mutation
       source_ref: chore/pm-github-pm-cli-2026-10-4
+close_reason: "Reverified main eebda9277e52 (unchanged since audit): [PR #106](https://github.com/unbraind/pm-github/pull/106) (888b29f) delivered the dated certification. Current package.json/lockfile have subsequent toolchain updates; historical certification is not a claim of current exact-head acceptance. Retained evidence: scripts/prepare-merge-driver.ts, test/prepare-merge-driver.test.ts."
 body: ""

.agents/pm/chores/pm-github-sx18.toon

@@ -2,12 +2,15 @@ id: pm-github-sx18
 title: Enable GitHub CodeQL code scanning
 description: "Add .github/workflows/codeql.yml (javascript-typescript, build-mode none, weekly staggered schedule). GET code-scanning/alerts returned 404 no-analysis-found, so the Security tab could not distinguish clean from never-ran. Advisory check only, not added to branch protection."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags: []
 created_at: "2026-08-22T17:43:42.366Z"
-updated_at: "2026-08-22T18:00:00.764Z"
+updated_at: "2026-10-21T19:04:49.153Z"
+closed_at: "2026-10-21T19:04:45.156Z"
+completed_at: "2026-10-21T19:04:45.156Z"
 author: "harness:ox-alpha"
+resolution: "Reverified main eebda9277e52 (unchanged since audit): .github/workflows/codeql.yml exists on main and registers code scanning; the item asks to enable this workflow, not to certify all security properties. Retained evidence: .github/workflows/codeql.yml."
 notes[1]{created_at,author,text}:
   "2026-08-22T17:43:54.385Z","harness:ox-alpha","Verified 2026-08-22: gh api repos/unbraind/pm-github/code-scanning/alerts -> 404 'no analysis found'. Workflow pins github/codeql-action v4 (fleet major-tag convention), permissions limited to security-events:write/actions:read/contents:read."
 files[1]{path,scope,note}:
@@ -21,4 +24,5 @@ tests[2]:
     scope: project
     assert_stdout_regex[1]: "^[1-9][0-9]*$"
     note: "At least one CodeQL analysis must exist. Deliberately queries /analyses, not /alerts: an empty /alerts array is ambiguous between analysed-and-clean and never-analysed, and that ambiguity is the exact defect this change removes. /analyses answers did-a-scan-run directly, so a clean repo passes and an unscanned one fails closed with HTTP 404."
+close_reason: "Reverified main eebda9277e52 (unchanged since audit): .github/workflows/codeql.yml exists on main and registers code scanning; the item asks to enable this workflow, not to certify all security properties. Retained evidence: .github/workflows/codeql.yml."
 body: ""

.agents/pm/features/pm-github-c093.toon

@@ -2,12 +2,15 @@ id: pm-github-c093
 title: "Preserve imported GitHub lifetimes, closure evidence and release attribution while linking cross-provider items"
 description: "Repair the import root cause behind twelve Sourcery findings across six gated sync PRs. Preserve source timestamps through supported SDK metadata, map closure reasons and evidence, select tag-date release windows, report state conflicts, and link existing provider owners before creating items. Verify with recorded API fixtures and real temporary trackers at unchanged release gates."
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags[4]: changelog-unreleased,fidelity,github,import
 created_at: "2026-10-16T22:29:39.865Z"
-updated_at: "2026-10-18T22:04:28.505Z"
+updated_at: "2026-10-21T18:58:21.454Z"
+closed_at: "2026-10-21T18:58:15.844Z"
+completed_at: "2026-10-21T18:58:15.844Z"
 author: codex-agent
+resolution: "Reverified main eebda9277e52 (unchanged since audit): [PR #142](https://github.com/unbraind/pm-github/pull/142) (ed0e3d6), with ownership correction #148 and native-owner reuse #158, preserves source lifecycle dates/reasons and provider ownership. Retained evidence: import-fidelity.ts, index.ts, test/atomic.test.ts."
 comments[40]{created_at,author,text}:
   "2026-10-16T22:30:04.918Z",codex-agent,"Read all twelve unresolved Sourcery threads and the changed tracker/changelog files in the six consumer sync PRs. Scope: fix import only; preserve append-only history and leave unrelated closeout work untouched. The pinned SDK exposes completedAt but reserves created_at, updated_at and closed_at; source timestamp metadata plus an explicit SDK-gap receipt is required unless a supported import path proves otherwise. No upstream SDK issue will be filed under the queue rules."
   "2026-10-16T22:35:10.689Z",codex-agent,"Found public SDK import primitives beyond high-level create/update: item locks, canonical document serialization, before/after history entries and appendHistoryEntry. Implementing an idempotent finalization event with real native dates and source metadata, without modifying any historical record. Existing provider owners receive provenance links only; their content, native lifecycle, release and export identity remain authoritative. Local Git calendar tag dates select the first release at or after source closure; later closures remain pending. GraphQL ClosedEvent closer provides actual closing PR attribution where REST commit_id is null."
@@ -90,4 +93,5 @@ tests[3]:
 docs[2]{path,scope}:
   docs/daily-release-refresh.md,project
   README.md,project
+close_reason: "Reverified main eebda9277e52 (unchanged since audit): [PR #142](https://github.com/unbraind/pm-github/pull/142) (ed0e3d6), with ownership correction #148 and native-owner reuse #158, preserves source lifecycle dates/reasons and provider ownership. Retained evidence: import-fidelity.ts, index.ts, test/atomic.test.ts."
 body: ""

.agents/pm/features/pm-github-ullj.toon

@@ -2,12 +2,15 @@ id: pm-github-ullj
 title: Refresh only already-linked GitHub items without importing new ones
 description: "Select explicit existing provenance, fetch linked issue numbers in GraphQL batches, reuse import lifecycle mapping, and apply audited update-only SDK transactions. Prove selection, zero creation, real lifecycle dates, missing reasons, dry-run immutability, and batch splitting."
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags[3]: changelog-unreleased,github,refresh
 created_at: "2026-10-19T16:13:56.599Z"
-updated_at: "2026-10-20T05:15:16.933Z"
+updated_at: "2026-10-21T18:57:35.673Z"
+closed_at: "2026-10-21T18:57:32.566Z"
+completed_at: "2026-10-21T18:57:32.566Z"
 author: codex-agent
+resolution: "Reverified main eebda9277e52 (unchanged since audit): [PR #154](https://github.com/unbraind/pm-github/pull/154) (c651421) adds already-linked-only refresh, batch fetches and audited update-only mutations. Retained evidence: import-fidelity.ts, index.ts, refresh.ts."
 comments[47]{created_at,author,text}:
   "2026-10-19T16:14:11.328Z",codex-agent,"Plan: reuse prepareGithubImport, source lifecycle projection and importGithubAtomic. Refresh selects explicit tag or github_url identities before transport, batches at 100, and supplies a guarded update-only transaction mode with native audit comments. Real tracker tests fake only HTTP; live acceptance uses scratch copies only."
   "2026-10-19T16:20:35.265Z",codex-agent,"Implementation uses shared import preparation, shared source-metadata projection, and guarded SDK update transactions. Dry-run acceptance exposed that complete-list SDK reads populate runtime caches; preview reads now use disposable copies so the selected tracker is byte-identical. The pinned SDK exposes no cache-write suppression option; this SDK UX limitation will be reported in the final summary."
@@ -112,4 +115,5 @@ tests[5]:
 docs[2]{path,scope}:
   docs/refresh-idempotency.md,project
   README.md,project
+close_reason: "Reverified main eebda9277e52 (unchanged since audit): [PR #154](https://github.com/unbraind/pm-github/pull/154) (c651421) adds already-linked-only refresh, batch fetches and audited update-only mutations. Retained evidence: import-fidelity.ts, index.ts, refresh.ts."
 body: ""

.agents/pm/features/pm-github-znig.toon

@@ -2,13 +2,16 @@ id: pm-github-znig
 title: Let reusable workflows carry their own release version
 description: Resolve reusable sync and closeout package versions at runtime from the release tag on documented job.workflow_sha. Public git ls-remote handles lightweight and peeled annotated tags without new credentials. Exact legacy-input fallback is deprecated and only allowed when no release tag matches; otherwise fail closed or warn and use the tag version. Restore release.yml token behavior without stamping or GitHub App setup. Retain daily Dependabot SHA updates and caller templates without version input. No caller repins or release dispatch.
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags: []
 created_at: "2026-10-16T12:47:09.319Z"
-updated_at: "2026-10-16T15:28:48.086Z"
+updated_at: "2026-10-21T19:01:09.325Z"
+closed_at: "2026-10-21T19:01:02.055Z"
+completed_at: "2026-10-21T19:01:02.055Z"
 author: codex-agent
 acceptance_criteria: "Real workflow bash contracts prove tag and peeled-tag matching, exact installs, no-match legacy fallback, fail-closed absent fallback, mismatch warnings and injection safety; npm and Bun release checks pass at unchanged thresholds; release stamping and app minting are removed."
+resolution: "Reverified main eebda9277e52 (unchanged since audit): [PR #139](https://github.com/unbraind/pm-github/pull/139) (6d9cc23) resolves reusable workflow release versions at runtime from job.workflow_sha and release tags. Retained evidence: test/import-gate.test.ts, test/self-versioned-workflows.test.ts."
 comments[11]{created_at,author,text}:
   "2026-10-16T12:47:21.478Z",codex-agent,"Design: release preparation stamps both reusable workflow input defaults and literal PM_GITHUB_VERSION job values from the prepared package version, before release checks and the metadata commit. The job always installs and verifies that literal exact version; REQUESTED_PM_GITHUB_VERSION carries the deprecated input only for a non-fatal mismatch warning. Both workflow paths join release commit and merged-state diff scopes. Contract tests execute real release/validation/install shell blocks with isolated files and command receipts. Caller docs use daily github-actions updates grouped as pm-toolchain, the existing auto-merge exemption for calendar-version major changes; commit prefix and labels do not authorize merging."
   "2026-10-16T12:52:56.211Z",codex-agent,"Found an operational requirement: stamping .github/workflows files requires Workflows write authorization, which GITHUB_TOKEN cannot grant. Added a SHA-pinned GitHub App token step with explicit repository permissions, checkout/release-PR authentication, and a missing-configuration refusal before version preparation. Tokens are minted and revoked automatically. Follow-up pm-github-ygye tracks the one-time app installation and configuration; no credential or release dispatch was changed. Sources: https://docs.github.com/en/rest/repos/contents#create-or-update-file-contents and https://docs.github.com/en/actions/tutorials/authenticate-with-github_token#granting-additional-permissions ."
@@ -35,4 +38,5 @@ docs[3]{path,scope}:
   docs/closeout-workflow-caller.yml,project
   docs/sync-workflow-caller.yml,project
   README.md,project
+close_reason: "Reverified main eebda9277e52 (unchanged since audit): [PR #139](https://github.com/unbraind/pm-github/pull/139) (6d9cc23) resolves reusable workflow release versions at runtime from job.workflow_sha and release tags. Retained evidence: test/import-gate.test.ts, test/self-versioned-workflows.test.ts."
 body: ""