Certify pm-web on PM CLI 2026.10.4 and consolidate pending dependency updates

.agents/pm/chores/pm-web-8pml.toon

@@ -1,15 +1,16 @@
 id: pm-web-8pml
-title: "Certify pm-web on PM CLI SDK 2026.10.4, pm-changelog 2026.9.25 and pm-ops 2026.9.28"
+title: Certify pm-web on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates
 description: "Update PM CLI/SDK, pm-changelog, and pm-ops package and lockfile pins from 2026.9.23 to current registry releases, verify installed runtime versions, then rerun the complete release and packed npm/Bun acceptance gates. Keep the public package and private hosted deployment boundaries separate."
 type: Chore
-status: blocked
+status: in_progress
 priority: 2
 tags: []
 created_at: "2026-09-26T16:15:15.599Z"
-updated_at: "2026-10-04T09:37:18.792Z"
+updated_at: "2026-10-04T14:04:21.500Z"
 author: codex
-acceptance_criteria: "package.json and package-lock.json resolve @unbrained/pm-cli 2026.10.4, pm-changelog 2026.9.25, and pm-ops 2026.9.28; local node_modules reports the same versions; npm run release:check passes; PM strict health passes; the PR names both package PM items and no hosted data is added."
-comments[10]{created_at,author,text}:
+acceptance_criteria: "Exact CLI2026.10.4 and latest pm-ops/pm-changelog/fleet pins, all devDependencies exact; absorb every pending dependency/workflow bump; full unchanged CI gate, strict pinned health, both audits clean, copied real-tracker packed npm/nativeBun acceptance, read-only managed pm-github preview; retain independent whole-source/privacy/hosted/reviewer boundaries and keep item open for orchestrator verification."
+actual_result: "Full linked release:check411/411, zero skips; duplicate0/40537lines/142sources; coverage84.49/80.60/77.82 over32configuredfiles, statementsunmeasured. Canonical launcher7/7, workflow/catalog15/15 andlinkedscoped22/22; test-first actualCLI childinitializationregression1/1 preservesancestorbytes. Clean npmci+Buninstall/freshbuild pass; npm/nativeBun tarballdoctor/start/status/stop+authenticatedboard/export/graph all132realitems, completeexportdeep-equality andtrackerbytespreserved, scratch+PGstopped/deleted. Stricthealth0 with2stale advisoryitems; prod audit0/fullaudit4high blockedxucb; GitHubreadonlypreviewzerochanges; reviews pending."
+comments[15]{created_at,author,text}:
   "2026-09-28T06:26:30.268Z",claude-hub,"2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch."
   "2026-10-02T22:11:44.555Z",codex-sol,"Restart: current branch is already rebased on main; previous bot replies were inspected without repeating them. Greptile graph-export finding is an acknowledged security trade-off: GET/HEAD cannot run extension activation; pure export fidelity stays tracked in pm-web-38n5. Add a current graph regression receipt and run the unchanged full locked CI gate using PM_FLEET_ROOT. Existing coverage target and substantive reviews stay open; no Docker or hosted service changes."
   "2026-10-02T23:03:20.822Z",codex-sol,"Catalog fixes now yield 409/409 tests and unchanged configured coverage, but full gate fails production audit on transitive ip-address 10.5.0 via express-rate-limit ^10.2.0. GHSA-h3mg-xc3c-68pw affects <=10.7.0 and is patched >=10.7.1. Refresh only the transitive lockfile resolution within the existing range, retain all audit thresholds and SDK pins, reinstall reproducibly and rerun full locked gate. No hosted or telemetry/config changes."
@@ -20,9 +21,30 @@ comments[10]{created_at,author,text}:
   "2026-10-02T23:47:58.329Z",codex-sol,"Review gate caught prefer-const in deferred server binding before tests ran. Corrected with a constant fixture-state holder and constant local server; retain early after hook, shutdown-order assertions and fail-safe restoration. Direct eslint invocation correctly refused absent ambient config; use the repository canonical lint wrapper via the unchanged full gate. No lint rule/config changed. Rerun with canonical fleet root and retain failed receipts."
   "2026-10-02T23:52:52.285Z",codex-sol,"Third/final candidate: constant fixture holder passes canonical lint and full unchanged release:check with explicit canonical fleet root: 409/409, zero skips, configured 32-source L/B/F 84.39/80.48/77.82. Production audit zero vulnerabilities, npm/Bun packed acceptance, changelog/date and attestation pass. Actual teardown-order assertion failed before the single hook fix, and focused/linked graph tests pass afterward. Four Cubic tracker corrections preserve history and explicitly keep extension-native response parity unmet. Record final source/receipt together, release claim; remaining source-100-percent, parity, hosted and required-review gates are independent. Max three review rounds; no item closure or merge."
   "2026-10-04T09:37:18.792Z",pi-land-s2,"Audit-driven SDK pin bump: GHSA-vfj7-8cjw-p6xm (updated 2026-10-02) flags every braces release <=3.0.3 with no patched version, and pm-cli 2026.9.26's production fast-glob chain reached it, so npm audit --omit=dev reported 4 high findings and the full gate failed at audit:prod. pm-cli 2026.10.3/2026.10.4 replaced fast-glob with tinyglobby (no braces), so package.json and the lockfile now resolve @unbrained/pm-cli 2026.10.4 (the registry's audit-recommended fix) and manifest.json's extension floor matches it per the packaging gate. Nothing else changed: pm-changelog 2026.9.25 and pm-ops 2026.9.28 pins are untouched, no audit threshold or gate was weakened, and the full locked release:check with the canonical fleet root passes 409/409 tests with zero skips, production audit at zero vulnerabilities, coverage thresholds met, packed npm/Bun acceptance and changelog/date/attestation checks green. Title and acceptance criteria updated to name the pin this branch now certifies, matching the earlier reviewer precedent."
+  "2026-10-04T13:44:22.815Z",codex-sol,"PR163 merged by orchestrator at13:42UTC (merge86c31b1); created certification branch from that new origin/main only. Reuse this existing open certification owner, exact required title, retain dated history. Absorb open Dependabot162/164/165/166, exact CodeQL v4.38.2 SHA2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 and latest npm pins. Upgrade ops/changelog10.4 and byte-copy published launcher; keep existing CLI/floor10.4. Full gate uses own disposable native PostgreSQL17.10 under sharedflock, noDocker/hosted/data/config changes. Existing whole-source ownerfy9a and privacy96 remain independent. Final rebase review metadata crossed orchestrator merge; cherry-picked own metadata commit into this consolidated PR and removed only the accidentally recreated remote branch under exact lease."
+  "2026-10-04T13:45:57.475Z",codex-sol,"Latest exact tool/development pins installed, pg8.23.1 incorporates165, tsx4.23.15 incorporates162, types26.6.4 supersedes166; CodeQL exact SHA/comment from164 copied. Malformed lookup regression failed oldlauncher(ENOTDIR) then canonicaltemplate passes7/7. Managedpm-github10.4 installed with read-only repo dry-run; no scheduling or issue writes. Productionaudit0, fullaudit4high throughunpatchedbraces/fastglob/pmops; separatefollow-upcreated, no forcedbreakingoverride/downgrade. Keep unchanged fullgate and independentqualityownerfy9a; disposable nativePG fixture queued under sharedflock."
+  "2026-10-04T13:52:56.405Z",codex-sol,"First full gate410tests failed408/410: workflow pin allowlist still named oldCodeQLSHA, and livefleetpm-ts-starter description nowSDK10.4. Updated exact allowlist from reviewedDependabotdiff; regenerated snapshot with npm run fleet:snapshot and canonicalPM_FLEET_ROOT (20extensions, registry reachable), preserved every catalog/source gate; focusedworkflow+catalog15/15pass. Mandatory packed acceptance exposed projectcreation500 beneathcopiedancestortracker. Installedtarball diagnostic reproduces CLI ancestor-init refusal; actualCLI regression failsoldimplementation. Fix explicitly initializes childworkspace with prefix and noninteractive defaults, preservesancestor settingsbytes. No --force/bypassedguard, no upstream defect claimed; repeat scoped/full/packed gates."
+  "2026-10-04T14:01:49.612Z",codex-sol,"Final fullgate passes411/411 zero skips, duplication0/40537 over142sources; configuredcoverage84.49L/80.60B/77.82F over32files, statementsunmeasured. Clean npmci+Buninstall andfreshbuild pass. Packedrealtracker npm/nativeBun bothdoctorOK,start/statusUP/healthy, authenticatedboard/export/observationalgraph all132items, exportvaluesdeep-equal, trackerbytespreserved, stop/statusDOWN; ownPGfixturestoppedanddeleted,scratchremoved. One acceptance retry compareddefaultopenbaseline21 tocompleteAPI132; correctedfixture to list--all, notapplication/assertions. Linkedscopedcatalog retry omittedPM_FLEET_ROOT and properlyrefusedworktreesassiblings; retainfailure, rerunwithcanonicalexplicitroot. Linkednpm auditswereexecutionerrors EALLOWSCRIPTS fromrunner-injectedallow_scripts, notsecurityfindings; directrechecks remainprod0/full4high. Clear only thatchildenvironment option for audit receipts."
+  "2026-10-04T14:04:18.787Z",codex-sol,"Durable certification document now records exact commands, before/after failures, gate411/411, complete132item copiedtracker acceptance throughnpm/nativeBun, scratch cleanup andscope boundaries. Corrected linked scoped run withcanonicalPM_FLEET_ROOT passes22/22, zero skips; actualCLI init linkedtest1/1pass. Linked audit wrappers produce real fullauditexit1/fourhigh andproductionexit0/allzero; earlierEALLOWSCRIPTS failures remain documented. Strict pinnedhealth exit0 withoneadvisoryfindingcovering2staleitems. Updated managedregistry andCI restoration; read-onlyGitHubdryrun synced0/skipped0/planned0. Release claim and keepchoreinprogressfororchestrator; dev auditxucb andrequiredreviews blockcertification."
 notes[1]{created_at,author,text}:
   "2026-09-26T16:23:28.535Z",codex,"2026-09-26: package runtime dependency and lock now exact-pin @unbrained/pm-cli 2026.9.26; dev tools pin pm-changelog 2026.9.25 and pm-ops 2026.9.26. Installed node_modules versions read back match. Extension manifest minimum host version is 2026.9.26. Copied the canonical pm-ops prepare launcher byte for byte after the first full gate correctly found drift. Focused real Git launcher tests passed 6/6, linked PM packaging/launcher test passed 1/1, and full npm run release:check passed including packed npm and Bun host versions 2026.9.26. pm-cli 2026.9.26 requires @sentry/node 10.75.1 transitively; the lockfile reflects that dependency while no telemetry source or configuration was changed. PR review, merge, hosted rollout, and 100% coverage remain separate gates."
-files[5]:
+files[19]:
+  - path: .agents/pm/extensions/.managed-extensions.json
+    scope: project
+  - path: .github/workflows/ci.yml
+    scope: project
+  - path: .github/workflows/codeql.yml
+    scope: project
+  - path: .gitignore
+    scope: project
+  - path: dist/services/pm-runner.d.ts
+    scope: project
+  - path: dist/services/pm-runner.js
+    scope: project
+  - path: dist/services/pm-runner.js.map
+    scope: project
+  - path: docs/certification-2026.10.4.md
+    scope: project
   - path: manifest.json
     scope: project
     note: minimum host CLI version
@@ -32,12 +54,24 @@ files[5]:
   - path: package.json
     scope: project
     note: exact package dependency pins
+  - path: scripts/install-pm-github.sh
+    scope: project
   - path: scripts/prepare-merge-driver.ts
     scope: project
     note: canonical pm-ops launcher
+  - path: src/services/pm-runner.ts
+    scope: project
+  - path: test/fleet-extensions.snapshot.json
+    scope: project
   - path: test/graph-read-only.test.ts
     scope: project
-tests[2]:
+  - path: test/pm-runner.test.ts
+    scope: project
+  - path: test/prepare-merge-driver.test.ts
+    scope: project
+  - path: test/workflow-security.test.ts
+    scope: project
+tests[5]:
   - command: node --test test/packaging.test.ts test/prepare-merge-driver.test.ts
     scope: project
     timeout_seconds: 120
@@ -53,6 +87,37 @@ tests[2]:
       created_at: "2026-10-02T22:11:47.806Z"
       source_kind: local_mutation
       source_ref: land-restart/pm-web-161
-docs[1]{path,scope}:
+  - command: "env -u PM_PATH npm run release:check"
+    scope: project
+    timeout_seconds: 2400
+    pm_context_mode: tracker
+    workspace_context_mode: source
+    provenance:
+      author: codex-sol
+      created_at: "2026-10-04T13:44:23.430Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-web-pm-cli-2026-10-4
+  - command: node --test test/prepare-merge-driver.test.ts test/workflow-security.test.ts test/catalog.test.ts
+    scope: project
+    timeout_seconds: 120
+    pm_context_mode: tracker
+    workspace_context_mode: source
+    provenance:
+      author: codex-sol
+      created_at: "2026-10-04T13:55:55.937Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-web-pm-cli-2026-10-4
+  - command: node --test --test-name-pattern=project.initialization.selects test/pm-runner.test.ts
+    scope: project
+    timeout_seconds: 120
+    pm_context_mode: tracker
+    workspace_context_mode: source
+    provenance:
+      author: codex-sol
+      created_at: "2026-10-04T13:55:57.002Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-web-pm-cli-2026-10-4
+docs[2]{path,scope}:
+  docs/certification-2026.10.4.md,project
   README.md,project
 body: ""

.agents/pm/extensions/.managed-extensions.json

@@ -0,0 +1,107 @@
+{
+  "version": 1,
+  "updated_at": "2026-10-04T13:45:15.113Z",
+  "entries": [
+    {
+      "name": "pm-github",
+      "directory": "pm-github",
+      "scope": "project",
+      "manifest_version": "2026.10.4",
+      "manifest_entry": "./dist/index.js",
+      "capabilities": [
+        "commands",
+        "hooks",
+        "importers",
+        "preflight",
+        "schema",
+        "search"
+      ],
+      "contributions": {
+        "schema_version": 1,
+        "commands": [
+          "gh-issues import",
+          "github export",
+          "github import",
+          "github project fields",
+          "github project import",
+          "github project list",
+          "github project sync",
+          "github sync",
+          "github validate"
+        ],
+        "command_overrides": [],
+        "command_handlers": [
+          "gh-issues import",
+          "github export",
+          "github import",
+          "github project fields",
+          "github project import",
+          "github project list",
+          "github project sync",
+          "github sync",
+          "github validate"
+        ],
+        "hooks": [
+          "after_command"
+        ],
+        "flag_commands": [
+          "gh-issues import",
+          "github export",
+          "github import",
+          "github project fields",
+          "github project import",
+          "github project list",
+          "github project sync",
+          "github sync",
+          "github validate"
+        ],
+        "item_types": [],
+        "item_fields": [
+          "github_author",
+          "github_created_at",
+          "github_number",
+          "github_state",
+          "github_updated_at",
+          "github_url"
+        ],
+        "migrations": [],
+        "profiles": [],
+        "importers": [
+          "github"
+        ],
+        "exporters": [
+          "github"
+        ],
+        "search_providers": [
+          "github"
+        ],
+        "vector_store_adapters": [],
+        "parser_overrides": [],
+        "service_overrides": [],
+        "renderer_overrides": [],
+        "preflight_overrides": 1,
+        "preflight_ownership": [
+          {
+            "commands": [
+              "github sync",
+              "github export",
+              "github import",
+              "gh-issues import",
+              "github project import",
+              "github project sync"
+            ]
+          }
+        ]
+      },
+      "installed_at": "2026-10-04T13:45:14.955Z",
+      "updated_at": "2026-10-04T13:45:14.955Z",
+      "source": {
+        "kind": "npm",
+        "input": "npm:pm-github@2026.10.4",
+        "location": "package",
+        "package": "pm-github",
+        "version": "2026.10.4"
+      }
+    }
+  ]
+}