Close delivered pm items and keep in progress for active work only

.agents/pm/chores/pm-github-rv9m.toon

@@ -0,0 +1,25 @@
+id: pm-github-rv9m
+title: Close delivered pm items and reserve in progress for active work (2026-10-24)
+description: "Review every in-progress and open record against merged delivery and current PR evidence. Preserve uncertain work as open, release stale claims, and submit the tracker changes for review."
+type: Chore
+status: open
+priority: 2
+tags[2]: maintenance,tracker-hygiene
+created_at: "2026-10-24T21:40:01.860Z"
+updated_at: "2026-10-24T21:54:53.731Z"
+author: codex-agent
+estimated_minutes: 60
+acceptance_criteria: "Every original in-progress and open item is inspected; delivery closures name the implementing merged PR, date and merge SHA and match the recorded acceptance; inactive work is open with claims released; original history records remain append-only; tracker health, changelog and PR CI outcomes are recorded."
+risk: low
+confidence: high
+comments[3]{created_at,author,text}:
+  "2026-10-24T21:40:02.778Z",codex-agent,"Oriented context, searched existing hygiene work, and read the complete tracker. Checking every original in-progress and open item against PR title/body/commits, delivery links and acceptance. The owner authorizes evidence-backed closure in this sweep. Ambiguous claims remain open; no PR merge or history rewrite."
+  "2026-10-24T21:53:34.413Z",codex-agent,Delivery closures are complete except pm-github-f1ev and pm-github-2o9k. The repo-pinned SDK refuses both records with project_runtime_item_format_incompatible because existing linked tests retain updated_by/updated_at metadata while the consumer floor is 2026.10.5. No evidence or history was removed. A prepared peer/manifest 2026.10.10 floor proposal passes 4/4 compatibility checks outside this tracker and awaits owner authorization because it changes consumer support. General bounded aggregation returns to open. Release this sweep claim while the compatibility decision is pending.
+  "2026-10-24T21:54:53.731Z",codex-agent,"Local tracker verification passed: repository changelog generation and consistency check, pinned strict health with required merge drivers under isolated Git identity, changed-item history verification, independent original-history prefix checks and linked git diff --check. The audit claim is released. Remaining in-progress count: 2. Any preserved guarded records and the required owner compatibility decision are explicitly listed in the PR. No production function changed, so source-function revert proof is inapplicable; per-item merged ancestry and lifecycle/history checks are the evidence. The PR will carry the full before/after/evidence table. Complete npm/Bun release checks and native platform checks run in PR CI; their final outcome is reported separately, without treating queued or skipped checks as approval."
+files[1]{path,scope,note}:
+  .agents/pm,project,Tracker lifecycle and append-only evidence
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  git diff --check,project,codex-agent,"2026-10-24T21:54:22.795Z",local_mutation,chore/pm-in-progress-sweep
+docs[1]{path,scope,note}:
+  CHANGELOG.md,project,Regenerated package release notes
+body: ""

.agents/pm/features/pm-github-cited-issue-adoption.toon

@@ -2,13 +2,18 @@ id: pm-github-cited-issue-adoption
 title: Require opt-in before adopting cited GitHub issue items
 description: "Keep normal import creates and structured identity matching by default while reporting read-only citation candidates. Require explicit opt-in, bounded text normalization and anchored ownership checks before reusing a cited item. Document provenance tags at item creation as primary prevention, and validate encoded references, no-git persistence, workflow propagation and public dry runs."
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags[3]: changelog-unreleased,github,import
 created_at: "2026-10-23T07:16:54.041Z"
-updated_at: "2026-10-23T16:28:46.870Z"
+updated_at: "2026-10-24T23:11:01.391Z"
+closed_at: "2026-10-24T21:53:34.304Z"
+completed_at: "2026-10-23T17:16:37.000Z"
 author: codex-agent
 acceptance_criteria: "Adoption is off by default across CLI, SDK and reusable sync, enabled only with --adopt-cited, adoptCited true or adopt-cited true respectively. Default import retains normal create/structured-match behavior and read-only citation_candidates without fallback ambiguity refusal. Document creating items with gh:owner/repo#N as primary duplicate prevention; Normalize HTML named/numeric entities and percent bytes repeatedly until stable with a bounded refusal, apply NFKC and remove invisible/bidi controls, unwrap Markdown links/reference definitions and join soft breaks before anchored ownership checks while retaining source for conservative exclusion; Only title qualified references, leading description closing-keyword references, or whole body Issue:/Tracks: URL lines can authorize opt-in adoption. Any other normalized GitHub URL, foreign repository, other number or unattributed reference refuses adoption and reports candidate hints. Preserve structured identity precedence, single-owner upsert, eligible-owner ambiguity refusal, receipts, idempotency and non-git support; Keep all review reproductions and prior shape inputs, add encoded-reference fuzzing and explicit pm-review Issue label positives/default creates, record behavioral function/workflow reverts and public dry-run receipts, run targeted checks and wait for exact-head npm/Bun CI release gates"
+resolution: "Citation adoption is explicit opt-in across CLI/SDK/workflow; bounded normalization and anchored ownership checks retain ambiguity refusals, structured identity and no-git idempotency."
+expected_result: "Adoption is off by default across CLI, SDK and reusable sync, enabled only with --adopt-cited, adoptCited true or adopt-cited true respectively. Default import retains normal create/structured-match behavior and read-only citation_candidates without fallback ambiguity refusal. Document creating items with gh:owner/repo#N as primary duplicate prevention; Normalize HTML named/numeric entities and percent bytes repeatedly until stable with a bounded refusal, apply NFKC and remove invisible/bidi controls, unwrap Markdown links/reference definitions and join soft breaks before anchored ownership checks while retaining source for conservative exclusion; Only title qualified references, leading description closing-keyword references, or whole body Issue:/Tracks: URL lines can authorize opt-in adoption. Any other normalized GitHub URL, foreign repository, other number or unattributed reference refuses adoption and reports candidate hints. Preserve structured identity precedence, single-owner upsert, eligible-owner ambiguity refusal, receipts, idempotency and non-git support; Keep all review reproductions and prior shape inputs, add encoded-reference fuzzing and explicit pm-review Issue label positives/default creates, record behavioral function/workflow reverts and public dry-run receipts, run targeted checks and wait for exact-head npm/Bun CI release gates"
+actual_result: "https://github.com/unbraind/pm-github/pull/169, merged 2026-10-23T17:16:37Z, merge 1fec9f3968d2cf5f8564f1e2ce7c29f41979d947: Citation adoption is explicit opt-in across CLI/SDK/workflow; bounded normalization and anchored ownership checks retain ambiguity refusals, structured identity and no-git idempotency."
 comments[48]{created_at,author,text}:
   "2026-10-23T07:17:26.861Z",codex-agent,"Overlap review: pm-github-c093 owns structured URL/provider back-link import matching, pm-github-identity-collisions diagnoses and repairs structured ownership, Projects import matches board and issue provenance, and export upserts linked issues. None adopts arbitrary exact prose citations. This feature adds a fallback only after existing import matching, preserving those paths. Scheduled gated sync already invokes import, so it inherits the default. Plan ambiguous citations before writes and refuse the batch with actionable candidate IDs."
   "2026-10-23T07:24:01.857Z",codex-agent,"Implementation: strong ownership matching stays first; exact qualified title/description/body citations fall back to a single existing item. All imports now prepare identities before writes, and ambiguous citations expose candidate IDs plus an exact tagging remedy. Adoption retains local tags and reports a separate count; provider-owned records retain link-only behavior. New tests use real trackers with a PATH containing node and the pinned pm CLI but no git, plus real git trackers for write-gate acceptance."
@@ -107,4 +112,5 @@ docs[3]{path,scope}:
   docs/cited-issue-adoption-validation.md,project
   docs/sync-workflow-caller.yml,project
   README.md,project
+close_reason: "https://github.com/unbraind/pm-github/pull/169, merged 2026-10-23T17:16:37Z, merge 1fec9f3968d2cf5f8564f1e2ce7c29f41979d947: Citation adoption is explicit opt-in across CLI/SDK/workflow; bounded normalization and anchored ownership checks retain ambiguity refusals, structured identity and no-git idempotency."
 body: ""

.agents/pm/features/pm-github-identity-collisions.toon

@@ -2,13 +2,18 @@ id: pm-github-identity-collisions
 title: Explore provider identity collisions and approve scoped provenance repairs
 description: "Add a read-only graph of conflicting external_ref, GitHub provenance tags and native ownership, with narrowly scoped repair plans."
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags[3]: changelog-unreleased,github,identity
 created_at: "2026-10-22T19:22:17.645Z"
-updated_at: "2026-10-22T21:00:37.645Z"
+updated_at: "2026-10-24T23:11:02.201Z"
+closed_at: "2026-10-24T21:53:34.349Z"
+completed_at: "2026-10-22T21:34:56.000Z"
 author: codex-agent
 acceptance_criteria: Synthetic copied examples and genuinely multi-provider items remain distinguishable; ambiguous identities refuse apply; approved repairs are audited and idempotent.
+resolution: "Distinguishes explicit provider identities from copied examples, refuses ambiguous ownership and applies only approved scoped provenance repairs with an audited idempotent recovery journal."
+expected_result: Synthetic copied examples and genuinely multi-provider items remain distinguishable; ambiguous identities refuse apply; approved repairs are audited and idempotent.
+actual_result: "https://github.com/unbraind/pm-github/pull/167, merged 2026-10-22T21:34:56Z, merge 313810ae0047fb60ce9e3e6ae6be99c212387c07: Distinguishes explicit provider identities from copied examples, refuses ambiguous ownership and applies only approved scoped provenance repairs with an audited idempotent recovery journal."
 comments[13]{created_at,author,text}:
   "2026-10-22T19:23:58.055Z",codex-agent,"Overlap recheck: core SDK complete-list certification, metadata validation, similarity duplicates, semantic previews, item mutations and durable writer transactions remain authoritative. pm-github import-fidelity and refresh already reuse rightful owners or refuse multiple owners; they expose no offline collision graph or approved detach surface. pm-jira provenance/export matching and pm-linear provenance indexing retain provider semantics. New scope: bounded offline graph of exact external_ref and GitHub tag/URL claims versus copied prose; one explicitly approved tag/reference detach from an independently declared owner, refusing ambiguous source metadata. Acceptance: copied examples and genuine multi-provider ownership remain distinct; ambiguous identities refuse apply; approved repairs are audited and idempotent. Use real non-git trackers and a read-only public tracker copy; full npm/Bun release gates in CI due host load."
   "2026-10-22T19:37:45.190Z",codex-agent,"Implementation reuses refresh scratch reads because complete SDK list calls produce derived runtime caches. Scratch copies now normalize only copied file permissions, supporting read-only input trackers. Production repair scope is exact GitHub tag detach only: the pinned SDK has no audited core external_ref clear operation (unset refuses it), so reference repair returns unsupported_repair with a provider-workflow remedy instead of bypassing core mutation rules. Added native source ownership evidence and single-item contradictory identity diagnosis. Plans use real SDK previews, approval digests and locked rechecks; native comment/history audit binds the exact scope and SDK replay handles interrupted mutation recovery."
@@ -34,4 +39,5 @@ docs[3]{path,scope}:
   docs/identity-collisions-validation.md,project
   docs/identity-collisions.md,project
   README.md,project
+close_reason: "https://github.com/unbraind/pm-github/pull/167, merged 2026-10-22T21:34:56Z, merge 313810ae0047fb60ce9e3e6ae6be99c212387c07: Distinguishes explicit provider identities from copied examples, refuses ambiguous ownership and applies only approved scoped provenance repairs with an audited idempotent recovery journal."
 body: ""

.agents/pm/features/pm-github-webhook-inbox.toon

@@ -2,13 +2,18 @@ id: pm-github-webhook-inbox
 title: Reconcile authenticated GitHub webhooks through a durable deduplicating inbox
 description: "Explicitly supplied issue webhook deliveries are signature verified before durable intake, deduplicated, and reconciled against current provider state into bounded proposals."
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags[3]: changelog-unreleased,github,webhooks
 created_at: "2026-10-21T20:34:29.731Z"
-updated_at: "2026-10-22T11:47:29.084Z"
+updated_at: "2026-10-24T23:11:02.940Z"
+closed_at: "2026-10-24T21:53:34.381Z"
+completed_at: "2026-10-22T13:58:05.000Z"
 author: codex-agent
 acceptance_criteria: Duplicate and out-of-order events do not regress lifecycle; signature failures cause zero writes; polling refresh remains a recovery route; typed SDK and CLI with compact TOON/JSON refusals and remedies; real public-tracker copy validation without git; npm and Bun CI gates pass.
+resolution: "Authenticated deduplicated durable webhook hints reconcile against current provider state, preventing stale lifecycle replay; invalid signatures write nothing and polling remains recovery."
+expected_result: Duplicate and out-of-order events do not regress lifecycle; signature failures cause zero writes; polling refresh remains a recovery route; typed SDK and CLI with compact TOON/JSON refusals and remedies; real public-tracker copy validation without git; npm and Bun CI gates pass.
+actual_result: "https://github.com/unbraind/pm-github/pull/165, merged 2026-10-22T13:58:05Z, merge 394129e3a8a607bfc13dd8acc8adfe4704165da2: Authenticated deduplicated durable webhook hints reconcile against current provider state, preventing stale lifecycle replay; invalid signatures write nothing and polling remains recovery."
 comments[13]{created_at,author,text}:
   "2026-10-21T20:34:36.573Z",codex-agent,"Overlap audit: existing refresh.ts polls only explicitly linked issues and owns update-only import transactions. Installed CLI MCP tool definitions transport pm commands, with no authenticated GitHub event inbox. pm-observer src/ingest.ts and export-adapters.ts ingest agent exports, not provider webhooks. No duplicate feature found by tracker search. PR #164 owns historical tracker reconciliation; its items remain untouched. Design: authenticate exact payload bytes before all writes; store minimal durable delivery hints; reconcile via current-provider refresh previews only; retain receipts and retry failures. Polling refresh remains the apply and recovery route."
   "2026-10-21T20:41:00.447Z",codex-agent,"Implementation: authenticated intake stores minimal immutable delivery hints; token-owned writer locking serializes concurrent deduplication; atomically published receipts are file/directory-flushed before acknowledgment. Reconciliation coalesces selected issue numbers and uses read-only current-provider refresh previews, persisting compact outcome receipts without item changes. No receiver is installed. Local targeted suite: 7/7 passing, new webhooks.ts measured 100% statements/branches/functions/lines. No-git acceptance removes git from PATH and sets a discovery ceiling. CI now invokes explicit npm and Bun release:check at unchanged thresholds; full gates run remotely because the host is saturated."
@@ -34,4 +39,5 @@ tests[1]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,
 docs[2]{path,scope}:
   docs/webhook-inbox.md,project
   README.md,project
+close_reason: "https://github.com/unbraind/pm-github/pull/165, merged 2026-10-22T13:58:05Z, merge 394129e3a8a607bfc13dd8acc8adfe4704165da2: Authenticated deduplicated durable webhook hints reconcile against current provider state, preventing stale lifecycle replay; invalid signatures write nothing and polling remains recovery."
 body: ""