Certify pm CLI 2026.9.21 and adopt the canonical pm-ops lint, duplication and merge-driver gates

.agents/pm/history/pm-graph-yuzr.jsonl

@@ -0,0 +1,9 @@
+{"hash_algorithm":"sha256","ts":"2026-09-22T05:08:23.357Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"00bb699c302e69b09b8e86f3","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-graph-yuzr"},{"op":"add","path":"/metadata/title","value":"Certify pm CLI 2026.9.21 and move onto the canonical pm-ops merge-driver, lint and duplication gates"},{"op":"add","path":"/metadata/description","value":"Adopt pm CLI 2026.9.21, pin @unbrained/pm-cli 2026.9.21 / pm-changelog / pm-ops exactly, absorb open Dependabot PRs, replace the vendored merge-driver prepare hook with the thin pm-ops/merge-driver launcher, add the canonical lint (pm-ops/eslint) and duplication (pm-ops/jscpd) gates with zero findings, fix the ~81 'any' type sites against real neo4j-driver types, and wire CI to require merge drivers. Companion epic pm-cli-website-5s6z."},{"op":"add","path":"/metadata/type","value":"Task"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":1},{"op":"add","path":"/metadata/tags","value":["certify","multi-agent","pm-cli-2026.9.21","quality"]},{"op":"add","path":"/metadata/created_at","value":"2026-09-22T05:08:23.357Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-09-22T05:08:23.357Z"},{"op":"add","path":"/metadata/author","value":"pi-agent"},{"op":"add","path":"/metadata/acceptance_criteria","value":"All three devDependency pins exact and verified in package.json + package-lock.json; npm run lint and npm run duplication exit 0 with 0 findings; pm health --strict-exit --require-merge-drivers exits 0; npm run release:check exits 0"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"476fa1ddbbe9df9624d533f42e693f5d6402cfd768581c0e9121f05ff3fdc636","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"dc3d65e90659ca33caf0d934a5e7b0af7073412570d9693c6284d47aabaaedb2"}
+{"hash_algorithm":"sha256","ts":"2026-09-22T05:08:26.655Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"00bb699c302e69b09b8e86f3","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-22T05:08:26.655Z"},{"op":"add","path":"/metadata/assignee","value":"pi-agent"},{"op":"add","path":"/metadata/claim_principal","value":"pi-agent"}],"before_hash":"476fa1ddbbe9df9624d533f42e693f5d6402cfd768581c0e9121f05ff3fdc636","after_hash":"47e1b7677fb6724e2118cb4beadf1f20f7f5c7cf6651bf744b350ab96d6687c5","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"e1cfb6a41291e35c339b719cf1655909d10f76f0756820696c0aa4c87f5a30cd"}
+{"hash_algorithm":"sha256","ts":"2026-09-22T05:08:27.576Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"00bb699c302e69b09b8e86f3","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-22T05:08:27.576Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"47e1b7677fb6724e2118cb4beadf1f20f7f5c7cf6651bf744b350ab96d6687c5","after_hash":"8b8a3110985701caa469ba87d3ee7f1c467d5be7a5ba5ba9f535b15d3ea56896","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"47ab356d2af497843a855a18030721d6106c84b1aa701b2b81cc41e082a3be2e"}
+{"hash_algorithm":"sha256","ts":"2026-09-22T05:09:44.627Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"00bb699c302e69b09b8e86f3","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-22T05:09:44.627Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-09-22T05:09:44.627Z","author":"pi-agent","text":"Baseline measured with canonical pm-ops 2026.9.18 gates run directly (launchers not yet created): lint 86 errors (83 no-restricted-syntax explicit-any, 1 no-duplicate-imports in test/impact-command.test.ts:16 area, 2 require-atomic-updates in src/index.ts); duplication 6.22% duplicated lines (789/12675), 44 sources, 80 clone pairs, threshold 0. Findings concentrated in test/*.test.ts and src/index.ts. Pins verified: @unbrained/pm-cli 2026.9.21, pm-changelog 2026.9.18, pm-ops 2026.9.18 in package.json + package-lock.json; @types/node lockfile 26.6.1 (Dependabot #107 landed exactly, range ^26.2.0 restored); codeql-action SHAs bumped per #111."}]}],"before_hash":"8b8a3110985701caa469ba87d3ee7f1c467d5be7a5ba5ba9f535b15d3ea56896","after_hash":"a7afcaa41582eb9b1a3d969b40154aa4e176b1f1bf82f3b29e029648b26a307c","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"3485a183856127d94373d5d9badfe334109af901bbf1d5a05153b894f141cacc"}
+{"hash_algorithm":"sha256","ts":"2026-09-23T00:03:36.230Z","author":"pi-glm-pm-graph","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"bbe3833f6765fc35cafe0956","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-09-23T00:03:36.230Z","author":"pi-glm-pm-graph","text":"Duplication gate reduced from 5.6% to 0% (74 to 0 clone pairs) by extracting shared helpers into test/helpers.ts (withNeo4jQueryTest, withCommandWorkspace, setupChainWorkspace, setupCycleWorkspace, setupBareWorkspace, activateWithRecording, captureStdoutThrow, expectCommandError, expectCommandErrorMulti, expectExporterReject, runExportRaw, createChain, synthNode/synthRel/synthGraph, NEO4J_FAIL_ENV, setNeo4jTestEnv, applyEnv, CmdResult/CommandError types). src/index.ts: extracted unwrapNeo4jInteger (toNumber+readNumberProperty), nodeLabelParts (renderDot+renderPlantuml), orderedNodeSet+collectBidirectionalEdges (impactSubgraph+impactSubgraphFromNodeSet), loadShapedAnalytics (cycles+critical-path+topo-sort), wrapCommandError (export catch blocks). Added docstrings to 8 type aliases and 3 functions. Lint exit 0, duplication 0%, release:check exit 0 (287 tests, coverage 100/100/100), pm health --strict-exit exit 0."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-23T00:03:36.230Z"}],"before_hash":"a7afcaa41582eb9b1a3d969b40154aa4e176b1f1bf82f3b29e029648b26a307c","after_hash":"be2afbf55096a869843418ebdf4c7dfdaff0d2ebe6e86403b40a2f918aab11c9","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"7c33ca5606fbc6b07aa3693060d46f64654bb653c2a414a779a32a41a0b6eea8"}
+{"hash_algorithm":"sha256","ts":"2026-09-23T00:03:39.691Z","author":"pi-glm-pm-graph","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"bbe3833f6765fc35cafe0956","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-23T00:03:39.691Z"},{"op":"add","path":"/metadata/files","value":[{"path":"test/helpers.ts","scope":"project"}]}],"before_hash":"be2afbf55096a869843418ebdf4c7dfdaff0d2ebe6e86403b40a2f918aab11c9","after_hash":"6661ef592892fe85aab5d25500076964c9f4d778fa77aee95d6863001ace25ab","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"7783a7a35429a231995ae6c8586e7465973346347955c894a6ecb5c44a6eff76"}
+{"hash_algorithm":"sha256","ts":"2026-09-23T00:03:40.281Z","author":"pi-glm-pm-graph","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"bbe3833f6765fc35cafe0956","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/0/path","value":"src/index.ts"},{"op":"add","path":"/metadata/files/1","value":{"path":"test/helpers.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-23T00:03:40.281Z"}],"before_hash":"6661ef592892fe85aab5d25500076964c9f4d778fa77aee95d6863001ace25ab","after_hash":"c99589e85bc84860c4d0a60336ed9ffdfbd089809e2b63abab00f397e8f6c6a9","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"c2be4e53758a79302454cb0f73c1d93c80a4b11d9a69bf25c606fce34dd7b15f"}
+{"hash_algorithm":"sha256","ts":"2026-09-23T00:03:40.850Z","author":"pi-glm-pm-graph","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"bbe3833f6765fc35cafe0956","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/1/path","value":"test/command-surface.test.ts"},{"op":"add","path":"/metadata/files/2","value":{"path":"test/helpers.ts","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-23T00:03:40.850Z"}],"before_hash":"c99589e85bc84860c4d0a60336ed9ffdfbd089809e2b63abab00f397e8f6c6a9","after_hash":"3651dfd3dd8fba35585afc263a502521dfece40a852d6498556021ef4fd1a250","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"8761eeda51670806fe0d215aff53c42a51fb374807153f7e11feb10eb047148a"}
+{"hash_algorithm":"sha256","ts":"2026-09-23T00:03:44.244Z","author":"pi-glm-pm-graph","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"bbe3833f6765fc35cafe0956","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":null,"topic":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-23T00:03:44.244Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"npm run release:check","scope":"project","provenance":{"author":"pi-glm-pm-graph","created_at":"2026-09-23T00:03:44.219Z","source_kind":"local_mutation","source_ref":"pm-cli-2026-9-21-canonical-pm-ops-gates"}}]}],"before_hash":"3651dfd3dd8fba35585afc263a502521dfece40a852d6498556021ef4fd1a250","after_hash":"f081632a526100b2a8e7c5034bec9a7cd00e2c0d260174a68b5132d079cecf43","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"61ff3342399198dee7cffb24dbf07f6e42920a7f4670e6a8153b608be980d731"}

.agents/pm/tasks/pm-graph-yuzr.toon

@@ -0,0 +1,23 @@
+id: pm-graph-yuzr
+title: "Certify pm CLI 2026.9.21 and move onto the canonical pm-ops merge-driver, lint and duplication gates"
+description: "Adopt pm CLI 2026.9.21, pin @unbrained/pm-cli 2026.9.21 / pm-changelog / pm-ops exactly, absorb open Dependabot PRs, replace the vendored merge-driver prepare hook with the thin pm-ops/merge-driver launcher, add the canonical lint (pm-ops/eslint) and duplication (pm-ops/jscpd) gates with zero findings, fix the ~81 'any' type sites against real neo4j-driver types, and wire CI to require merge drivers. Companion epic pm-cli-website-5s6z."
+type: Task
+status: in_progress
+priority: 1
+tags[4]: certify,multi-agent,pm-cli-2026.9.21,quality
+created_at: "2026-09-22T05:08:23.357Z"
+updated_at: "2026-09-23T00:03:44.244Z"
+assignee: pi-agent
+claim_principal: pi-agent
+author: pi-agent
+acceptance_criteria: "All three devDependency pins exact and verified in package.json + package-lock.json; npm run lint and npm run duplication exit 0 with 0 findings; pm health --strict-exit --require-merge-drivers exits 0; npm run release:check exits 0"
+comments[2]{created_at,author,text}:
+  "2026-09-22T05:09:44.627Z",pi-agent,"Baseline measured with canonical pm-ops 2026.9.18 gates run directly (launchers not yet created): lint 86 errors (83 no-restricted-syntax explicit-any, 1 no-duplicate-imports in test/impact-command.test.ts:16 area, 2 require-atomic-updates in src/index.ts); duplication 6.22% duplicated lines (789/12675), 44 sources, 80 clone pairs, threshold 0. Findings concentrated in test/*.test.ts and src/index.ts. Pins verified: @unbrained/pm-cli 2026.9.21, pm-changelog 2026.9.18, pm-ops 2026.9.18 in package.json + package-lock.json; @types/node lockfile 26.6.1 (Dependabot #107 landed exactly, range ^26.2.0 restored); codeql-action SHAs bumped per #111."
+  "2026-09-23T00:03:36.230Z",pi-glm-pm-graph,"Duplication gate reduced from 5.6% to 0% (74 to 0 clone pairs) by extracting shared helpers into test/helpers.ts (withNeo4jQueryTest, withCommandWorkspace, setupChainWorkspace, setupCycleWorkspace, setupBareWorkspace, activateWithRecording, captureStdoutThrow, expectCommandError, expectCommandErrorMulti, expectExporterReject, runExportRaw, createChain, synthNode/synthRel/synthGraph, NEO4J_FAIL_ENV, setNeo4jTestEnv, applyEnv, CmdResult/CommandError types). src/index.ts: extracted unwrapNeo4jInteger (toNumber+readNumberProperty), nodeLabelParts (renderDot+renderPlantuml), orderedNodeSet+collectBidirectionalEdges (impactSubgraph+impactSubgraphFromNodeSet), loadShapedAnalytics (cycles+critical-path+topo-sort), wrapCommandError (export catch blocks). Added docstrings to 8 type aliases and 3 functions. Lint exit 0, duplication 0%, release:check exit 0 (287 tests, coverage 100/100/100), pm health --strict-exit exit 0."
+files[3]{path,scope}:
+  src/index.ts,project
+  test/command-surface.test.ts,project
+  test/helpers.ts,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  "npm run release:check",project,pi-glm-pm-graph,"2026-09-23T00:03:44.219Z",local_mutation,pm-cli-2026-9-21-canonical-pm-ops-gates
+body: ""

.github/workflows/ci.yml

@@ -75,11 +75,17 @@ jobs:
           #
           # `--strict-exit` is load-bearing: non-strict health may report findings while
           # still exiting successfully.
-          timeout --signal=TERM --kill-after=10s 120s ./node_modules/.bin/pm health --strict-exit
+          timeout --signal=TERM --kill-after=10s 120s ./node_modules/.bin/pm health --strict-exit --require-merge-drivers
 
       - name: Type check
         run: npm run typecheck
 
+      - name: Lint with the canonical fleet policy
+        run: npm run lint
+
+      - name: Duplication gate
+        run: npm run duplication
+
       - name: Build and verify committed output is current
         shell: bash
         run: |
@@ -157,10 +163,14 @@ jobs:
           node-version: 22
           cache: npm
 
-      # npm ci runs the production prepare lifecycle through cmd.exe before the
-      # adversarial fixture below exercises spaces and percent-delimited paths.
+      # npm ci runs the production prepare lifecycle (the thin launcher over
+      # pm-ops/merge-driver) through cmd.exe, and the health check below fails
+      # unless that run registered the drivers .gitattributes declares.
       - name: Install dependencies and merge drivers
         run: npm ci
 
+      - name: Verify the prepare lifecycle registered the merge drivers
+        run: npx pm health --strict-exit --require-merge-drivers
+
       - name: Exercise the real Windows command parser
         run: node --test test/windows-prepare.integration.ts

README.md

@@ -491,9 +491,12 @@ This package supports GitHub, npm, and Bun-compatible installs. Publication rema
 This repo tracks its project management in `.agents/pm/` and ships a committed `.gitattributes`
 that maps those tracker artifacts to pm-cli's field-aware Git merge drivers, so concurrent-branch
 tracker edits merge cleanly instead of hard-conflicting. The driver definitions live in per-clone
-Git config; `npm install` / `npm ci` wires them automatically via the `prepare` script (an erasable TypeScript Node guard, `scripts/prepare-merge-driver.ts`: it runs
-`pm merge install` only when the `pm` CLI is on `PATH`, and no-ops cleanly otherwise so
-production / `--omit=dev` installs are not broken; being Node-based it behaves identically
+Git config; `npm install` / `npm ci` wires them automatically via the `prepare` script (a thin TypeScript
+launcher, `scripts/prepare-merge-driver.ts`, over the canonical `pm-ops/merge-driver` export: it runs
+`pm merge install` only when the `pm` CLI is on `PATH`, and no-ops cleanly when `pm` is absent.
+Registry installs of this package never run `prepare`; a production install of a clone
+(`npm ci --omit=dev`) omits `pm-ops` too, so it must pass `--ignore-scripts` (the guarded launcher is
+tracked as companion item pm-cli-website-xy19); being Node-based it behaves identically
 on POSIX shells and Windows `cmd.exe`). To (re)run manually: `npm run merge:install`.
 
 After merging a branch that touched `.agents/pm/`, reconcile any residual history-hash drift with