From 8323f3cdaafde64657582380a5b9e003a0c40f76 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 13:36:54 +0200 Subject: [PATCH 1/3] Certify pm-todos on PM CLI 2026.10.4 and consolidate dependency updates --- .../pm/{issues => chores}/pm-todos-zpyc.toon | 39 ++- .../pm/extensions/.managed-extensions.json | 10 +- .agents/pm/history/pm-todos-zpyc.jsonl | 19 ++ .github/workflows/ci.yml | 4 +- .github/workflows/codeql.yml | 4 +- .github/workflows/pm-github-sync.yml | 4 +- docs/certification-2026.10.4.md | 55 +++ package-lock.json | 313 ++++-------------- package.json | 10 +- scripts/accept-packed.ts | 3 + scripts/prepare-merge-driver.ts | 19 +- test/coverage-commands.test.ts | 4 +- test/import-close-reason.test.ts | 8 +- test/integration.test.ts | 6 +- test/packed-fixture.ts | 23 ++ 15 files changed, 230 insertions(+), 291 deletions(-) rename .agents/pm/{issues => chores}/pm-todos-zpyc.toon (54%) create mode 100644 docs/certification-2026.10.4.md create mode 100644 test/packed-fixture.ts diff --git a/.agents/pm/issues/pm-todos-zpyc.toon b/.agents/pm/chores/pm-todos-zpyc.toon similarity index 54% rename from .agents/pm/issues/pm-todos-zpyc.toon rename to .agents/pm/chores/pm-todos-zpyc.toon index c7266789..bbe5e817 100644 --- a/.agents/pm/issues/pm-todos-zpyc.toon +++ b/.agents/pm/chores/pm-todos-zpyc.toon @@ -1,45 +1,60 @@ id: pm-todos-zpyc -title: Certify pm-todos on CLI 2026.9.27 and pinned GitHub extension -description: "Main pins PM CLI, pm-ops, and pm-changelog 2026.9.23 and manages pm-github 2026.8.18. Host CLI 2026.9.27 reports extension SDK-link skew. CI and the disabled scheduled sync install unversioned pm-github through an obsolete npm 10 shim and rewrite its manifest. Align published tool pins and managed extension source in both workflows, and retain the disabled sync boundary until a separate pre-push privacy gate passes." -type: Issue -status: blocked +title: Certify pm-todos on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates +description: "Certify the published PM CLI/SDK 2026.10.4 with exact latest development tools, canonical pm-ops launcher, Dependabot CodeQL consolidation, strict health, full release gate, packed acceptance and real tracker npm/native-Bun dogfood. Preserve minimum host 2026.8.20, existing coverage thresholds and disabled GitHub issue-sync boundary." +type: Chore +status: in_progress priority: 1 tags[3]: agent-ux,"area:github","area:release" created_at: "2026-09-27T08:15:15.176Z" -updated_at: "2026-10-02T22:49:13.270Z" +updated_at: "2026-10-04T11:36:08.511Z" author: codex acceptance_criteria: "Package and lock pins updated to published CLI, pm-ops and pm-changelog; managed pm-github source exact 2026.9.26; canonical launcher and real broken-install child tests pass; strict health and full release gate pass; sync stays disabled pending privacy gate; exact-head CI and review complete." repro_steps: "On main, run pm health --strict-exit --json under host CLI 2026.9.27 and observe extension_host_pm_cli_version_skew; inspect CI and sync workflow unversioned extension installs. After updating pm-ops, the existing canonical launcher byte-identity test fails until its published template is copied." -expected_result: Project-local CLI/SDK 2026.9.27 and managed pm-github 2026.9.26 pass strict health; both workflows install exact source; full release and packed acceptance pass; sync stays disabled. -actual_result: Main has old SDK linkage and workflow installs can drift to future unreviewed versions. +expected_result: "Pinned 2026.10.4 tooling passes existing gates, health, packed consumers and read-only GitHub preview; PR stays open for orchestrator review/merge." +actual_result: "2026-10-04: full locked release:check passed 280/280 tests, zero skips; 97.87% lines/93.33% branches/98.46% functions across index.ts (no separate statement metric). Canonical-reader, audits, package pack, four current/minimum npm/Bun packed scenarios, changelog/date/attestation gates pass. Strict health passed; GitHub atomic dry-run proposed 0 imports/2 updates/0 skips. Real tracker npx/native-Bun dogfood exported and updated all 83 items; scratch deleted. Exact-head CI and reviews remain pending; orchestrator owns merge and closure." dependencies[1]{id,kind,created_at,author,source_kind,author_source}: pm-todos-p60g,related,"2026-09-27T08:22:58.654Z",codex,"cli:update:dep",detected -comments[4]{created_at,author,text}: +comments[10]{created_at,author,text}: "2026-09-28T06:20:10.124Z",claude-hub,"2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch." "2026-10-02T22:10:28.268Z",codex-sol,"Restart by codex-sol: preserved remote PR #103 and all existing bot replies/reactions were inspected. Branch is already current with origin/main. No new actionable unresolved inline finding is present. Retain documented coverage/health/publication blockers; rerun unchanged full CI gate with the host-wide flock. No merge, publish or item closure." "2026-10-02T22:36:28.489Z",codex-sol,"Restart: reproduced CI exact project-local npm:pm-github@2026.9.26 installation and verified package version; restored the tracked managed registry exactly as CI does. Locked npm ci and unchanged release:check pass 280/280 tests, zero skips, measured index.ts 97.87% lines / 93.33% branches / 98.46% functions; statements are not separately reported. Canonical-reader, production audit, packed npm/Bun current/minimum host acceptance, changelog/date/attestation gates pass. The linked prepare suite initially refused foreign-ref trust; acknowledged authorized commands and reran successfully. Published canonical-template identity continues to cover ancestor-install handling. Coverage pm-todos-p60g and fail-closed pre-push privacy prerequisites remain open; issue-sync workflow stays disabled. No merge, publish or close; release claim for orchestrator." "2026-10-02T22:48:37.309Z",codex-sol,"Valid CodeRabbit/Cubic tracking correction: the #124 link note was stale, not a current publication blocker. Updated only the current doc-link note to identify pinned published pm-ops 2026.9.28; preserved every dated comment/note/history line. Full gate at 309a379 passed 280/280 plus canonical reader and packed npm/Bun. Coverage and pre-push privacy blockers remain." + "2026-10-04T10:50:21.519Z",codex-sol,"2026-10-04 codex-sol: isolated certification worktree from origin/main 64552c7. Reuse this certification item, consolidate Dependabot #104 CodeQL SHA, exact latest dev pins, preserve minimum host 2026.8.20 and existing coverage thresholds; no open Dependabot alerts. Scheduled issue sync remains disabled. Orchestrator owns merge and closure." + "2026-10-04T10:54:06.854Z",codex-sol,"Exact dependencies installed: CLI/SDK, pm-ops, pm-changelog 2026.10.4; @types/node 26.6.4; TypeScript 7.0.2. Both npm audit --omit=dev and npm audit report zero vulnerabilities. Existing canonical byte-identity regression failed before copying the published pm-ops template, then node --test test/prepare-merge-driver.test.ts passed 7/7, zero skips. Shared host lock serializes extension restore and release acceptance." + "2026-10-04T11:01:06.457Z",codex-sol,"Full gate failed test-first: CLI 2026.10.4 correctly refuses incomplete 10,000-entry local checkout installs (extension_install_incomplete_source_scan) in coverage-commands, import-close-reason and rich JSONL integration fixtures. Replace checkout scanning with npm pack --ignore-scripts distribution artifacts and canonical package install; preserve all original behavior/doctor assertions and coverage thresholds. No upstream defect: this is the intended fail-closed installer behavior." + "2026-10-04T11:10:07.880Z",codex-sol,"Real tracker packed dogfood passed under npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun @unbrained/pm-cli@2026.10.4: version=2026.10.4; --json todos export --format jsonl --output /real-.jsonl exported all 83 parseable rows; --json todos import --format jsonl --upsert --dry-run proposed 0 imports/83 updates/0 skips; actual upsert reported 0 imports/83 updates/0 skips. Only scratch copies were mutated and the scratch root was deleted. Exact command suffixes and receipts are in docs/certification-2026.10.4.md." + "2026-10-04T11:16:49.942Z",codex-sol,"Second full gate: 280/280 tests, zero skips; index.ts 97.87% lines/93.33% branches/98.46% functions, canonical-reader and audit pass. Packed acceptance failed test-first because pm test exports PM_PATH for its tracker sandbox and accept-packed inherited it into independent scenarios. Scope PM_PATH explicitly to each scenario-local .agents/pm so no ambient tracker can be reinitialized; preserve all four current/minimum npm/Bun scenarios and exact assertions." + "2026-10-04T11:36:06.433Z",codex-sol,"Final full gate passed via npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker --override-linked-pm-context; linked command is flock /tmp/claude-1000/heavy-gate.lock npm run release:check. 280/280 tests, zero skips; 97.87/93.33/98.46 measured line/branch/function coverage; four packed current/minimum npm/Bun scenarios pass. Releasing claim for orchestrator; item stays in_progress and open for review/merge verification." notes[3]{created_at,author,text}: "2026-09-27T08:17:04.004Z",codex,"2026-09-27: Published CLI/SDK 2026.9.27 and pm-github 2026.9.26 installed through the project-local CLI; strict health passes with stale-item advisories. The published pm-ops launcher byte-identity test failed before copying its 2026.9.26 template, then the focused child-checkout suite passed 7/7 including incomplete directory and dangling link. Following a valid CodeRabbit privacy finding on the sibling pm-jira candidate, the checked-in scheduled sync job now has an if: false guard in addition to GitHub disabled_manually. The separate pre-push privacy gate is still absent; sync must not be enabled." "2026-09-27T08:27:21.211Z",codex,"2026-09-27 final guarded candidate: npm run release:check exits 0 after sync job if: false and PM link updates. 280/280 source tests pass with zero skips; index.ts honestly measures 97.87% lines, 93.33% branches, and 98.46% functions, with no statement metric. Docstring gate documents 81/81 declarations; zero production npm audit findings. Packed npm-current and bun-current against CLI/SDK 2026.9.27 and npm-minimum and bun-minimum against 2026.8.20 each imported 1 and exported 2 real fixture rows. The separate coverage item pm-todos-p60g remains open; the checked-in and GitHub scheduled sync are inert pending a fail-closed pre-push privacy gate. Exact-head CI and bot review remain to be completed after push." "2026-09-27T08:35:54.168Z",codex,"2026-09-27 exact-head Greptile P1 is valid: an incomplete ancestor node_modules/pm-ops can be treated as omit-dev by the published pm-ops 2026.9.26 launcher. The canonical source issue ops-jzp5 in unmerged pm-ops #124 already scans ancestor resolution paths and tests a real hoisted incomplete install. Keep this consumer PR open until the reviewed source is published, update the pin and byte-identical template, rerun full release and packed npm/Bun acceptance, and request a fresh exact-head review. CodeRabbit reported no actionable issue, but Greptile check fails on this head." -files[6]{path,scope,note}: +files[10]{path,scope,note}: .agents/pm/extensions/.managed-extensions.json,project,Exact managed pm-github source .github/workflows/ci.yml,project,CI pinned extension install + .github/workflows/codeql.yml,project,Dependabot #104 exact pinned SHA .github/workflows/pm-github-sync.yml,project,Disabled and inert issue-sync job + package-lock.json,project,Exact npm resolution for certification package.json,project,Published CLI and quality-tool pins + scripts/accept-packed.ts,project,Isolate scenario tracker from linked-test PM_PATH scripts/prepare-merge-driver.ts,project,Published pm-ops launcher template + test/packed-fixture.ts,project,Shared packed-artifact fixture for fail-closed 2026.10.4 installer test/prepare-merge-driver.test.ts,project,Real incomplete and dangling install fixtures -tests[2]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}: +tests[4]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}: "npm run release:check",project,900,codex,"2026-09-27T08:20:15.063Z",local_mutation,fix/pm-todos-cli-2026-09-27-github-pin node --test test/prepare-merge-driver.test.ts,project,120,codex,"2026-09-27T08:20:15.063Z",local_mutation,fix/pm-todos-cli-2026-09-27-github-pin -docs[3]: + "flock /tmp/claude-1000/heavy-gate.lock npm run release:check",project,2400,codex-sol,"2026-10-04T10:51:32.568Z",local_mutation,chore/pm-todos-pm-cli-2026-10-4 + "flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed",project,2400,codex-sol,"2026-10-04T11:16:53.205Z",local_mutation,chore/pm-todos-pm-cli-2026-10-4 +docs[4]: - path: "https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-jzp5.toon" scope: global note: Canonical hoisted broken-install source issue - path: "https://github.com/unbraind/pm-ops/pull/124" scope: global - note: Canonical source fix published in pinned pm-ops 2026.9.28 + note: Canonical source fix included in pinned published pm-ops 2026.10.4 + - path: docs/certification-2026.10.4.md + scope: project + note: Gate and real tracker packed npm/Bun receipts - path: README.md scope: project body: "" diff --git a/.agents/pm/extensions/.managed-extensions.json b/.agents/pm/extensions/.managed-extensions.json index ecfa2f19..368e9f05 100644 --- a/.agents/pm/extensions/.managed-extensions.json +++ b/.agents/pm/extensions/.managed-extensions.json @@ -1,12 +1,12 @@ { "version": 1, - "updated_at": "2026-09-27T08:13:55.807Z", + "updated_at": "2026-10-04T10:56:46.221Z", "entries": [ { "name": "pm-github", "directory": "pm-github", "scope": "project", - "manifest_version": "2026.9.26", + "manifest_version": "2026.10.4", "manifest_entry": "./dist/index.js", "capabilities": [ "commands", @@ -94,13 +94,13 @@ ] }, "installed_at": "2026-08-28T20:03:22.833Z", - "updated_at": "2026-09-27T08:13:55.772Z", + "updated_at": "2026-10-04T10:56:46.095Z", "source": { "kind": "npm", - "input": "npm:pm-github@2026.9.26", + "input": "npm:pm-github@2026.10.4", "location": "package", "package": "pm-github", - "version": "2026.9.26" + "version": "2026.10.4" } } ] diff --git a/.agents/pm/history/pm-todos-zpyc.jsonl b/.agents/pm/history/pm-todos-zpyc.jsonl index e2815300..997cae8a 100644 --- a/.agents/pm/history/pm-todos-zpyc.jsonl +++ b/.agents/pm/history/pm-todos-zpyc.jsonl @@ -22,3 +22,22 @@ {"hash_algorithm":"sha256","ts":"2026-10-02T22:49:11.285Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b2389d19e26c4d93974a8087","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"remove","path":"/metadata/docs/2"},{"op":"remove","path":"/metadata/docs/1/note"},{"op":"replace","path":"/metadata/docs/1/scope","value":"project"},{"op":"replace","path":"/metadata/docs/1/path","value":"README.md"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-02T22:49:11.285Z"}],"before_hash":"4e2a89e12a39fa3640408290f3a3b82cfdbe883591a7bfdd9b3f415f9a27b3f5","after_hash":"a8118e03dc3a599870bcde14521ce5fbcf7d3e4456485c393d642122ac2ff012","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4a8a8525ef877133b2470eb968a44cbd18b4400f56b24396898b43aeccea1374"} {"hash_algorithm":"sha256","ts":"2026-10-02T22:49:12.295Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b2389d19e26c4d93974a8087","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"add","path":"/metadata/docs/1/note","value":"Canonical source fix published in pinned pm-ops 2026.9.28"},{"op":"replace","path":"/metadata/docs/1/scope","value":"global"},{"op":"replace","path":"/metadata/docs/1/path","value":"https://github.com/unbraind/pm-ops/pull/124"},{"op":"add","path":"/metadata/docs/2","value":{"path":"README.md","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-02T22:49:12.295Z"}],"before_hash":"a8118e03dc3a599870bcde14521ce5fbcf7d3e4456485c393d642122ac2ff012","after_hash":"09bfd047d12ef35b1d0d6d2c58382b47be93b39488642b1d0fbe1e8840649daf","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"a81c7bb37ca363818ad3673d5a1a68f8c1d4f1a9fb467038a9c8d99ff30490ce"} {"hash_algorithm":"sha256","ts":"2026-10-02T22:49:13.270Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"b2389d19e26c4d93974a8087","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-02T22:49:13.270Z"}],"before_hash":"09bfd047d12ef35b1d0d6d2c58382b47be93b39488642b1d0fbe1e8840649daf","after_hash":"f0cc56c6b9193551ccacffa8c1cbff82a6eacb25477204a6b3bdeb06555ea7df","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"529c6e004dd429d8137408ed557c76bdb20d30ceee7d27efb0f86a0d2ed165f7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:19.840Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:19.840Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"f0cc56c6b9193551ccacffa8c1cbff82a6eacb25477204a6b3bdeb06555ea7df","after_hash":"167ec85de4c6b8090bb59e48195d52efe5dca77b837311fbfaea231750da9188","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"1e3b0d6efeb3a38be555ab051f0a54c5a44630ecc5395dbea1c9731fffcbff24"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:20.604Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:20.604Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"},{"op":"replace","path":"/metadata/type","value":"Chore"},{"op":"replace","path":"/metadata/title","value":"Certify pm-todos on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates"}],"before_hash":"167ec85de4c6b8090bb59e48195d52efe5dca77b837311fbfaea231750da9188","after_hash":"b5a214f0bf3b406eec205017c4a5eceddb5f67cea95cf9d3b390ec3a42669ac0","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5888add32821785a6dcdc12684e0353bf464e05692681ca07f3e24fbae746822"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:50:21.519Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-10-04T10:50:21.519Z","author":"codex-sol","text":"2026-10-04 codex-sol: isolated certification worktree from origin/main 64552c7. Reuse this certification item, consolidate Dependabot #104 CodeQL SHA, exact latest dev pins, preserve minimum host 2026.8.20 and existing coverage thresholds; no open Dependabot alerts. Scheduled issue sync remains disabled. Orchestrator owns merge and closure."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:50:21.519Z"}],"before_hash":"b5a214f0bf3b406eec205017c4a5eceddb5f67cea95cf9d3b390ec3a42669ac0","after_hash":"8c9bd0f59ad198785844fce1bb7a9acbdfcd9e5e4a6e617fcee835e2253e2712","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f0b96a623c0dd506b5ef4358afb0a30a7268afa3607160d3fac35632dd2ddbce"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:51:31.347Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/5/note","value":"Published pm-ops launcher template"},{"op":"replace","path":"/metadata/files/5/path","value":"scripts/prepare-merge-driver.ts"},{"op":"replace","path":"/metadata/files/4/note","value":"Published CLI and quality-tool pins"},{"op":"replace","path":"/metadata/files/4/path","value":"package.json"},{"op":"replace","path":"/metadata/files/3/note","value":"Exact npm resolution for certification"},{"op":"replace","path":"/metadata/files/3/path","value":"package-lock.json"},{"op":"add","path":"/metadata/files/6","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project","note":"Real incomplete and dangling install fixtures"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:51:31.347Z"}],"before_hash":"8c9bd0f59ad198785844fce1bb7a9acbdfcd9e5e4a6e617fcee835e2253e2712","after_hash":"245f16804f2a6e3c562dc9ecf896b5820f225dbbb33ae8a2ac9ee4f3949454eb","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"3d6810a546d48545fe32bbd7f5c14ecf11d37ec36f065024a2b70b67ad1fe9b8"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:51:32.005Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/6/note","value":"Published pm-ops launcher template"},{"op":"replace","path":"/metadata/files/6/path","value":"scripts/prepare-merge-driver.ts"},{"op":"replace","path":"/metadata/files/5/note","value":"Published CLI and quality-tool pins"},{"op":"replace","path":"/metadata/files/5/path","value":"package.json"},{"op":"replace","path":"/metadata/files/4/note","value":"Exact npm resolution for certification"},{"op":"replace","path":"/metadata/files/4/path","value":"package-lock.json"},{"op":"replace","path":"/metadata/files/3/note","value":"Disabled and inert issue-sync job"},{"op":"replace","path":"/metadata/files/3/path","value":".github/workflows/pm-github-sync.yml"},{"op":"replace","path":"/metadata/files/2/note","value":"Dependabot #104 exact pinned SHA"},{"op":"replace","path":"/metadata/files/2/path","value":".github/workflows/codeql.yml"},{"op":"add","path":"/metadata/files/7","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project","note":"Real incomplete and dangling install fixtures"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:51:32.005Z"}],"before_hash":"245f16804f2a6e3c562dc9ecf896b5820f225dbbb33ae8a2ac9ee4f3949454eb","after_hash":"86446a318246c14e684317fa3af0ecbc834a88d2b03cdb50d57e8df8c00f8cf3","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"8d78e80884f825aa22b8cd5e4ad41443b0d9b58bec84027bbb07d467c21ae093"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:51:32.600Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/2","value":{"command":"flock /tmp/claude-1000/heavy-gate.lock npm run release:check","scope":"project","timeout_seconds":2400,"provenance":{"author":"codex-sol","created_at":"2026-10-04T10:51:32.568Z","source_kind":"local_mutation","source_ref":"chore/pm-todos-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:51:32.600Z"}],"before_hash":"86446a318246c14e684317fa3af0ecbc834a88d2b03cdb50d57e8df8c00f8cf3","after_hash":"e9da932d59c83e39b0f3eae195351a0dab90116416a11de60d832f0c9a054d96","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"76c11b5629621f4f90f7b109bb17b37b00b83178e7fbe7b21946ac50e5d36338"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:51:33.179Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"add","path":"/metadata/docs/2/note","value":"Gate and real tracker packed npm/Bun receipts"},{"op":"replace","path":"/metadata/docs/2/path","value":"docs/certification-2026.10.4.md"},{"op":"add","path":"/metadata/docs/3","value":{"path":"README.md","scope":"project"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:51:33.179Z"}],"before_hash":"e9da932d59c83e39b0f3eae195351a0dab90116416a11de60d832f0c9a054d96","after_hash":"630adf4fc81a2e8cfd87188e62e7656e56292905daee30f8c419b6bd1e51c2b1","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"34b481347dc4315de8704b0a2a755b307f7b42865178bf685ef620af81e6c7ec"} +{"hash_algorithm":"sha256","ts":"2026-10-04T10:54:06.854Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/5","value":{"created_at":"2026-10-04T10:54:06.854Z","author":"codex-sol","text":"Exact dependencies installed: CLI/SDK, pm-ops, pm-changelog 2026.10.4; @types/node 26.6.4; TypeScript 7.0.2. Both npm audit --omit=dev and npm audit report zero vulnerabilities. Existing canonical byte-identity regression failed before copying the published pm-ops template, then node --test test/prepare-merge-driver.test.ts passed 7/7, zero skips. Shared host lock serializes extension restore and release acceptance."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T10:54:06.854Z"}],"before_hash":"630adf4fc81a2e8cfd87188e62e7656e56292905daee30f8c419b6bd1e51c2b1","after_hash":"fb6c68cd5d253aa73923e51e8e06d5d4c9917e94407d10b89d46890179a6ca37","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"af900b534f7cfdb26e637d4156b4071296adf3145e4e1e73c3844ba13a575924"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:01:06.457Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/6","value":{"created_at":"2026-10-04T11:01:06.457Z","author":"codex-sol","text":"Full gate failed test-first: CLI 2026.10.4 correctly refuses incomplete 10,000-entry local checkout installs (extension_install_incomplete_source_scan) in coverage-commands, import-close-reason and rich JSONL integration fixtures. Replace checkout scanning with npm pack --ignore-scripts distribution artifacts and canonical package install; preserve all original behavior/doctor assertions and coverage thresholds. No upstream defect: this is the intended fail-closed installer behavior."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:01:06.457Z"}],"before_hash":"fb6c68cd5d253aa73923e51e8e06d5d4c9917e94407d10b89d46890179a6ca37","after_hash":"073a9165c4fab045f1ce603c2c2dd3d62f99c51f8d775215a605a1c1b61baa95","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"a79a3745810e9a76a7b8efaf6aee22c75571af0f77262ac817f1b2ac9873cb31"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:01:07.703Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/7/note","value":"Shared packed-artifact fixture for fail-closed 2026.10.4 installer"},{"op":"replace","path":"/metadata/files/7/path","value":"test/packed-fixture.ts"},{"op":"add","path":"/metadata/files/8","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project","note":"Real incomplete and dangling install fixtures"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:01:07.703Z"}],"before_hash":"073a9165c4fab045f1ce603c2c2dd3d62f99c51f8d775215a605a1c1b61baa95","after_hash":"9be7bed2bf9871e8886825526dd2715a8cb21946b3d4ba73038cc76886b3e208","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"1508f3622ab1bdb61eddbfdc64403e5c3c72abf45573a596c4321a3b679d9ad0"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:06:05.267Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/expected_result","value":"Pinned 2026.10.4 tooling passes existing gates, health, packed consumers and read-only GitHub preview; PR stays open for orchestrator review/merge."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:06:05.267Z"},{"op":"replace","path":"/metadata/description","value":"Certify the published PM CLI/SDK 2026.10.4 with exact latest development tools, canonical pm-ops launcher, Dependabot CodeQL consolidation, strict health, full release gate, packed acceptance and real tracker npm/native-Bun dogfood. Preserve minimum host 2026.8.20, existing coverage thresholds and disabled GitHub issue-sync boundary."}],"before_hash":"9be7bed2bf9871e8886825526dd2715a8cb21946b3d4ba73038cc76886b3e208","after_hash":"bdf38baa0319e4f2badab00a68bc66b59d1828179a17cecc7ecbe308b0f5d454","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"30f99fa6622f6149b8f6e554f4f756c3fa0d5c59ca3b45e65956f9c07482737f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:10:07.880Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/7","value":{"created_at":"2026-10-04T11:10:07.880Z","author":"codex-sol","text":"Real tracker packed dogfood passed under npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun @unbrained/pm-cli@2026.10.4: version=2026.10.4; --json todos export --format jsonl --output /real-.jsonl exported all 83 parseable rows; --json todos import --format jsonl --upsert --dry-run proposed 0 imports/83 updates/0 skips; actual upsert reported 0 imports/83 updates/0 skips. Only scratch copies were mutated and the scratch root was deleted. Exact command suffixes and receipts are in docs/certification-2026.10.4.md."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:10:07.880Z"}],"before_hash":"bdf38baa0319e4f2badab00a68bc66b59d1828179a17cecc7ecbe308b0f5d454","after_hash":"101044d4e3d351bf22ed1ca389ec19ac31b172fe81e2f99d6a34587f49776293","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"fc4eb273f5a040cdebdbe7a263459cb3e1a51365de8e8ae276ac33dcbb0e78a4"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:16:49.942Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/8","value":{"created_at":"2026-10-04T11:16:49.942Z","author":"codex-sol","text":"Second full gate: 280/280 tests, zero skips; index.ts 97.87% lines/93.33% branches/98.46% functions, canonical-reader and audit pass. Packed acceptance failed test-first because pm test exports PM_PATH for its tracker sandbox and accept-packed inherited it into independent scenarios. Scope PM_PATH explicitly to each scenario-local .agents/pm so no ambient tracker can be reinitialized; preserve all four current/minimum npm/Bun scenarios and exact assertions."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:16:49.942Z"}],"before_hash":"101044d4e3d351bf22ed1ca389ec19ac31b172fe81e2f99d6a34587f49776293","after_hash":"f26c33432c0a72e900b2be8cd84911bb214e7e65c1abeccd9f4d3bb39ca6f69a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"532d0b1d72e1a8a2ae8a874abaf6d85aa7190497f7657733bddbf2329ea372c2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:16:51.372Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/8/note","value":"Shared packed-artifact fixture for fail-closed 2026.10.4 installer"},{"op":"replace","path":"/metadata/files/8/path","value":"test/packed-fixture.ts"},{"op":"replace","path":"/metadata/files/7/note","value":"Published pm-ops launcher template"},{"op":"replace","path":"/metadata/files/7/path","value":"scripts/prepare-merge-driver.ts"},{"op":"replace","path":"/metadata/files/6/note","value":"Isolate scenario tracker from linked-test PM_PATH"},{"op":"replace","path":"/metadata/files/6/path","value":"scripts/accept-packed.ts"},{"op":"add","path":"/metadata/files/9","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project","note":"Real incomplete and dangling install fixtures"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:16:51.372Z"}],"before_hash":"f26c33432c0a72e900b2be8cd84911bb214e7e65c1abeccd9f4d3bb39ca6f69a","after_hash":"eeb479dfd93a0afaa3ef7723bef1430844f80dcc40b8f060c2b0f3e54f3a77b9","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"c06d625876faefdfaf0f13ca9372322a21e178a88e6169b1566d71b4f40196fb"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:16:53.256Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed","scope":"project","timeout_seconds":2400,"provenance":{"author":"codex-sol","created_at":"2026-10-04T11:16:53.205Z","source_kind":"local_mutation","source_ref":"chore/pm-todos-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:16:53.256Z"}],"before_hash":"eeb479dfd93a0afaa3ef7723bef1430844f80dcc40b8f060c2b0f3e54f3a77b9","after_hash":"2d3f2e15368f2c6ae910b798aa37e6f7ee3f0d526423e2484e0f24c578320e14","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"50ee982dd4c73fc646e4cdfe1fde74d1988c3f76332ae2d7aee8fe1a1b6a4fd1"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:18:28.707Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"replace","path":"/metadata/docs/1/note","value":"Canonical source fix included in pinned published pm-ops 2026.10.4"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:18:28.707Z"}],"before_hash":"2d3f2e15368f2c6ae910b798aa37e6f7ee3f0d526423e2484e0f24c578320e14","after_hash":"4cd8f1ebe3f7e129647607398fd60cbeb5b0644d71943c96fd03714b7a9e65e8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"2a467f9d8cc26907780e69182118f67d12ac8d35ec3ab9960650ebe50d4fdb9f"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:36:04.363Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"2026-10-04: full locked release:check passed 280/280 tests, zero skips; 97.87% lines/93.33% branches/98.46% functions across index.ts (no separate statement metric). Canonical-reader, audits, package pack, four current/minimum npm/Bun packed scenarios, changelog/date/attestation gates pass. Strict health passed; GitHub atomic dry-run proposed 0 imports/2 updates/0 skips. Real tracker npx/native-Bun dogfood exported and updated all 83 items; scratch deleted. Exact-head CI and reviews remain pending; orchestrator owns merge and closure."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:36:04.363Z"}],"before_hash":"4cd8f1ebe3f7e129647607398fd60cbeb5b0644d71943c96fd03714b7a9e65e8","after_hash":"e130606419b2d3fff9bde031e268f9396e5f4d2db5a017004fce27964df0666d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"0f3cd2eca4022625b2dd190d7053eb2357c49625f9eb18492abc48420ff030f4"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:36:06.433Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-04T11:36:06.433Z","author":"codex-sol","text":"Final full gate passed via npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker --override-linked-pm-context; linked command is flock /tmp/claude-1000/heavy-gate.lock npm run release:check. 280/280 tests, zero skips; 97.87/93.33/98.46 measured line/branch/function coverage; four packed current/minimum npm/Bun scenarios pass. Releasing claim for orchestrator; item stays in_progress and open for review/merge verification."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:36:06.433Z"}],"before_hash":"e130606419b2d3fff9bde031e268f9396e5f4d2db5a017004fce27964df0666d","after_hash":"5cab56c827ef2e31499f09566e2496d8f2d9ed20fbdd64034f3a23bf84d2f790","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"fe2ebf57ea6b4fef555d1f7fb0b7d203e838c7e37f49786d25aa800e8be61592"} +{"hash_algorithm":"sha256","ts":"2026-10-04T11:36:08.511Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:36:08.511Z"}],"before_hash":"5cab56c827ef2e31499f09566e2496d8f2d9ed20fbdd64034f3a23bf84d2f790","after_hash":"990f1f647bdec98ea3d6c9f59890f9cb953e760753fcc61d2fc756c4c25e5908","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"e35cce55ed4ba1a8556a67d3026a2667bf56928b5528934513b83f9ca1c9e0e6"} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 34a45f2a..f1dff040 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,8 +41,8 @@ jobs: shell: bash run: | set -euo pipefail - ./node_modules/.bin/pm package install npm:pm-github@2026.9.26 --project - node -e 'if (require("./.agents/pm/extensions/pm-github/package.json").version !== "2026.9.26") process.exit(1)' + ./node_modules/.bin/pm package install npm:pm-github@2026.10.4 --project + node -e 'if (require("./.agents/pm/extensions/pm-github/package.json").version !== "2026.10.4") process.exit(1)' managed_registry=".agents/pm/extensions/.managed-extensions.json" if git ls-files --error-unmatch "${managed_registry}" > /dev/null 2>&1; then git restore -- "${managed_registry}" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 68b74611..87013720 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,13 +28,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: languages: javascript-typescript # These packages are analyzed from source without a compiled build. build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: category: "/language:javascript-typescript" diff --git a/.github/workflows/pm-github-sync.yml b/.github/workflows/pm-github-sync.yml index 80da7d25..029353d9 100644 --- a/.github/workflows/pm-github-sync.yml +++ b/.github/workflows/pm-github-sync.yml @@ -58,8 +58,8 @@ jobs: shell: bash run: | set -euo pipefail - ./node_modules/.bin/pm package install npm:pm-github@2026.9.26 --project - node -e 'if (require("./.agents/pm/extensions/pm-github/package.json").version !== "2026.9.26") process.exit(1)' + ./node_modules/.bin/pm package install npm:pm-github@2026.10.4 --project + node -e 'if (require("./.agents/pm/extensions/pm-github/package.json").version !== "2026.10.4") process.exit(1)' managed_registry=".agents/pm/extensions/.managed-extensions.json" if git ls-files --error-unmatch "${managed_registry}" > /dev/null 2>&1; then git restore -- "${managed_registry}" diff --git a/docs/certification-2026.10.4.md b/docs/certification-2026.10.4.md new file mode 100644 index 00000000..2527ddd0 --- /dev/null +++ b/docs/certification-2026.10.4.md @@ -0,0 +1,55 @@ +# PM CLI/SDK 2026.10.4 certification + +Owner: [pm-todos-zpyc](https://github.com/unbraind/pm-todos/blob/main/.agents/pm/chores/pm-todos-zpyc.toon). + +Development pins: `@unbrained/pm-cli`, `pm-ops`, `pm-changelog` 2026.10.4; +`@types/node` 26.6.4; TypeScript 7.0.2. The supported host floor remains +2026.8.20. The managed GitHub extension and CI restoration use pm-github +2026.10.4. Dependabot #104's CodeQL init/analyze SHA is copied exactly: +`2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2` (`# v4`). + +The canonical launcher was copied unchanged from the installed +`pm-ops/templates/prepare-merge-driver.ts`. Its byte-identity test failed before +refresh and the launcher suite passed 7/7 afterward. CLI 2026.10.4 refuses +incomplete local-directory installs; the three affected behavioral fixtures now +install this checkout's packed distribution. Their behavioral assertions are +preserved; the focused integration/import tests passed 5/5 with zero skips. + +Both `npm audit --omit=dev` and `npm audit` report zero vulnerabilities; the +repository has no open Dependabot security alerts. `npx pm health --strict-exit +--require-merge-drivers` passed. The read-only `npx pm github import +unbraind/pm-todos --state all --atomic --dry-run` preview found two existing +issues and proposed 0 imports, 2 tracker updates, 0 skips, with no writes. +The scheduled sync remains disabled. + +The test stage of the full gate passed 280/280 tests with zero skips and measured 97.87% lines, +93.33% branches and 98.46% functions across its one configured source file. +Its packed scenarios additionally isolate PM_PATH from the invoking linked-test +runner. The final `flock /tmp/claude-1000/heavy-gate.lock npm run release:check` +passed via `npx pm test pm-todos-zpyc --run --only-index 3 --progress +--pm-context tracker --override-linked-pm-context`, including canonical-reader, +production audit, pack, all four packed current/minimum npm/Bun scenarios, +changelog, date and publish-attestation checks. Existing coverage thresholds remain 97% lines, +93% branches and 98% functions; no separate statement metric is enforced. + +Real-data dogfood copied this repository's `.agents/pm` into disposable +`pm-todos-dogfood/.agents/pm`, packed the package with `npm pack +--pack-destination /pack`, and installed its tarball with `npm install +--ignore-scripts @unbrained/pm-cli@2026.10.4 ` and `npx -y +@unbrained/pm-cli@2026.10.4 package install --project`. For each of +`npx -y @unbrained/pm-cli@2026.10.4` and `bunx --bun +@unbrained/pm-cli@2026.10.4`, the exact command suffixes were: + +```sh +--version +--json todos export --format jsonl --output /real-.jsonl +--json todos import /real-.jsonl --format jsonl --upsert --dry-run +--json todos import /real-.jsonl --format jsonl --upsert +``` + +Both hosts reported 2026.10.4; both exported 83 real items, previewed 0 imports / +83 updates / 0 skips, and applied 0 imports / 83 updates / 0 skips inside scratch +only. Both exported files contained 83 parseable JSONL rows. All commands exited +0. The scratch copy was deleted afterward. This establishes command operation +on the real tracker; rich-field fidelity remains covered separately by the +integration fixture. All heavy commands held the shared host lock. diff --git a/package-lock.json b/package-lock.json index 43ced1b1..83b3ab47 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,11 +9,11 @@ "version": "2026.10.3", "license": "MIT", "devDependencies": { - "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.27", - "pm-changelog": "2026.9.25", - "pm-ops": "2026.9.28", - "typescript": "^7.0.2" + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2" }, "engines": { "node": ">=22.18.0" @@ -35,44 +35,6 @@ "node": ">=18.0.0" } }, - "node_modules/@nodelib/fs.scandir": { - "version": "2.1.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", - "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "2.0.5", - "run-parallel": "^1.1.9" - }, - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.stat": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz", - "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/@nodelib/fs.walk": { - "version": "1.2.8", - "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz", - "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.scandir": "2.1.5", - "fastq": "^1.6.0" - }, - "engines": { - "node": ">= 8" - } - }, "node_modules/@opentelemetry/api": { "version": "1.9.1", "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz", @@ -319,9 +281,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.2", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz", - "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==", + "version": "26.6.4", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.4.tgz", + "integrity": "sha512-ldVPDCzj7fsaGZrLB0NuHuTvJcsNasysBAqMolr/cgxrLd1xbqxIr3XJiPnHHJUCxj5sNF1vnRj9aWnrVh5Jcg==", "dev": true, "license": "MIT", "dependencies": { @@ -669,9 +631,9 @@ } }, "node_modules/@unbrained/pm-cli": { - "version": "2026.9.27", - "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.9.27.tgz", - "integrity": "sha512-l7m3GIm50oMecjXYnzA+RuzHgFD/uAOZko3eRJXfT+pYV9pceh4xvJ9dbD+35p2mY/zvUNiZjggCOOrWVuswSA==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/@unbrained/pm-cli/-/pm-cli-2026.10.4.tgz", + "integrity": "sha512-NZLdiUSUKIRcFiMj9lG0L5UubA9G33fq5WzB1JzJjTTlYxYCVjrFFOCV2rtxYTaYTCzX9o/6V/A4fDx6N3mm/w==", "dev": true, "license": "MIT", "dependencies": { @@ -679,10 +641,10 @@ "@toon-format/toon": "^4.1.1", "@types/node": ">=22", "commander": "^15.0.0", - "fast-glob": "^3.3.3", "fast-json-patch": "^3.1.1", "npm-package-arg": "^13.0.2", "tar": "7.5.22", + "tinyglobby": "^0.2.17", "yaml": "^2.9.1" }, "bin": { @@ -695,19 +657,6 @@ "node": ">=22.18.0" } }, - "node_modules/braces": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", - "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", - "dev": true, - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/chownr": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz", @@ -760,23 +709,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fast-glob": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz", - "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@nodelib/fs.stat": "^2.0.2", - "@nodelib/fs.walk": "^1.2.3", - "glob-parent": "^5.1.2", - "merge2": "^1.3.0", - "micromatch": "^4.0.8" - }, - "engines": { - "node": ">=8.6.0" - } - }, "node_modules/fast-json-patch": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz", @@ -784,42 +716,6 @@ "dev": true, "license": "MIT" }, - "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", - "dev": true, - "license": "ISC", - "dependencies": { - "reusify": "^1.0.4" - } - }, - "node_modules/fill-range": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", - "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", - "dev": true, - "license": "MIT", - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/glob-parent": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", - "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, "node_modules/hosted-git-info": { "version": "9.0.3", "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz", @@ -848,39 +744,6 @@ "node": ">=18" } }, - "node_modules/is-extglob": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", - "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-glob": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz", - "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==", - "dev": true, - "license": "MIT", - "dependencies": { - "is-extglob": "^2.1.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/is-number": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", - "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.12.0" - } - }, "node_modules/lru-cache": { "version": "11.5.2", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz", @@ -891,30 +754,6 @@ "node": "20 || >=22" } }, - "node_modules/merge2": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", - "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/micromatch": { - "version": "4.0.8", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz", - "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==", - "dev": true, - "license": "MIT", - "dependencies": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" - }, - "engines": { - "node": ">=8.6" - } - }, "node_modules/minipass": { "version": "7.1.3", "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz", @@ -968,23 +807,10 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, "node_modules/pm-changelog": { - "version": "2026.9.25", - "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.9.25.tgz", - "integrity": "sha512-j2l97jlJIfuMiB7KDi7oIr9MWxdQvqnDx/JwE3pxC31fDw3MywnSmaTcE9/gV6sVlZbQkOSxnxooHzDwRo+1+g==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-changelog/-/pm-changelog-2026.10.4.tgz", + "integrity": "sha512-YJJHJYv2i+olzGVF+qdab3wWG6auiRVIvf7TZD4ZdUhE/8lIawf3aYOOZZVJHogN8xP8rNUlVV9Lc1OXKLlQ7w==", "dev": true, "license": "MIT", "bin": { @@ -998,9 +824,9 @@ } }, "node_modules/pm-ops": { - "version": "2026.9.28", - "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.9.28.tgz", - "integrity": "sha512-MjsVk6uGYz8X3OxVuBHuBUEjcoUb3ubqSCG/hWvYOlj8AI8gbc3IPsIUGfDECH6WYP63B8hYjvc6Ahv3DdbIyQ==", + "version": "2026.10.4", + "resolved": "https://registry.npmjs.org/pm-ops/-/pm-ops-2026.10.4.tgz", + "integrity": "sha512-/6ehQBNwKquIol3EUW1r4pZSXKaohHc1gXJUSk7cqQwkVJOSlP8cCcHzNFH76/6O9hG04Eb5KAH90vFkhTxfMQ==", "dev": true, "license": "MIT", "dependencies": { @@ -1046,27 +872,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/queue-microtask": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz", - "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT" - }, "node_modules/require-in-the-middle": { "version": "8.0.1", "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz", @@ -1081,41 +886,6 @@ "node": ">=9.3.0 || >=8.10.0 <9.0.0" } }, - "node_modules/reusify": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz", - "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==", - "dev": true, - "license": "MIT", - "engines": { - "iojs": ">=1.0.0", - "node": ">=0.10.0" - } - }, - "node_modules/run-parallel": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz", - "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT", - "dependencies": { - "queue-microtask": "^1.2.2" - } - }, "node_modules/semver": { "version": "7.8.5", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", @@ -1146,17 +916,52 @@ "node": ">=18" } }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", - "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", "dev": true, "license": "MIT", "dependencies": { - "is-number": "^7.0.0" + "fdir": "^6.5.0", + "picomatch": "^4.0.4" }, "engines": { - "node": ">=8.0" + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/tinyglobby/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/tinyglobby/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" } }, "node_modules/typescript": { diff --git a/package.json b/package.json index 05b51361..25c09c33 100644 --- a/package.json +++ b/package.json @@ -48,11 +48,11 @@ "@unbrained/pm-cli": ">=2026.8.20" }, "devDependencies": { - "@types/node": "^26.1.1", - "@unbrained/pm-cli": "2026.9.27", - "pm-changelog": "2026.9.25", - "pm-ops": "2026.9.28", - "typescript": "^7.0.2" + "@types/node": "26.6.4", + "@unbrained/pm-cli": "2026.10.4", + "pm-changelog": "2026.10.4", + "pm-ops": "2026.10.4", + "typescript": "7.0.2" }, "keywords": [ "exporter", diff --git a/scripts/accept-packed.ts b/scripts/accept-packed.ts index e21e56ad..7e95dd7e 100644 --- a/scripts/accept-packed.ts +++ b/scripts/accept-packed.ts @@ -123,6 +123,9 @@ try { mkdirSync(isolatedData); const scenarioEnvironment: NodeJS.ProcessEnv = { ...cleanEnvironment, + // A linked pm test exports its own tracker path; each consumer must + // initialize and exercise only its scenario-local tracker. + PM_PATH: join(scenarioRoot, ".agents", "pm"), PM_GLOBAL_PATH: join(scenarioRoot, "global-pm"), XDG_CONFIG_HOME: isolatedConfig, XDG_DATA_HOME: isolatedData, diff --git a/scripts/prepare-merge-driver.ts b/scripts/prepare-merge-driver.ts index 728ece4a..f6f49f07 100644 --- a/scripts/prepare-merge-driver.ts +++ b/scripts/prepare-merge-driver.ts @@ -31,8 +31,12 @@ try { // the original error is rethrown. A probe that finds no package.json is not // yet proof of absence: a broken install can leave `node_modules/pm-ops` (a // directory or a dangling link) with no package.json in any ancestor Node - // searches. Such an entry also counts as present. Node returns null paths - // only for built-in modules; pm-ops/package.json is a package specifier. + // searches. Such an entry also counts as present. Keep Node's global paths + // too: the installer resolution above can use them, so an absent local + // package alone cannot prove absence. An unreadable or malformed lookup path + // leaves presence uncertain and must fail closed with the original error. + // Node returns null paths only for built-in modules; pm-ops/package.json is + // a package specifier. let packagePresent = true; try { resolver.resolve("pm-ops/package.json"); @@ -40,7 +44,16 @@ try { packagePresent = !(probe instanceof Error && "code" in probe && probe.code === "MODULE_NOT_FOUND") || resolver.resolve.paths("pm-ops/package.json")!.some( - (directory) => lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined, + (directory) => { + try { + return lstatSync(join(directory, "pm-ops"), { throwIfNoEntry: false }) !== undefined; + } catch { + // throwIfNoEntry:false only suppresses ENOENT, not EACCES, EPERM, + // ENOTDIR, or ELOOP. Do not replace the installer diagnostic or + // treat an inconclusive presence check as an omit-dev install. + return true; + } + }, ); } if (packagePresent) throw error; diff --git a/test/coverage-commands.test.ts b/test/coverage-commands.test.ts index 88fc37a2..2313e51d 100644 --- a/test/coverage-commands.test.ts +++ b/test/coverage-commands.test.ts @@ -29,6 +29,8 @@ import { tmpdir } from "node:os"; import { join } from "node:path"; import test, { before, beforeEach } from "node:test"; +import { packExtension } from "./packed-fixture.ts"; + import { createExtensionTestHarness } from "@unbrained/pm-cli/sdk/testing"; import type { ExtensionTestHarness } from "@unbrained/pm-cli/sdk/testing"; @@ -55,7 +57,7 @@ const env: NodeJS.ProcessEnv = { XDG_DATA_HOME: xdgData, }; execFileSync(pmBin, ["init", tracker, "--json"], { cwd: root, env, encoding: "utf-8" }); -execFileSync(pmBin, ["--pm-path", tracker, "install", process.cwd(), "--project", "--json"], { +execFileSync(pmBin, ["--pm-path", tracker, "package", "install", packExtension(root), "--project", "--json"], { cwd: root, env, encoding: "utf-8", }); diff --git a/test/import-close-reason.test.ts b/test/import-close-reason.test.ts index 18f0fb59..19d87c8a 100644 --- a/test/import-close-reason.test.ts +++ b/test/import-close-reason.test.ts @@ -20,6 +20,8 @@ import { tmpdir } from "node:os"; import { join } from "node:path"; import test from "node:test"; +import { packExtension } from "./packed-fixture.ts"; + /** The pm binary shipped with the installed dev dependency. */ const pmBin = join(process.cwd(), "node_modules", ".bin", "pm"); @@ -98,11 +100,11 @@ function freshWorkspace(): { return { status: result.status, stdout: result.stdout, stderr: result.stderr }; }; // Bootstrap the tracker and install this package as a project extension. - // The package is installed from its own source (process.cwd()), so the test - // exercises the code in this repository, not a stale published build. + // The artifact is packed from this checkout after the test script builds it, + // so the fixture exercises this repository rather than a published build. assert.equal(run(["init", tracker, "--json"]).status, 0, "pm init must succeed"); assert.equal( - run(["--pm-path", tracker, "install", process.cwd(), "--project", "--json"]).status, + run(["--pm-path", tracker, "package", "install", packExtension(root), "--project", "--json"]).status, 0, "pm install of this package must succeed", ); diff --git a/test/integration.test.ts b/test/integration.test.ts index b811fdff..79357e16 100644 --- a/test/integration.test.ts +++ b/test/integration.test.ts @@ -5,6 +5,8 @@ import { tmpdir } from "node:os"; import { join } from "node:path"; import test from "node:test"; +import { packExtension } from "./packed-fixture.ts"; + test("installed package preserves rich JSONL context through the pm store", () => { const root = mkdtempSync(join(tmpdir(), "pm-todos-jsonl-")); const tracker = join(root, "tracker"); @@ -34,9 +36,9 @@ test("installed package preserves rich JSONL context through the pm store", () = try { runPm(["init", tracker, "--json"]); - runPm(["--pm-path", tracker, "install", process.cwd(), "--project", "--json"]); + runPm(["--pm-path", tracker, "package", "install", packExtension(root), "--project", "--json"]); const doctor = JSON.parse(runPm(["--pm-path", tracker, "package", "doctor", "--project", "--detail", "deep", "--json"])); - // This fixture installs the package from a local directory, which has no GitHub + // This fixture installs a packed archive, which has no GitHub // release feed, so the update-health probe cannot cover it. pm-cli 2026.9.8 // (GH-1219) began reporting that skip instead of counting it as covered, so the // truthful result here is exactly one partial-coverage warning naming the reason. diff --git a/test/packed-fixture.ts b/test/packed-fixture.ts new file mode 100644 index 00000000..5bf42c96 --- /dev/null +++ b/test/packed-fixture.ts @@ -0,0 +1,23 @@ +import assert from "node:assert/strict"; +import { execFileSync } from "node:child_process"; +import { readdirSync } from "node:fs"; +import { devNull } from "node:os"; +import { join } from "node:path"; + +/** Pack the built distribution into the fixture instead of scanning node_modules. */ +export function packExtension(destination: string): string { + const windows = process.platform === "win32"; + const env = { + ...process.env, + npm_config_userconfig: devNull, + NPM_CONFIG_USERCONFIG: devNull, + npm_config_ignore_scripts: "true", + NPM_CONFIG_IGNORE_SCRIPTS: "true", + }; + execFileSync(windows ? "npm.cmd" : "npm", [ + "pack", "--ignore-scripts", "--pack-destination", destination, + ], { cwd: process.cwd(), env, encoding: "utf8", shell: windows }); + const archives = readdirSync(destination).filter((name) => name.endsWith(".tgz")); + assert.equal(archives.length, 1, "fixture must install exactly one packed artifact"); + return join(destination, archives[0]!); +} From f750aec1c04f6287c334d6442e34bf1b0660fe0d Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 14:31:39 +0200 Subject: [PATCH 2/3] Cover malformed merge-driver lookup diagnostics from review --- .agents/pm/chores/pm-todos-zpyc.toon | 52 +++++++++++++++++++++----- .agents/pm/history/pm-todos-zpyc.jsonl | 10 +++++ docs/certification-2026.10.4.md | 11 ++++++ test/prepare-merge-driver.test.ts | 9 +++++ 4 files changed, 72 insertions(+), 10 deletions(-) diff --git a/.agents/pm/chores/pm-todos-zpyc.toon b/.agents/pm/chores/pm-todos-zpyc.toon index bbe5e817..ff2ad531 100644 --- a/.agents/pm/chores/pm-todos-zpyc.toon +++ b/.agents/pm/chores/pm-todos-zpyc.toon @@ -6,15 +6,15 @@ status: in_progress priority: 1 tags[3]: agent-ux,"area:github","area:release" created_at: "2026-09-27T08:15:15.176Z" -updated_at: "2026-10-04T11:36:08.511Z" +updated_at: "2026-10-04T12:31:31.808Z" author: codex -acceptance_criteria: "Package and lock pins updated to published CLI, pm-ops and pm-changelog; managed pm-github source exact 2026.9.26; canonical launcher and real broken-install child tests pass; strict health and full release gate pass; sync stays disabled pending privacy gate; exact-head CI and review complete." +acceptance_criteria: "Package and lock pins updated to published CLI, pm-ops and pm-changelog 2026.10.4; managed pm-github source exact 2026.10.4; canonical launcher and real broken-install child tests pass; strict health and full release gate pass; sync stays disabled pending privacy gate; exact-head CI and review complete." repro_steps: "On main, run pm health --strict-exit --json under host CLI 2026.9.27 and observe extension_host_pm_cli_version_skew; inspect CI and sync workflow unversioned extension installs. After updating pm-ops, the existing canonical launcher byte-identity test fails until its published template is copied." expected_result: "Pinned 2026.10.4 tooling passes existing gates, health, packed consumers and read-only GitHub preview; PR stays open for orchestrator review/merge." -actual_result: "2026-10-04: full locked release:check passed 280/280 tests, zero skips; 97.87% lines/93.33% branches/98.46% functions across index.ts (no separate statement metric). Canonical-reader, audits, package pack, four current/minimum npm/Bun packed scenarios, changelog/date/attestation gates pass. Strict health passed; GitHub atomic dry-run proposed 0 imports/2 updates/0 skips. Real tracker npx/native-Bun dogfood exported and updated all 83 items; scratch deleted. Exact-head CI and reviews remain pending; orchestrator owns merge and closure." +actual_result: "Review follow-up locked release:check PASS 281/281, zero skips; unchanged index.ts L/B/F coverage 97.87/93.33/98.46 (statements not separately reported). Canonical-reader, production audit, pack, all four current/minimum npm/Bun packed scenarios and changelog/date/attestation pass. Both audits clean. Greptile malformed lookup regression is red against old launcher (ENOTDIR), green against canonical pm-ops 2026.10.4 (MODULE_NOT_FOUND, no skip). Strict health and real tracker npm/native-Bun round-trip all 83 items passed; GitHub preview 0/2/0 read-only. Linked gate creates lock parent. Review/CI follow-up pending; quota/absent bots do not establish approval." dependencies[1]{id,kind,created_at,author,source_kind,author_source}: pm-todos-p60g,related,"2026-09-27T08:22:58.654Z",codex,"cli:update:dep",detected -comments[10]{created_at,author,text}: +comments[13]{created_at,author,text}: "2026-09-28T06:20:10.124Z",claude-hub,"2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch." "2026-10-02T22:10:28.268Z",codex-sol,"Restart by codex-sol: preserved remote PR #103 and all existing bot replies/reactions were inspected. Branch is already current with origin/main. No new actionable unresolved inline finding is present. Retain documented coverage/health/publication blockers; rerun unchanged full CI gate with the host-wide flock. No merge, publish or item closure." "2026-10-02T22:36:28.489Z",codex-sol,"Restart: reproduced CI exact project-local npm:pm-github@2026.9.26 installation and verified package version; restored the tracked managed registry exactly as CI does. Locked npm ci and unchanged release:check pass 280/280 tests, zero skips, measured index.ts 97.87% lines / 93.33% branches / 98.46% functions; statements are not separately reported. Canonical-reader, production audit, packed npm/Bun current/minimum host acceptance, changelog/date/attestation gates pass. The linked prepare suite initially refused foreign-ref trust; acknowledged authorized commands and reran successfully. Published canonical-template identity continues to cover ancestor-install handling. Coverage pm-todos-p60g and fail-closed pre-push privacy prerequisites remain open; issue-sync workflow stays disabled. No merge, publish or close; release claim for orchestrator." @@ -25,6 +25,9 @@ comments[10]{created_at,author,text}: "2026-10-04T11:10:07.880Z",codex-sol,"Real tracker packed dogfood passed under npx -y @unbrained/pm-cli@2026.10.4 and bunx --bun @unbrained/pm-cli@2026.10.4: version=2026.10.4; --json todos export --format jsonl --output /real-.jsonl exported all 83 parseable rows; --json todos import --format jsonl --upsert --dry-run proposed 0 imports/83 updates/0 skips; actual upsert reported 0 imports/83 updates/0 skips. Only scratch copies were mutated and the scratch root was deleted. Exact command suffixes and receipts are in docs/certification-2026.10.4.md." "2026-10-04T11:16:49.942Z",codex-sol,"Second full gate: 280/280 tests, zero skips; index.ts 97.87% lines/93.33% branches/98.46% functions, canonical-reader and audit pass. Packed acceptance failed test-first because pm test exports PM_PATH for its tracker sandbox and accept-packed inherited it into independent scenarios. Scope PM_PATH explicitly to each scenario-local .agents/pm so no ambient tracker can be reinitialized; preserve all four current/minimum npm/Bun scenarios and exact assertions." "2026-10-04T11:36:06.433Z",codex-sol,"Final full gate passed via npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker --override-linked-pm-context; linked command is flock /tmp/claude-1000/heavy-gate.lock npm run release:check. 280/280 tests, zero skips; 97.87/93.33/98.46 measured line/branch/function coverage; four packed current/minimum npm/Bun scenarios pass. Releasing claim for orchestrator; item stays in_progress and open for review/merge verification." + "2026-10-04T12:25:02.506Z",codex-sol,"Greptile PR #106 identified the missing malformed-lookup regression for the canonical launcher. Added a child-process fixture with node_modules as a file: it fails against origin/main launcher with ENOTDIR, and passes with the unchanged pm-ops 2026.10.4 template while requiring MODULE_NOT_FOUND and no omit-dev notice. Scoped launcher suite and lint pass. Initial remote Node 22.18/26 and CodeQL passed; CodeRabbit auto-review skipped, Sourcery quota exhausted, other requested reviews remain missing." + "2026-10-04T12:25:36.420Z",codex-sol,"Correction to the preceding note: the scoped launcher suite passed 8/8, zero skips. This repository has no ESLint dependency or lint script; the attempted direct eslint invocation was unavailable. The actual repository check is TypeScript typecheck, now exercised by the full linked release gate. No lint outcome is claimed." + "2026-10-04T12:31:29.975Z",codex-sol,"Review follow-up full locked release gate PASS 281/281 tests, zero skipped; unchanged configured L/B/F coverage 97.87/93.33/98.46 and no separate statements metric. The new malformed lookup test fails old launcher with ENOTDIR and passes the unchanged published template. Updated stale managed-extension acceptance version to 2026.10.4 and create shared-lock parent in linked gate, preserving mandatory lock and release body. Both audits, native canonical reader, all four current/minimum npm/Bun packed scenarios and release checks pass. Sourcery weekly and Cubic monthly quota notices are missing review evidence; manual remaining reviews follow after push." notes[3]{created_at,author,text}: "2026-09-27T08:17:04.004Z",codex,"2026-09-27: Published CLI/SDK 2026.9.27 and pm-github 2026.9.26 installed through the project-local CLI; strict health passes with stale-item advisories. The published pm-ops launcher byte-identity test failed before copying its 2026.9.26 template, then the focused child-checkout suite passed 7/7 including incomplete directory and dangling link. Following a valid CodeRabbit privacy finding on the sibling pm-jira candidate, the checked-in scheduled sync job now has an if: false guard in addition to GitHub disabled_manually. The separate pre-push privacy gate is still absent; sync must not be enabled." "2026-09-27T08:27:21.211Z",codex,"2026-09-27 final guarded candidate: npm run release:check exits 0 after sync job if: false and PM link updates. 280/280 source tests pass with zero skips; index.ts honestly measures 97.87% lines, 93.33% branches, and 98.46% functions, with no statement metric. Docstring gate documents 81/81 declarations; zero production npm audit findings. Packed npm-current and bun-current against CLI/SDK 2026.9.27 and npm-minimum and bun-minimum against 2026.8.20 each imported 1 and exported 2 real fixture rows. The separate coverage item pm-todos-p60g remains open; the checked-in and GitHub scheduled sync are inert pending a fail-closed pre-push privacy gate. Exact-head CI and bot review remain to be completed after push." @@ -39,12 +42,41 @@ files[10]{path,scope,note}: scripts/accept-packed.ts,project,Isolate scenario tracker from linked-test PM_PATH scripts/prepare-merge-driver.ts,project,Published pm-ops launcher template test/packed-fixture.ts,project,Shared packed-artifact fixture for fail-closed 2026.10.4 installer - test/prepare-merge-driver.test.ts,project,Real incomplete and dangling install fixtures -tests[4]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}: - "npm run release:check",project,900,codex,"2026-09-27T08:20:15.063Z",local_mutation,fix/pm-todos-cli-2026-09-27-github-pin - node --test test/prepare-merge-driver.test.ts,project,120,codex,"2026-09-27T08:20:15.063Z",local_mutation,fix/pm-todos-cli-2026-09-27-github-pin - "flock /tmp/claude-1000/heavy-gate.lock npm run release:check",project,2400,codex-sol,"2026-10-04T10:51:32.568Z",local_mutation,chore/pm-todos-pm-cli-2026-10-4 - "flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed",project,2400,codex-sol,"2026-10-04T11:16:53.205Z",local_mutation,chore/pm-todos-pm-cli-2026-10-4 + test/prepare-merge-driver.test.ts,project,Greptile malformed lookup diagnostic regression +tests[4]: + - command: "npm run release:check" + scope: project + timeout_seconds: 900 + provenance: + author: codex + created_at: "2026-09-27T08:20:15.063Z" + source_kind: local_mutation + source_ref: fix/pm-todos-cli-2026-09-27-github-pin + - command: node --test test/prepare-merge-driver.test.ts + scope: project + timeout_seconds: 120 + provenance: + author: codex + created_at: "2026-09-27T08:20:15.063Z" + source_kind: local_mutation + source_ref: fix/pm-todos-cli-2026-09-27-github-pin + - command: "flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed" + scope: project + timeout_seconds: 2400 + provenance: + author: codex-sol + created_at: "2026-10-04T11:16:53.205Z" + source_kind: local_mutation + source_ref: chore/pm-todos-pm-cli-2026-10-4 + - command: "mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check" + scope: project + timeout_seconds: 2400 + pm_context_mode: tracker + provenance: + author: codex-sol + created_at: "2026-10-04T12:31:29.065Z" + source_kind: local_mutation + source_ref: chore/pm-todos-pm-cli-2026-10-4 docs[4]: - path: "https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-jzp5.toon" scope: global diff --git a/.agents/pm/history/pm-todos-zpyc.jsonl b/.agents/pm/history/pm-todos-zpyc.jsonl index 997cae8a..9d4310a4 100644 --- a/.agents/pm/history/pm-todos-zpyc.jsonl +++ b/.agents/pm/history/pm-todos-zpyc.jsonl @@ -41,3 +41,13 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T11:36:04.363Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"2026-10-04: full locked release:check passed 280/280 tests, zero skips; 97.87% lines/93.33% branches/98.46% functions across index.ts (no separate statement metric). Canonical-reader, audits, package pack, four current/minimum npm/Bun packed scenarios, changelog/date/attestation gates pass. Strict health passed; GitHub atomic dry-run proposed 0 imports/2 updates/0 skips. Real tracker npx/native-Bun dogfood exported and updated all 83 items; scratch deleted. Exact-head CI and reviews remain pending; orchestrator owns merge and closure."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:36:04.363Z"}],"before_hash":"4cd8f1ebe3f7e129647607398fd60cbeb5b0644d71943c96fd03714b7a9e65e8","after_hash":"e130606419b2d3fff9bde031e268f9396e5f4d2db5a017004fce27964df0666d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"0f3cd2eca4022625b2dd190d7053eb2357c49625f9eb18492abc48420ff030f4"} {"hash_algorithm":"sha256","ts":"2026-10-04T11:36:06.433Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-04T11:36:06.433Z","author":"codex-sol","text":"Final full gate passed via npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker --override-linked-pm-context; linked command is flock /tmp/claude-1000/heavy-gate.lock npm run release:check. 280/280 tests, zero skips; 97.87/93.33/98.46 measured line/branch/function coverage; four packed current/minimum npm/Bun scenarios pass. Releasing claim for orchestrator; item stays in_progress and open for review/merge verification."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:36:06.433Z"}],"before_hash":"e130606419b2d3fff9bde031e268f9396e5f4d2db5a017004fce27964df0666d","after_hash":"5cab56c827ef2e31499f09566e2496d8f2d9ed20fbdd64034f3a23bf84d2f790","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"fe2ebf57ea6b4fef555d1f7fb0b7d203e838c7e37f49786d25aa800e8be61592"} {"hash_algorithm":"sha256","ts":"2026-10-04T11:36:08.511Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T11:36:08.511Z"}],"before_hash":"5cab56c827ef2e31499f09566e2496d8f2d9ed20fbdd64034f3a23bf84d2f790","after_hash":"990f1f647bdec98ea3d6c9f59890f9cb953e760753fcc61d2fc756c4c25e5908","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"e35cce55ed4ba1a8556a67d3026a2667bf56928b5528934513b83f9ca1c9e0e6"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:25:00.144Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:25:00.144Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"990f1f647bdec98ea3d6c9f59890f9cb953e760753fcc61d2fc756c4c25e5908","after_hash":"a333fb32e444922c81f4b7d57efba9bf45928bb9892809dc61ba1115053cd685","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"6e03424463f443942a931ec353633651e0f477140a1a8a17f70ec21776ce0db5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:25:02.506Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/10","value":{"created_at":"2026-10-04T12:25:02.506Z","author":"codex-sol","text":"Greptile PR #106 identified the missing malformed-lookup regression for the canonical launcher. Added a child-process fixture with node_modules as a file: it fails against origin/main launcher with ENOTDIR, and passes with the unchanged pm-ops 2026.10.4 template while requiring MODULE_NOT_FOUND and no omit-dev notice. Scoped launcher suite and lint pass. Initial remote Node 22.18/26 and CodeQL passed; CodeRabbit auto-review skipped, Sourcery quota exhausted, other requested reviews remain missing."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:25:02.506Z"}],"before_hash":"a333fb32e444922c81f4b7d57efba9bf45928bb9892809dc61ba1115053cd685","after_hash":"6c69d960059a0534b161d3214b3c47a13c4d139e6922f3f03e6994f9036ffec1","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f5a4d83151968d3666d67fce644cf2e881aacd32eb7d46d4bf22ac9b9ea6c448"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:25:03.431Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/9/note","value":"Greptile malformed lookup diagnostic regression"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:25:03.431Z"}],"before_hash":"6c69d960059a0534b161d3214b3c47a13c4d139e6922f3f03e6994f9036ffec1","after_hash":"cbff450044b567725c3b094ee6580b45ad3b82e22d708dbf2b238d09b5b49cf8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"8123b71e816b9b87ed7eeca505e93ce0773048a765886bc17256227dc49ad130"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:25:36.420Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/11","value":{"created_at":"2026-10-04T12:25:36.420Z","author":"codex-sol","text":"Correction to the preceding note: the scoped launcher suite passed 8/8, zero skips. This repository has no ESLint dependency or lint script; the attempted direct eslint invocation was unavailable. The actual repository check is TypeScript typecheck, now exercised by the full linked release gate. No lint outcome is claimed."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:25:36.420Z"}],"before_hash":"cbff450044b567725c3b094ee6580b45ad3b82e22d708dbf2b238d09b5b49cf8","after_hash":"b02a987216024759ad46a0335e4360cf6addc22b43c8270012ccb81cf6217602","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"49c44a679c50dcc30fc3cb7f53bff492299336e636c6863718997f3dd8e185f2"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:31:27.304Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/acceptance_criteria","value":"Package and lock pins updated to published CLI, pm-ops and pm-changelog 2026.10.4; managed pm-github source exact 2026.10.4; canonical launcher and real broken-install child tests pass; strict health and full release gate pass; sync stays disabled pending privacy gate; exact-head CI and review complete."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:27.304Z"}],"before_hash":"b02a987216024759ad46a0335e4360cf6addc22b43c8270012ccb81cf6217602","after_hash":"4ffc3d63cfe080686e284e527765b064166cec9933c3b22c2b0606cf7464c00c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"cc2365fa261e47636e740b09e1931cee9323ab22f7587a9c9d3e05aa26a15962"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:31:28.201Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_remove","patch":[{"op":"remove","path":"/metadata/tests/3"},{"op":"replace","path":"/metadata/tests/2/provenance/created_at","value":"2026-10-04T11:16:53.205Z"},{"op":"replace","path":"/metadata/tests/2/command","value":"flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:28.201Z"}],"before_hash":"4ffc3d63cfe080686e284e527765b064166cec9933c3b22c2b0606cf7464c00c","after_hash":"b562878a3920a6ff25efcde2f44855c12f4d6aa064e04064298934e790699e50","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"98974926c0d7928cf90a7e1172710c825580a0ed856abc029d1a367f896917a1"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:31:29.093Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check","scope":"project","timeout_seconds":2400,"pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T12:31:29.065Z","source_kind":"local_mutation","source_ref":"chore/pm-todos-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:29.093Z"}],"before_hash":"b562878a3920a6ff25efcde2f44855c12f4d6aa064e04064298934e790699e50","after_hash":"c7fe6cb99c2f5a5c8b02909ae642660c679c0716f04753b94462cbd9c8ad27df","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b533c5cb4f33ae9679f096f2128e3c53af1b5e9762b41921e7486878d75ef1ac"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:31:29.975Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/12","value":{"created_at":"2026-10-04T12:31:29.975Z","author":"codex-sol","text":"Review follow-up full locked release gate PASS 281/281 tests, zero skipped; unchanged configured L/B/F coverage 97.87/93.33/98.46 and no separate statements metric. The new malformed lookup test fails old launcher with ENOTDIR and passes the unchanged published template. Updated stale managed-extension acceptance version to 2026.10.4 and create shared-lock parent in linked gate, preserving mandatory lock and release body. Both audits, native canonical reader, all four current/minimum npm/Bun packed scenarios and release checks pass. Sourcery weekly and Cubic monthly quota notices are missing review evidence; manual remaining reviews follow after push."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:29.975Z"}],"before_hash":"c7fe6cb99c2f5a5c8b02909ae642660c679c0716f04753b94462cbd9c8ad27df","after_hash":"007dc2b6f05bca6ed1d1f7046638c188596b19371fff1a3b517a77a4681cc07d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"262df67833675a9100bfb87e504310172147dde3717104992179245faa2aa611"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:31:30.926Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Review follow-up locked release:check PASS 281/281, zero skips; unchanged index.ts L/B/F coverage 97.87/93.33/98.46 (statements not separately reported). Canonical-reader, production audit, pack, all four current/minimum npm/Bun packed scenarios and changelog/date/attestation pass. Both audits clean. Greptile malformed lookup regression is red against old launcher (ENOTDIR), green against canonical pm-ops 2026.10.4 (MODULE_NOT_FOUND, no skip). Strict health and real tracker npm/native-Bun round-trip all 83 items passed; GitHub preview 0/2/0 read-only. Linked gate creates lock parent. Review/CI follow-up pending; quota/absent bots do not establish approval."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:30.926Z"}],"before_hash":"007dc2b6f05bca6ed1d1f7046638c188596b19371fff1a3b517a77a4681cc07d","after_hash":"85d84c59d7794fcf6c9b161e0e08e96365ef220305e1238c073105cbbbcb8ce8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"19f7d9c05eef087dc05fba6ec94cd79f8b63563c73e3f7d221507863b9688c86"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:31:31.808Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:31.808Z"}],"before_hash":"85d84c59d7794fcf6c9b161e0e08e96365ef220305e1238c073105cbbbcb8ce8","after_hash":"4c4189e5fd16ee30e4e2daeda5d22b416d6364b2d323abfae64bd058702483e5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"5c7d5a8e97f79b4bd0f6f9a11f76077d3988b697121f7a795b485b71da57a6dd"} diff --git a/docs/certification-2026.10.4.md b/docs/certification-2026.10.4.md index 2527ddd0..742753f1 100644 --- a/docs/certification-2026.10.4.md +++ b/docs/certification-2026.10.4.md @@ -53,3 +53,14 @@ only. Both exported files contained 83 parseable JSONL rows. All commands exited 0. The scratch copy was deleted afterward. This establishes command operation on the real tracker; rich-field fidelity remains covered separately by the integration fixture. All heavy commands held the shared host lock. + +Greptile review follow-up: a malformed lookup-path child fixture (node_modules +as a regular file) fails against the old launcher with ENOTDIR and passes the +unchanged canonical pm-ops 2026.10.4 template with MODULE_NOT_FOUND and no skip +notice. The scoped launcher suite passes 8/8. The subsequent full PM-linked +locked release gate passes **281/281 tests, zero skips**, with unchanged +97.87% lines / 93.33% branches / 98.46% functions and all four packed scenarios. +Statements remain unmeasured. Acceptance criteria now name managed pm-github +2026.10.4; the linked gate creates `/tmp/claude-1000` before acquiring the same +mandatory heavy lock. Sourcery weekly and Cubic monthly quota notices remain +missing substantive review evidence. diff --git a/test/prepare-merge-driver.test.ts b/test/prepare-merge-driver.test.ts index e2760c8b..a1d17d9b 100644 --- a/test/prepare-merge-driver.test.ts +++ b/test/prepare-merge-driver.test.ts @@ -136,3 +136,12 @@ test("an installer killed by a signal fails the install instead of reporting suc const result = prepare(checkout("killed", "pinned"), stubPm("killed", 0, "kill -9 $PPID")); assert.equal(result.status, 1, result.stderr); }); + +test("a malformed lookup path preserves the original installer failure", () => { + const directory = checkout("malformed-lookup", "absent"); + writeFileSync(join(directory, "node_modules"), "not a directory\n"); + const result = prepare(directory, hostPath); + assert.notEqual(result.status, 0); + assert.match(result.stderr, /MODULE_NOT_FOUND/); + assert.doesNotMatch(result.stderr, /ENOTDIR|skipping merge-driver install/); +}); From d9e2ced40cd64ff9c26ab498e467c7e100faaea7 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 14:55:06 +0200 Subject: [PATCH 3/3] Preserve Windows npm pack arguments and prepare both linked-gate lock parents --- .agents/pm/chores/pm-todos-zpyc.toon | 20 ++++++----- .agents/pm/history/pm-todos-zpyc.jsonl | 8 +++++ docs/certification-2026.10.4.md | 16 +++++++++ test/packed-fixture.test.ts | 47 ++++++++++++++++++++++++++ test/packed-fixture.ts | 29 +++++++++++++--- 5 files changed, 107 insertions(+), 13 deletions(-) create mode 100644 test/packed-fixture.test.ts diff --git a/.agents/pm/chores/pm-todos-zpyc.toon b/.agents/pm/chores/pm-todos-zpyc.toon index ff2ad531..9d5b4e6e 100644 --- a/.agents/pm/chores/pm-todos-zpyc.toon +++ b/.agents/pm/chores/pm-todos-zpyc.toon @@ -6,15 +6,15 @@ status: in_progress priority: 1 tags[3]: agent-ux,"area:github","area:release" created_at: "2026-09-27T08:15:15.176Z" -updated_at: "2026-10-04T12:31:31.808Z" +updated_at: "2026-10-04T12:54:57.347Z" author: codex acceptance_criteria: "Package and lock pins updated to published CLI, pm-ops and pm-changelog 2026.10.4; managed pm-github source exact 2026.10.4; canonical launcher and real broken-install child tests pass; strict health and full release gate pass; sync stays disabled pending privacy gate; exact-head CI and review complete." repro_steps: "On main, run pm health --strict-exit --json under host CLI 2026.9.27 and observe extension_host_pm_cli_version_skew; inspect CI and sync workflow unversioned extension installs. After updating pm-ops, the existing canonical launcher byte-identity test fails until its published template is copied." expected_result: "Pinned 2026.10.4 tooling passes existing gates, health, packed consumers and read-only GitHub preview; PR stays open for orchestrator review/merge." -actual_result: "Review follow-up locked release:check PASS 281/281, zero skips; unchanged index.ts L/B/F coverage 97.87/93.33/98.46 (statements not separately reported). Canonical-reader, production audit, pack, all four current/minimum npm/Bun packed scenarios and changelog/date/attestation pass. Both audits clean. Greptile malformed lookup regression is red against old launcher (ENOTDIR), green against canonical pm-ops 2026.10.4 (MODULE_NOT_FOUND, no skip). Strict health and real tracker npm/native-Bun round-trip all 83 items passed; GitHub preview 0/2/0 read-only. Linked gate creates lock parent. Review/CI follow-up pending; quota/absent bots do not establish approval." +actual_result: "Final locked release:check PASS 285/285 zero skips; unchanged index.ts L/B/F 97.87/93.33/98.46, no separately measured statements. Canonical reader, production audit, pack, four current/minimum npm/Bun scenarios, changelog/date/attestation pass. Both audits clean; strict health pass. Greptile malformed lookup regression red/green verified. CodeRabbit Windows pack regression 3 failures before/4 passes after shell-free Node npm launcher and literal argv check; native Windows not measured. Both linked heavy commands create the required lock parent. Real tracker npm/native-Bun 83-item round-trip and GitHub preview 0/2/0 pass. Remaining review quotas/absent bots do not establish approval; final remote checks follow." dependencies[1]{id,kind,created_at,author,source_kind,author_source}: pm-todos-p60g,related,"2026-09-27T08:22:58.654Z",codex,"cli:update:dep",detected -comments[13]{created_at,author,text}: +comments[15]{created_at,author,text}: "2026-09-28T06:20:10.124Z",claude-hub,"2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch." "2026-10-02T22:10:28.268Z",codex-sol,"Restart by codex-sol: preserved remote PR #103 and all existing bot replies/reactions were inspected. Branch is already current with origin/main. No new actionable unresolved inline finding is present. Retain documented coverage/health/publication blockers; rerun unchanged full CI gate with the host-wide flock. No merge, publish or item closure." "2026-10-02T22:36:28.489Z",codex-sol,"Restart: reproduced CI exact project-local npm:pm-github@2026.9.26 installation and verified package version; restored the tracked managed registry exactly as CI does. Locked npm ci and unchanged release:check pass 280/280 tests, zero skips, measured index.ts 97.87% lines / 93.33% branches / 98.46% functions; statements are not separately reported. Canonical-reader, production audit, packed npm/Bun current/minimum host acceptance, changelog/date/attestation gates pass. The linked prepare suite initially refused foreign-ref trust; acknowledged authorized commands and reran successfully. Published canonical-template identity continues to cover ancestor-install handling. Coverage pm-todos-p60g and fail-closed pre-push privacy prerequisites remain open; issue-sync workflow stays disabled. No merge, publish or close; release claim for orchestrator." @@ -28,11 +28,13 @@ comments[13]{created_at,author,text}: "2026-10-04T12:25:02.506Z",codex-sol,"Greptile PR #106 identified the missing malformed-lookup regression for the canonical launcher. Added a child-process fixture with node_modules as a file: it fails against origin/main launcher with ENOTDIR, and passes with the unchanged pm-ops 2026.10.4 template while requiring MODULE_NOT_FOUND and no omit-dev notice. Scoped launcher suite and lint pass. Initial remote Node 22.18/26 and CodeQL passed; CodeRabbit auto-review skipped, Sourcery quota exhausted, other requested reviews remain missing." "2026-10-04T12:25:36.420Z",codex-sol,"Correction to the preceding note: the scoped launcher suite passed 8/8, zero skips. This repository has no ESLint dependency or lint script; the attempted direct eslint invocation was unavailable. The actual repository check is TypeScript typecheck, now exercised by the full linked release gate. No lint outcome is claimed." "2026-10-04T12:31:29.975Z",codex-sol,"Review follow-up full locked release gate PASS 281/281 tests, zero skipped; unchanged configured L/B/F coverage 97.87/93.33/98.46 and no separate statements metric. The new malformed lookup test fails old launcher with ENOTDIR and passes the unchanged published template. Updated stale managed-extension acceptance version to 2026.10.4 and create shared-lock parent in linked gate, preserving mandatory lock and release body. Both audits, native canonical reader, all four current/minimum npm/Bun packed scenarios and release checks pass. Sourcery weekly and Cubic monthly quota notices are missing review evidence; manual remaining reviews follow after push." + "2026-10-04T12:49:42.156Z",codex-sol,"CodeRabbit #106 valid Windows pack finding reproduced test-first: 3 Windows invocation regressions fail before the fix while POSIX passes. Invoke npm JavaScript entrypoint through process.execPath on Windows with shell=false, preserving literal spaced destination and ampersand/percent arguments; fallback entrypoint beside Node covered. Real Node subprocess preserves arguments. All four new tests pass. Also create mandatory lock parent before the separate packed linked test. Full gate follows; native Windows execution is not claimed." + "2026-10-04T12:54:55.040Z",codex-sol,"Final Windows review-fix full PM-linked gate PASS 285/285 tests, zero skips, unchanged measured L/B/F 97.87/93.33/98.46 across index.ts and no statement metric. Exact runner npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker --override-linked-pm-context executes mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check. Canonical reader, audits, pack, all four current/minimum npm/Bun scenarios and release checks pass. Portable Windows plan/real Node argv regressions pass 4/4; native Windows execution remains outside measured evidence. Both linked heavy tests create the lock parent; release claim without closure." notes[3]{created_at,author,text}: "2026-09-27T08:17:04.004Z",codex,"2026-09-27: Published CLI/SDK 2026.9.27 and pm-github 2026.9.26 installed through the project-local CLI; strict health passes with stale-item advisories. The published pm-ops launcher byte-identity test failed before copying its 2026.9.26 template, then the focused child-checkout suite passed 7/7 including incomplete directory and dangling link. Following a valid CodeRabbit privacy finding on the sibling pm-jira candidate, the checked-in scheduled sync job now has an if: false guard in addition to GitHub disabled_manually. The separate pre-push privacy gate is still absent; sync must not be enabled." "2026-09-27T08:27:21.211Z",codex,"2026-09-27 final guarded candidate: npm run release:check exits 0 after sync job if: false and PM link updates. 280/280 source tests pass with zero skips; index.ts honestly measures 97.87% lines, 93.33% branches, and 98.46% functions, with no statement metric. Docstring gate documents 81/81 declarations; zero production npm audit findings. Packed npm-current and bun-current against CLI/SDK 2026.9.27 and npm-minimum and bun-minimum against 2026.8.20 each imported 1 and exported 2 real fixture rows. The separate coverage item pm-todos-p60g remains open; the checked-in and GitHub scheduled sync are inert pending a fail-closed pre-push privacy gate. Exact-head CI and bot review remain to be completed after push." "2026-09-27T08:35:54.168Z",codex,"2026-09-27 exact-head Greptile P1 is valid: an incomplete ancestor node_modules/pm-ops can be treated as omit-dev by the published pm-ops 2026.9.26 launcher. The canonical source issue ops-jzp5 in unmerged pm-ops #124 already scans ancestor resolution paths and tests a real hoisted incomplete install. Keep this consumer PR open until the reviewed source is published, update the pin and byte-identical template, rerun full release and packed npm/Bun acceptance, and request a fresh exact-head review. CodeRabbit reported no actionable issue, but Greptile check fails on this head." -files[10]{path,scope,note}: +files[11]{path,scope,note}: .agents/pm/extensions/.managed-extensions.json,project,Exact managed pm-github source .github/workflows/ci.yml,project,CI pinned extension install .github/workflows/codeql.yml,project,Dependabot #104 exact pinned SHA @@ -41,6 +43,7 @@ files[10]{path,scope,note}: package.json,project,Published CLI and quality-tool pins scripts/accept-packed.ts,project,Isolate scenario tracker from linked-test PM_PATH scripts/prepare-merge-driver.ts,project,Published pm-ops launcher template + test/packed-fixture.test.ts,project,Shell-free Windows npm launch plan and real argv boundary test/packed-fixture.ts,project,Shared packed-artifact fixture for fail-closed 2026.10.4 installer test/prepare-merge-driver.test.ts,project,Greptile malformed lookup diagnostic regression tests[4]: @@ -60,21 +63,22 @@ tests[4]: created_at: "2026-09-27T08:20:15.063Z" source_kind: local_mutation source_ref: fix/pm-todos-cli-2026-09-27-github-pin - - command: "flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed" + - command: "mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check" scope: project timeout_seconds: 2400 + pm_context_mode: tracker provenance: author: codex-sol - created_at: "2026-10-04T11:16:53.205Z" + created_at: "2026-10-04T12:31:29.065Z" source_kind: local_mutation source_ref: chore/pm-todos-pm-cli-2026-10-4 - - command: "mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check" + - command: "mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed" scope: project timeout_seconds: 2400 pm_context_mode: tracker provenance: author: codex-sol - created_at: "2026-10-04T12:31:29.065Z" + created_at: "2026-10-04T12:49:41.232Z" source_kind: local_mutation source_ref: chore/pm-todos-pm-cli-2026-10-4 docs[4]: diff --git a/.agents/pm/history/pm-todos-zpyc.jsonl b/.agents/pm/history/pm-todos-zpyc.jsonl index 9d4310a4..3501aa58 100644 --- a/.agents/pm/history/pm-todos-zpyc.jsonl +++ b/.agents/pm/history/pm-todos-zpyc.jsonl @@ -51,3 +51,11 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T12:31:29.975Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/12","value":{"created_at":"2026-10-04T12:31:29.975Z","author":"codex-sol","text":"Review follow-up full locked release gate PASS 281/281 tests, zero skipped; unchanged configured L/B/F coverage 97.87/93.33/98.46 and no separate statements metric. The new malformed lookup test fails old launcher with ENOTDIR and passes the unchanged published template. Updated stale managed-extension acceptance version to 2026.10.4 and create shared-lock parent in linked gate, preserving mandatory lock and release body. Both audits, native canonical reader, all four current/minimum npm/Bun packed scenarios and release checks pass. Sourcery weekly and Cubic monthly quota notices are missing review evidence; manual remaining reviews follow after push."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:29.975Z"}],"before_hash":"c7fe6cb99c2f5a5c8b02909ae642660c679c0716f04753b94462cbd9c8ad27df","after_hash":"007dc2b6f05bca6ed1d1f7046638c188596b19371fff1a3b517a77a4681cc07d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"262df67833675a9100bfb87e504310172147dde3717104992179245faa2aa611"} {"hash_algorithm":"sha256","ts":"2026-10-04T12:31:30.926Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Review follow-up locked release:check PASS 281/281, zero skips; unchanged index.ts L/B/F coverage 97.87/93.33/98.46 (statements not separately reported). Canonical-reader, production audit, pack, all four current/minimum npm/Bun packed scenarios and changelog/date/attestation pass. Both audits clean. Greptile malformed lookup regression is red against old launcher (ENOTDIR), green against canonical pm-ops 2026.10.4 (MODULE_NOT_FOUND, no skip). Strict health and real tracker npm/native-Bun round-trip all 83 items passed; GitHub preview 0/2/0 read-only. Linked gate creates lock parent. Review/CI follow-up pending; quota/absent bots do not establish approval."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:30.926Z"}],"before_hash":"007dc2b6f05bca6ed1d1f7046638c188596b19371fff1a3b517a77a4681cc07d","after_hash":"85d84c59d7794fcf6c9b161e0e08e96365ef220305e1238c073105cbbbcb8ce8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"19f7d9c05eef087dc05fba6ec94cd79f8b63563c73e3f7d221507863b9688c86"} {"hash_algorithm":"sha256","ts":"2026-10-04T12:31:31.808Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:31:31.808Z"}],"before_hash":"85d84c59d7794fcf6c9b161e0e08e96365ef220305e1238c073105cbbbcb8ce8","after_hash":"4c4189e5fd16ee30e4e2daeda5d22b416d6364b2d323abfae64bd058702483e5","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"5c7d5a8e97f79b4bd0f6f9a11f76077d3988b697121f7a795b485b71da57a6dd"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:49:39.375Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:49:39.375Z"},{"op":"add","path":"/metadata/assignee","value":"codex-sol"},{"op":"add","path":"/metadata/claim_principal","value":"codex-sol"}],"before_hash":"4c4189e5fd16ee30e4e2daeda5d22b416d6364b2d323abfae64bd058702483e5","after_hash":"95b1b3d52d514aea7d3df57480a5eb6ca26c950c17c80520a93cc1b0d231780a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"3457d04a6db5ae4098d4fcbd42b234b8d4cd51bd694b826ffde9fea9a505b2fa"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:49:40.310Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_remove","patch":[{"op":"remove","path":"/metadata/tests/3"},{"op":"replace","path":"/metadata/tests/2/provenance/created_at","value":"2026-10-04T12:31:29.065Z"},{"op":"replace","path":"/metadata/tests/2/command","value":"mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check"},{"op":"add","path":"/metadata/tests/2/pm_context_mode","value":"tracker"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:49:40.310Z"}],"before_hash":"95b1b3d52d514aea7d3df57480a5eb6ca26c950c17c80520a93cc1b0d231780a","after_hash":"39ac79a8629f40a7ca55fbf64d7e90fa578abfdaa8c1b0eb2d15cf65a19bf074","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"062d09b1924907a09423e8f279bace3e74e78046243a940d2cbc18194e2c5c7a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:49:41.260Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"tests_add","patch":[{"op":"add","path":"/metadata/tests/3","value":{"command":"mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run accept:packed","scope":"project","timeout_seconds":2400,"pm_context_mode":"tracker","provenance":{"author":"codex-sol","created_at":"2026-10-04T12:49:41.232Z","source_kind":"local_mutation","source_ref":"chore/pm-todos-pm-cli-2026-10-4"}}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:49:41.260Z"}],"before_hash":"39ac79a8629f40a7ca55fbf64d7e90fa578abfdaa8c1b0eb2d15cf65a19bf074","after_hash":"f96b767b1e1b6a5598906abd09fb70e7540b0df1b30d1f551d7416b6ddae8771","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"11b1a68fd794a853ab426339e2d8c1787674a9867bbd1dbf676450ce2dcbbb8a"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:49:42.156Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/13","value":{"created_at":"2026-10-04T12:49:42.156Z","author":"codex-sol","text":"CodeRabbit #106 valid Windows pack finding reproduced test-first: 3 Windows invocation regressions fail before the fix while POSIX passes. Invoke npm JavaScript entrypoint through process.execPath on Windows with shell=false, preserving literal spaced destination and ampersand/percent arguments; fallback entrypoint beside Node covered. Real Node subprocess preserves arguments. All four new tests pass. Also create mandatory lock parent before the separate packed linked test. Full gate follows; native Windows execution is not claimed."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:49:42.156Z"}],"before_hash":"f96b767b1e1b6a5598906abd09fb70e7540b0df1b30d1f551d7416b6ddae8771","after_hash":"cce1f2c7c33c37fbf08fa78e0666cbb26c05bb692fc1795f3bf60d94f8ef3589","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"21ff6c9e08537e122da3df6c3373d4088ad84ef15d650012282d78f044838bd7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:49:43.099Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/files/9/note","value":"Shared packed-artifact fixture for fail-closed 2026.10.4 installer"},{"op":"replace","path":"/metadata/files/9/path","value":"test/packed-fixture.ts"},{"op":"replace","path":"/metadata/files/8/note","value":"Shell-free Windows npm launch plan and real argv boundary"},{"op":"replace","path":"/metadata/files/8/path","value":"test/packed-fixture.test.ts"},{"op":"add","path":"/metadata/files/10","value":{"path":"test/prepare-merge-driver.test.ts","scope":"project","note":"Greptile malformed lookup diagnostic regression"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:49:43.099Z"}],"before_hash":"cce1f2c7c33c37fbf08fa78e0666cbb26c05bb692fc1795f3bf60d94f8ef3589","after_hash":"a03509f2c355f6d1f802c8c157b25ae26ba21d6d0e6b02a336d5c4aa7bdf4a2c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"0749613b5bc1eb40aa132ae2cc39185aa289a56e9db8304463fca57a3d9758e0"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:54:55.040Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/14","value":{"created_at":"2026-10-04T12:54:55.040Z","author":"codex-sol","text":"Final Windows review-fix full PM-linked gate PASS 285/285 tests, zero skips, unchanged measured L/B/F 97.87/93.33/98.46 across index.ts and no statement metric. Exact runner npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker --override-linked-pm-context executes mkdir -p /tmp/claude-1000 && flock /tmp/claude-1000/heavy-gate.lock npm run release:check. Canonical reader, audits, pack, all four current/minimum npm/Bun scenarios and release checks pass. Portable Windows plan/real Node argv regressions pass 4/4; native Windows execution remains outside measured evidence. Both linked heavy tests create the lock parent; release claim without closure."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:54:55.040Z"}],"before_hash":"a03509f2c355f6d1f802c8c157b25ae26ba21d6d0e6b02a336d5c4aa7bdf4a2c","after_hash":"eb662a2085bb11cf06f1413e421c3cf7389d45151930d6ec356249b6002100e6","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"162ee4e1374afff6ef559d8a109adeac8c797f295beb84dc1eeafc3a76e83fc5"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:54:56.196Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/actual_result","value":"Final locked release:check PASS 285/285 zero skips; unchanged index.ts L/B/F 97.87/93.33/98.46, no separately measured statements. Canonical reader, production audit, pack, four current/minimum npm/Bun scenarios, changelog/date/attestation pass. Both audits clean; strict health pass. Greptile malformed lookup regression red/green verified. CodeRabbit Windows pack regression 3 failures before/4 passes after shell-free Node npm launcher and literal argv check; native Windows not measured. Both linked heavy commands create the required lock parent. Real tracker npm/native-Bun 83-item round-trip and GitHub preview 0/2/0 pass. Remaining review quotas/absent bots do not establish approval; final remote checks follow."},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:54:56.196Z"}],"before_hash":"eb662a2085bb11cf06f1413e421c3cf7389d45151930d6ec356249b6002100e6","after_hash":"eef9cbc27d5dbb5cec0190c5427c2a00d7921b0c698b52dc74f365513cc2517d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"d773e3b30e5c28bf1eb34424ef1539dcac1de6300a7732bafc1ad7813e3d4d20"} +{"hash_algorithm":"sha256","ts":"2026-10-04T12:54:57.347Z","author":"codex-sol","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"301a7c0e113e18b3288b6924","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T12:54:57.347Z"}],"before_hash":"eef9cbc27d5dbb5cec0190c5427c2a00d7921b0c698b52dc74f365513cc2517d","after_hash":"f381e1ee41de51a042c3f3f1ebea3fb525b520db2aafc6eba3d818f3da4cd7db","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b818faa3cc7dddc1182b79bc1c8487b8b6fcab07791ff20be25e266de3d68ea8"} diff --git a/docs/certification-2026.10.4.md b/docs/certification-2026.10.4.md index 742753f1..461c8d3e 100644 --- a/docs/certification-2026.10.4.md +++ b/docs/certification-2026.10.4.md @@ -64,3 +64,19 @@ Statements remain unmeasured. Acceptance criteria now name managed pm-github 2026.10.4; the linked gate creates `/tmp/claude-1000` before acquiring the same mandatory heavy lock. Sourcery weekly and Cubic monthly quota notices remain missing substantive review evidence. + +CodeRabbit Windows pack follow-up: npm.cmd with shell mode can split a spaced +pack destination. The helper now invokes npm's JavaScript entrypoint through +Node on Windows with `shell: false`, retaining literal arguments on POSIX. Four +regressions cover Windows entrypoint selection, fallback, unchanged POSIX argv +and a real subprocess with a spaced entrypoint and ampersand/percent destination. +Three Windows cases failed before the fix; all four pass afterwards. This is a +portable invocation/argv test, not native Windows execution. The separate packed +linked command now also creates the shared-lock parent before flock. + +The final full PM-linked gate passes **285/285 tests, zero skips**, with unchanged +97.87% lines / 93.33% branches / 98.46% functions and all four current/minimum +npm/Bun packed scenarios. Statements remain unmeasured. Exact runner: +`npx pm test pm-todos-zpyc --run --only-index 3 --progress --pm-context tracker +--override-linked-pm-context`, executing `mkdir -p /tmp/claude-1000 && flock +/tmp/claude-1000/heavy-gate.lock npm run release:check`. diff --git a/test/packed-fixture.test.ts b/test/packed-fixture.test.ts new file mode 100644 index 00000000..4b8fe513 --- /dev/null +++ b/test/packed-fixture.test.ts @@ -0,0 +1,47 @@ +import assert from "node:assert/strict"; +import { execFileSync } from "node:child_process"; +import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; +import { tmpdir } from "node:os"; +import { dirname, join } from "node:path"; +import test from "node:test"; +import { packInvocation } from "./packed-fixture.ts"; + +test("Windows packing uses Node's npm entrypoint with literal destination arguments", () => { + const destination = "C:\\User Data\\archive & %fixture%"; + const entrypoint = "C:\\Program Files\\nodejs\\npm-cli.js"; + const invocation = packInvocation(destination, "win32", { npm_execpath: entrypoint }); + assert.equal(invocation.executable, process.execPath); + assert.equal(invocation.shell, false); + assert.deepEqual(invocation.arguments, [entrypoint, "pack", "--ignore-scripts", "--pack-destination", destination]); +}); + +test("Windows packing falls back to npm beside the Node installation", () => { + const invocation = packInvocation("archive", "win32", {}); + assert.equal(invocation.arguments[0], join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")); + assert.equal(invocation.executable, process.execPath); + assert.equal(invocation.shell, false); +}); + +test("POSIX packing leaves destination arguments unquoted and uses no shell", () => { + const destination = "/tmp/archive with spaces & %fixture%"; + const invocation = packInvocation(destination, "linux", {}); + assert.equal(invocation.executable, "npm"); + assert.equal(invocation.shell, false); + assert.deepEqual(invocation.arguments, ["pack", "--ignore-scripts", "--pack-destination", destination]); +}); + +test("the Windows invocation preserves spaced entrypoint and shell metacharacters in a real subprocess", () => { + const root = mkdtempSync(join(tmpdir(), "pm-todos pack & fixture-")); + try { + const entrypoint = join(root, "npm entrypoint.mjs"); + writeFileSync(entrypoint, "process.stdout.write(JSON.stringify(process.argv.slice(2)));\n"); + const destination = join(root, "archive & %fixture%"); + const invocation = packInvocation(destination, "win32", { npm_execpath: entrypoint }); + const result = execFileSync(invocation.executable, invocation.arguments, { + encoding: "utf8", shell: invocation.shell, + }); + assert.deepEqual(JSON.parse(result), ["pack", "--ignore-scripts", "--pack-destination", destination]); + } finally { + rmSync(root, { recursive: true, force: true }); + } +}); diff --git a/test/packed-fixture.ts b/test/packed-fixture.ts index 5bf42c96..d66feb1e 100644 --- a/test/packed-fixture.ts +++ b/test/packed-fixture.ts @@ -2,11 +2,29 @@ import assert from "node:assert/strict"; import { execFileSync } from "node:child_process"; import { readdirSync } from "node:fs"; import { devNull } from "node:os"; -import { join } from "node:path"; +import { dirname, join } from "node:path"; + +/** Describe the npm pack process so platform-specific argument handling is testable. */ +export function packInvocation(destination: string, platform: string, environment: NodeJS.ProcessEnv): { + executable: string; + arguments: string[]; + shell: boolean; +} { + const arguments_ = ["pack", "--ignore-scripts", "--pack-destination", destination]; + if (platform === "win32") { + const entrypoint = environment.npm_execpath + ?? join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"); + return { executable: process.execPath, arguments: [entrypoint, ...arguments_], shell: false }; + } + return { + executable: "npm", + arguments: arguments_, + shell: false, + }; +} /** Pack the built distribution into the fixture instead of scanning node_modules. */ export function packExtension(destination: string): string { - const windows = process.platform === "win32"; const env = { ...process.env, npm_config_userconfig: devNull, @@ -14,9 +32,10 @@ export function packExtension(destination: string): string { npm_config_ignore_scripts: "true", NPM_CONFIG_IGNORE_SCRIPTS: "true", }; - execFileSync(windows ? "npm.cmd" : "npm", [ - "pack", "--ignore-scripts", "--pack-destination", destination, - ], { cwd: process.cwd(), env, encoding: "utf8", shell: windows }); + const invocation = packInvocation(destination, process.platform, env); + execFileSync(invocation.executable, invocation.arguments, { + cwd: process.cwd(), env, encoding: "utf8", shell: invocation.shell, + }); const archives = readdirSync(destination).filter((name) => name.endsWith(".tgz")); assert.equal(archives.length, 1, "fixture must install exactly one packed artifact"); return join(destination, archives[0]!);