Close 37 tracker items already delivered on main

.agents/pm/chores/pm-web-auc2.toon

@@ -2,12 +2,15 @@ id: pm-web-auc2
 title: Enable GitHub CodeQL code scanning
 description: "Add .github/workflows/codeql.yml (javascript-typescript, build-mode none, weekly staggered schedule). GET code-scanning/alerts returned 404 no-analysis-found, so the Security tab could not distinguish clean from never-ran. Advisory check only, not added to branch protection."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags: []
 created_at: "2026-08-22T18:08:21.678Z"
-updated_at: "2026-08-22T18:08:34.527Z"
+updated_at: "2026-10-21T19:40:43.199Z"
+closed_at: "2026-10-21T19:40:42.809Z"
+completed_at: "2026-10-21T19:40:42.809Z"
 author: "harness:ox-alpha"
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): .github/workflows/codeql.yml is present on main and registers code scanning. The request to enable the workflow is delivered; this is not a whole-package security certification. Retained evidence: .github/workflows/codeql.yml."
 notes[1]{created_at,author,text}:
   "2026-08-22T18:08:33.397Z","harness:ox-alpha","Verified 2026-08-22: gh api repos/unbraind/pm-web/code-scanning/alerts -> 404 'no analysis found'. Workflow SHA-pins github/codeql-action db488dde (v4.37.8) matching this repo's full-SHA pinning convention; permissions limited to security-events:write/actions:read/contents:read."
 files[1]{path,scope,note}:
@@ -20,4 +23,5 @@ tests[2]:
     scope: project
     assert_stdout_regex[1]: rule_id|most_recent_instance|analysis_key
     note: code-scanning alerts endpoint returns an analysis instead of 404 no-analysis-found
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): .github/workflows/codeql.yml is present on main and registers code scanning. The request to enable the workflow is delivered; this is not a whole-package security certification. Retained evidence: .github/workflows/codeql.yml."
 body: ""

.agents/pm/chores/pm-web-e6s4.toon

@@ -2,13 +2,17 @@ id: pm-web-e6s4
 title: "Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs"
 description: "Repin the gated sync caller to pm-github 2026.10.16 (tag 67a5e3e: npm-project-dir input, caller default branch resolved through the API for schedule payloads) and add the reusable gated closeout caller, which opens one reviewed PR per day closing items delivered by merged pull requests."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags[3]: changed,ci,pm-github
 created_at: "2026-10-16T10:40:20.808Z"
-updated_at: "2026-10-16T12:41:01.088Z"
+updated_at: "2026-10-21T19:36:19.574Z"
+closed_at: "2026-10-21T19:36:18.997Z"
+completed_at: "2026-10-21T19:36:18.997Z"
 author: claude-orchestrator
 acceptance_criteria: pm-github-sync.yml pins 2026.10.16 at 67a5e3e; pm-github-closeout.yml calls the reusable closeout workflow at the same pin
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): Both .github/workflows/pm-github-sync.yml and pm-github-closeout.yml pin 67a5e3e / 2026.10.16. Adoption is delivered; this does not claim scheduled jobs are currently green. Retained evidence: .github/workflows/pm-github-sync.yml, .github/workflows/pm-github-closeout.yml."
 comments[1]{created_at,author,text}:
   "2026-10-16T12:41:01.088Z",claude-orchestrator,"CI on the wave PR failed in test/workflow-security.test.ts and test/workflow-update-automation.test.ts: the pin policy only recognised pm-github's reusable sync workflow, so the new pm-github-closeout.yml caller was treated as an untrusted action owner. The policy now lists both canonical reusable workflows, each bound to its dedicated caller file and job (pm-github-sync.yml/gated-sync, pm-github-closeout.yml/gated-closeout), with the same full-SHA pin and pm-github release/version match. Local: workflow-security 6/6, workflow-update-automation passing."
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): Both .github/workflows/pm-github-sync.yml and pm-github-closeout.yml pin 67a5e3e / 2026.10.16. Adoption is delivered; this does not claim scheduled jobs are currently green. Retained evidence: .github/workflows/pm-github-sync.yml, .github/workflows/pm-github-closeout.yml."
 body: ""

.agents/pm/chores/pm-web-gated-issue-sync.toon

@@ -2,12 +2,15 @@ id: pm-web-gated-issue-sync
 title: Enable the gated pm-github issue sync and remove the braces chain
 description: "Adopt the pinned reusable gated issue-sync caller; consume latest published fleet dependencies and exact PM CLI 2026.10.15 in runtime and development; remove the glob advisory chain. Related: pm-github-aiok (pm-github adoption task). Leave pm-web-8pml in_progress with full-audit evidence. No hosted deployment work."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags[1]: changed
 created_at: "2026-10-15T07:04:57.239Z"
-updated_at: "2026-10-15T12:26:48.267Z"
+updated_at: "2026-10-21T19:37:01.198Z"
+closed_at: "2026-10-21T19:36:58.765Z"
+completed_at: "2026-10-21T19:36:58.765Z"
 author: codex-agent
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): The SHA-pinned .github/workflows/pm-github-sync.yml caller is present on main. Toolchain manifests record adopted canonical tooling; later scheduled-job failures are separate from caller adoption. Retained evidence: .github/workflows/pm-github-sync.yml, package.json."
 comments[6]{created_at,author,text}:
   "2026-10-15T07:05:09.819Z",codex-agent,"Baseline: direct fast-glob 3.3.3 and pm-ops 2026.10.6 carry micromatch 4.0.8/braces 3.0.3; dev audit has 4 high findings. CI already supports workflow_dispatch. Update runtime and explicit development PM CLI pins to 2026.10.15, and pm-ops/pm-changelog/pm-graph to latest published 2026.10.14. No code imports fast-glob. The workflow supplier test currently allows only third-party actions, so extend it narrowly for the exact canonical reusable workflow with an immutable SHA and matching release/package version, retaining all negative action checks and adding red/revert evidence."
   "2026-10-15T07:06:51.690Z",codex-agent,"Workflow policy red/green/revert proof: the new canonical caller regression failed 0/1 with the original validator (unapproved owner); the narrow updated validator passes workflow-security 6/6. Restoring only assertWorkflowActionPins from origin/main makes the new regression fail 0/1 again; fixed policy restored. Negative cases retain immutable SHA, exact supplier/path, dedicated caller/job, valid release comment and matching package input requirements. Both glob-chain trees are empty and the full dev-included audit is clean. Disposable local PostgreSQL is ready for release gates; no Docker or hosted data access."
@@ -27,4 +30,5 @@ tests[2]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,
   node scripts/with-test-db.ts node --test test/graph-export-fidelity.test.ts test/prepare-merge-driver.test.ts,project,600,codex-agent,"2026-10-15T07:27:00.957Z",local_mutation,chore/gated-issue-sync-and-braces-free-gates
 docs[1]{path,scope}:
   docs/dependency-update-policy.md,project
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): The SHA-pinned .github/workflows/pm-github-sync.yml caller is present on main. Toolchain manifests record adopted canonical tooling; later scheduled-job failures are separate from caller adoption. Retained evidence: .github/workflows/pm-github-sync.yml, package.json."
 body: ""

.agents/pm/epics/pm-web-9ulj.toon

@@ -2,14 +2,18 @@ id: pm-web-9ulj
 title: Bring the pm-web HTTP route layer under real-Postgres integration coverage
 description: "pm-web is the canonical hosted data source (pm-web.unbrained.dev) and holds real multi-tenant user data, yet its entire Express route layer is effectively unexercised: sharing.ts, admin.ts, auth.ts, github.ts and groups.ts all report 0.00% function coverage, and routes/pm.ts reports 7.08%. Package totals are 49.54% lines / 80.65% branches / 44.83% functions, which the coverage gate currently accepts because the ratchet floor was set from the measured CI floor rather than from the 100% mandate. The untested surface is precisely the access-control surface: project ownership checks, share grants, group membership and admin actions. A view-only-collaborator privilege bug has already shipped once in this layer, which is direct evidence the gap is load-bearing rather than theoretical. Existing route tests stub pool.query ad-hoc via 'as any', so they assert against a hand-rolled fake instead of real SQL semantics and cannot catch a wrong JOIN or a missing ownership predicate. This epic replaces that with a real throwaway PostgreSQL instance driven through the real Express app over an ephemeral HTTP server, seeded via the shipped idempotent initSchema(), and adds a postgres service container to CI so the gate runs the same way there."
 type: Epic
-status: open
+status: closed
 priority: 2
 tags: []
 created_at: "2026-07-29T17:26:16.033Z"
-updated_at: "2026-08-21T11:42:34.989Z"
+updated_at: "2026-10-21T19:40:53.273Z"
+closed_at: "2026-10-21T19:40:52.653Z"
+completed_at: "2026-10-21T19:40:52.653Z"
 author: codex
 estimated_minutes: 2400
 acceptance_criteria: "A reusable real-Postgres integration harness exists that boots the real Express app via createApp() over an ephemeral HTTP server and seeds through the shipped initSchema(), with no pool.query stubbing and no 'as any'; the access-control route surface (sharing, groups, admin, projects, auth, oidc) is covered by tests that assert both the allow and the deny path for every ownership and permission branch; CI provides a postgres service container so the coverage gate runs against a real database on both Node 22 and 26; the coverageGate thresholds are ratcheted up to the newly measured floor so the gain cannot silently regress; the tests must fail loudly rather than skip when no database is reachable, so the gate is not cheatable by omission; npm run coverage and npm run check both pass locally and in CI"
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): [PR #171](https://github.com/unbraind/pm-web/pull/171) adds real-Postgres auth/sharing/groups/admin route tests and the reusable HTTP harness; #209 extends real command/bootstrap coverage. Current tests query the real pool, not stubs. The remaining whole-source exact-100 requirement is tracked by fy9a. Retained evidence: scripts/coverage-gate.ts, src/routes/pm.ts, src/services/pm-runner.ts."
 notes[1]{created_at,author,text}:
   "2026-08-21T11:41:30.209Z",codex,"After 289 real-PostgreSQL tests,aggregate configured-source coverage is 66.18 percent lines,80.40 percent branches,and 60.45 percent functions across 26 sources. Thresholds ratchet from 60/80/57 to 66/80/60 without lowering any dimension. This remains far below exact 100/100/100/100 and does not measure the independent statement dimension,so the epic stays open."
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): [PR #171](https://github.com/unbraind/pm-web/pull/171) adds real-Postgres auth/sharing/groups/admin route tests and the reusable HTTP harness; #209 extends real command/bootstrap coverage. Current tests query the real pool, not stubs. The remaining whole-source exact-100 requirement is tracked by fy9a. Retained evidence: scripts/coverage-gate.ts, src/routes/pm.ts, src/services/pm-runner.ts."
 body: ""

.agents/pm/features/pm-web-bazs.toon

@@ -2,12 +2,15 @@ id: pm-web-bazs
 title: Skip unchanged history reads in real-time project watchers
 description: "Mitigate upstream https://github.com/unbraind/pm-cli/issues/1485 with cheap project history change detection, signal invalidation, bounded replay safety checks and single-flight queries. Related investigation pm-web-h4vh and PR #211. Measure idle lock acquisitions and mixed-writer delivery before and after on synthetic projects."
 type: Feature
-status: in_progress
+status: closed
 priority: 1
 tags[3]: capacity,performance,realtime
 created_at: "2026-10-16T12:48:33.614Z"
-updated_at: "2026-10-16T13:56:18.048Z"
+updated_at: "2026-10-21T19:31:32.911Z"
+closed_at: "2026-10-21T19:31:29.870Z"
+completed_at: "2026-10-21T19:31:29.870Z"
 author: codex-agent
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): [PR #214](https://github.com/unbraind/pm-web/pull/214) (a0c32f9) avoids unchanged history-index reads and retains signal invalidation/replay checks, with synthetic capacity measurements. Retained evidence: scripts/capacity-fixture.ts, scripts/capacity-metrics.ts, scripts/capacity-probe.ts."
 comments[8]{created_at,author,text}:
   "2026-10-16T12:48:48.204Z",codex-agent,"Created after keyword searches and open-item review found no duplicate mitigation feature. Based on perf/realtime-delivery-p99 (PR #211 remains open) to reuse real-process stage tracing. Related investigation pm-web-h4vh; upstream https://github.com/unbraind/pm-cli/issues/1485. First verify watcher multiplicity and SDK marker API, then collect matched baseline measurements before production changes. Hosted services and data are outside scope."
   "2026-10-16T12:49:56.765Z",codex-agent,"Inspection correction: viewers of one project already share one subscription (getActiveProjectIds plus the reconciler map); the 250 ms loop is per active project, not per viewer. Each idle loop calls listMutationEvents and therefore takes the SDK index lock. The pinned SDK has no public cheap generation marker. Test-only IPC now counts successful index-lock payload writes; idle observations occur after the production filesystem baseline with zero writers, followed by the unchanged traced 100-subscriber mixed-writer workload. Host load is currently elevated; record load and short CPU samples and avoid overlapping our own experiments."
@@ -38,4 +41,5 @@ tests[2]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,
 docs[2]{path,scope}:
   docs/capacity.md,project
   docs/capacity/2026-10-16-reader-lock.md,project
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): [PR #214](https://github.com/unbraind/pm-web/pull/214) (a0c32f9) avoids unchanged history-index reads and retains signal invalidation/replay checks, with synthetic capacity measurements. Retained evidence: scripts/capacity-fixture.ts, scripts/capacity-metrics.ts, scripts/capacity-probe.ts."
 body: ""

.agents/pm/features/pm-web-lh4b.toon

@@ -2,12 +2,15 @@ id: pm-web-lh4b
 title: Measure real-time collaboration capacity with mixed writers
 description: "Companion pm-cli-website-ghe1. Add a reproducible production-entry SSE capacity ladder with authenticated HTTP and separate pinned CLI writers, per-write delivery evidence, resource telemetry, a real-Postgres smoke test, and a measured local report."
 type: Feature
-status: in_progress
+status: closed
 priority: 1
 tags[3]: acceptance,capacity,realtime
 created_at: "2026-10-15T08:43:30.988Z"
-updated_at: "2026-10-15T12:24:33.125Z"
+updated_at: "2026-10-21T19:32:51.662Z"
+closed_at: "2026-10-21T19:32:50.419Z"
+completed_at: "2026-10-21T19:32:50.419Z"
 author: codex-agent
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): [PR #205](https://github.com/unbraind/pm-web/pull/205) (d9a8525) delivers the mixed-writer SSE ladder/harness and measured report. Achieving 3000 normal-startup subscribers is a separate requirement, pm-web-jstr. Retained evidence: scripts/capacity-fixture.ts, scripts/capacity-metrics.ts, scripts/capacity-probe.ts."
 comments[12]{created_at,author,text}:
   "2026-10-15T08:44:06.809Z",codex-agent,"Companion pm-cli-website-ghe1. Duplicate search found no capacity harness item. Plan: run the built production entry on the existing disposable PostgreSQL test service with temporary project roots; measure item-specific SSE receipts for unique mixed-writer mutations, history timestamps, process resources, live health counters and bounded loss deadlines. Keep every production watcher and the realtime bus enabled. Limit the local ladder to 3000 and stop on loss or SLO breach. Hosted systems are outside this task."
   "2026-10-15T08:54:34.103Z",codex-agent,Implemented production-entry mixed writers and per-subscriber receipt accounting. Initial smoke passed 3/3 in 24.1 seconds overall (22.7 second live scenario). A repeat observed one missing mutation at all 20 subscribers; retained it as delivery evidence and started a diagnostic rerun rather than loosening loss accounting. Diagnostic run delivered 5/5 writes to all 20 with zero loss/duplicates; to-all p99 618.4 ms. A bounded default ladder trial is now running on the disposable test database. No production functions changed.
@@ -41,4 +44,5 @@ tests[4]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
 docs[2]{path,scope}:
   docs/capacity.md,project
   docs/capacity/2026-10-15-local.md,project
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): [PR #205](https://github.com/unbraind/pm-web/pull/205) (d9a8525) delivers the mixed-writer SSE ladder/harness and measured report. Achieving 3000 normal-startup subscribers is a separate requirement, pm-web-jstr. Retained evidence: scripts/capacity-fixture.ts, scripts/capacity-metrics.ts, scripts/capacity-probe.ts."
 body: ""

.agents/pm/features/pm-web-t2oi.toon

@@ -2,13 +2,16 @@ id: pm-web-t2oi
 title: List pm-swarm in the package catalog as an unreleased fleet package
 description: "Add the public pm-swarm workflow extension with commands and schema capabilities, seven documented swarm commands and GitHub links; keep installation unavailable until publication. Cover the catalog, fleet roster, snapshot, UI and compiled HTTP behavior."
 type: Feature
-status: in_progress
+status: closed
 priority: 2
 tags[2]: catalog,pm-swarm
 created_at: "2026-10-15T21:36:06.580Z"
-updated_at: "2026-10-15T22:33:42.624Z"
+updated_at: "2026-10-21T19:36:44.409Z"
+closed_at: "2026-10-21T19:36:42.715Z"
+completed_at: "2026-10-21T19:36:42.715Z"
 author: codex-agent
 acceptance_criteria: Swarm metadata and unreleased installation boundary are covered by regression tests; behavioral revert proof fails; npm and Bun release gates pass at unchanged thresholds.
+resolution: "Reverified main ca7e188bc91e (unchanged since audit): [PR #207](https://github.com/unbraind/pm-web/pull/207) (cdaaf22) adds the unreleased pm-swarm catalog entry. Retained evidence: src/services/package-catalog.ts, test/catalog-built.test.ts, test/catalog-install-e2e.test.ts."
 comments[8]{created_at,author,text}:
   "2026-10-15T21:36:35.897Z",codex-agent,"Read pm-swarm package.json pm block and manifest.json on feat/swarm: workflow product extension with commands and schema capabilities. Keep the manifest summary unchanged in the fleet receipt while explicitly verifying the requested longer catalog display text. Add seven command paths, public links, unreleased UI and HTTP installation checks, roster coverage and behavioral revert proof. No runtime dependency changes are needed."
   "2026-10-15T21:38:39.225Z",codex-agent,"npm view pm-swarm version --json returned E404, confirming npmPublished false despite publishConfig intent. The complete roster now contains 25 public identities: 24 extensions (17 published, seven unreleased) plus native Rust. Initial broader local catalog checks detected partial sibling-worktree discovery and separate ADO/Jev upstream metadata drift. Full gates will use a standalone clone of the candidate commit, matching CI snapshot coverage without changing thresholds or tests. The UI test asserts the existing i18n badge attribute because this unit harness does not load translations."
@@ -47,4 +50,5 @@ tests[2]:
 docs[2]{path,scope}:
   docs/fleet-package-catalog.md,project
   README.md,project
+close_reason: "Reverified main ca7e188bc91e (unchanged since audit): [PR #207](https://github.com/unbraind/pm-web/pull/207) (cdaaf22) adds the unreleased pm-swarm catalog entry. Retained evidence: src/services/package-catalog.ts, test/catalog-built.test.ts, test/catalog-install-e2e.test.ts."
 body: ""