Move pm-web's runtime dependency on pm CLI to 2026.9.23

.agents/pm/chores/pm-web-gbuc.toon

@@ -0,0 +1,24 @@
+id: pm-web-gbuc
+title: Move pm-web's runtime dependency on pm CLI to 2026.9.23
+description: "The 2026-09-25 fleet wave (pm-web#158) moved pm-ops and pm-changelog to 2026.9.23 but left @unbrained/pm-cli at 2026.9.21, because pm-web declares it under dependencies (it runs pm at request time) and the wave script only rewrote devDependencies. This moves the runtime dependency, the lockfile and manifest.json pm_min_version (tests require it to equal the pinned SDK) to 2026.9.23, which the hosted pm-web.unbrained.dev build then picks up. Tenant compatibility was checked on a private copy of all 31 hosted workspaces: identical item counts, id sets and health under 2026.9.21 and 2026.9.23. Companion epic pm-cli-website-5s6z."
+type: Chore
+status: closed
+priority: 1
+tags[3]: certify,hosted,pm-cli-2026.9.23
+created_at: "2026-09-25T09:57:04.128Z"
+updated_at: "2026-09-25T10:26:10.386Z"
+closed_at: "2026-09-25T10:26:09.755Z"
+completed_at: "2026-09-25T10:26:09.755Z"
+author: claude-hub
+acceptance_criteria: "package.json dependencies, package-lock.json and manifest.json pm_min_version all name 2026.9.23; release:check exits 0"
+resolution: Moved the runtime pm CLI dependency to 2026.9.23
+expected_result: pm-web runs pm 2026.9.23 at request time and its gates pass
+actual_result: "release:check exits 0 with the 2026.9.23 runtime pin"
+files[3]{path,scope}:
+  manifest.json,project
+  package-lock.json,project
+  package.json,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  "npm run release:check",project,claude-hub,"2026-09-25T10:26:09.174Z",local_mutation,pm-web-runtime-dependency-pm-cli-2026-9-23
+close_reason: "package.json dependencies, package-lock.json and manifest.json pm_min_version name @unbrained/pm-cli 2026.9.23; npm run release:check exits 0 (408/408 tests); a private copy of all 31 hosted workspaces reads identically under 2026.9.21 and 2026.9.23."
+body: ""

.agents/pm/history/pm-web-gbuc.jsonl

@@ -0,0 +1,6 @@
+{"hash_algorithm":"sha256","ts":"2026-09-25T09:57:04.128Z","author":"claude-hub","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"e0d15f3cda6eb998be619306","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.282","source":"probe"}},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-web-gbuc"},{"op":"add","path":"/metadata/title","value":"Move pm-web's runtime dependency on pm CLI to 2026.9.23"},{"op":"add","path":"/metadata/description","value":"The 2026-09-25 fleet wave (pm-web#158) moved pm-ops and pm-changelog to 2026.9.23 but left @unbrained/pm-cli at 2026.9.21, because pm-web declares it under dependencies (it runs pm at request time) and the wave script only rewrote devDependencies. This moves the runtime dependency, the lockfile and manifest.json pm_min_version (tests require it to equal the pinned SDK) to 2026.9.23, which the hosted pm-web.unbrained.dev build then picks up. Tenant compatibility was checked on a private copy of all 31 hosted workspaces: identical item counts, id sets and health under 2026.9.21 and 2026.9.23. Companion epic pm-cli-website-5s6z."},{"op":"add","path":"/metadata/type","value":"Chore"},{"op":"add","path":"/metadata/status","value":"in_progress"},{"op":"add","path":"/metadata/priority","value":1},{"op":"add","path":"/metadata/tags","value":["certify","hosted","pm-cli-2026.9.23"]},{"op":"add","path":"/metadata/created_at","value":"2026-09-25T09:57:04.128Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-09-25T09:57:04.128Z"},{"op":"add","path":"/metadata/author","value":"claude-hub"},{"op":"add","path":"/metadata/acceptance_criteria","value":"package.json dependencies, package-lock.json and manifest.json pm_min_version all name 2026.9.23; release:check exits 0"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"1041af15c022c7d80560d10d20b9007236ea1d667e3cd28ba43301bb81041bb8","item_hash_version":3,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"c3fb776ed082e9b6cb30ea1eddd7e043c8cdf26d1c22ff2b9275b66b0fbc8fcb"}
+{"hash_algorithm":"sha256","ts":"2026-09-25T09:57:11.130Z","author":"claude-hub","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"e0d15f3cda6eb998be619306","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.282","source":"probe"}},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-25T09:57:11.130Z"},{"op":"add","path":"/metadata/assignee","value":"claude-hub"},{"op":"add","path":"/metadata/claim_principal","value":"claude-hub"}],"before_hash":"1041af15c022c7d80560d10d20b9007236ea1d667e3cd28ba43301bb81041bb8","after_hash":"e63546fcad77089a498230ab2c4642812e6c755e6368703dbeb6732d779a39ef","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"431308fe35df2e15b3893fc9b219188136388c349675378d76ef41192ed2cd7e"}
+{"hash_algorithm":"sha256","ts":"2026-09-25T10:26:08.641Z","author":"claude-hub","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"e0d15f3cda6eb998be619306","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.282","source":"probe"}},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-25T10:26:08.641Z"},{"op":"add","path":"/metadata/files","value":[{"path":"manifest.json","scope":"project"},{"path":"package-lock.json","scope":"project"},{"path":"package.json","scope":"project"}]}],"before_hash":"e63546fcad77089a498230ab2c4642812e6c755e6368703dbeb6732d779a39ef","after_hash":"2a9b9dfe31c7ad4727d180a4658313c1033f520ae0e9ab0db5a0358ce1a0d349","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"12b63425674d738df83351a0194d216aca4cc5024cada3d46dcd4171445fce8b"}
+{"hash_algorithm":"sha256","ts":"2026-09-25T10:26:09.203Z","author":"claude-hub","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"e0d15f3cda6eb998be619306","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.282","source":"probe"}},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-25T10:26:09.203Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"npm run release:check","scope":"project","provenance":{"author":"claude-hub","created_at":"2026-09-25T10:26:09.174Z","source_kind":"local_mutation","source_ref":"pm-web-runtime-dependency-pm-cli-2026-9-23"}}]}],"before_hash":"2a9b9dfe31c7ad4727d180a4658313c1033f520ae0e9ab0db5a0358ce1a0d349","after_hash":"0e598eb44d6318c6c39c54de2796c546d0713c2c29687a53a6822892b7583346","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"97d0530431036b68f4df59bcbc8929e3f18ae91fa9b350b9a265bcafb95d86b6"}
+{"hash_algorithm":"sha256","ts":"2026-09-25T10:26:09.780Z","author":"claude-hub","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"e0d15f3cda6eb998be619306","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.282","source":"probe"}},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-25T10:26:09.780Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-09-25T10:26:09.755Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-09-25T10:26:09.755Z"},{"op":"add","path":"/metadata/resolution","value":"Moved the runtime pm CLI dependency to 2026.9.23"},{"op":"add","path":"/metadata/expected_result","value":"pm-web runs pm 2026.9.23 at request time and its gates pass"},{"op":"add","path":"/metadata/actual_result","value":"release:check exits 0 with the 2026.9.23 runtime pin"},{"op":"add","path":"/metadata/close_reason","value":"package.json dependencies, package-lock.json and manifest.json pm_min_version name @unbrained/pm-cli 2026.9.23; npm run release:check exits 0 (408/408 tests); a private copy of all 31 hosted workspaces reads identically under 2026.9.21 and 2026.9.23."}],"before_hash":"0e598eb44d6318c6c39c54de2796c546d0713c2c29687a53a6822892b7583346","after_hash":"5fe2507e2de4072a770c72629fb91c7aaaf2de249e8e9e7a1a2115683a8fbd97","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"4f0e3c18b39874ab6a5701838040b1b566d9d5a4f209dadf594ef0792ede5b9b"}
+{"hash_algorithm":"sha256","ts":"2026-09-25T10:26:10.386Z","author":"claude-hub","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"e0d15f3cda6eb998be619306","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.282","source":"probe"}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-25T10:26:10.386Z"}],"before_hash":"5fe2507e2de4072a770c72629fb91c7aaaf2de249e8e9e7a1a2115683a8fbd97","after_hash":"3f50c8234551c5ecfc460fe1abfd13040539b27ecfd51542aa5283c90bf7c0d2","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"ce0d335fb179f470ceef3d4a080fefd19834bcfad5b0052f0eb9d177974f2e24"}

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Other
 
+- Move pm-web's runtime dependency on pm CLI to 2026.9.23 ([pm-web-gbuc](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-gbuc.toon))
 - Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher ([pm-web-75mz](https://github.com/unbraind/pm-web/blob/main/.agents/pm/chores/pm-web-75mz.toon))
 
 ## 2026.9.23 - 2026-09-23

manifest.json

@@ -5,7 +5,7 @@
   "author": "@unbraind",
   "entry": "./dist/index.js",
   "priority": 50,
-  "pm_min_version": "2026.9.21",
+  "pm_min_version": "2026.9.23",
   "capabilities": [
     "commands",
     "schema"

package.json

@@ -48,7 +48,7 @@
     "verify:release-publish-attestation": "node scripts/verify-release-publish-attestation.ts"
   },
   "dependencies": {
-    "@unbrained/pm-cli": "2026.9.21",
+    "@unbrained/pm-cli": "2026.9.23",
     "bcryptjs": "^3.0.3",
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",