Changelog

Unreleased

Added

• Source-to-item traceability: derive which tracked work produced any given file or line, so an agent can ask why this code exists and get an evidence-backed answer (pm-f86lth)
• Automatic semantic session attribution: infer bounded topic and role from claimed work and harness context without per-call identity flags (pm-3zgh2c)

Fixed

• pm get cannot report linked files, tests, or docs in any projection, so the one command an agent uses to rebuild an item's context silently reports them as absent (pm-tld20c)

2026.8.10 - 2026-08-10

Added

• GH-472: create error for missing required custom fields lists the field names (pm-4bzq)
• Provenance records distinguish unavailable configuration from resolver failures (pm-lu6sca)

Fixed

• GH-959 recurrence: snapshot restore planning races lease-expiry fixture cleanup (pm-usq49n)
• GH-960: structured diagnostic notices preserve machine-readable JSON envelopes (pm-embm6t)
• GH-956: lossless acceptance-criteria replacement and unmatched-removal failure contract (pm-lppm6y)
• GH-954: fail-fast dependency target validation with explicit forward-reference intent (pm-x3dq0l)
• Preserve executable recovery semantics across terminators, nested aliases, and tracker scope (pm-szn67i)
• Measure source replication against an independently discovered denominator (pm-b84irw)
• GH-515: pm test --add reorders linked tests — --only-last can execute a non-newest command (pm-x2vx)
• GH-490: unknown-command suggester ranks substring hits over synonyms/edit distance — pm log suggests 'extension catalog' (pm-g543)
• GH-441: type-aware create help mislabels applicable flags as required (ignores create-mode) (pm-qmjx)
• GH-519: close recovery bundle suggests --validate-close "<value>" for an enum flag and hides the real resolution-fields blocker (pm-ulqu)
• GH-950: item-addressing commands reject a consistent --id alias and misroute recovery (pm-mkinft)
• GH-951: required-field policy can force fabricated relationship edges (pm-st7wgu)
• GH-953: close recovery suggested_retry is not executable and drops supplied flags (pm-p316vn)
• A sandboxed fixture records provenance from the host harness environment, so the suite is green on CI and deterministically red for any agent running it locally (pm-xgah3a)
• The session-role dimension is wired to a boolean child-session flag, so every nested claude-code invocation records the role literally as "1" and fleet analytics will group real work under a meaningless label (pm-eq9dlw)
• GH-921/GH-922: merge-decision receipts are not durable in fresh-clone CI (pm-1j5j21)
• GH-948: version-skewed pm invocations silently rewrite the tracked merge fence during unrelated commands (pm-l56d0o)
• A measurement ratchet bound stops enforcing the moment its owner reaches a terminal status, so every guarded population goes unbounded exactly when its fix ships (pm-5z9plz)
• The docs tree grows one file per shipped contract, so 39 of 51 documents are stubs and the SDK's story is split across twelve files (pm-9hv1o7)
• The status-token normalization rule is replicated at five sites and the replication gate covers none of them (pm-ulxdqp)
• The two slowest governance commands load every item body while twenty other SDK modules use the light read path (pm-sr3xzg)
• GH-946: context signal-store staleness warning has no executable remediation contract (pm-wn1jy1)
• GH-943: health remediation points at validate while actionable unknown-author recovery remains undiscoverable (pm-jwmszf)
• GH-942: expose the lightweight all-item metadata reader through the public SDK (pm-yrj7qr)
• GH-941: pm read omits notes without declaring their omission and invites duplicate writes (pm-swfelk)

Other

• Refresh pinned GitHub Actions for PR #958 with exact-head compatibility proof (pm-obh6lo)
• The measurement ratchet floors only aggregate graph totals, so converting typed semantic edges to untyped ones passes every declaration (pm-70jyvw)

2026.8.9 - 2026-08-09

Fixed

• The release gate cannot classify Sentry events emitted before its own contract producer shipped, so a correct usage refusal from an older release blocks the daily cut for the whole rolling window and clears only by hand (pm-h75tjh)
• Entity projections carry a collection key only when it is non-empty, so an absent key cannot be distinguished from an unprojected one and neither projection level is a superset of the other (pm-b1w8vr)
• Ordering recorded as blocks is invisible to actionability: the same prerequisite schedules differently depending on which endpoint wrote it (pm-jkbqt8)
• Dependency-kind lexicon: fifteen accepted spellings for roughly eight relations, canonicalized inconsistently at write time, so the stored graph vocabulary keeps fragmenting (pm-4020c5)
• GH-930: duplicates --status all silently scans zero items (pm-sy24w2)
• GH-920: health conflates lossless merge receipts with discarded-value decisions (pm-jtwsct)
• GH-937: package list exposes alias rows as packages and overstates the catalog total (pm-fr6u17)
• Post-merge guidance names history-repair, which clears drift but never settles the merge receipt, so every merged item leaves a permanent merge_decisions_unreviewed warning (pm-lwmstb)
• GH-925: package manage diagnostics reject universal read-output controls (pm-479ggz)
• Surface replication gate activates unrelated sets through shared required members (pm-kmnvug)
• GH-924: closed completed plans still recommend pm close (pm-ltlcsw)
• Merge direction decides which agent's value survives: the same two branches converge to different item state depending on which side merges, and nothing reports the divergence (pm-dlx7v7)
• GH-931: linked-test detector misclassifies unrelated node dist/cli.js commands as pm (pm-u3o3ur)
• Release candidate acceptance hard-codes the pre-bump CLI version and blocks the daily cut (pm-7ipajv)

2026.8.8 - 2026-08-08

Added

• The CLI has 195 error codes and contracts none of them: the surface agents read when they are wrong is the only one with no enumeration, no stability promise, and no gate (pm-x4nn3z)

Fixed

• PR #935 review remediation: executable gate registry and fail-closed runtime context parsing (pm-n41vay)
• GH-926: warn before a stale pm binary mutates a project pinned to a newer CLI/SDK (pm-1eted6)
• PR #935 CI: preserve dependency-free fast-version startup and regenerate runtime contracts (pm-dskxwf)
• Make stale-runtime compatibility classification action-aware across mixed CLI commands (pm-zjelve)
• CLI and SDK refusal contracts now preserve consistent codes and recovery semantics (pm-0xmajx)
• Sentry exception capture never writes the pm.error_code and pm.exit_code tags the release gate reads, so every unexpected runtime error is unclassifiable by construction and blocks the daily cut for the full rolling window (pm-qxo5iu)
• Sentry PM-CLI-2S: resource-exhausted copy reports a high handled error without actionable storage guidance (pm-4odf0c)
• Sentry PM-CLI-2Q: expected snapshot-name validation is captured as a high production error (pm-qyg51h)
• The release gate classifies production errors by message prose and reads none of the 236 error codes the product declares, so every waiver is a latent re-block and a broad substring is a silent waiver (pm-dqtzva)
• The mandatory command-wiring replication set is enforced only by a prose checklist, and the census shows partial application is the single largest recurring defect class in the record (pm-7rrqsk)
• pm get silently discards --output-include field names because entity reads bind the flag to sections while collection reads bind it to fields, and the omission receipt reports no omissions either way (pm-0k19l7)
• GH-919: _workspace author-attribution coordinates cannot be acknowledged (pm-ety1qc)
• pm comments write response replays the entire accumulated history, so one append can emit hundreds of comments (pm-9stazf)
• GH-457: pm health hangs during vectorization check with no output (never-block violation) (pm-tu71)

Security

• GHSA-2v37-7h3g-55p8: pin patched nanoid in the Vite/PostCSS development graph (pm-5dwz1a)
• GH-933: nested PM writes in non-PM linked tests can mutate the source project (pm-alhqbz)

Other

• One governed verification plan now drives local preflight and maps hosted release gates (pm-ei6x66)
• Every command declares its exit-code set, and the code distinguishes applied from applied-to-nothing (pm-hqa8g1)
• Floor polarity for the tracker measurement ratchet, with graph edge and node floors declared (pm-z0cfor)
• Refresh tsx to 4.23.11 with full release-gate proof (pm-nw1y14)

2026.8.7 - 2026-08-07

Added

• Caller-carried output sessions compose token budgets across reads and suppress repeated item facts (pm-hid9g1)
• Fleet attribution analytics: per-harness and per-model throughput, rework, and defect-escape rates derived from immutable history alone (pm-gw6uyq)
• Improvement ledger: measured properties of pm carry a recorded time series, because a ceiling proves a number did not grow and can never prove a change made it smaller (pm-chahyq)

Changed

• Update @toon-format/toon to 4.1.1 and verify codec compatibility (pm-ko35zx)

Fixed

• Nested pm test coverage changes repository-root fixtures because outer PM_PATH sandboxing leaks into package-owned run-tests (pm-ay3l0p)
• Read surfaces have no common row contract: field projection reaches 4 of 11 commands and the row collection sits under a different key on each, so no single shell or jq expression works across pm (pm-sb0tns)
• Sentry PM-CLI-2W: rejected unknown-author acknowledgments are emitted as high production errors (pm-c3uru0)
• Expose live bounded provenance coverage over immutable history (pm-1wiugq)
• GH-915: Windows nightly Vite import portability and shared contract-fixture isolation regressions (pm-ssd7vv)
• GH-914: macOS extension source identity compares non-canonical /var and /private/var paths (pm-eu46an)
• The coverage gate every contributor is told to run is not a gate: run-tests.mjs coverage prints the shortfall and exits 0, so only CI can fail on coverage (pm-2qqcgl)
• The one projection that promises completeness is the one that loses data: pm contracts --full drops all 76 structured command summaries, returns 160 bare name strings, and reports has_omissions false (pm-x0iv17)
• GH-910: keep extension assets outside item merge-driver patterns (pm-t9qbmp)
• GH-911: preserve runtime dependency resolution in post-install activation probes (pm-pg9599)
• GH-912 regression: restore atomic cross-owner seeded Plan creation (pm-hxuqsa)

Other

• Refresh compatible tooling dependencies: tsx 4.23.8 and pm-changelog 2026.8.6 (pm-l9fv1e)

2026.8.6 - 2026-08-06

Fixed

• GH-909: executable extension migration application and remediation contract (pm-ig5cfe)
• GH-908: explicit package-source identity and bare-name ambiguity diagnostics (pm-495lkc)
• GH-907: preflight override ownership and statically disjoint command scopes (pm-miy5k6)
• Release ratchet verdicts are a property of the working copy, not the commit: gitignored installs and clone-local git config decide three populations, so an identical commit passes locally and fails in CI (pm-fr4dg8)
• Exact-tag Release recovery must bootstrap tracker gates and publish an unpublished immutable tag from its tagged source (pm-lwnifd)

Other

• Refresh compatible 2026-08-05 TypeScript-ESLint and Unicorn quality tooling (pm-7gxbl8)

2026.8.5 - 2026-08-05

Fixed

• GH-896: heterogeneous atomic specification batches need batch-local references and one discoverable SDK-first CLI path (pm-o8z748)
• Completion is decomposed while creation is composed: create takes nine inline evidence flags, close takes none, so the prescribed finish protocol is seven invocations and seven unrelated history entries (pm-cyn0y6)
• Reindex coverage test leaks semantic refresh HTTP beyond its mock lifetime (pm-cflhoj)
• Sentry PM-CLI-2V: pm init surfaces raw EACCES when the managed workspace .gitignore cannot be written (pm-3gh457)
• Filed defect populations grow after they are measured and nothing turns a tracker measurement into a ceiling: the maintenance passes that record the count are the writer that widens it (pm-ips23h)
• Tracker-only PM governance commits cannot satisfy required CI without changing the generated changelog (pm-2x5x83)
• GH-891: external blockers make graph stale_lifecycle_block impossible to resolve truthfully (pm-6sc8jq)
• GH-889: merge-conflict recovery guidance hides the durable discarded-value report (pm-fbrz7p)
• GH-890: extension collision diagnostics omit the effective winner and cannot distinguish safe scoped overlap (pm-6mjxgq)
• GH-885: create-time close_reason_required recovery recommends an impossible different-command retry (pm-5uclvd)
• GH-887: terminal create contract is non-atomic and inconsistent across importer-facing closure metadata (pm-ykdt4m)

Security

• 2026-08-04 holistic pm CLI, SDK, and ecosystem manual review and optimization plan (pm-gzyt2j)

Other

• Auto Release fresh clones build the CLI and install merge drivers before tracker gates (pm-xvccnm)
• Tracker data-quality ratchet in CI: pm validate and pm health run against this repository's own workspace with a shrinking-only per-warning baseline (pm-kpftft)
• Eliminate July static-analysis nullability, dead-code, and redundant-allocation findings (pm-cp5pbo)

2026.8.4 - 2026-08-04

Added

• GH-471: pm context includes an installed package/extension health summary (pm-h85e)
• Static contribution manifest: persist the install-time contribution inventory so the command registry is built from data and extension modules import only when a contribution is actually invoked (pm-021kdp)

Fixed

• Uniform multi-value filter-value grammar: --status accepts CSV but --type/--priority fail fast and --tag silently matches the literal CSV string (pm-gknu)
• list applies an undisclosed default lifecycle scope and reports the scoped count as the corpus total with has_more false, while search applies no such scope, so the two discovery surfaces disagree about what exists (pm-999jh7)
• GH-882: unresolved extension commands must lead with the activation failure and actionable recovery (pm-4uplae)
• Extension-mode is folded into the metadata-cache identity, so alternating --no-extensions with a normal invocation evicts a 4.5 MB cache and every command costs 5 seconds instead of 0.4 (pm-77okxr)
• Declared activation.commands is silently overridden by the renderers/hooks/parser/preflight capability tier, so any extension beyond plain commands is eagerly imported on every invocation (pm-j0w7j9)
• GH-832: package command namespace ownership and collision diagnostics are not discoverable (pm-6z0wzf)
• GH-681: latest calendar ordinal must satisfy stable package peer ranges (pm-csuce0)
• The model provenance resolver derives the harness session-file path with an incomplete slug encoding, so it silently resolves nothing in any workspace whose path contains an underscore - including this repository (pm-9gvazz)
• GH-878: nested workspace snapshot and help paths are enumerated but not resolvable by structured help (pm-7wx1f9)
• Warn when custom schema fields collide with MCP transport or tool-specific inputs (pm-yfdav2)
• GH-844: local npm package archives are rejected as install sources (pm-lw6acw)
• The one-release-per-day guard compares a prefix glob against unpadded date keys, so it is correct only by accident of tag creation order and silently skips a real release for any out-of-order tag (pm-ki67py)

Security

• Refresh transitive brace-expansion and PostCSS patches for 2026-08-03 audit advisories (pm-2cv2o1)

Other

• Scripting contract: documented and test-gated guarantees for exit codes, stdout/stderr stream discipline, and stable machine-readable field names (pm-psy1)
• Published artifact weight: the npm tarball ships 20MB of inline-source sourcemaps plus duplicate tsc and bundle outputs (pm-998juj)

2026.8.3 - 2026-08-03

Added

• One declared output-bounding dimension set on every read surface: 25 flag spellings across 19 commands collapse to include / how-much / cost / encoding, with a precedence algebra and permanent aliases (pm-hb7ug8)
• Intent-scoped read projections: a command returns exactly the fields the declared intent consumes, so agents stop paying for fields they discard (pm-cxr0jb)

Fixed

• Auto Release coverage depends on a /proc timing race in the SDK entrypoint sampler (pm-q2a7hr)
• The author field is an ungoverned free-text vocabulary: 477 distinct spellings across 41,021 immutable entries encode harness, model, session role, topic, and date because those dimensions had no fields, and the record cannot be rewritten (pm-3yxwv5)
• Recorded agent provenance is unreadable in practice: the only projection carrying it also carries every JSON Patch operation at 63.5x the compact cost, and no read surface can filter on harness, model, effort, or instance (pm-v8gfi7)
• Harness provenance can only be declared as environment variables, so the model the primary harness publishes in its own session record is inexpressible: 900 of 900 explicit entries still record model null while effort resolves (pm-ffz0a9)
• GH-867: linked files and docs no-op additions report changed and append phantom history (pm-jb1ron)
• GH-868: atomic replacement contract for linked files and docs (pm-cstuys)
• GH-865: classify linked-test lock contention as infrastructure collision (pm-2irc1p)
• GH-779 recurrence: history-redact must refresh item and drift projections atomically (pm-wnbk2l)
• GH-870: make runtime workspace path assertions portable in Windows nightly (pm-rusbe4)
• GH-871: preserve letter-suffixed issue codes in duplicate similarity scoring (pm-sn3xor)
• GH-866: telemetry flush queue-drain contract reports partial progress as fully drained (pm-u5c27w)

Security

• GH-864: history-redact output must never echo literal secrets (pm-y3w0ld)

2026.8.2 - 2026-08-02

Added

• Episode identity: a stable, labelled, nestable episode key that survives process, surface and harness boundaries so trajectory grouping and fleet aggregation have a join key (pm-oqo9l2)

Fixed

• Both published bin names are refused as subcommands, so npx PKG pm init and bunx PKG pm init fail while the version probe that guards them passes (pm-rnl3sa)
• The intent budget binds downward and is inert upward: a sevenfold budget increase buys zero rows and the field that would reveal the clamp is omitted exactly when it applies (pm-prsvjh)
• The MCP action vocabulary is not derived from the CLI contract table: 26 MCP-only spellings, and seven contracted capability families including merge, workspace snapshot and eval have no MCP route at all (pm-0834kq)
• The SDK boundary gate proves the CLI stopped importing private core and never proves the CLI only imports the published SDK, so ten private SDK modules carry our own commands (pm-xpumg4)
• GH-855: core mutation locators must honor extension-registered item types (pm-scga6k)
• GH-853: extension command test harness must inject the real host-bound SDK (pm-wx2lr5)
• Session-topic provenance has no descriptor keys on any harness, and effort/role are wired for only claude-code and codex, so most fleet history records harness and model but nothing about the work's shape (pm-rbg1qo)
• Explicit-unavailable provenance is recorded for the model dimension only, so effort and role absence is permanently indistinguishable from a legacy entry (pm-9wbiye)
• GH-851: compare init discovery roots by filesystem identity (pm-noq46i)
• GH-847: tighten managed built-in static SDK contracts and author guidance (pm-ka6m65)
• The MCP server never receives the harness provenance environment, so one agent session writes permanently divergent identity records depending on which surface it used (pm-1zhfls)
• The bounded read costs 13.8 times the unbounded read to deliver the same set, because eight metadata blocks are re-emitted per page and the page carries two rows (pm-sf31yl)
• Declared intent token budgets are smaller than the smallest projection their own command can emit, so three of five intents return no result at all on this tracker (pm-yekkvt)
• Declared read-intent token budgets are written to a flag three of five intent commands do not accept, so the shipped intent layer overruns its own declaration by up to 43.8x (pm-7hbfch)
• The public SDK's item-lifecycle surface re-exports CLI command modules, so lifecycle policy cannot be expressed, inspected, or overridden through the SDK (pm-z5pmf8)

Security

• GH-854: transactional extension mutation guards for enforceable domain invariants (pm-hx23u5)
• CodeQL alert 33: eliminate polynomial trailing-whitespace matching in SDK append (pm-8wskoj)

Other

• Self-reported token accounting: any command can report the token cost of its own output so budget spend is attributable at runtime and in CI (pm-t5dt4z)

2026.8.1 - 2026-08-01

Fixed

• Mutation echo parity reversed after pm-nilh closed: the MCP surface now returns 5.2x the CLI default for an identical create (pm-awe3t6)
• The bunx release gate passes with an arbitrary token in the executable position, so the only Bun coverage in the pipeline cannot fail for the reason it exists (pm-lpqln4)
• The published-artifact gate never executes pm-mcp: two of three declared bins resolve to the same file and the third — which already shipped dead once — has zero release coverage (pm-u0oz2k)
• One governance rule, two terminal-transition paths, opposite answers: pm close refuses a reasonless close while pm update --status closed invents a reason and writes it into the immutable record unmarked (pm-2ew0w3)
• Closing an item deletes its ordering edges, so the historical ordering graph is structurally unable to exist (pm-xm0id4)
• GH-831: actionable unknown-author health evidence is truncated without a complete disposition selector (pm-1bmeta)
• GH-841: init ancestor discovery obscures the selected workspace and safe current-directory target (pm-ipbwcq)
• GH-840: annotation primitives lack a merge-safe structured event append and query contract (pm-09rdni)
• GH-839: extension field declarations accept types the persisted schema cannot validate (pm-tom5xp)
• Harness-detection specs inherit the ambient harness, so four tests fail under Claude Code and pass in CI on the same commit: the local verdict depends on which agent ran it (pm-631t9p)
• Extension-registered item types are created, stored and versioned like any other item but are invisible to the merge fence and its drift detector, which reports the fence clean (pm-5rexki)
• Four edge-counting conventions publish under one edge_count field: graph analyze reports 10046 and graph centrality 7351 for the same graph at the same cache fingerprint (pm-jiusod)
• Four read surfaces publish a jq_selector that is guaranteed to return nothing: the self-describing row contract is present, vacuous, and indistinguishable from an empty result (pm-x710qm)

Security

• GH-827: local package install must prevent recursive self-copy and disk exhaustion (pm-0682l4)

Other

• Refresh compatible Sentry 10.69 and Greptile 3.3 dependencies (pm-7564ov)

2026.7.31 - 2026-07-31

Fixed

• Exact-tag npm recovery must stabilize public package access before verification (pm-t310hx)
• GH-830: duplicate-safe creation must require explicit bypass before persistence (pm-35w9l2)
• GH-828: init status registries must expose one coherent alias contract (pm-62n4kk)
• GH-826: extension commands need structured failure results and preserved remediation (pm-ye9v2t)
• GH-825: restore SDK excess-property safety for extension definition metadata (pm-unwsns)
• GH-824: core-field recovery must name dedicated flags instead of extension activation (pm-2jtbl8)
• CodeFactor fixed-only success payload blocks exact-head release gate (pm-xcrlkl)
• Both declared context intents are unreachable because the intent applier assigns field-group names into the section value domain, and the two validators give contradictory advice (pm-ai45y9)
• GH-814: SDK metadata reads must distinguish missing and invalid tracker roots from an empty tracker (pm-23xkss)
• The runtime contract enumeration is not closed over the surface it can resolve: 14 rendered commands, including the list-open that AGENTS.md mandates, are contract-backed by name yet absent from every enumeration (pm-6j7r1a)
• GH-817: machine-readable flag contracts need semantic invocation metadata and stdin capability (pm-11phn1)

2026.7.30 - 2026-07-30

Added

• Omission receipts: every bounded read shape names the field groups it withheld and the flag that restores each, with the same rigor row truncation already has (pm-p258tx)

Fixed

• Workspace snapshot heartbeat races atomic root activation and loses its writer lock (pm-ifuysd)
• GH-815: optional missing merge drivers must be advisory in default health verdicts (pm-r8u2g6)
• Sentry gate misclassifies handled snapshot identifier validation as a blocking runtime error (pm-k785lu)
• Scale fixtures vary only in size: the sole synthetic workspace generator hardcodes population shape, so the million-item tier is eleven simulated days deep with one history entry per item (pm-vv2lti)
• Whole-workspace snapshot restore silently rewinds the immutable record: history streams are deleted and nothing records that a rewind happened (pm-6l2mza)
• GH-808: lifecycle completion resolver types and provenance lie when no timestamp exists (pm-qhnq6t)
• pm activity --compact --json emits an empty activity:[] decoy key alongside compact_activity (pm-p3x4)
• Mode-paired envelopes zero-fill the inactive collection instead of omitting it, so parsing the obvious key returns an empty array that is indistinguishable from a real empty result (pm-cyrfjq)
• GH-802: persist structured numeric measurements with test runs (pm-ygerpy)
• GH-806: publish and reuse the eval query-set contract across help, errors, SDK, and machine discovery (pm-wd61s2)
• The rendered command surface is not a subset of the contracted surface: pm workspace ships in help, runs, and exits 2 on its own contract lookup, and no gate compares the two sets (pm-1jrdri)
• GH-797: rank read/show/view recovery by executable intent and bounded contracts guidance (pm-bex0ui)
• GH-803: hoist repeated linked-test execution context and honor lean output (pm-fqdmbf)
• GH-807: make the default eval query set version-controllable in every initialized workspace (pm-jdh1jg)

Other

• The product advertises CI gates in its own help that no pipeline runs: pm eval names --fail-under a CI gate and nothing consumes it (pm-b2hc4x)
• Gate registry: every enforced CI and release gate has an owner item, a declared failure taxonomy, a bypass policy, and a negative-control fixture proving it fails on known-bad input (pm-k6t4yb)

2026.7.29 - 2026-07-29

Added

• GH-787: workspace snapshot and restore primitives for cheap reproducible evaluation episodes (pm-dkrmzv)
• Reproducible workspace instances: seeded identifiers, injectable clock, and byte-identical construction from a declared recipe (pm-rbcvt2)

Fixed

• GH-676: list tag filter must accept the CSV shape used by tag mutations (pm-b1zsk9)
• GH-675: lifecycle must record actual completion time separately from tracker close time (pm-bwnclq)
• GH-711: update must support intentional unresolved parent references under strict governance (pm-cragzs)
• GH-715: expose mutation-guard policies through canonical config help and output (pm-5ecnar)
• GH-672: pm context low_level rows omit blocked state and blocker IDs (pm-r2suqb)
• GH-651: pm activity bare relative windows silently return empty results (pm-b0twiy)
• GH-784: SDK blueprint preflight misses host-owned flag collisions and malformed long-flag tokens (pm-huolbk)
• GH-785: align pm health ok with warn-only exit semantics on fresh clones (pm-83ov2i)
• GH-792: fresh-clone health must not require ignored runtime and empty extension directories (pm-0k4o8t)
• GH-793: remove or disambiguate list --all so filtered output cannot claim workspace completeness (pm-q7qojt)
• GH-794: make copied identity output_format overrides decline instead of exposing the host envelope (pm-wi301j)
• Nightly static quality fails closed in shallow workflow checkouts because CodeFactor parity cannot resolve a committed base (pm-1hbw4y)
• GH-790/GH-791: pm merge install reports workspace_root in a different canonical form depending on which channel resolved it, so the same repository has two non-equal spellings on macOS and Windows (pm-ihmfs6)
• The dependency token budget is enforced against a different representation than the one emitted, so a command that reports staying inside 16k tokens delivers about 45k (pm-t2t709)
• pm activity has no default bound: a bare invocation returns all 40,446 history entries at 1.59M tokens, 397x the ceiling its own contract declares (pm-z2j1qt)
• Both token gates are structurally unable to fail: one measures only help payloads, the other measures command output against a three-item fixture, so no check anywhere compares real output to the ceiling the contract declares (pm-9sui7t)
• Sentry PM-CLI-2N: malformed missing tags crash normalizeItemMetadata before search can report the item (pm-89neyq)
• pm-governance-audit comments-audit limit contract contradicts runtime alias semantics (pm-v657)
• pm-governance-audit dedupe-audit rejects --status all, breaking explicit all-lifecycle duplicate sweeps (pm-mp49)
• GH-781: managed built-in extensions redeclare public SDK contracts locally, and the mirrors already disagree with the authoritative declarations in shipped packages (pm-vnk7ob)

Security

• GH-799: confine custom item-type storage folders to the tracker root (pm-d30cmk)
• PR #795 exact-head review hardening: dependency budget progress, rendered fixed points, nightly credential isolation, and drift-cache diagnostics (pm-jd3m6p)

Other

• Refresh compatible 2026-07-29 development dependencies (pm-77bmeu)
• Token-budget gate corpus is unrepresentative in both scale and coverage: budgets are set on a seeded micro-workspace and the largest agent-facing payloads are not measured at all (pm-z71aoy)
• GH-782: guide-shell special-cases one multi-word command name and duplicates its status derivation, and calendar's throw-only validation call is unexplained, inside package-managed built-ins consumers cannot patch (pm-cb8qq2)

2026.7.28 - 2026-07-28

Added

• MCP tool profiles: core/standard/full/custom tiers with an allowlist override, so 31 tools are the maximum surface, not the default (pm-9k90)
• MCP resources and prompts surface: expose workspace context as addressable resources and canonical workflows as prompts, not only as tools (pm-yf07b7)
• Project live workspace schema and extension commands into MCP discovery and mutations (pm-m4ikkz)
• Public SDK contracts and static runtimes let extension authors reuse the CLI baseline (pm-w7mqzt)

Changed

• Dedupe flag-contracts.ts repetitive per-command blocks (9 internal clones, ~150 lines) (pm-ueuq)

Fixed

• GH-770: pending merge receipts remain invisible to validation and CI before reconciliation (pm-ysqb6n)
• GH-775: make fresh-clone health distinguish material tracker loss from absent empty type folders (pm-xyuhh7)
• GH-779: invalidate history drift cache after item and repair mutations (pm-ajaskl)
• The merge fence covers item documents but not tracked non-item JSON, so .managed-extensions.json line-conflicts between agents on different branches (pm-gjicmx)
• GH-773: install portable merge drivers without permanent checkout-path drift (pm-w91mvg)
• GH-776: preserve output override compatibility and export the public decision contract (pm-u2tqn6)
• GH-778: make lean structured reads omit caller echoes and inactive pagination metadata (pm-oi4zs3)
• GH-772: rejected extension command registration leaves silent partial activation and zero-exit command gaps (pm-4vwcvq)
• The surface-discovery contract costs 31k tokens in its brief form and still omits every flag, so the cheapest way to learn pm is the most expensive call it offers (pm-gmdzaa)
• Linked-test schema sandbox breaks package prepare hooks that install the PM merge driver (pm-uawujr)
• The list family exposes three incompatible --json projections under one flag, so an agent filtering on an unprojected field silently reads absent instead of unset (pm-pjnu91)
• GH-768: deduplicate public SDK provenance exports across core and root entrypoints (pm-44aa4x)
• GH-766: Windows nightly extension timeout and merge-safety cleanup EBUSY (pm-25b7tg)
• Merge-fence scope ambiguity: extension-contributed item folders make default validation disagree with the no-extensions CI baseline (pm-mkzw1x)
• GH-764: one host-global flag collision quarantines an entire extension and suggests reinstalling the installed package (pm-gnowgi)
• Recovery bundle mines flag names from usage-error prose: scope errors like '--rebuild and --clear apply only to graph index' yield missing:--clear + suggested_retry appending the other invalid flag (pm-ikv6m0)
• GH-755: dependency edges are written with a null author, so the relationship graph is the only recorded collection with no provenance (pm-0a24f5)
• GH-752: list results claim completeness while unreadable items are omitted (pm-57ir3b)
• GH-763: merge-decision receipt persists shell-quoted item_path that cannot resolve (pm-9nfpwd)
• GH-747: the bundled TOON encoder emits documents its own decoder rejects, so a valid item becomes permanently unreadable (pm-avv3wx)
• Identity provenance is a fixed three-dimension schema, so the reasoning level sitting in the environment right now and any session role are structurally unrepresentable (pm-itsjf0)
• Model capture is inert in practice: zero of 35,103 recorded entries carry a model, because the declared signal for the primary harness is an environment variable that harness does not set (pm-0zcwz6)
• The public harness detectors default env to an empty object, so detectAgentIdentity() and detectHarnessIdentity() silently return empty for every SDK caller (pm-pwq0g5)
• GH-746: the release publish step guards on a package scope that does not exist, so publish idempotence and access recovery are permanently dead code (pm-2z9263)

Other

• Evaluate Sentry 10.68.0 compatibility and retain 10.67.0 (pm-r31390)
• Derive ALL MCP tool inputSchemas from *_FLAG_CONTRACTS — eliminate hand-declared parallel schema tables (extend the pm_copy pattern) (pm-xwah)
• Generate shell completions, MCP tool registrations, and command reference docs from the contracts table (single source of truth) (pm-mu8m)
• The agent token-surface harness from pm-a22j is wired into nothing, so output-size regressions like the 33k-token health check land undetected (pm-dpqa3h)
• Ecosystem review and deep-graph enrichment pass 2026-07-27: all-status census, CLI simplification + token-efficiency + long-term brainstorm, dedupe-checked gap filing (pm-89qv6b)
• Evaluate @toon-format/toon 4 compatibility and item-format migration (pm-5cgm2z)
• ADR amendment: extensible durable agent provenance dimensions and privacy boundaries (pm-oskdmu)
• SDK completeness is asserted by a 10-case curated array against 85 declared actions: the boundary proves the CLI reaches nothing below the SDK, nothing proves the SDK can do what the CLI does (pm-te6elw)

2026.7.27 - 2026-07-27

Fixed

• GH-754: the merge driver's field-level conflict report is transient stdout, so the value it discarded leaves no durable record anywhere (pm-rh98vo)
• Merge fence fails open: an unresolvable pm driver leaves unmarked UU files whose naive resolution silently discards the other branch's fields and history (pm-c0wthb)
• Merged-main Windows init package acceptance exceeds generic Vitest timeout (pm-0vkmqs)
• GH-739: expose duplicate-cluster discovery as a first-class CLI and SDK workflow (pm-n13lzc)
• PmClient activation queue serializes unrelated workspaces and extension-free actions (pm-zpoyg9)
• GH-741: replace reference-identity service override claiming with an explicit observable contract (pm-h3ipax)
• GH-740: make the documented aggregate SDK barrel complete and continuously derived (pm-obbh43)
• GH-738: publish the machine-readable public SDK surface snapshot with the package (pm-lnswp0)
• Terminal release transitions retain stale claim_principal ownership (pm-bnrndo)
• SDK: inject host-bound runtime into ImportExportContext (pm-i7indd)
• Detected agent identity is not agent-unique, so claim mutual exclusion silently degenerates across a same-harness fleet (pm-z8qd4k)
• GH-714: linked-test verbose child stdout still aborts with EAGAIN after bounded-drain fix (pm-5sm91o)
• CodeFactor 2026-07-26 SDK and digital-twin regression cluster (GH-722 through GH-732) (pm-eq3ak8)
• GH-733: Windows Node 24 nightly portability regressions in author, recovery, and drift tests (pm-wr8utz)
• Sentry PM-CLI-2M: classify workspace audit-state drift as an actionable conflict (pm-o71t68)
• GH-728: preserve live harness authorship across initialized multi-agent workspaces (pm-si2uur)
• GH-720: diagnose unbuilt GitHub extension sources and recommend resolvable npm artifacts (pm-0sx3kz)
• GH-719: reject or diagnose extension command flags shadowed by pm globals (pm-ill9gv)

Security

• Scorecard Security-Policy (4→10): enrich SECURITY.md to full scoring depth (pm-2d7k)
• Scorecard Fuzzing (0→10): add a fuzzing/property-based harness for the parser and codec surfaces (pm-0yi7)

Other

• The merge-safety gate verifies one history stream of 2,058 and never checks drift, so a clean merge that provably corrupts stream anchoring passes CI green (pm-pdr8t1)
• Branch merge is an unrecorded mutation: the field-aware merge produces an item state that no history entry ever produced, so the merged state is unaddressable by restore and point-in-time reads (pm-9j2r3b)
• Continuous multi-branch merge conformance: randomized N-branch divergence and merge property suite with a zero-conflict acceptance bar (pm-76dnfg)
• 2026-07-26 ecosystem review: all-status walk, graph depth enrichment, agent-ergonomics and release-pipeline verification (pm-v4iypw)
• Historical release attribution backfill: stamp every terminal item with the release tag that contains its close event (pm-3j6it6)
• Terminal relationship backfill, evidence-derived tranche: make every closed and canceled item reachable by typed graph traversal (pm-qudvto)
• 2026-07-26 agent-context readiness audit: full CLI, SDK, and ecosystem review and optimization plan (pm-t9e3bc)
• Ecosystem review and deep-graph enrichment pass 2026-07-26: all-status inspection, CLI simplification + context-algorithm brainstorm, gap filing (pm-e9yevx)

2026.7.26 - 2026-07-26

Added

• Immutable-tree DeepScan and CodeFactor zero-new-issues release gate (pm-39cqqx)
• Model-aware agent identity: detection resolves harness, model, and session so an agent never types an identity flag and history still records which model acted (pm-03pq3o)
• Author-resolution bypass class: create/copy and the context, next, and usage-feedback paths re-implement author precedence without harness detection, stamping author 'unknown' on new items (pm-42p9nk)

Changed

• Dependabot update queue 2026-07-21: PRs #618-#621 (pm-pegcmx)
• Harness signal registry: identity detection becomes declared data that a config entry or a package can extend without a code change (pm-brxdct)
• Public SDK surface snapshot and breaking-change gate: the exported API is a reviewed artifact, and an unintended removal or signature change cannot merge (pm-e6tm5c)

Fixed

• GH-716: detect npm and Slack credential shapes in mutation secret guard (pm-fhhhlk)
• pm package init doubles the pm- prefix and mints an unusable pm pm ... command path when given the package name every real pm package actually uses (pm-c5f0gh)
• pm extension --init and pm package init are divergent scaffold generators behind the same grammar; the extension path emits no tests and an unpublishable manifest (pm-9smp7j)
• Built-in help examples teach an explicit --author on dozens of commands, training every agent to suppress its own detected identity and pay tokens for it (pm-sx52hr)
• Shipped MCP manifests and MCP tool guidance hardwire a static author, overriding the automatic identity of every plugin-hosted agent (pm-zqsrt5)
• A configured author_default suppresses harness detection entirely, so any workspace that sets a default author records no harness and no model provenance (pm-6uxhe0)
• GH-677: pm-path relocation must diagnose extension discovery changes (pm-qswf81)
• GH-691: parseItemDocument errors need stable structured SDK classification (pm-r9pudt)
• First-party service collision: builtin-calendar and builtin-guide-shell both override the global output_format service (pm-ixoa)
• GH-680: completed Plan close must transition plan_mode terminally (pm-g512pv)
• GH-692: plan update-step must persist file, test, and doc evidence fields (pm-z5vamp)
• GH-678: linked-test sandbox must preserve freshly installed project extensions across child processes (pm-jvken3)
• GH-709: batch duplicate-cluster sweep with canonical precomputed similarity signals (pm-2i12ti)
• pm config set on one leaf key rewrites settings.json with every default materialized and silently replaces explicit stored values (validation.parent_reference warn -> strict_error) (pm-x2aplf)
• GH-690: plan resume and approve must apply or reject scope changes (pm-bxdlfa)
• GH-688: seeded Plan creation must be atomic across ownership boundaries (pm-96tter)
• GH-679: linked-test output capture must not abort verbose child tools with EAGAIN (pm-j36ypd)
• GH-706: accept bare conventional forms for create/update boolean metadata flags (pm-ulb3rc)
• GH-700/GH-701/GH-702: nightly Node 22 and cross-platform regression bundle (pm-3x8w4m)
• GH-704: make extension activation failures actionable at command and lifecycle boundaries (pm-3ljt19)
• GH-705: make duplicate governance discoverable and advisory by default (pm-de3foa)
• GH-703: populate portable workspace coordinates in extension CommandHandlerContext (pm-fc9gm4)

Removed

• GH-708: make retained delete tombstones discoverable and policy-controlled (pm-wdrkfr)

Security

• Add TruffleHog OSS verified-secret scanning to the security workflow and complete free GitHub secret-scanning toggles (pm-4ris)
• Refresh 2026-07-15 npm dependency updates with compatibility and release-gate proof (pm-tll8)

Other

• CI/CD + test-suite performance: in-process CLI runner and dedupe redundant matrix legs (pm-7rlp)
• ADR: agent identity model — stable author namespace plus structured harness, model, and session provenance (pm-qwuber)
• Public SDK surface shape: 881 exports behind one flat entrypoint with no capability tiering and a 250ms eager import cost (pm-38bskj)
• CLI transport overhead budget: gate the per-invocation bootstrap floor and the CLI-vs-SDK delta, not just absolute scale numbers (pm-yse5dt)

2026.7.25 - 2026-07-25

Added

• Harness-aware author identity: pm resolves the acting agent from its runtime harness so PM_AUTHOR is never required (pm-z9x1r2)
• Mutation event stream primitive: pm events --follow (NDJSON with durable cursor) + SDK subscription API for cross-process agent coordination (pm-e200)
• Create-time near-duplicate advisory: pm create/copy surface similar existing items before new work is filed (pm-4ri6)

Fixed

• GH-686: validate extension flag descriptors and support repeatable as a list alias (pm-s1w0sf)
• GH-683: standard get projection must expose tests_count when tests are omitted (pm-1exil1)
• GH-685: extension CommandContext needs portable source and tracker workspace coordinates (pm-j4ac9a)
• GH-682: linked-test tracker sandbox must preserve source VCS workspace identity (pm-954h0o)
• 10k scale gate regression: CLI create latency and create/claim peak RSS exceed fixed budgets (pm-hcrmye)
• PR #673 review hardening: literal Git paths, canonical workspace identity, bounded diagnostics, and recoverable init (pm-d7crwk)
• GH-666/GH-667: nightly Node 22 stderr and Windows permission-contract regressions (pm-lvd647)
• GH-665: schema migrations need derived idempotency keys and structured recovery (pm-s79kel)
• GH-663: fresh init must install and surface the semantic merge fence (pm-1w3ljt)
• GH-514: pm init writes no .gitignore rules — runtime/search caches churn as tracked files in downstream repos (pm-hous)
• Stale-lock takeover race in acquireLock: two waiters can both remove the stale lock and both believe they own the item (pm-zwib)
• Create/copy ID allocation TOCTOU: duplicate generated id silently overwrites the other item's file; idExists misses extension type folders (pm-khdq)
• GH-664: published daily release fails Bun node:sqlite verification before GitHub Release (pm-cedo0g)

Security

• Adopt TruffleHog 3.96.0 security action update (pm-ion0bp)
• Semgrep 874840488: High spawn shell true in scripts/release/utils.mjs#L38 (pm-a7m7)
• Semgrep 874962820: High spawn shell true in plugins/pm-codex/scripts/pm-mcp-server.mjs#L86 (pm-1uul)
• Semgrep 874962821: High spawn shell true in plugins/pm-claude/scripts/pm-mcp-server.mjs#L82 (pm-f7ik)
• Dependabot alert: brace-expansion unbounded expansion denial of service (GHSA-mh99-v99m-4gvg) (pm-5q81jq)
• Dependabot alert #43: PostCSS previous source-map path traversal (GHSA-r28c-9q8g-f849) (pm-a24aqt)
• Release pipeline permits duplicate same-day production versions (pm-4s24d2)

Other

• PR #684 post-merge deferred checks and review follow-up (pm-e3g0h6)
• Execute and expose the unknown-author acknowledgment flow: dispose the five stranded events and give the shipped SDK primitive a CLI and MCP surface (pm-zqpnte)
• Holistic pm CLI, SDK, and ecosystem optimization roadmap (pm-xe0c38)

2026.7.24-3 - 2026-07-24

Fixed

• Same-day ordinal npm publish requires an explicit stable dist-tag (pm-gis0qo)

2026.7.24-2 - 2026-07-24

Added

• Stale in-progress detection: validate/health flag in_progress items with no active claim or recent activity (pm-w8q4)

Fixed

• Full coverage gate flakes when real all-package install exceeds generic 30-second unit timeout under load (pm-7x0wqg)
• Sentry PM-CLI-2K: schema migration input error crosses CLI boundary as high TypeError (pm-rxqcp9)
• Author attribution enforcement: opt-in strict unknown-author rejection, SDK test-all author parity, and audited disposition for stranded actionable events (pm-h90s)

Security

• Write-time secret detection advisory: mutation paths flag credential-shaped content before it enters the immutable history stream (pm-pim7)

2026.7.24 - 2026-07-24

Added

• pm validate needs a counts-only projection so agents can read drift numbers without row-array payloads (pm-a9mc)
• GH-445: suppress/factor repeated inherited tags in pm context rows (--no-tags + tag folding) (pm-ishm)
• NDJSON output mode: --format ndjson on list/search/context emits one JSON object per line for grep/jq/xargs pipelines (pm-646c)
• Workspace-scoped audit history stream: schema/config/profile/init mutations recorded as append-only hash-chained JSONL (pm-klo8)
• Schema evolution migrations: lossless, history-recorded bulk migration of existing items when custom types, fields, or statuses are renamed or retired (pm-dijg)
• Beyond-PM SDK exemplar phase 2: temporal digital-twin graph with entity relationships, event replay, point-in-time state, and invariants (pm-kr3t)
• Bounded SQLite metadata list reads and compact get child continuations (pm-px153l)
• Workspace memory tiers: derived rollup summaries of closed-item epochs keep decades-old work queryable in bounded tokens (pm-5qmm)

Fixed

• pm deps tree must remain bounded on cyclic deep relationship graphs (pm-gygna8)
• GH-449: contracts policy_modes advertises 'enforce' but governance config accepts 'strict' (contract drift) (pm-kjbh)
• Scoped renderer ownership: safe package renderers should not keep isolated package doctor in warning state (pm-nf7q)
• Extension flag value-arity decided by three divergent predicates in cli/extension-command-help.ts - help, parse, and summary surfaces can disagree (pm-853a)
• Post-install activation verification can load stale overwritten extension modules (pm-4v4c)
• Relationship timestamp snapshots must honor event time for late and offline arrivals (pm-j3swnb)

Security

• Extension install: untrusted manifest dependency specs reach npm install unvalidated (arg injection all-OS; shell command injection on Windows) (pm-g072)
• CodeQL alert 30: polynomial ReDoS in shared path normalization primitive (pm-v3zd3o)

Other

• SDK reference documentation for promoted primitives + migration notes for the CLI-on-SDK layering (pm-ds3b)
• SDK authoring DX polish: manifest-drift guard in scaffold tests, expectation key naming, repeated --capability, define* index signatures (pm-llrp)
• Extension install should scaffold newly required item-type folders (pm health ok:false after installing pm-kanban until pm init) (pm-l98s)
• Cursor fingerprints: replace per-command presentation-flag deny-lists with contract-declared semantic classification in sdk/pagination (pm-fgih)

2026.7.23 - 2026-07-23

Added

• SDK relationship registry and graph-query primitives: custom typed edges, adjacency, paths, closures, impact, and bounded subgraphs (pm-ju83)
• Context relevance signal feature store: derived recency, graph, claim, risk, deadline, knowledge-density, and semantic-match signals (pm-3hps)

Fixed

• GH-646: classify merge reconciliation discards by net outcome (pm-mmm9o5)
• GH-649: reject self-referential ordering relationships at the SDK mutation boundary (pm-k9t17l)
• GH-645: standard-depth get/show JSON omits notes without notes_count (pm-3esl28)
• GH-638: delete JSON envelope reports the removed item as open (pm-tz2ikr)
• GH-635: plan create cannot forward strict Plan-required metadata (pm-qd3woa)
• GH-642: linked-test runner enters interactive init wizard before repository commands (pm-lcnk2n)
• GH-641: plan link promotion rejects registered implements relationship kind (pm-ypuc39)

Other

• Capstone: zero the SDK import-boundary baseline — flip remaining CLI/MCP private-core imports to SDK primitives and harden the ratchet into a hard boundary gate (pm-9x6e)

2026.7.22 - 2026-07-22

Fixed

• Sentry PM-CLI-2G: make merge-driver installation permission failures actionable (pm-bnmlsc)
• Sentry PM-CLI-2F: classify manifest-proven torn bundle call-time TypeError (pm-pz7xtx)
• Compatibility gate rejects compact legacy create envelopes after release promotion (pm-pkdpyz)
• Sentry PM-CLI-2E: directory-shaped settings.json crashes CLI bootstrap (pm-k0nl2w)
• Sentry PM-CLI-2D: storage-integrity history scan reads .jsonl directories as files (pm-o1c53b)
• GH-576: unknown-command help probes return structured non-zero errors (pm-bu1m)
• GH-551: dependency seeds accept global source_kind and preserve cross-workspace IDs (pm-topu)
• GH-595: list JSON always emits total/has_more/truncated/next_cursor and omits unset filters (pm-wrss)
• GH-623: opt-in post-merge history reconciliation hook and one-command verify repair (pm-mfkv92)
• GH-553/GH-584: CodeFactor unnecessary-spread findings — restructure flagged spread sites (class owner) (pm-zt1c)
• GH-574: flattened extension alias subcommands still drop option contracts after GH-503/GH-550 fixes (empty --help, valid options rejected as positionals) (pm-7ufz)

Security

• Dependabot alert #42: brace-expansion CPU denial of service (GHSA-3jxr-9vmj-r5cp) (pm-f5hy2n)

Other

• GitHub analyzer follow-up: GH-628 unnecessary spread, GH-629 duplicate blocks, and GH-630 unsafe optional chaining (pm-aw59hb)
• GH-582: runRegisteredListCommand flagged Complex Method by CodeFactor — extract option-assembly helpers in register-list-query.ts (pm-zwya)

2026.7.21 - 2026-07-21

Added

• Graph planning & structural analytics: critical-path slack, betweenness/closeness centrality, and articulation points/bridges (pm-efuo34)
• CLI+MCP surface for atomic bulk item mutations: JSON mutation batch on stdin over commitItemMutations (pm-xm7c)
• GH-438: accept a full item JSON document on stdin for pm create / pm update (pm-kipd)
• GH-435: lean JSON output mode omitting null/empty fields (~50% token cut for --json) (pm-cfed)
• GH-437: make lean mutation output the CLI default (parity with MCP compact envelope) (pm-nilh)
• GH-443: lean error mode — drop constant required/why boilerplate from structured errors (pm-g9xk)

2026.7.20 - 2026-07-20

Added

• Merge-driver fence completeness: relationships/*.jsonl event stores uncovered and schema-added custom type folders silently drop driver coverage (pm-i4fx)
• Tracker merge semantics: field-aware merge guidance, history-chain-safe JSONL merging, and post-merge reconciliation for multi-branch agent workflows (pm-g5sx)
• GH-613: public SDK bulk item-mutation helper on commitWorkspaceTransaction — atomic create/update/close batches without hand-rolled step+compensation wiring (pm-y9hq)
• GH-612: additive --add-ac/--remove-ac forms for acceptance criteria — replace-only --ac clobbers concurrent branch edits (pm-xh82)
• GH-599: git merge driver + documented workflow for append-only history/*.jsonl (concurrent appends fork the hash chain) (pm-wc1r)

Fixed

• MERGE_SAFETY.md documented an invalid config invocation: 'pm config set project ids.token_length 6' exits 2 (scope must precede the verb) (pm-46octv)
• GH-601: SDK mutation option bags and projected list items are Record<string,unknown> — typos and wrong types compile clean under strict (pm-x29o)
• GH-600: item id generation not collision-safe across branches/concurrent agents (4 base36 chars, local-disk-only uniqueness) (pm-pibw)
• GH-615: pm notes --message without content is a silent no-op — apply the GH-588 empty-comment guard to the notes twin (pm-iedg)
• GH-602: SDK .d.ts require @types/node but package does not declare it — tsc errors inside node_modules for consumers; plus shipped JSDoc defects (pm-n1xx)
• GH-596: update-many --ids must report nonexistent requested IDs (pm-ukml)
• GH-597: reject empty append text without false updated_at freshness (pm-d9g9)
• Nightly macOS+Windows red post-PR#568: staging-base selection compares realpath'd source against non-canonical temp dir — staging lands inside source, fs.cp EINVAL self-copy (pm-hvt3)
• fix: nightly windows/Node24 red — vcs-extension spec asserts POSIX 'relationships/events.jsonl' against native default store path (pm-34yf)
• GH-607: validate reports ok:true / checked_items:0 on structurally-unparseable item .toon — silently skips what pm get hard-errors on (pm-cxyv)
• GH-598: pm init .gitignore block hardcodes .agents/pm/ prefix — custom-root workspaces commit runtime cache and conflict on every merge (pm-4uqm)

Other

• Adopt collision-resistant id entropy in the pm-cli repository (ids.token_length 4 -> 6) (pm-88cy)
• Adopt PR#614 merge safety in the pm-cli repository itself: pm merge install, committed .gitattributes fence, CI storage-integrity + strict history-verify gates, transactions GC schedule (pm-iwsj)

2026.7.19 - 2026-07-19

Added

• Public SDK transaction boundary: atomic multi-item + relationship-event commit primitive (pm-4e12)
• Beyond-PM SDK exemplar spike: minimal VCS-style changeset workflow as a pm package (custom schema + event-sourced history + hooks) (pm-xtrd)

Fixed

• Workspace-transaction journals: .agents/pm/transactions/ outside the init gitignore block with no retention or GC (pm-8xod)
• GH-609: settings.json/schema/*.json have no merge driver; validate reports ok:true by silently falling back to defaults on unparseable config (pm-xdn6)
• GH-611: delete/modify merge silently resurrects deleted items and leaves conflict markers in history/*.jsonl while validate stays green (pm-wwfd)
• GH-604: pm history <id> --verify exits 0 when verification.ok is false; no --strict-exit — unusable as a merge-safety gate (pm-ol3p)
• GH-608: concurrent edits to different fields always conflict on the shared updated_at scalar (no field-level .toon merge) (pm-m3nl)
• GH-603: history-repair cements cross-author data loss after a lossy merge — reverting patch discards the other author's mutation, validate fully green (pm-gpo7)
• GH-606: concurrent note/tag appends hard-conflict the .toon item file; stale count headers corrupt the item beyond parsing (pm-9q2t)
• GH-588: pm comment --message exits 0 recording nothing — comment invocation without any comment text must fail fast (pm-yp56)
• GH-589: pm next --assignee X answers from anonymous-caller perspective and pm claim conflates assignment with claim (pm-cj9v)
• GH-591: pm context agenda events re-embed full item payloads already listed in the same response (~35% of brief output) (pm-6m1i)
• GH-592: tracker_not_initialized recovery re-suggests pm init even when a --pm-path tracker exists — following it silently splits workspace state (pm-tmhs)
• GH-586: graph audit severity and code summaries mix finding and affected-item units (pm-um4g)
• GH-590: cycle-creating blocked_by mutations succeed silently — items deadlock out of pm next with no inline feedback (pm-i6pi)
• GH-585: extension alias collision diagnostics for core command groups (pm-v1yo)

2026.7.18 - 2026-07-18

Fixed

• MCP nested options accept unknown keys silently (pm_deps options.dep no-ops) — extend pm-qxwu top-level warning into options objects (pm-upi0)
• Sentry PM-CLI-2C: classify Node MaxListeners runtime warnings as warning-level diagnostics (pm-qpfv)
• GH-578: align pm context and pm list-blocked with edge-aware pm next semantics (pm-uxkf)
• pm deps context format reports missing_count without enumerating missing references and disagrees with tree format (pm-8kch)

Security

• CodeQL alert 27: js/polynomial-redos in sdk/test/linked-command-detection.ts trailing-dash prefix trim (pm-8og4)

2026.7.17 - 2026-07-17

Added

• SDK-only exemplar: minimal custom PM CLI package proving the universal-tool story end-to-end (pm-cbwg)
• Promote execution and diagnostics primitives to the public SDK: linked-test running and test-run lifecycle, search eval harness, telemetry stats/export (pm-oslr)

Fixed

• cli/main.ts commander program is a module-level singleton: dynamically registered extension commands/flags persist across in-process invocations (pm-qfdd)
• Windows packed-extension install regression exceeds the generic Vitest timeout (pm-ph3i)

2026.7.16 - 2026-07-16

Other

• 2026-07-15 full CLI SDK and ecosystem manual audit and optimization plan (review pass 91) (pm-45lr)

2026.7.15 - 2026-07-15

Added

• Promote governance, validation, health, and maintenance primitives to the public SDK: validate, health, gc, changelog/reporting hooks (pm-oxrw)
• GH-444: ergonomic author attribution — global --author, init author_default, unknown-author advisory (pm-cpja)
• Promote schema, config, profile, and init primitives to the public SDK: full workspace customization programmatically (pm-3mna)
• Promote package & extension lifecycle primitives to the public SDK: install, upgrade, extension list/enable/disable, managed-package state (pm-x6jf)
• Promote annotation and link primitives to the public SDK: comments, notes, learnings, files, docs, deps, append metadata (pm-zwpp)
• Point-in-time read projection: pm get --at <version|timestamp> renders reconstructed historical item state without mutating (pm-hib1)

Fixed

• Linked-test item reference parser skips item IDs after value-bearing flags (pm-jhg9)
• Sentry PM-CLI-2B: external extension subprocess cannot resolve pm executable (pm-d4ns)
• Sentry PM-CLI-29: external Neo4j command reports missing configuration as a high pm-cli error (pm-7n5a)
• Nightly windows/Node24: package-manifest SDK-surface exemption uses POSIX endsWith — governance-audit runtime.ts check fails on backslash paths (pm-u5zr)
• GH-522: Windows nightly red — init next-steps hints POSIX-quote native Windows paths (quoteCommandArg backslash escaping) (pm-b24b)
• GH-567: macOS+Windows nightly red — extension-install copy self-nesting check misses symlinked/short-name temp paths (realpath fallback asymmetry) (pm-0fhw)
• Adopt CodSpeed continuous CPU benchmarking in CI: review/land PR#564 and establish the per-PR perf-regression signal (pm-yh6t)
• GH-562: pm init rejects --id-prefix/--prefix flag though id prefix is only positional (pm-nmzx)
• GH-560: extension renderer overrides diverge between SDK harness and real CLI output (pm-as4a)
• GH-557: contract layer intercepts -h/--help before variadic-positional handlers, blocking legitimate positional content (pm-albl)
• GH-547: SDK exporters and renderers cannot suppress host rendering of handled output (pm-f38n)
• GH-550: extension list flags are erased at the real CLI boundary (pm-evav)
• GH-558: export canonical item-to-context-relevance candidate derivation from the public SDK (pm-qyc6)
• GH-555: remove unnecessary spread in relationship registry ordering assertion (pm-ofgc)
• Validate lifecycle cycles using ordering relationship kinds only (pm-6irg)

Security

• Add OSSF Scorecard supply-chain security workflow with published results and SARIF code-scanning upload (pm-k7dp)

Other

• validate_history_unknown_author_events: legacy/actionable split for immutable unknown-author history events + first-party automation author coverage (pm-demq)
• Ship DeepSource, DeepScan, and Scrutinizer CI free-OSS analyzer configurations with documented activation (pm-3a68)
• ADR: relationship graph semantics — typed directional, ordering, provenance, evidence, and associative edges with schema-extensible invariants (pm-4jqm)

2026.7.14 - 2026-07-14

Added

• Promote history-stream maintenance primitives to the public SDK: history-redact, history-repair, history-compact (audited rewrite, re-anchor, checkpoint/prune) (pm-4a7m)
• Context usage feedback signal: served-then-acted-on outcomes strengthen relevance scoring (retrieval-practice effect) (pm-uwfs)
• GH-544: linked-file path anchoring — files/docs add/glob/discover/validate-paths resolve at process.cwd() while validate --check-files anchors at the workspace root (pm-chyh)

Changed

• Replace obsolete front-matter vocabulary with item metadata terminology (pm-hq28)

Fixed

• pm get --full omits children for Plan parents while pm list --parent returns them (pm-y4z5)
• Intentional package CommandError outcomes create high-severity Sentry issues (PM-CLI-16) (pm-7071)
• Extension install self-copy guard: reject source-inside-destination layouts before fs.cp EINVAL (PM-CLI-28) (pm-8myl)
• Sentry captures deliberate Ctrl+C interrupts as error-level events (AbortError, PM-CLI-27) (pm-ksv2)
• Torn-install bundle transients block scheduled releases: boot-time chunk-integrity self-check + distinct error code for gate classification (pm-wfvq)
• GH-446: pm get omits schedule facet (events/start_at/end_at/location) for Meeting/Event/Reminder (pm-x1g5)
• GH-533: create/update accept empty --title — required-title contract inconsistent between omitted and empty string (pm-7je0)
• GH-535: pm deps omits dangling parent references (missing_count:0, missing:false) contradicting validate's dangling_reference_count (pm-p9sc)
• GH-542: MCP pm_copy nests title/message under options while sibling tools declare flat camelCase params — own suite triggers unexpected-arg warnings (pm-hno5)
• GH-532: --estimated-minutes accepts negative numbers and floats — missing non-negative-integer range validation (pm-jh9t)
• GH-534: no-op update reports phantom changed_fields in --json while TOON reports empty, and changed_field_count is always null in JSON (pm-45mb)
• GH-526: aggregate --sum/--avg accept unknown field names and silently report 0 (pm-96vo)
• GH-530: list --status <invalid> silently returns count 0 — validate against the status domain like --type and search status: (pm-kj4k)
• Separate active dangling dependency warnings from terminal historical reference diagnostics (pm-2ler)

Other

• Docstring coverage regressed below achieved-100% by PR#536 extraction files; quality:static floors never ratcheted and mask drift; drop dead closure-pattern export (pm-fb3i)
• PR review helper: watch GitHub checks and enforce thread-scoped replies (pm-0fxa)
• Token-budget context packer: diversity-aware selection, projection degradation, and bounded output for pm context/next (pm-55ra)
• Complete public linked-resource SDK primitives and actionable dependency governance (pm-jcvg)

2026.7.13 - 2026-07-13

Added

• Bare-core audit extraction phase 2: move audit command implementations and audit flags out of default CLI/SDK into pm-governance-audit (pm-vjk3)
• Cursor pagination and bounded-output defaults for list/search/context at scale (pm-dfg0)
• Notes/learnings repair parity: add --edit/--delete (and a real --stdin/--file input source) matching comments, so bad annotation entries are fixable via the CLI (pm-a2h3)

Changed

• S3: move the --allow-audit-* override flag family out of core command registrations into pm-governance-audit (enforcement stays core) (pm-7dcf)
• S2: move the --audit linked-usage report mode off pm files/pm docs into pm-governance-audit (pm-27mv)
• S1: relocate dedupe-audit/dedupe-merge/comments-audit/normalize implementations into pm-governance-audit and delete their public SDK exports (pm-79fr)

Fixed

• Runtime-extension snapshot caches go stale in long-lived in-process embeddings (install invisible to next invocation) (pm-8fxc)
• GH-518: reduce Complex Method in src/cli/commands/next.ts (CodeFactor, PR#517 rank rendering) (pm-2gvp)

Other

• Extract governance audit runtime from the default CLI and SDK (pm-w1c0)
• S5: coverage migration + bare-core vs installed-plugin e2e verification for the audit extraction (pm-rxp1)
• S4: purge audit surface from default SDK contracts, MCP tool definitions, completion, help, and docs; package declares its own contracts; re-measure token surface (pm-kg18)
• Promote terminal-status and mutation runner primitives required by package-owned governance workflows (pm-yu6d)
• Decision: extension-point mechanism and bare-core fallback semantics for extracted audit flags (D1+D2 of pm-vjk3) (pm-fg0b)
• Scale benchmark harness: synthetic 10k/100k/1M-item workspace generator + latency/memory/token baseline for the read and claim hot paths (pm-mi2x)
• Lazy-load @sentry/node off the command hot path (~850ms ESM load on every command, even when telemetry disabled) (pm-1ybs)
• ADR: workspace scale-out strategy — indexed reads, storage fan-out, and bounded-output contracts for 100k-1M-item workspaces (proposed) (pm-bl8x)
• Local test/coverage dev loop 17+min: replace per-call spawnSync CLI runner with synchronous worker-thread bridge (pm-kvd0)

2026.7.12 - 2026-07-12

Added

• Promote plan workflow primitives to the public SDK: plan create/steps/dependencies/decisions/discoveries/validation/materialization (pm-je50)

Fixed

• Restore 100% SDK workspace read-error coverage (pm-jw2a)
• GH-510: macOS nightly red — withTempPmPath skips realpath canonicalization; init-path-guard probe-root assertion fails (/var vs /private/var) (pm-dprb)
• GH-454: schema add-field accepts reserved built-in names silently; collision error names no partner (pm-b9ov)
• GH-516: pm init seeds unrelated managed packages into fresh PM_GLOBAL_PATH workspaces (pm-b0se)
• GH-448: boolean custom field is silently never persisted (data-loss class) (pm-sjfs)
• GH-509: pm claim --next lacks candidate filters and race-loss walk — thread next filters + advance to next candidate (pm-fjxm)
• Prevent Decision items from entering agent work lanes by default; allow explicit maintainer opt-in (pm-eqk0)
• GH-513: pm next ready[] documented as ranked but not priority-ordered; no rank/score exposed (pm-1mwk)
• Fix red main coverage gate: measure-agent-token-surface.mjs landed without a covering spec (pm-ksca)
• GH-508: dedupe LegacyNoneCollectionNormalizer tables duplicated between create.ts and update.ts (CodeFactor) (pm-zuw8)
• Release-readiness guard expects pre-sync version:check command after date-version synchronization (pm-pmmv)
• Restore generated-loader docstrings and redact host path from tracker history (pm-9ugc)
• Full coverage contention times out metadata content-filter integration case (pm-d30l)
• GH-453: plan materialize --json response omits title/type/parent on materialized entries (pm-ypha)
• GH-452: plan materialize dead-ends on types with required-on-create custom fields (pm-qd2h)
• GH-507: recovery suggested_retry appends <value> to missing boolean EXTENSION flags (contract arity ignored) (pm-9qcr)
• GH-505: nested extension failures suggest irrelevant missing flags instead of preserving tracker recovery (pm-o71e)
• GH-504: importer/exporter registered without options yields an unusable CLI command (no arg/flag contracts) (pm-0mjz)
• GH-503: flattened extension-command aliases (csv-export, jira-sync) drop option contracts (pm-s9iu)

Other

• Coverage to 100%: src/core, src/mcp, and src/sdk modules (pm-krwu)
• Baseline agent token cost of the CLI surface: measure pm --help, per-command help, and contracts payload sizes before consolidation (pm-a22j)
• Research and document the July 2026 native ChatGPT/Codex plugin implementation plan (pm-n28t)
• Align all plugin and package manifests to date-based versioning with release-time sync (pm-hxsv)

2026.7.11 - 2026-07-11

Added

• pm claim --next: atomically claim the next actionable item so parallel agents each get distinct work (pm-114v)

Fixed

• Dangling dependency references: accepted at create/update, skipped by validate, and treated as satisfied by pm next (silent unblock) (pm-ol5v)
• Classify tracker-not-initialized Sentry CommandErrors as expected handled CLI errors (pm-w7jq)
• GH-498: pm comments rejects --body — accept it as an alias for --add and hint on unknown options (pm-z32q)
• GH-500: suggested_retry renders boolean flags with a "<value>" placeholder — literal suggestion fails (pm-6y58)
• pm next repeats the recommended item verbatim as ready[0] — emit an id reference instead (pm-hfg5)
• pm next recommends another agent's assigned in_progress item as 'resume to finish' — recommendation must be caller-aware (pm-yl6c)
• GH-489: pm next summary reports blocked: 0 while blocked items exist — blocked companion list missing (pm-l0bu)
• GH-501: pm init <path> roots a tracker that workspace discovery cannot find — tracker_not_initialized loop right after init (pm-69nl)
• GH-496: extension flags declared list:true don't accumulate repeated occurrences — host maps to scalar, Commander last-wins drops values (pm-kfq5)
• Reserved item-field name collisions are invisible to SDK lint/preflight/harness (pm-ghf1)
• Repeated --ac flags on create/update silently keep only the last acceptance criterion (pm-b84u)
• GH-497: pm create --template silently drops tags and custom type-option fields — only built-ins (priority/assignee) apply (pm-l6rz)
• pm create/update --dep silently normalizes malformed shorthand into dangling dependency ids (related:pm-x26a -> pm-related:pm-x26a) (pm-zazb)
• contracts-snapshot gate is environment-dependent: fixture baked in installed-extension contracts, failing CI on extension version drift or absence (pm-zcjy)
• GH-495: extension context pm_root ignores root-layout trackers (falls back to non-existent .agents/pm) (pm-kvev)
• pm close never stamps closed_at, so changelog and release-notes bucketing always falls back to updated_at (pm-m4iu)

Other

• Repo-wide 100% docstring coverage: public API + data contracts (gate-enforced) (pm-4ak1)
• Docstring gate: extend static-quality-gate to enforce public-API + data-contract coverage repo-wide (pm-5566)
• Docstrings: src/types (shared data model interfaces + consts) (pm-uxmf)
• Docstrings: src/sdk (public SDK surface + cli-contracts) (pm-uwu0)
• Docstrings: packages/* (module docs + exported/public surface for all 11 shipped packages) (pm-qely)
• Docstrings: src/core/extensions (extension-types + loader/runtime contracts) (pm-mswi)
• Docstrings: src/cli/commands (largest surface — command option/result interfaces) (pm-m0uc)
• Docstrings: src/core (search, schema, test, history, telemetry, governance, store, item, and remaining core modules) (pm-768v)
• Docstrings: src/cli (non-commands), src/mcp, src/ root modules (pm-2vb2)
• Untrack vendored pm-changelog extension dist from git (installed npm artifact, restored by changelog:pm:install) (pm-sod3)
• Refresh CodeQL Actions and reject incompatible Node 26 type-contract bump (pm-2a9n)

2026.7.10 - 2026-07-10

Added

• GH-473: pm install prints a post-install verification summary (pm-yjim)

Fixed

• Sentry release gate misclassifies handled duplicate-import refusal as a blocking runtime error (pm-io4t)
• GH-488: path-target pm init emits executable tracker-scoped follow-up commands (pm-x26a)
• Declarative extension install: activation failure is misreported and scaffold next_steps break when @unbrained/pm-cli is unresolvable (pm-3wsi)
• Project package install with --pm-path can write extensions into the caller workspace (pm-qt5d)
• GH-482: Node 24 nightly coverage gate flake — readdir-order-dependent branch at front-matter-cache.ts:505 (pm-gume)
• Context evaluation runner and CI gate: rank-aware quality metrics plus token-budget regression checks (pm-xmp5)
• Token-cost regression gate: CI budget check over a representative command-output corpus (pm-cu1i)
• GH-484: pm update --blocked-by silently overwrites prior blockers instead of appending (pm-q6gx)
• GH-485: pm search rewrites quoted status:all hybrid queries into --status and drops keywords (pm-2ldo)

Other

• Pre-install package-owned command names should hint the owning package install command (pm-b3e9)
• Context relevance scorer contract: pluggable SDK weighting, deterministic default model, and extension override path (pm-h3no)

2026.7.9 - 2026-07-09

Added

• GH-442: lean pm contracts --summary mode for cheap agent bootstrap (25KB -> 1-3KB) (pm-vxxm)
• GH-470: pm list --today and --recent shorthand filters for recently active items (pm-bfma)

2026.7.8 - 2026-07-08

Added

• GH-474: pm search --limit support in hybrid mode (pm-alnj)
• GH-467: isolated package/extension diagnostics — project-scoped doctor and smoke tests without global pm state leaking in (pm-6abs)

Fixed

• Triage: close GH-455 with shipped evidence once the Ollama embedding auto-default fix releases (pm-hq0r)

Other

• Expose sentry telemetry gate as package script alias (pm-w86l)
• Expose package lifecycle primitives through public SDK helpers (pm-kffw)
• ADR: 2026-06-07 deep review + remediation pass (never-block, MCP/version coherence, docs/CI hardening) (pm-96wm)
• GH-476: pm context rejects --max-items with an untargeted unknown_option (alias or recovery hint) (pm-5h9g)

2026.7.7 - 2026-07-07

Added

• Promote query/read primitives to the public SDK: list, get, search, context, next, aggregate, stats (pm-rjqr)
• Promote item lifecycle primitives to the public SDK: create, update, close, claim/release, copy, delete, restore, focus (pm-98cz)

Fixed

• Relative lancedb vector-store path resolves against process cwd, creating nested .agents/pm/.agents/pm stores (pm-og1v)
• Annotation --add silently stores flag-like tokens as content: pm notes <id> --add --stdin records the literal note "--stdin" (pm-vcu7)
• pm plan create silently ignores the root --id-only flag (prints full plan envelope) (pm-oz0k)
• GH-427: Windows Node 24 nightly fails — POSIX-only error-code assertions (EACCES/EISDIR) in restore-command and history-rewrite specs (pm-lt6n)
• pm extension --install pm-<alias> / @unbrained/pm-<alias> fails with 'Local extension source does not exist' instead of suggesting the bundled catalog alias (pm-jqd2)
• GH-455: pm health auto-selects an uninstalled Ollama embedding model then fails vector refresh (pm-aems)
• GH-463: linked PM tracker-read tests should auto-remediate or suggest --auto-pm-context (pm-6e1d)
• SDK client.run() rejects structured payloads for create: raw {type,title} fails with 'Missing required option --title' (pm-395t)
• Bare extension command group (pm changelog / pm graph) exits 0 with zero output instead of rendering group help (pm-1k57)

Other

• 2026-07-07 ecosystem audit #16: all-status review, long-horizon gap items (merge semantics, event stream, policy roles, flow metrics) (pm-su60)
• chore: 2026-07-06 ecosystem audit #13 — Semgrep-issue metadata backfill, scale-out initiative pm-9rxu, composability contract set (pm-lgim)
• chore: 2026-07-06 ecosystem audit #14 — WIP status hygiene (docstring family reset) + stale in-progress detection backlog (pm-6a1g)
• 2026-07-06 ecosystem audit #12: GH-467..474 backlog coverage + code-scanning capability epic (pm-3rgp)
• 2026-07-06 ecosystem audit #15: WIP hygiene, GH/commit coverage verification, grammar+SDK domain completions, horizon-4 planning (pm-pvij)
• Triage: close stale dogfood reports GH-436 (pm next/focus) and GH-440 (context --fields) with shipped evidence (pm-7cx8)
• GH-458: claim/start-task reject --assignee with an untargeted recovery hint (alias or better hint) (pm-qfte)
• pm install should accept multiple package targets (help already advertises [targets...]) (pm-hj9h)
• Unblock dependabot PRs: @types/node 26 type error, pnpm release-age cooldown, codeql-action lockstep group (pm-2czc)
• GH-468: clarify or publish the pm SDK npm package coordinates (@unbrained/pm-sdk is 404) (pm-25d0)

2026.7.6 - 2026-07-06

Added

• Expose SDK runAction and PmClient execution surface for programmatic integrations (pm-xzhz)

Other

• ADR: the pm SDK is the single public API — CLI and MCP are presentation layers (proposed) (pm-muhw)

2026.7.5 - 2026-07-05

Added

• Architecture boundary ratchet: prevent new CLI/MCP private core imports while SDK promotion shrinks the baseline (pm-8778)
• Lock contention auto-retry: bounded jittered wait before lock_conflict so parallel agent mutations self-heal (pm-2muu)

Fixed

• Extension installs are dead-on-arrival in CommonJS host projects: installed extension dirs lack package.json type:module (pm-r0m4)
• beads/todos import-export runtime broken from real npm installs: runtime-loader imports .ts under node_modules (type-strip refused) (pm-ejy7)
• pm close <id> -m 'text' still hard-blocks with close_reason_required: accept --message text as close-reason fallback (like closed pm-7x8d did for --resolution) (pm-9hry)
• pm claim silently steals items already assigned to another agent — claim must be atomic test-and-set for multi-agent work distribution (pm-8t5x)
• Extension activation adds ~200ms to every command when bundled packages are installed (pm-4oww)

Other

• Backfill full-context bodies (and comments/deps/risk) on all active items so context is rebuildable from pm CLI alone (pm-o043)
• 2026-07-04 full pm-backlog audit: reconcile pm items with entire ecosystem (code, tests, docs, ideas, decisions) (pm-y904)
• 2026-07-04 ecosystem audit #4: coverage matrix, governance capability epic & relationship modeling (pm-osea)
• Bundle GH-433 self-parent guard, Windows nightly lock proof, and pnpm 11 bootstrap hardening (pm-q1ke)
• Inventory the CLI-to-core call graph: map every command to core modules and classify logic for SDK promotion (pm-lodl)
• Sandbox audit fixes: package describe accepts npm package name; pm context <id> routes to pm get (pm-ayn7)
• SDK testing-helper input validation: runRegisteredCommandForTest positional misuse crashes; createExtensionTestHarness accepts non-extension module silently (pm-2exf)
• GH-426: reduce complex method in compatibility-check.spec runCurrentPmCommand (pm-24o5)

2026.7.4 - 2026-07-04

Security

• Extreme mandatory quality gates: strict ESLint everywhere, jscpd strict/zero-threshold, suppressions budget, Trivy/ShellCheck/PSScriptAnalyzer/actionlint CI, admin-proof branch protection (pm-7wmq)

Other

• Test meaningfulness audit: strengthen hollow assertions, de-mock thin specs, convert contract source-mirrors to behavior (pm-4i73)

2026.7.3 - 2026-07-03

Fixed

• GH-416: Windows nightly validate linked-artifact prune classification (pm-xpkt)

Other

• Perf: pm context / pm next hot path ~700ms on an ~850-item tracker (pm-z1pv)
• 2026-07-02 full ecosystem audit & optimization pass (CLI+SDK+packages+docs+CI) (pm-fpod)
• Zero the jscpd clone baseline: dedupe registration-helpers/flag-contracts source clones and 21 test-spec clones (pm-chxp)
• Lane E: Docs audit (progressive disclosure, minimal README, link graph, duplicated docs/skills) (pm-p99b)
• Lane F: CI/CD best-practice + secret/PII leak scan incl. pm history files (pm-mo2v)
• Lane A: E2E ecosystem smoke in temp workspace (pack+install CLI, all first-party packages, full command surface, agent UX/token-efficiency) (pm-kes3)
• Lane C: Code quality audit (complexity, dead code, cross-file duplication, long files, type safety, dependencies) (pm-hfli)
• CodeFactor residual complexity and duplication cleanup for 27-issue main snapshot (pm-bssk)
• Lane B: SDK best-practice + package-authoring DX review (define/compose/harness/preflight loop, scaffold matrix) (pm-6vy7)
• Lane D: Performance audit (startup latency, per-command responsiveness, hot paths) (pm-3l76)

2026.7.2 - 2026-07-02

Changed

• CodeFactor/Complexity: decompose runUpdate, the update mutate apply-callback, and register-mutation MCP arrows (pm-0n6p)

2026.7.1 - 2026-07-01

Changed

• CodeFactor/Complexity: decompose runCreate (CC 172) and the audit-scope update guard (CC 38) (pm-g7vl)

Fixed

• Auto Release blocked: bot cannot push version commit to protected main (GH006, 12 required checks) (pm-9gxi)

Removed

• CodeFactor/Complexity: remove 33 suppressions and split 100+ complexity-point dispatch hot spots (pm-o34s)

Other

• CodeFactor/Complexity: cut cyclomatic-complexity debt across the extension authoring, management & diagnostics surface (pm-zro7)
• CodeFactor/Complexity: zero out the SDK contract-resolution, extension-loader and composition surface (pm-lzzp)
• AGENTS.md: mandate reading full live pm item data (status/resolution/comments) before any state claim (pm-g61e)

2026.6.30 - 2026-06-30

Added

• Describe --markdown writes reference docs to a file (pm-u2tm)
• Complete scaffold capability matrix: --capability renderers/parser/preflight/services starters (pm-i5p5)
• Scaffolded & authored command-bearing extensions reliably activate for their own commands (pm-yxb5)
• Project profile presets: compose types, statuses, fields, workflows, templates, and packages (pm-v37g)
• pm next: recommend the next actionable (unblocked, ready) work item with rationale + blocked companion (pm-nj90)
• Add pm package / pm packages shell completion (bash/zsh/fish), including the package-only --declarative flag (pm-mthy)
• Project profile author-time validation: lintProjectProfile + assertProjectProfile + pm profile lint (pm-j1fj)
• pm package/extension init --capability profile: scaffold a project-profile starter package (pm-h2hk)
• SDK + CLI: render extension/package surfaces to Markdown reference docs (renderExtensionSurfaceMarkdown + describe --markdown) (pm-dmum)
• pm package/extension init --capability schema: scaffold custom item type/field/migration starter (pm-d1ig)
• First-party baseline profile package built on public SDK primitives (pm-a7o4)
• pm package init --declarative: scaffold a composeExtension blueprint starter + author-time preflight test (pm-8mxg)
• SDK test harness summary/render surface (pm-2qte)
• TypeScript-only extension loading: ship .ts entry, load via Node native type stripping (no compiled .js) (pm-2p7a)
• Extension-contributed project profiles: api.registerProfile end-to-end (pm-08sv)

Changed

• ADR: pm extensions are authored AND loaded as TypeScript via Node native type stripping (pm-m1uz)
• CodeFactor/Duplication: remove duplicated code blocks (×20: 2 Critical, 3 Major, 15 Minor) (pm-fmjy)
• CodeFactor/Complexity: reduce cyclomatic complexity (×152: 3 Critical, 7 High, 142 Moderate) (pm-arzz)

Fixed

• pm validate --check-files mis-handles remote (URL) doc/file references: flagged as deleted and silently destroyed by --prune-missing (pm-k2n4)
• pm next hides completed-container closeout rows while leaf work exists (pm-9g87)
• MCP action-schema contracts drifted from CLI flag tables (guide.list, health.brief, validate.parentCycleSeverity, contracts.full) (pm-zx13)
• describeExtensionBlueprint omits importer/exporter-with-options command definitions (parity gap vs describeExtensionActivation) (pm-zqes)
• Contracts command lookup should handle package namespace roots (pm-y1o4)
• GH-363: Windows nightly (Node 24) red — runtime-loader colon-path + telemetry detached-spawn unhandled error + npm-install regression (pm-xaib)
• CI: make Codecov badge uploads branch-explicit (pm-x878)
• deriveExtensionCapabilities omits 'schema' for importer/exporter options.flags (declarative blueprint under-grant) (pm-v3ty)
• pm install does not scaffold extension-contributed item-type folders (transient missing_directory health warning) (pm-rjab)
• Auto Release blocked-alert step can never create its tracking issue (auto-release.yml missing issues:write) (pm-qawd)
• pm package doctor should warn when a schema package registers item types/fields but declares narrow activation.commands (silently non-global) (pm-ok47)
• Scaffolded search/importers package commands fail to dispatch: lazy-activation probe skips command-bearing extensions that omit activation.commands (pm-nacb)
• CodeFactor/Maintainability: fix unsafe optional chaining (no-unsafe-optional-chaining ×25) (pm-m8yl)
• Package lifecycle typo recovery should suggest action subcommands (pm-js02)
• Windows background stop progress assertion (pm-bnh3)
• CodeFactor no-regression gate: complexity ceiling + ESLint suppressions baseline + Greptile in local CI/CD (pm-bkcv)
• Aggregate --status all should match duplicate-safe lifecycle filters (pm-bhtx)
• Harden extensionNeedsActivationForProbe: non-terminal search gate + command-bearing importers (pm-b5r8)
• Sentry PM-CLI-1T: pm stats should tolerate disappearing history streams (pm-7o0s)
• pm next should skip completed open containers when recommending actionable work (pm-2n6i)
• GH-348/GH-376: Windows nightly Vitest worker fork exits unexpectedly after passing tests (pm-2kkl)

Removed

• CodeFactor/Maintainability: remove useless object-spread fallbacks (unicorn/no-useless-fallback-in-spread ×57) (pm-xsth)

Other

• 2026-06-25 PM ecosystem taxonomy and context backlog normalization (pm-57vh)
• Normalize stale audit containers and intentional-open resolved items (pm-psc0)
• Extend pm package init --declarative to the full capability matrix (hooks/search/importers/schema/renderers/parser/preflight/services) (pm-lfdv)
• CodeFactor parity tooling: local ESLint (unicorn) + complexity + duplication lint to reproduce findings and prevent regressions (pm-6sqo)
• Built-in MCP actions are now extension-aware: pm_profile/pm_list/pm_schema activate workspace extensions like the CLI (pm-zumn)
• Sub-agent lane: source, tests, docs, and command-surface coverage map (pm-xezi)
• Schema scaffold tests: unit coverage (package+extension variants) + materialize/run generated node:test smoke (pm-x3vi)
• pm profile list/show/apply merges extension-registered profiles with source labels (pm-vpwt)
• Package scaffolds declare current SDK compatibility floor (pm-sf08)
• Document activation.commands lazy-activation contract in scaffold README, EXTENSIONS.md, SDK.md (pm-scvz)
• Refresh runtime dependencies for audit baseline (pm-r642)
• ADR: profile lint severity model — errors break apply, warnings flag suspicious-but-valid cross-references (pm-qcdu)
• CodeFactor/Maintainability: clear remaining unicorn lints (no-thenable ×4, no-useless-spread ×2, no-useless-length-check ×1) (pm-q0ye)
• Schema scaffold docs: EXTENSIONS.md, SDK.md, shell completion, help-content examples (pm-pwf1)
• Docs: SDK.md/EXTENSIONS.md document api.registerProfile + regenerate contracts/full.json (pm-ol8j)
• Sub-agent lane: SDK, packages, MCP, and universal customization backlog (pm-o578)
• Scaffold emits manifest activation.commands matching registered command paths per capability (pm-mhih)
• Implement schema scaffold capability in scaffold.ts (manifest/entrypoint/README/define* guidance, omit activation.commands) (pm-mdw6)
• SDK profile parity: assertRegisteredProfile + composeExtension blueprint.profiles + deriveExtensionCapabilities + describe (pm-l8fl)
• Sub-agent lane: tracker taxonomy, hierarchy, and duplicate hygiene (pm-klpw)
• Dogfood: pm-kanban registers kanbanProfile so pm profile apply kanban works (pm-kj7x)
• Schema-capability scaffolds must omit narrow activation.commands so custom item types/fields register globally (pm-halx)
• Action-scoped MCP parameter descriptions: split shared name/target description per action (schema vs profile) (pm-fq80)
• ADR: offline BM25 lexical provider + relevance eval harness for search quality (pm-f2al)
• ADR: explicit pm_format_version front-matter field for storage schema evolution (pm-eeai)
• PR #406 review follow-up: clear partial MCP extension registries before fallback execution (pm-dyzy)
• Expose project profile application through MCP contracts and drift gates (pm-bhmk)
• ADR: dependency-aware actionability for pm next — ready = active leaf with no open blocked_by; reuse compareCriticalItems + shared blocked_by resolver (pm-9x6k)
• registerProfile core registration surface: ExtensionApi + registry + loader gate + capability-usage + policy surface (pm-6oox)
• First-party package manifests declare current SDK compatibility floor (pm-6d7q)
• Refresh Sentry release and telemetry dependencies (pm-4dz7)
• Decompose cli-contracts.ts monolith into flag-contracts + tool-schema sibling modules (pm-3wue)
• Sub-agent lane: release, GitHub, Sentry, telemetry, and live-ops evidence (pm-3whx)

2026.6.24 - 2026-06-24

Added

• SDK author-once manifest synthesis: synthesizeExtensionManifest + assertExtensionManifestMatchesBlueprint (pm-u5le)
• SDK unified author-time preflight capstone: preflightExtension + assertExtensionPreflight (pm-ozaf)
• Modular declarative authoring: mergeExtensionBlueprints + composeExtensionPackage (pm-2p38)
• SDK author-time version-compatibility preflight: checkExtensionManifestCompatibility + assertExtensionManifestCompatible (pm-1w0d)
• TypeScript-first extension & package scaffolding + SDK docs reframe (pm-09rh)

Changed

• Extract shared version-compat core (core/extensions/version-compat.ts); loader delegates, behavior-preserving (pm-sjea)

Other

• preflightExtension(blueprint, options) — pure unified author-time analyzer (compose.ts) (pm-tcw1)
• assertExtensionPreflight(blueprint, options) — throwing CI/test bookend (testing.ts) + barrel re-export (pm-t8yl)
• assertExtensionManifestMatchesBlueprint(manifest, blueprint): strict least-privilege CI guard against capability drift (pm-pfxi)
• defineExtensionBlueprint: typed identity helper for partial blueprint fragments (pm-nvgy)
• synthesizeExtensionManifest(blueprint, identity): generate a complete least-privilege ExtensionManifest from a blueprint (pm-nr5j)
• Reframe SDK docs & docstrings TypeScript-first (SDK.md, EXTENSIONS.md, define*/compose*) (pm-l2ud)
• checkExtensionManifestCompatibility(manifest, target) — pure author-time analyzer (pm-knma)
• assertExtensionManifestCompatible(manifest, target) — SDK testing assert (pm-hng2)
• mergeExtensionBlueprints: pure modular composition of partial ExtensionBlueprints (pm-high)
• Scaffolder emits TypeScript source: index.ts + tsconfig.json + type-check/test scripts (./index.ts entry) (pm-frou)
• composeExtensionPackage: author-once capstone returning { module, manifest } (pm-cn0c)
• Convert docs/examples extensions to TypeScript-first (starter-extension, policy-restricted-extension) (pm-ax7z)
• ADR: pm extensions & SDK packages must be authored fully in TypeScript (pm-2c28)

2026.6.23 - 2026-06-23

Added

• SDK describeExtensionBlueprint: static author-time surface map of a composeExtension blueprint (author-time inverse of describeExtensionActivation) (pm-tlpv)
• pm extension/package describe: agent-facing CLI + MCP surface for describeExtensionActivation (pm-l4c8)
• Unified extension test harness (createExtensionTestHarness): one fluent fixture binding all activate/assert/invoke/deactivate SDK helpers (pm-jcyn)
• Declarative extension authoring: composeExtension blueprint + deriveExtensionCapabilities + defineExtensionManifest (pm-iqq0)
• SDK lintExtensionBlueprint + assertExtensionBlueprint: author-time preflight for composeExtension blueprints (capability drift, duplicate commands, empty surfaces) (pm-9ect)
• SDK describeExtensionActivation: single-call introspection of every registered surface (complements assert*/run*) (pm-16ue)
• SDK authoring-time define* typed builders for every extension registration surface (pm-12tj)

Fixed

• deriveExtensionCapabilities omits 'schema' for a CommandDefinition with inline flags (manifest under-grant would fail activation) (pm-5758)
• GH-340: Windows nightly telemetry OTLP cleanup EBUSY (pm-zpe7)

Other

• ADR: SDK author-time helpers are the static inverse of runtime extension checks (derive↔reconcile, describe-blueprint↔describe-activation, lint↔loader-enforcement+doctor) (pm-4oio)
• ADR: SDK define* builders are zero-cost identity helpers (defineConfig pattern), generic for object defs / non-generic for function defs (pm-3mph)

2026.6.22 - 2026-06-22

Added

• pm package init --capability search: scaffold search provider starter packages (pm-pwai)
• SDK testing helper to invoke a registered extension command handler: runRegisteredCommandForTest (pm-owm0)
• pm package init --capability <kind>: scaffold capability-targeted starter packages (commands|hook) (pm-nhby)
• Complete the SDK extension-invoke testing surface: runRegisteredHookForTest + override invoke helpers (pm-miqm)
• Add importers package scaffold and dependency-maintenance closeout (pm-j5az)
• Least-privilege capability reconciliation: pm package doctor flags declared-but-unused extension capabilities + SDK assertExtensionCapabilityUsage (pm-fk84)
• SDK invoke helpers for search providers, vector store adapters and migrations (pm-bd3u)
• SDK invoke helpers for importers & exporters: runRegisteredImporterForTest + runRegisteredExporterForTest (pm-1p2u)
• SDK deactivate test lifecycle: deactivateExtensionForTest + assertExtensionDeactivated helpers (pm-0zn9)

Fixed

• Fix Windows nightly full-test path and permission assumptions (pm-83rt)

Other

• Package and extension scaffolds emit least-privilege manifest policy metadata (pm-bav0)

2026.6.21 - 2026-06-21

Added

• item-format-migration: add format-version field to front-matter for future migration gating (pm-ae1u)
• Complete SDK package-author test-assertion surface: service-override + migration helpers (pm-6pmp)

Fixed

• Windows nightly: secondary POSIX-separator + mocked-path test class (static-quality-gate, docs-skills-gate, bundle-cli, contracts-snapshot, smoke-npx-from-pack) (pm-s5pe)
• Nightly windows-latest STILL red after pm-i84i: scriptModule test harness imports .mjs scripts via absolute file:// URL, shebang survives missing transform (SyntaxError) (pm-dita)

Other

• Code quality & perf audit 2026-06-12 (pm-nimu)
• SDK testing helper for registerFlags registrations (pm-oveq)

2026.6.20 - 2026-06-20

Added

• Add wiring-checklist reference card to ARCHITECTURE.md for new command authors (pm-zyse)
• Add 120-file unit-test cap governance test to ci-workflow-contract.spec.ts (pm-wc0d)
• Search relevance eval harness: implement nDCG/MRR runner and gate in CI (pm-u8n5)
• gc --scope checkpoints: prune stale bulk-mutation checkpoint files (pm-tyj8)
• Add Windows path-separator test coverage for fs-utils and store/paths (pm-tq5t)
• Add remediation registry entry for validate_metadata_duplicate_issue_codes warning (pm-sdbo)
• Add performance / startup-latency section to ARCHITECTURE.md (pm-p37b)
• Add vitest.config.ts coverage include/exclude governance guidance to ARCHITECTURE.md (pm-othr)
• Sentry KNOWN_NOISY_CONSOLE_MESSAGE_PATTERNS maintenance: add a governance test to prevent silent accumulation of stale patterns (pm-jxls)
• Add nightly.yml failure alerting: notify on Windows/Node25 smoke failures (pm-ehbb)
• Add remediation registry entry for extension_update_health_partial_coverage warning (pm-bdvm)
• Add integration test for close-many --rollback checkpoint restore (pm-7p4w)
• Offline BM25 lexical retrieval provider when no Ollama/OpenAI is configured (pm-75k9)
• Add integration test for background-refresh (instant mutations) non-blocking behavior (pm-5rge)
• Add integration test for schema add-type / remove-type round-trip with governance.workflow_enforcement (pm-4dtf)
• LanceDB snapshot: add gc --scope embeddings to include pending-refresh.json and drift-cache coordination (pm-3b1t)

Changed

• COMMANDS.md omits pm get and pm copy; command-families table missing get/copy/update-many/close-many (pm-xvzm)
• Replace 'as unknown as ItemMetadata' double-casts (9 sites) with typed mutation/replay returns (pm-ul02)
• Refactor runUpdate (~950-line function) into table-driven per-field apply helpers (pm-e7dn)

Fixed

• GH-293..296 CLI parser and search regression bundle (pm-yy45)
• appendLineAtomic is not truly atomic: concurrent appends to history JSONL can interleave (pm-xy9n)
• Project-scope extension install writes ~69MB node_modules per workspace (peer pm-cli + transitive Sentry/OTel) (pm-oxq2)
• Daily auto-release was silently blocked 06-14..16 by a single stale, unresolved Sentry error (sentry-telemetry-gate is:unresolved has no time window) (pm-nb08)
• Fix ARCHITECTURE.md storage layout: add plans/, stories/, schema/, checkpoints/, runtime/ dirs (pm-mcgf)
• Nightly windows-latest red since 2026-06-14: ~373 tests fail with 'SyntaxError: Invalid or unexpected token' from file://-URL TS dynamic imports + POSIX-separator assertions (pm-i84i)
• Accept --status all for duplicate-safe search and list filters (pm-i02t)
• Fix nightly cross-platform reliability: macOS realpath in extension-command test and Windows .cmd spawn EINVAL (pm-gf6f)
• pm health 2.3-3.1s in dev repo (~2x the 1.3s baseline): drift-scan cache hit still reads + content-hashes every history stream (pm-c90s)
• pm-changelog over-escapes markdown in entry titles (parens + intra-word underscores) (pm-3299)

Removed

• Built-in type lists and storage layout drift: Plan missing; ARCHITECTURE.md still lists removed index/ dir (pm-7u4z)

Other

• Export hygiene: 1 dead export + ~57 exported-but-internal-only symbols (pm-vn9l)
• Unknown-command did-you-mean misses executable aliases: 'pm shwo' gets no suggestion (show/view/comment not in candidate set) (pm-i35t)
• Sentry tracesSampleRate is hardcoded at 0.2 — expose as configurable knob or document intent (pm-gg8e)
• Document search eval golden-query harness usage in TESTING.md (pm-eg9k)
• CLAUDE_CODE_PLUGIN.md drift: architecture tree shows 9/14 commands + 1/4 agents; compat table says plugin 1.0.0 (actual 1.4.0) (pm-cxi9)
• Docs index missing EXTENSION_AUTHOR_CONTRACTS + MIGRATION_CLI_SIMPLIFICATION links; migration note predates --pm-path (pm-c97q)
• pm todos import: positional source arg silently ignored + folder-not-found error omits --folder flag (beads parity) (pm-90hp)

2026.6.19 - 2026-06-19

Added

• Add agent-identity dimension to telemetry events: surface PM_AUTHOR as hashed author_context (pm-fbyu)
• Sub-hour duration granularity for scheduling: support minutes in --duration / event duration= (pm-zoe4)
• pm context --fields: per-row field projection for focus items (GH-156 follow-up to --depth full) (pm-hnjf)
• pm history-compact: expose --scope all-streams (history GC pass) for closed items (pm-yj9w)
• Core read/validate integrity: exact-ID search rank guarantee across modes + parent-hierarchy cycle detection (pm-rkie)
• pm search: structured inline query syntax (tag:/status:) + matched-text highlighting (GH-157 remainder) (pm-ldr1)
• Dedupe merge workflow: pm dedupe-merge to consolidate duplicates (GH-163, builds on closed pm-4n1a detection) (pm-jmld)
• pm telemetry stats: add error_rate and resolution breakdown per command bucket (pm-gsoe)
• History stream bulk-compaction: pm history-compact --all-over N to batch-compact large streams (pm-f3pa)
• pm plan discoverability: templates and auto-suggest for complex work (GH-158 remainder) (pm-aer3)
• Validate governance accuracy: suppress false-positive duplicate-code & terminal-item metadata noise + files --remove input clarity (pm-6bz1)
• GH-208: linked test sandbox ergonomics (pm-52eh)
• Surface duration_ms percentile breakdown in pm telemetry stats (p50/p95 per command) (pm-3n3b)
• pm list output formats: csv/table for human export (GH-154 remainder) (pm-1lll)
• Auto-compact policy: config-driven threshold to trigger pm history-compact automatically (pm-0pnz)

Changed

• pm update --allow-audit-update: permit append-only --comment/--file/--doc evidence (GH-207) (pm-kanu)

Fixed

• pm templates: unknown subcommand + flags silently fall back to 'list' (exit 0) instead of erroring (pm-r2kd)
• linked-test-adapters package install loses ESM module type (pm-v8fy)
• GH-215: enforce timestamps in history entries (pm-u42x)
• GH-281: exact-ID search match is rank-diluted in hybrid/semantic mode (keyword score normalized + capped by keyword weight) (pm-oqgf)
• Dynamic package commands should reject excess args and unknown parent tokens (pm-nt1y)
• GH-206: test-all silent run process-liveness regression (pm-mcxr)
• GH-262: prevent path-like pm init from corrupting caller tracker settings (pm-jek2)
• GH-284: align pm init required schema directories with health (pm-hl9y)
• CI contracts snapshot temp cleanup can fail with ENOTEMPTY (pm-c61g)
• PR #266 review feedback: tighten init and dynamic option validation (pm-at1j)
• GH-265: schema unknown subcommands must not create custom types (pm-ablm)
• GH-280: pm validate does not detect circular parent references (hierarchy cycles A->B->A of any length) (pm-8vul)
• Auto Release retries branch push after main advances (pm-5oti)

Other

• Dogfood audit 2026-06-12: ecosystem verification (CLI+SDK+packages) (pm-krgd)
• PR #274 review follow-up: CodeQL and bot feedback (pm-0bwe)
• GH #268-#270 agent lookup and context output polish (pm-x7g1)
• SDK.md PM_PACKAGE_RESOURCE_KINDS drift: assets/prompts kinds missing (pm-u8y9)
• GH-276: metadata check skip terminal items for planning fields (pm-pktw)
• Repo-wide docstring coverage gate for source files (pm-p4mw)
• GH-277: files --remove path-only input clarity (pm-k8ld)
• GH #267/#271/#272 follow-up: lifecycle automation, logical dependency validation, read format parity (pm-8uhf)
• PR #274 second review follow-up: prefix, format, and owner scoring (pm-89ur)
• GH-278: duplicate_issue_codes exclude items closed-as-duplicate (pm-5fid)
• GH-275: duplicate_issue_codes skip legitimate parent/child code-prefix pairs (pm-2nxe)

2026.6.17 - 2026-06-17

Added

• Sentry PM-CLI-1R: 'cannot add command init as already have command init' — top-level init double-registration throws raw Commander error (pm-zyez)
• GH-216: default lifecycle transition suggestions (pm-y1z0)
• pm schema list-fields / show-field / add-field / remove-field: CLI management of schema/fields.json (pm-vhbf)
• GH-245: schema add-type --infer from title prefixes (pm-tb42)
• Expose schema.unknown_field_policy via pm config set schema_unknown_field_policy (pm-nnaq)
• Expose id_prefix, author_default, output.default_format, locks.ttl_seconds via pm config set (pm-9byd)
• pm schema apply-preset <agile|ops|research>: standalone type-preset for already-initialized projects (pm-86ob)
• GH-217: scheduling type creation shortcuts (pm-76r5)
• GH-258: strict unknown-key rejection across all structured CSV/markdown link & metadata parsers (validation parity with test --add) (pm-0v9k)

Other

• Document schema/fields.json runtime custom field authoring in CONFIGURATION.md (pm-izx5)

2026.6.16 - 2026-06-16

Added

• pm search keyword mode: --match-mode (and/or/exact) + default result limit (GH-181 remainder) (pm-i1z6)
• Metadata governance & coverage observability (missing-field filters, stats breakdowns, validate full-id lists, aggregate explicit labels) (pm-yq7m)
• GH-235: detect duplicate logical issue code prefixes (pm-rpag)
• GH-236: governance metadata missing-field filters (pm-mfl1)
• Module-mirrored test reorganization: retire lane/wave naming, add shared script harness (pm-m449)
• Search corpus: include type, priority, parent, assignee fields in keyword and semantic corpus (pm-jyie)
• pm context --depth full: comprehensive snapshot (all sections, no per-section cap) (GH-156) (pm-j0vc)
• pm close: short aliases -m/-r/-d for --message/--reason/--duplicate-of (GH-226) (pm-i1mu)
• GH-242: field-existence filters for list/search (pm-hntj)
• GH-244: surface provider/vector-store resolution source in pm health (pm-gnu2)
• pm validate: missing-link owner attribution (GH-210) + type-default estimate backfill (GH-212) (pm-gnnb)
• pm get: include child rollup summary for Milestone/Epic items (GH-155) (pm-gcm3)
• pm context --parent <id>: scope snapshot to a single epic/parent subtree (pm-ds0m)
• Configurable min-score threshold for pm search: --min-score per-query override of search.score_threshold (pm-cstl)
• Apply Gemini correctness fixes & cover new branches (config/init/reindex/register-mutation) (pm-bw70)
• GH-241: stats content-field utilization metrics (pm-7snq)
• pm create/update --body-file: load body markdown from a file (GH-214) (pm-7c48)
• pm focus: session default parent/context inheritance for new items (GH-161) (pm-72xf)
• GH-243: comments edit/delete lifecycle commands (pm-4swf)
• Search: persistent search.hybrid_semantic_weight setting as default for pm search --semantic-weight (pm-2xwh)
• pm search filter parity with pm list: add --updated-after/before, --created-after/before, --assignee, --sprint, --release, --parent (pm-13nx)
• Finalize literal 100% coverage: close c8-ignore-masked gaps & remediate PR #240 bot review (pm-0xix)
• pm list --no-truncate/--all: explicit override of any --limit + surface total vs returned count (GH-154) (pm-0c0j)

Changed

• Dedupe history-rewrite orchestration block triplicated across history-redact/repair/compact (pm-bzgt)
• Small verified cross-file duplications (4 pairs) + static-gate duplicate scan does not cover src/cli (pm-z2gi)
• pm update-many: --filter-ac-missing/--filter-estimates-missing/--filter-resolution-missing selection filters for bulk backfill (GH-220) (pm-wbak)
• LOC growth watch: 5 src files back over 2000 lines (cap 3400) after 2026-05-25 barrel splits (pm-k1im)
• health.ts re-implements doctor.ts capability-guidance helpers verbatim instead of importing the exported versions (pm-aabt)

Fixed

• Extension activation failure is invisible outside pm health --json: extension list shows ok, no stderr hint, commands partially registered (pm-yffj)
• pm create <type> --title X silently ignores positional type, defaults to Task (pm-8sr3)
• GH-209 follow-up: OTEL span export keeps the CLI alive ~10s (and can exit 13) when the traces endpoint is unreachable (pm-25se)
• GH-256: update-many --dry-run skips field validation (priority/type/status/deadline) (pm-v4tb)
• GH-253: invalid --type create error hardcodes .agents/pm path, ignoring active --pm-path (pm-nd08)
• GH-205: surface telemetry flush/probe + OTEL export diagnostics in pm health (pm-hx5a)
• GH-252: pm get --json places body outside item (parity with list --include-body) (pm-hofv)
• c8 ignore end (invalid keyword) silently masked source coverage; literal-100% gate passed on hidden code (pm-dg8j)
• GH-249: create --status closed bypasses governance.require_close_reason (pm-4a1p)
• GH-248: fix schema add-type silent slug-collision overwrite + malformed-name acceptance (pm-3l0f)
• GH-250: pm close checks item existence before the close-reason gate (pm-1jtl)

Security

• Track open Dependabot alerts #39/#40/#41 (vite and @opentelemetry/core) (pm-c24n)

Other

• Content-field & governance introspection (GH-241/242/236) (pm-php4)
• Source-correctness audit of all-source-100%-coverage branch src/ edits (pm-e2jt)
• Test-suite dedup & best-practice audit (post module-mirror reorg) (pm-2nqx)
• GitHub issue triage 2026-06-12 (pm-tk1z)
• pm close: when require_close_reason is on, accept --resolution text as the close reason instead of hard-blocking (pm-7x8d)
• Literal 100% all-source test coverage & module-mirrored test reorganization (pm-xau3)
• ADR: literal all-src coverage supersedes curated include/exclude allowlist (pm-w13j)
• pm aggregate: explicit (unassigned)/(none) labels for blank group keys in all output modes (GH-225) (pm-zcx9)
• tests/unit is at exactly 120/120 spec files: zero headroom before Gates(static) fails; consolidation candidates identified (pm-vks9)
• Coverage to 100%: src/cli infrastructure (registration, bootstrap, help, main) (pm-uvxc)
• Coverage to 100%: src/cli command handlers (group A — mutation, history, storage, schema) (pm-ud1x)
• Document and test telemetry env-var surface: PM_TELEMETRY_DISABLED, PM_NO_TELEMETRY, PM_TELEMETRY_SOURCE_CONTEXT, PM_TELEMETRY_OTEL_DISABLED, PM_TELEMETRY_INLINE_FLUSH (pm-r7md)
• Slim guided-error boilerplate in agent contexts; lead unknown-command Examples with the did-you-mean candidate (pm-q0kr)
• pm validate: --all-affected-ids flag + never truncate ID lists in JSON mode (GH-224) (pm-o0d2)
• PR #240 review: applied vs declined Gemini findings (with rationale) (pm-lg65)
• ADR: test organization convention — module-mirrored spec files, no lane/wave naming (pm-kjmx)
• Shared core/governance/metadata-coverage primitive: missing-field predicates + coverage % + grouped lifecycle counts (pm-hm1q)
• pm stats: --by-assignee/--by-tag/--by-priority breakdowns + --metadata-coverage + lifecycle/type adoption (GH-213/218/219) (pm-gq27)
• pm list: --filter-ac-missing/--filter-estimates-missing/--filter-resolution-missing/--filter-metadata-missing (GH-228) (pm-fryg)
• Coverage to 100%: build, release, and smoke scripts (pm-f2ne)
• Close c8-exposed coverage gaps in src/cli/commands/create.ts to 100% (pm-eifq)
• Close c8-exposed coverage gaps in src/cli/commands/contracts.ts and restore.ts to 100% (pm-dmuq)
• Close c8-exposed coverage gaps in src/cli/commands/history-redact.ts and normalize.ts to 100% (pm-byl1)
• Coverage to 100%: src/cli command handlers (group B — query, search, calendar, test, init, extension) (pm-7v9s)
• Coverage to 100%: packages, plugins, and docs examples (pm-6tch)

2026.6.13 - 2026-06-13

Changed

• Dedup private Levenshtein implementations onto shared OSA helper (pm-dzcx)

Fixed

• pm-mcp bin is dead on npm installs: main-module guard fails under symlinked argv[1] (silent exit 0, no JSON-RPC output) (pm-qtbc)
• pm validate --check-files misclassifies existing directories as deleted (GH-203, prune/auto-fix data-loss path) (pm-b1ni)
• Compact strict-create recovery duplicates missing fields under two keys (pm-3rjo)
• Claude Code plugin install spec drift: README says pm-cli@pm but plugin name is pm-claude (pm-m4bx)
• GH-209: successful pm mutations can exit 13 from unsettled top-level await (pm-1byt)

Other

• Ecosystem audit + GH-204..208/210 remediation session 2026-06-13 (pm-y7sc)
• Compact strict create recovery for agents (pm-tjvl)
• CI gap: plugin/package markdown pushed to main runs no functional workflow (pm-5909)

2026.6.12 - 2026-06-12

Added

• Add pm health 'locks' check: surface stale item-claim counts before gc is needed (pm-xo1n)
• pm validate metadata report grouped by item type (GH-172) (pm-pmyq)
• pm files/docs: standalone --note flag alongside --add (GH-170) (pm-pfnx)
• pm validate --auto-fix: apply safe remediations automatically (GH-179, GH-153 interactive part, GH-167 backfill part) (pm-c3sz)
• pm history-repair --all: bulk drift repair across streams (GH-171) (pm-9ftr)
• pm validate --check-files: classify stale linked paths (moved vs deleted) and offer --prune-missing (GH-184) (pm-0v2m)

Fixed

• Session 2026-06-11: validation auto-fix & self-repair PR (validate --auto-fix/--prune-missing/grouped metadata, history-repair --all, health locks, files/docs --note, plan --step accumulate, consent CI guard, completion drift) (pm-dhrp)
• Lifecycle subcommand flags duplicated on the parent extension/package command are silently dropped (commander hoists them) (pm-df9k)
• Telemetry first-run prompt CI guard is inverted: CI=true does not skip, only CI=false/0/no/off does (pm-0hx2)
• MCP pm_files discover/apply/discoveryNote params are declared but ignored by the files action handler (pm-wcaa)
• pm validate lifecycle: auto-fix for active items with closed/terminal parents (GH-168) (pm-8jss)
• pm plan create: repeated --step silently keeps only the last value instead of accumulating steps (pm-6mit)
• PR #200 review: batch validate prune-missing auto-fix removals (pm-60p0)

Other

• Refresh Sentry expected handled CLI classifier for 2026-06-11 dogfood CommandErrors (pm-lg9i)
• PR #200 review: contract and defensive hardening follow-up (pm-im0s)
• Shell completion drift: show-status missing from bash/zsh/fish schema subcommand lists (pm-6qi8)
• Milestone calendar_item_without_schedule warning should include actionable hint (GH-174) (pm-2cgu)

2026.6.11 - 2026-06-11

Added

• Add pm_schema and pm_config narrow MCP tools for workspace configuration via MCP (pm-v68d)
• MCP pm_list/pm_search: expose active filter summary in compact output so agents know what was applied (pm-rmjy)
• Add narrow pm_append MCP tool for agent log-seeding without pm_run passthrough (pm-7u9j)

Fixed

• GH-191: test --add command parser should accept quoted commands containing -- (pm-vcr2)

Other

• Contract schema golden-file must cover MCP tool inputSchema shapes — current snapshot only covers CLI flags (pm-4os2)

2026.6.10 - 2026-06-10

Added

• Combined PR: duplicate-aware close, parent fail-fast, id-only output, context/aggregate completion stats, robust test add/run (pm-z9e9)
• pm close --duplicate-of: structured duplicate tracking with auto-populated closure fields (GH-183, GH-160) (pm-xnkd)
• Embedding provider migration guide + pm reindex --migrate: automated full reindex on model/provider change (pm-wt0g)
• pm test --run selectors: --match / --only-index / --only-last (GH-194) (pm-p86h)
• pm context: per-epic completion stats + recently_created/unparented sections (GH-187, GH-182) (pm-ojpq)
• Incremental reindex --mode semantic --stale-only: skip already-up-to-date vectors (pm-o3nr)
• pm_max_version default-BLOCK should have a per-layer warn-only toggle in settings (pm-k5e8)
• Root --id-only flag: minimal mutation output (id+status) for agent automation loops (GH-195) (pm-esf6)
• pm aggregate --completion: closed/total ratio and completion_pct per group (GH-185) (pm-eaer)
• Extension teardown: per-deactivate timeout guard so a hanging deactivate() cannot block host shutdown/reload (pm-bujg)
• Add importer/exporter options arg and command-def examples to SDK.md (pm-btwe)
• pm list: include parent in default compact projection when set (GH-180) (pm-awfr)
• Add MCP pm_context, pm_contracts, pm_plan, pm_health integration tests (pm-8d00)
• Settings read cache: memoize readSettingsWithMetadata across the 3-5 reads per command (pm-2bn5)
• First-party exemplar package for registerCommand + registerFlags + registerParser (commands capability pattern) (pm-1js9)

Fixed

• Fix Windows Nightly smoke cleanup helper import (pm-uzty)
• GH-190: SDK locateItem should default idPrefix or throw explicit argument errors (pm-rjh9)
• GH-189: create --parent should fail fast on unresolved references (pm-p9hw)
• Harden history replay and compact diff against malformed patch entries (pm-kf5q)
• Telemetry queue max_attempts backlog health warning: surface items near retry exhaustion in pm health (pm-irc7)
• MCP server: request-scoped extension registries (process-global set/clear can race under concurrent native-action requests) (pm-bl6m)

Security

• Extension sandbox profiles are advisory-only — no runtime enforcement of declared permission boundaries (pm-pl53)
• Declare trusted=true, sandbox_profile, and permissions on all 9 first-party package manifests (pm-iljy)

Other

• Document pm-linked-test-adapters package in EXTENSIONS.md and TESTING.md (pm-yj8n)
• Close stale GH issues, clarify dedupe-audit docs, and bump @sentry/node (pm-utd6)
• Run verification matrix and temp-dir smoke for active cycle (pm-rav7)
• SDK author-ergonomics batch: extension-manifest JSON Schema, getWorkspaceContracts memoization, FlagDefinition type/value_type unification (pm-l0jd)
• Upgrade pm-changelog to 2026.6.9 and validate changelog fidelity (pm-kx7v)

2026.6.9 - 2026-06-09

Added

• PmPackageResourceKind is missing 'assets' and 'prompts' as canonical resource types (pm-z9ho)
• Extension API missing self-identity accessor: extensions cannot read their own name, layer, or version at activation (pm-qo36)
• registerItemFields/registerItemTypes: validate declared field type against known coercion kinds with did-you-mean (pm-oll8)
• Extension activation: no teardown/deactivation hook — extensions cannot clean up timers, connections, or state (pm-k1e4)

Fixed

• Extension FlagDefinition lacks 'list' and 'default' fields — extension-registered flags cannot match core comma-list contract (pm-ltbr)

Other

• SDK lacks assertRegisteredCommandOverride testing helper (coverage gap in testing.ts) (pm-aw7d)

2026.6.8 - 2026-06-08

Added

• MCP pm_health defaults to the compact summary projection for token-efficient agent health checks (pm-yjub)
• pm-changelog classifier mis-routes feature titles containing the word 'remove'/'delete' into the Removed section (pm-ybiz)
• list/search: trim default filters/projection/sorting/now trailer in compact/agent mode (pm-vhx6)
• Add schema show-status status inspection (pm-qpus)

Changed

• Remove dead code and dedupe pm-cli version readers into resolvePmCliVersion (pm-wrqk)

Fixed

• Fix inaccurate PR CI matrix description in CONTRIBUTING.md (pm-t73k)
• Fix: --path/PM_PATH did not discover .agents/pm under a project root (never-block dead-end) (pm-ryik)
• MCP ping method not handled — returns 'Unsupported MCP method' instead of empty response (pm-lold)
• MCP tools/call structuredContent.result is always present but isError path lacks it — inconsistent envelope (pm-l40h)
• MCP narrow tools silently drop top-level filter keys (pm_list {type:Task} returns unfiltered) (pm-jozc)
• CI smoke npx pack cleanup can fail with ENOTEMPTY (pm-i2xg)
• Fix: pm close/close-many hard-failed without a reason via a generic, non-actionable error (P0 never-block) (pm-g799)
• Document pm-changelog external repo dependency and pad-match fix in RELEASING.md (pm-97yv)
• Fix MCP tool-count doc drift (18/21 -> 22, add pm_copy) and lock the claude-plugin smoke to the live tools/list count (pm-7tvx)
• Drift-cache gc scope: pm gc --scope runtime should clear history-drift-cache.json (pm-7n8v)
• writeFileAtomic cross-device rename safety: handle EXDEV when tmp and target are on different mounts (pm-6vv6)
• list/search --tags hard-refuses (exit 2) while create --tag auto-corrects — accept --tags as a never-block alias (pm-6l17)
• MCP server serverInfo.version is hardcoded '1.0.0' — should reflect package.json version (pm-2nvw)

Security

• Pin CodeQL action refs to immutable SHAs in codeql.yml (pm-ji5c)

Other

• 2026-06-07 agent UX package ecosystem and path guardrail hardening (pm-yo3f)
• Ecosystem-wide PM living-context audit & forward-backlog rebuild (2026-06-07) (pm-8u2a)
• 2026-06-07 pm CLI ecosystem audit lanes (pm-xm98)
• Warn in pm health when server-advertised max telemetry schema version exceeds client version (pm-dfhp)
• ADR: Agent self-repair via a centralized remediation registry surfaced through pm health --json and pm validate --fix-hints (pm-cc04)
• ADR: Test-coverage governance — 100% V8 thresholds with a curated include/exclude allowlist, a tests/unit file-count cap, and pure-logic extraction into small core modules (pm-7sq6)

2026.6.7 - 2026-06-07

Added

• pm list --tree: recursive subtree rendering with indented hierarchy (pm-vbzc)
• Configurable vector store collection name (post-v0.1 adapter optimization) (pm-usw2)
• pm copy <id>: clone an item to a new ID with optional title override (pm-m4nn)
• Per-query hybrid weight override: pm search --semantic-weight (post-v0.1) (pm-cy8i)
• Configurable semantic corpus character limit (search.embedding_corpus_max_characters) (pm-cxdg)
• pm aggregate --sum/--avg: numeric aggregation over filtered items (pm-bvns)
• Advanced relevance tuning (post-v0.1): cross-encoder reranking + query expansion (pm-7tsx)
• pm-governance-audit: onWrite/onRead hooks exemplar (hooks capability) (pm-7m8p)
• pm history-compact: checkpoint-based history stream compaction (pm-3pbq)

Fixed

• Drift-scan cache can false-hit on mtime-preserving file copies (pm-up22)
• Track removal of TOON upstream bracket-bug workaround when upstream fix ships (pm-idnz)
• Search relevance evaluation harness (golden queries, nDCG) for regression detection (pm-22x2)

Security

• Harden afterCommand coverage and GitHub code-scanning visibility (pm-izid)

Other

• PR #123 review: make governance hook sidecar logging fail-open (pm-mzlu)
• Publish pm-github starter package as a community reference (credential-requiring pattern) (pm-zw0n)
• SDK testing helper for package manifest resource assertions (pm-xevy)
• Stabilize npx onboarding path for scoped pm package (pm-pgew)
• Config-driven optional close reason via governance.require_close_reason (pm-peyv)
• Package install fallback hints and extension collision plans (pm-e48i)
• Agent command compatibility and package command discovery (pm-7etc)
• SDK testing helper for vector store adapter registrations (pm-475h)
• Make list --ids repeatable for focused agent working-set refresh (pm-42tb)
• SDK testing helpers for schema package registrations (pm-01bm)

2026.6.6 - 2026-06-06

Added

• Add Claude Code rows to docs read-path and README start-here tables (pm-pwdx)
• pm history --diff: per-entry field-level before/after diffs (pm-puvn)
• Create ONBOARDING.md for new maintainers and first-time contributors (pm-oh5h)
• Add markdown broken-link check to the docs CI gate (pm-mp6c)
• Add pm stats --storage: aggregate history-stream metrics (pm-mnee)
• Add MCP protocol handshake tests (initialize + tools/list + unknown-tool error) (pm-kl11)
• Add narrow MCP tools pm_notes, pm_learnings, pm_deps (agent self-documentation + deps) (pm-hywv)
• Add pm gc --scope locks: sweep expired lock debris from crashed processes (pm-d70h)
• pm telemetry local-analytics subcommand (status/flush/stats/clear) (pm-6xdl)
• Add AGENTS.md/README workflow-update checkbox to the PR template (pm-0sqs)

Changed

• Export PM_TOOL_PARAMETERS_SCHEMA_VERSION constant and bind all assertion sites (pm-r9sz)
• Generate pm_run action-list description from PM_TOOL_ACTIONS to end prose/enum drift (pm-fd8n)

Fixed

• MCP TOOL_SCHEMA_BASE additionalProperties:true silently swallows typo'd top-level args (pm-qxwu)
• File-backed schema sections (types/statuses/fields/type_workflows) leak into settings.json on writeSettings (pm-haak)
• PRD/contract drift: reminders_weight and events_weight missing from search.tuning docs (pm-75du)
• MCP stdio server processes JSON-RPC lines concurrently → pipelined mutations on the same item lock-conflict (pm-3puw)

Other

• MCP & contract platform maturity PR (pm-5k4v): narrow tools pm_notes/pm_learnings/pm_deps + schema-base hardening + action-list drift-gen + schema-version constant + handshake tests (pm-at83)
• Document capture_level semantics for extension authors (pm-te9x)
• Telemetry schema versioning/negotiation preparation (pm-t4wb)
• History & storage observability: pm gc locks scope, pm history --diff before/after, pm stats --storage (pm-l709)
• Document the create vs mutateItem dual write-path contract (pm-k5r6)
• Drift-lock the .agents/plugins/marketplace.json (pm-local) manifest in the plugin contract test (pm-g3xl)
• Clean up stale closed tracker-item references in docs/ header lines (pm-e376)
• Contract schema golden-file snapshot gate in CI (pm-d6kq)
• Evaluate commander 15.0.0 major upgrade (current 14.0.3) (pm-7j8t)
• Document changelog classifier keyword routing for contributors (pm-5vsv)

2026.6.5 - 2026-06-05

Added

• pm list --updated-after/--created-after incremental date filters (pm-y138)
• Reusable external npm package ecosystem smoke harness (pm-vnjh)
• First-party hooks capability exemplar (lifecycle hook) for pm-izsi completion (pm-s40s)
• Add generic create/update setter for extension item fields (pm-qvdj)
• pm schema list / pm schema show: inspect registered custom and built-in types (pm-qq69)
• pm close-many: bulk-close matched items with shared reason and validate-close semantics (pm-i17g)
• Per-type workflow / allowed-transitions config (schema/workflows.json) (pm-f4r1)
• pm search --status filter (parity with pm list) (pm-ec4s)
• pm schema add-status: register custom statuses (complement to add-type) (pm-e77a)
• pm validate --fix-hints: machine-executable remediation commands per check (pm-6m3y)
• pm init --type-preset agile|ops|research: batch-register domain item types (pm-1lkm)
• pm update-many --ids: explicit ID-list filter for targeted bulk mutations (pm-1h99)
• Structured remediation map on pm health --json for all non-extension checks (pm-0hnu)

Changed

• 2026-06-02 commander SDK custom-field and extension-output hardening (pm-lwtx)

Fixed

• Auto Release 2026-06-01 tagged v2026.6.1 but npm publish never completed (latest npm = 2026.5.31) (pm-kcba)
• Sentry reliability gate blocks release on dogfood-generated expected CLI errors (brittle per-count + missing standup-export patterns) (pm-yohx)
• governance.create_default_type is not settable via pm config set (pm-jpwo)
• Fix GitHub #98 dependency --dep type parsing (pm-dlfq)
• Warn on global service and renderer override footguns (pm-5teq)

Removed

• pm schema remove-type: delete a custom type from types.json (pm-k8ik)

Other

• 2026-06-02 latest-main ecosystem dogfood and SDK review (pm-kddw)
• After-command hook affected item transition context (pm-qzv2)
• Agent context & bulk-ops primitives: incremental date filters, search --status, --ids targeting, close-many (pm-j2ig)
• Sentry gate expected handled CLI classifier refresh (pm-flbo)
• SDK extension hook context and manifest capability guardrails (pm-e9ut)
• Surface settings_read_invalid_schema warning proactively on affected commands (pm-7tcw)

2026.6.2 - 2026-06-02

Added

• pm-todos + pm-beads: migrate to registerImporter/registerExporter (importers capability exemplar) (pm-13bn)
• pm-search-advanced: register a built-in SearchProvider exemplar (search capability) (pm-bqpg)
• First-class importer/exporter registration: registerImporter/registerExporter accept command metadata (description/flags/intent/examples) (pm-7qjk)

Other

• 2026-06-01 package ecosystem SDK agent UX audit and hardening (pm-z0ip)
• 2026-05-31 late latest-main ecosystem dogfood and review closure (pm-etxf)

2026.6.1 - 2026-06-01

Added

• SDK ergonomics: package-safe error base, version negotiation, document PM_CLI_PACKAGE_ROOT (pm-oxyo)
• Declare pm_min_version in all 8 first-party package manifests (pm-nf2q)
• Extend SDK testing helpers to cover hooks, search providers, importers/exporters (pm-kfd8)
• Build package-first pm ecosystem and install command (pm-59gj)
• Extension manifest pm_max_version (upper compatibility bound) (pm-4gw6)

Changed

• Vector store: prune orphans on reindex + reset on embedding-model/dimension change (pm-xutw)
• Dedup create/update parsers + optional command-file splits (pm-8ehg)

Fixed

• Calendar: normalize recurrence exdates by instant + document count-window semantics (pm-qcsz)

Security

• ADR: Extension sandbox profiles are advisory governance attestations, not enforced isolation (pm-6ef3)

Other

• Ecosystem PM living-map audit & reorganization methodology (pm-knqw)
• Runtime-resolved shell completion for custom statuses/types via helper command (pm-q4zx)
• Lazy extension activation: defer import+activate until a command needs contributions (pm-5wb6)
• Ecosystem-wide PM living-context map: audit, ADRs, roadmap, and forward backlog (2026-05-31) (pm-w7f2)
• Verify living-map: ecosystem coverage gaps (pm-xmhn)
• ADR: Stable CLI exit-code contract (0 success, 1 generic, 2 usage, 3 not_found, 4 conflict, 5 dependency_failed) (pm-x1z3)
• ADR: Three-tier metadata cache (light scalars / bodies / collections) keyed by file stat (pm-vnie)
• ADR: Non-blocking background semantic refresh (detached worker + reindex lock) (pm-vizt)
• ADR: Two extension-authoring idioms: defineExtension (package mode) vs import-free JSDoc (extension-only) (pm-vb5a)
• Verify living-map: hierarchy, dependencies & ADR coverage (pm-uid0)
• ADR: Dependency-free settings validator (replaced zod on the hot path) (pm-u7xx)
• ADR: First-party packages ship hand-maintained .js alongside .ts (no per-package build) (pm-tsio)
• ADR: TOON as canonical item storage; JSON-Markdown is legacy read-only (pm-rvbt)
• Audit domain: MCP server, SDK & contracts (pm-rpc3)
• ADR: Hand-rolled dependency-free MCP server (JSON-RPC over stdio) (pm-pif3)
• ADR: Product vision & guiding principle — project management = context management (pm-oxq5)
• ADR: Governance presets (minimal/default/strict/custom) as the primary config surface (pm-ouvu)
• Audit domain: Docs, onboarding, release, changelog & CI (pm-obxz)
• Audit domain: Extensions, packages & SDK extension API (pm-n15j)
• ADR: Local-first telemetry with 'redacted' capture as the privileged default (pm-mplj)
• Audit domain: Telemetry, observability, Sentry, health/validate (pm-kxw0)
• ADR: Compact-by-default is the agent path at the MCP boundary (pm-ko1g)
• 2026-05-31 external package audit and agent contract hardening (pm-kd9n)
• ADR: Health checks are advisory vs blocking: telemetry_* never flips ok:false (pm-jezo)
• ADR: Startup-latency strategy (prebuilt JS, lazy per-command imports, external deps, no single bundle) (pm-irp1)
• ADR: Git-native filesystem is the database (one file per item; no server, daemon, or DB engine) (pm-i7i4)
• Audit domain: Core CLI command surface & item lifecycle (pm-hqka)
• ADR: Append-only JSONL history with SHA-256 hash chain (pm-hg0k)
• Audit domain: Search & semantic (keyword/semantic/hybrid, embeddings, vector stores) (pm-h7n6)
• Living-map verification & gap-closure pass (continuation, 2026-05-31) (pm-h31a)
• Verify living-map: dedup & definition quality (pm-f6rm)
• Governance test: enforce manifest pm_min_version and manifest_version on all first-party packages (pm-exrw)
• ADR: Date-based calendar versioning with daily automated release and manual same-day follow-ups (pm-ee1k)
• ADR: Expected-error classification keeps Sentry signal-to-noise high (pm-c8qa)
• ADR: Never-block agent UX: high-frequency aliases are executable bootstrap rewrites, not suggestion text (pm-bwlz)
• Audit domain: Storage, item-store, history, TOON, restore (pm-ar08)
• ADR: Config-driven runtime schema (4-file model) over hard-coded type/status/field registries (pm-a859)
• ADR: Plugin hybrid model: pm is the git-native store; the editor/agent panel is a live session view (pm-7c4t)
• ADR: CHANGELOG is auto-generated from closed items by pm-changelog; never hand-edited (pm-6san)
• ADR: Hybrid search = normalized linear interpolation with a configurable weight (pm-66ig)
• Audit domain: Config, schema, custom types & init (pm-4uxz)
• Refresh changelog after PR closeout merge (pm-2y28)
• ADR: Single-source contracts: cli-contracts.ts is the authoritative CLI+MCP+contracts surface (pm-2evy)
• ADR: LanceDB pure-JSON snapshot vector store (no native bindings) (pm-164t)
• ADR: Collision-checked random short IDs (configurable prefix + base36 token) (pm-12j1)

2026.5.31 - 2026-05-31

Added

• Non-blocking background search index refresh on mutations (pm-3ju0)

Changed

• Per-command code-splitting: lazy command-module imports drop the 943KB monolith + fast-glob from the read path (pm-t57d)

Fixed

• pm health ok:false from legacy unused 'index' required subdir (pm-yf31)
• Fix per-type default_status config was silently ignored at create (pm-y0gl)
• Fix slow/oversized local vector snapshot and mislabeled search fallback (pm-f58e)
• Calendar date math is UTC-only: ignores event.timezone and all-day semantics (pm-0l88)
• Fix Windows npm command resolution for extension package installs (pm-arax)

Other

• Make MCP status enum + shell completion runtime-resolved from schema (not hardcoded) (pm-jtdc)
• Calendar view/format did-you-mean + dependency and type-safety cleanup (pm-5oxq)
• Defer eager per-command startup work: completion flag-strings, MCP tool schema build, telemetry flush spawn (pm-3mal)
• 2026-05-30 package SDK dogfood audit and startup telemetry performance pass (pm-qmx3)

2026.5.30 - 2026-05-30

Added

• Semantic index not auto-refreshed on mutation: create then pm search --semantic misses the new item (stale index) (pm-bpaj)
• Reduce ESM module-resolution startup overhead (~85ms) via core bundling (pm-ss1d)

Fixed

• Calendar positional-date and impossible-deadline UX: pm calendar 2026-06-15 hard-errors; --deadline 2026-02-30 silently rolls to Mar 2 (pm-wr74)
• Split metadata cache into light + collections tiers to cut list hot-path JSON parse (pm-jd3v)
• create's schedule-less calendar hint suggests rejected --event pipe form (accepts CSV) — blocks agents (pm-8c2s)
• Suggestion-only command aliases (show/comment/note/view) still hard-fail as nonexistent_command instead of executing (pm-7by2)
• create rejects common type synonyms (Bug/bug, Change/change) instead of mapping to Issue/Chore (pm-4d1b)
• Semantic auto-defaults are all-or-nothing: one config leaf disables ALL defaults and hard-errors reindex (pm-407c)

Other

• CLI perf, simplification, and best-practice remediation (2026-05-27) (pm-th6y)

2026.5.29 - 2026-05-29

Added

• Calendar best-practice: honor timezone, surface Milestone/Meeting items, ICS export (pm-xzrx)
• Model-agnostic search: provider settable via pm config + docs + index staleness surfacing (pm-7ilo)

Changed

• Code-quality refactors: split runUpdate/runCreate, cli-contracts barrel, shared dedup helpers, drop dead exports (pm-1b96)

Fixed

• pm comments/notes/learnings --add HTML-escapes angle brackets in stored text (pm-ydkl)
• MCP pm_create/pm_update crashed with 'raw.trim is not a function' when priority was sent as a JSON number (pm-9r7z)
• pm update doesn't accept --expected/--actual aliases that pm close accepts (pm-1lws)

2026.5.28 - 2026-05-28

Fixed

• Minor UX/correctness: test --add wording, dep-kind vocab, same-command did-you-mean, plan materialize, close inline resolution, scaffold defineExtension (pm-fl0c)
• Agent-UX footguns: create-type silent mistype + token-bloat in validate/search output (pm-edge)

2026.5.27 - 2026-05-27

Added

• Bundle CLI with esbuild for sub-200ms startup (pm-gt82)
• Add pm config set positional value form and shorten the invalid config-key error (pm-mf4j)
• Add --no-changed-fields flag and compact MCP mutation output to drop the redundant changed_fields array (pm-ch59)
• Cut list/search latency: skip 4.9MB cache rewrite + drop bodies + onRead short-circuit (pm-4r5t)

Changed

• Split large command files exceeding 2000 LOC (pm-mbdu)
• Deduplicate item/metadata to record widening casts behind a shared toItemRecord helper (pm-p5if)

Fixed

• pm-changelog generator silently drops items the bundled @unbrained/pm-cli SDK cannot read (pm-hybj)
• Surface extension command handler error messages instead of opaque extension_command_handler_failed code (pm-zwl7)
• Fix Auto Release failure: build dist before pm-changelog generation runs (pm-yf8t)
• Calendar: improve positional view UX (PM-CLI-Z Sentry) (pm-nb68)
• Address pre-existing extension/SDK issues surfaced by PR #69 review (CodeRabbit) (pm-ll50)
• Handle concurrent project package installs without EEXIST (pm-hw6z)
• Repeated loose-mapped --tag flags silently keep only the last value (agent-unfriendly) (pm-cf1u)
• Improve unknown-option recovery with nearest, abbreviated, and cross-command flag suggestions plus list --sort aliases (pm-8nyc)
• pm health takes 8s and reports ok:false due to blocking telemetry flush to unreachable endpoint (pm-1lgy)

Security

• Add audited history-stream redaction command (pm-xk39)
• Latest CLI quality, SDK, telemetry, search, and calendar remediation (pm-rnpb)
• Harden extension install against path traversal and fill missing health/validate MCP schema props (pm-qhu4)

Other

• Deduplicate beads/todos index.ts package-runtime loader (install-safe mechanism needed) (pm-wwa7)
• Deduplicate Beads and Todos package adapter runtimes (pm-ybfj)
• Deduplicate bundled package runtime option parsing helpers (pm-y5u0)
• Code dedup: extract shared CLI parser blocks and consolidate item-record casts (pm-why9)
• Single-source extension capability and policy-surface contract lists (pm-w98k)
• Harden read-then-lock window uniformly across history-redact/restore/history-repair (pm-uer0)
• Docs hygiene: stop shipping PRD.md in npm package, dedupe PRD<->docs, slim CHANGELOG, reconcile marketplace.json (pm-rjgh)
• Dedupe history-redact + history-repair lock+ownership scaffolding (pm-kbm9)
• Deduplicate files/docs linked-resource command implementations (pm-jzf4)
• Code-quality & dead/duplicate code audit (2026-05-27) (pm-jvbt)
• Deduplicate Claude and Codex plugin MCP wrappers and smoke flows (pm-js0r)
• Release @unbrained/pm-cli 2026.5.24 (pm-jpfc)
• Extract shared legacy settings test fixtures (pm-ibyi)
• Extract reusable semantic HTTP mock fixtures (pm-gvk2)
• Manual real-world E2E dogfood of full pm CLI surface (2026-05-27) (pm-gqx7)
• Single-source Codex plugin docs tool surface (pm-d97r)
• Single-source extension governance policy defaults (pm-axd1)
• Unify plugin/MCP naming: pm-cli-claude→pm-claude, pm-cli-codex→pm-codex, pm-cli-native MCP→pm-mcp, packages @unbrained/pm-package-X→@unbrained/pm-X (pm-ash0)
• Generate full historical CHANGELOG.md through pm-changelog (pm-afl9)
• Calendar + SDK + vector-search + docs review (2026-05-27) (pm-a0w4)
• Agent-UX combined PR: compact mutation output (pm-ch59) + smarter unknown-flag recovery (pm-8nyc) (pm-70mi)
• Dogfood 2026-05-20 low-severity CLI polish backlog (config UX, init verbosity, help alias bloat, default-safety, doc/validator drift) (pm-5k2w)
• Verify and repair pm-changelog-generated main CHANGELOG release alignment (pm-5baq)
• Single-source guide-shell routing snippets across docs (pm-48vd)
• Single-source Plan workflow examples across plugin docs (pm-3y56)
• Keep large modules maintainable via barrel re-export splits + explicit uncovered allowlist (pm-3cbk)
• Single-source extension manifest and policy examples in docs (pm-2awd)
• Bump @sentry/node 10.53.1 to 10.54.0 (pm-0g2p)
• Single-source Claude plugin capability inventory docs (pm-0d0q)
• Create native Codex plugin for pm CLI (pm-0c9q)

2026.5.24 - 2026-05-24

Added

• pm schema add-type CLI + invalid-type error hint (pm-e1va) (pm-fy8o)
• Default-safety policy for destructive pm commands (gc keeps delete-by-default; add pm delete --dry-run) (pm-tobi)
• Config-driven custom item types: wire schema/types.json into runtime schema (pm-e1va)

Fixed

• pm update/create --test shares the B2 silent key-corruption (no cmd alias, no unknown-key rejection) (pm-swie)
• Linked test sandbox cleanup can fail with ENOTEMPTY (pm-u43m)
• Auto daily release silently skips releasable commits when CHANGELOG [Unreleased] is empty (pm-ot8r)
• pm update --blocked-by does not create a pm deps graph edge (pm-kyd6)
• Recover 16 unreadable TOON item files: strict decoder mis-parses bracketed tokens followed by a colon inside quoted text fields (pm-iqgj)
• pm-changelog extension fails on large tracker JSON (pm-bu50)

Removed

• CLI ergonomics polish: concise init, help alias collapse, named priorities, package install hints, starter templates, delete dry-run (pm-fuat)
• Deduplicate item-store mutation and delete lifecycle setup (pm-za3c)

Security

• Deduplicate path containment helpers across package and extension code (pm-dpzc)
• Update npm dependencies: minor version bumps (sentry/cli, toon, node types, vitest, tsx) (pm-a2g6)

Other

• history-repair command + legacy drift cleanup + replay dedup (pm-c3dx)
• Deduplicate templates package runtime and legacy command implementation (pm-ypqp)
• Deduplicate mutation author fallback resolution across commands (pm-xh0y)
• Deduplicate item-type definition normalization across settings and registry (pm-v798)
• Calendar agent ergonomics: equal start/end rejected; schedule-less Event items invisible (pm-uzmf)
• Deduplicate health and validate history-drift checks (pm-qsk8)
• Centralize audit ownership-conflict guidance (pm-ols6)
• Deduplicate recurrence weekday ordering helper (pm-max1)
• Extract shared extension fixture writer for tests (pm-j15d)
• Deduplicate runtime terminal-status checks across query commands (pm-i04b)
• Dogfood 2026-05-21 follow-ups: test --add key validation, semantic-fallback labeling, close active-children info, stale blocker on close (pm-fu5d)
• Extract shared test item factories for command specs (pm-eltf)
• Deduplicate lazy dynamic-import cache boilerplate in CLI registration (pm-c98b)
• Extract shared JSON error-envelope test assertions (pm-alqo)
• Deduplicate comments, notes, and learnings command stacks (pm-9y8q)
• Deduplicate front-matter key-order contract literals in tests (pm-8fx3)
• Extract shared temporary-directory lifecycle helpers for tests (pm-7tug)
• Install and validate pm-changelog package (pm-7811)
• Extract shared direct CLI spawn helper for integration tests (pm-401l)

2026.5.23 - 2026-05-23

Added

• pm health output stays large even with --brief/--skip flags; add a true one-line summary mode (pm-nbht)
• Reduce default verbosity of pm activity/history CLI output and add a compact mode to pm history (pm-3pbs)

Changed

• Remove dead code: command-aware.ts module, 5 orphaned exported functions, unused undici dependency (pm-b7do)

Fixed

• MCP pm_search defaults to full item bodies, blowing past agent token limits (pm-qrxs)
• pm create --blocked-by stores free-text metadata, not a dependency edge or blocked status (agent-confusing) (pm-orrl)
• Calendar: pm cal <view> --date crashes (positional view + any flag) (pm-l292)
• Agent UX: pm update --status closed, explicit semantic/hybrid search, and pm create <type> <title> must never block agents (pm-j1v7)
• Sentry PM-CLI-R/PM-CLI-S: undefined-status .trim and undefined-tags .join crashes (fixed in HEAD, mark resolvedInNextRelease) (pm-d7us)
• Dogfood 2026-05-20: CLI/agent-UX consistency fixes (append text forms, scope errors, --list parity, command typo suggestions) (pm-atsv)
• MCP pm_run activity defaults to verbose raw history-patch dump (token waste for agents) (pm-8jd3)
• Audited history-repair (re-anchor) command + clear legacy history drift so pm health is ok (pm-85hm)
• MCP pm_comments returns full comment history (no default limit) — token bloat on long-lived items (pm-6vfg)
• pm plan: materialize creates dependency cycle; decision/discovery/validation flag mismatch; --steps all unsupported (pm-6blp)

Security

• Harden secret-scan guardrail for GitHub token prefixes and local credential hygiene (pm-h4zb)

Other

• Session 2026-05-23: agent-UX + deps-graph integrity batch (multi-agent) (pm-uz25)
• Deduplicate history, restore, and redaction replay helpers (pm-pjs5)
• pm validate: ok:false on warn-only checks + dumps every item ID per field (pm-1nht)

2026.5.18 - 2026-05-18

Added

• pm claim --if-available (skip when held) — reduce 533 ownership_conflict events (pm-d4bo)
• pm list should default to --brief (full output via --full) to halve token cost (pm-b7sd)
• pm get/show: did-you-mean suggestions for unknown IDs (telemetry: 233 hits/30d) (pm-99x5)
• pm init footer + bundle calendar so cal/templates are discoverable (pm-8wwl)
• pm update with no fields should noop-succeed, not fail (telemetry: 128 hits/30d) (pm-7cup)
• Auto-route pm update --status closed --close-reason to pm close (telemetry: 248 hits/30d) (pm-12ib)
• Add pm plan list subcommand or did-you-mean to pm list --type Plan (pm-zpa5)
• Add agent-optimized pm plan command with linked dependencies (pm-v7dj)
• Drastically improve GitHub runner time and resource usage (free-tier only) (pm-tzwy)
• Add built-in Plan item type and storage/search integration (pm-jauk)
• Add --with-packages flag to pm init for one-shot package install (pm-hosd)
• Add pm init checks for AGENTS/CLAUDE pm workflow guidance (pm-7t04)

Fixed

• MCP pm_context crashes on caller-supplied projection flags (compact/brief/fields/includeBody) (pm-xy02)
• pm install <invalid> lacks did-you-mean for built-in aliases (pm-uuee)
• pm validate after fresh create is scary — downgrade default profile noise (pm-tylj)
• auto-release.yml workflow_dispatch silently overrides explicit push=false to true (pm-qa2h)
• pm contracts default returns 286 KB / 9612 lines — token catastrophe for agents (pm-p8j6)
• Sentry extension errors: cannot find module and activate failures (pm-p7av)
• pm install exits 0 on error (CRITICAL agent-blocker) (pm-naiv)
• CLI silently corrupts --tags '["a","b"]' JSON-array input (agent-unfriendly) (pm-klqo)
• Embedding timeout UX: improve ollama feedback for PM-CLI-A/9 (pm-ibp7)
• pm bare command silent exit 0 — no help shown (pm-8rj2)
• Investigate validate/health telemetry classification (71-74% failure rate) (pm-bzx3)
• Accept positional title argument in pm create (pm-7vm9)
• Fix CSV status filter and multi-status support in pm list (pm-ziv0)
• Clean project linked-file validation hygiene (pm-xz1p)
• pm install writes absolute-home-path into tracked .managed-extensions.json (pm-u83w)
• Perf: pm health takes 2.5s due to vectorization check (pm-tibg)
• MCP pm_update --comment string crashes with 'values.map is not a function' (pm-qeu1)
• Fix TOON array-of-objects continuation lines double-indent (pm-ps85)
• Default project scope for files/docs/tests and simplify scope UX (pm-ntnf)
• Telemetry queue tmp file orphan cleanup (83MB stale) (pm-nhka)
• CI: cache .agents/pm/search/lancedb + sentry release cache (pm-n28v)
• CI: smaller matrix on PRs, full matrix on main push only (pm-lkd7)
• Cache item body in metadata cache for fast keyword search (pm-jw36)
• Stop listing provided --flag as missing in error recovery bundle (pm-ixi1)
• CI: skip non-source jobs on docs-only changes (pm-iv1u)
• CI: combine pnpm test + pnpm test:coverage into single coverage run (pm-hpjd)
• pm test --add causes immediate history drift via null timeout_seconds (pm-er4q)
• Fix: ENOENT lstat in extension path operations (pm-bh13)
• Fix: localeCompare on undefined in sort comparators (pm-b9y1)
• Suppress benign extension_service_override_collision when calendar+guide-shell both bundled (pm-5u9z)
• MCP pm_list defaults to compact projection for agents (pm-2cqx)
• CI: split quality+smoke gates into a parallel job, share dist via artifact (pm-27yz)
• CI: cache vitest/.cache + tsbuildinfo for incremental builds + faster tests (pm-1pah)
• Add regression coverage for pm init agent guidance workflows (pm-0nia)

Other

• Dogfood + remediation session 13 (2026-05-17) (pm-vmeo)
• Smoke test after audit (pm-xmsn)
• 2026-05-03 latest PM CLI dogfood audit (pm-jrjt)
• Implement pm plan command family for agent harness workflows (pm-ze5g)
• Accept positional title for pm plan create like pm create does (pm-qbts)
• Accept pm init --yes alias for --defaults (pm-lwbr)
• Build idempotent AGENTS/CLAUDE pm guidance detector and writer (pm-g2nd)
• Release @unbrained/pm-cli after 2026.5.12 (pm-dc5d)
• Expose agent guidance init option in settings, contracts, help, and config (pm-b8rf)
• Expose Plan workflow in SDK, MCP, plugins, docs, and dogfood (pm-aqat)
• Wire pm init approval flow and declined guidance persistence (pm-8rjn)
• Implement pm guide docs and skills modernization (pm-4z9m)
• Merge Dependabot PRs: dev+prod deps and pnpm/action-setup (pm-2723)
• Opt CI JavaScript actions into Node 24 runtime (pm-1lef)
• Document pm init agent guidance context workflow (pm-1265)

2026.5.14 - 2026-05-14

Added

• Add reusable package-first temp-project dogfood script (pm-8l7d)
• Publish package gallery and marketplace metadata (pm-2b3l)

Changed

• Extract guide and completion UX into installable package (pm-zjuv)
• Extract calendar UX into installable pm package (pm-pznn)
• Extract governance audit surfaces into installable package (pm-ixt3)
• Define linked test runner package boundary (pm-7xk5)
• Extract advanced search and vectorization into installable pm package (pm-2rj1)
• Extract create templates into installable pm package (pm-2fgn)

Fixed

• Hybrid semantic reindex should emit bounded progress and deterministic JSON completion (pm-6zqq)
• Expose runtime command-path state in extension explore (pm-5mua)
• Sync package JS runtimes to public SDK surface (pm-2t78)

Other

• Decouple optional package actions from static SDK contracts (pm-wxxv)
• Design full pm package manifest and resource model (pm-t5ud)
• Migrate extension terminology to package-first docs and UX (pm-lwun)
• Expose package runtime helpers through public SDK (pm-hkql)
• Simplify command inputs for setup-agnostic agent workflows (pm-ej01)

2026.5.12 - 2026-05-12

Added

• Generalize pm package resources for project-management extensions (pm-su6i)
• Add package-first command aliases and pm install (pm-9x1c)

Fixed

• Suppress linked-test sandbox ENOENT seed races (pm-kk4t)

Other

• Extract bundled import/export customizations into installable pm packages (pm-hxp2)
• Run package-first CLI and SDK temp-project E2E (pm-gy6w)
• Classify barebone core boundary and package migration matrix (pm-c933)
• Implement pm upgrade for CLI, SDK, and packages (pm-bob2)
• Stop tracking runtime metadata cache (pm-4det)

2026.5.11 - 2026-05-11

Fixed

• Fix Claude plugin smoke marketplace contract (pm-sw92)
• Profile and optimize command startup latency (pm-m4ov)

Other

• Full-scope SDK and extension platform upgrade for app/CI integrations (pm-dhie)

2026.5.10 - 2026-05-10

Added

• Comments shorthand compatibility and docs parity (pm-cvwi)

Security

• 2026-05-09 latest-build full pm CLI dogfood audit and remediation (pm-m35h)

2026.5.6 - 2026-05-06

Fixed

• GitHub #20: resilient mixed-frontmatter item-format migration (pm-w5j7)
• GitHub #21: document resilient global git-install recovery (pm-drje)

Other

• Release @unbrained/pm-cli after 2026.5.4 (pm-0rjf)

2026.5.3-2 - 2026-05-04

Other

• Release @unbrained/pm-cli after 2026.5.2 (pm-0qv7)

2026.5.3 - 2026-05-03

Changed

• main.ts still has 4 extraction candidates (~1325 lines) (pm-sh6o)
• Code quality review - latest refactor surface (pm-zk79)
• Code quality + architecture review with targeted tests (pm-lvww)
• Duplicated parseLimit/parsePriority/parseType across 8+ command files (pm-hb8t)

Fixed

• Blocker: telemetry endpoint returning HTTP 521 (pm-ut35)
• UX: Telemetry shows 84 'No update flags provided' errors - improve guidance (pm-sh4x)
• PmCliError events leaking to Sentry via captureConsoleIntegration (pm-9iho)

Security

• Execute latest dogfood audit and targeted fixes (pm-mm3h)
• Security/privacy leakage gate - redact host/IP/token from tracked files (pm-m0fh)
• Pin GitHub Actions to immutable SHAs (pm-hfny)

Other

• 2026-05-03 Full PM CLI Re-Audit (Live Cycle) (pm-476d)
• 2026-05-02 Comprehensive PM CLI Audit (v2026.5.2) (pm-5zkg)
• Telemetry + Sentry analysis and remediation (pm-xwl6)
• Calendar + agent output audit (pm-wyvu)
• Decision: Re-audit final verification and system health summary (pm-tdo5)
• CI: make package test scripts sandbox-first (pm-swja)
• Extract shared HTTP fetch/timeout/error patterns from providers.ts and vector-stores.ts (pm-p0p1)
• SDK + extension platform audit and ergonomics (pm-lvea)
• Dogfood full E2E lifecycle in temp sandbox (pm-g4zb)
• Performance baseline: list-open reads all 636 items front-matter on every invocation (pm-f6wr)
• Decision: v2026.5.2 Audit Results - System Healthy (pm-dmam)
• Dogfood lifecycle matrix in temp project (pm-cu50)
• Search + Calendar + SDK deep validation (pm-937o)
• main.ts exceeds 5000+ lines - assess decomposition into per-command registration modules (pm-6c3h)
• Search/vector/auto-indexing deep audit (critical path) (pm-4u2e)
• CI/CD + telemetry/Sentry client re-audit (pm-44hv)
• Live remote infra + Sentry SaaS analysis (pm-2o82)
• CI/CD hardening sweep - workflows + release scripts (pm-0kd4)

2026.5.2 - 2026-05-02

Added

• SDK: Export ItemFrontMatter and ItemDocument types (pm-slul)
• Agent-optimized documentation structure (pm-r9gu)
• Feature: Core commands verified - all 10 types and lifecycle (pm-qwe2)
• Feature: Extensibility architecture verified - governance, custom types, agent UX (pm-oe33)
• Add --compact mode to pm activity for agent-friendly condensed output (pm-ne67)
• Add vector dimension mismatch warning counter to LanceDB queries (pm-k213)
• Performance: Parallelize listAllFrontMatter I/O (pm-hiji)
• Architecture: Decompose extension loader types (pm-f9s0)
• Performance: list/filter operations scan all 625+ item files on each invocation (pm-cd2f)
• Feature: SDK exports complete with 78 public symbols (pm-92s0)
• Docs: Add practical SDK extension examples (pm-7k9o)
• Code Quality: Extract shared primitives module (pm-5na9)
• Feature: Calendar fully functional with recurrence expansion (pm-409c)
• Audit latest CLI, SDK, calendar, and telemetry workflows (pm-3fti)
• Agent UX: Add --brief output mode and context suggestions (pm-32si)
• Feature: Telemetry pipeline verified end-to-end (pm-0kjv)

Fixed

• pm cal --include events|scheduled expands recurring events without default cap (pm-vg5h)
• pm health ok:false for normal telemetry queue draining is non-actionable noise (pm-gmnh)
• Calendar recurring event line has redundant double-title (item title repeated in event title field) (pm-b1pd)
• Telemetry queue timeout: 21 events stuck with flush timeout (pm-sgmb)
• Telemetry: Fix queue bloat and move flush to background (pm-sgko)
• SDK: bundled extensions use internal imports instead of @unbrained/pm-cli/sdk (pm-qfuq)
• Telemetry queue oversized-event pruning not applied during flush phase (regression) (pm-on3q)
• Issue: Telemetry queue bloat from oversized result_summary payloads (pm-ntr0)
• Calendar --include scheduled alias missing (calendar summary uses 'scheduled' but filter requires 'events') (pm-itb0)
• Search: Fix cosine similarity with L2 normalization (pm-h2pi)
• Project tracker validation hygiene warnings remain (pm-e0b5)
• pm templates bare command shows empty output (should list templates) (pm-dc2y)
• pm files --add bare path fails with misleading error (scope implied required) (pm-8r2r)
• Code duplication: toErrorMessage and toNonEmptyString across 5+ files (pm-540l)
• Priority --priority error message missing 0..4 range and semantic labels (pm-1h7w)

Removed

• Remove 15 dead root-level facade re-export files (pm-l9j6)

Security

• Documentation overhaul and public docs safety (pm-3042)
• 2026-05-02 Full PM CLI Audit: Build Fix, Security, Performance, Telemetry (pm-nnhi)
• 2026-05-02 Full PM CLI Audit Phase 2: Dead Code Removal, Security Enhancement, Sentry Optimization (pm-kkmo)
• Chore: 2026-05-02 Phase 3 Audit - IP scrub, dogfood, analysis tooling (pm-2326)
• Pin release dependency ranges for Dependabot hygiene (pm-q71q)
• Enhance check-secrets.mjs with private IP detection rule (pm-daft)
• Rewrite README and public documentation (pm-1sb2)

Other

• Verify remote telemetry stack receives events and data flows to [redacted_monitoring_ui] (pm-g8gj)
• 2026-05-01 Full PM CLI Audit Implementation (pm-twpc)
• 2026-05-02 Comprehensive PM CLI Audit (pm-rrjv)
• 2026-05-01 Full PM CLI Dogfood Audit v2 (pm-2eb3)
• 2026-04-30 Full PM CLI Dogfood Audit (pm-23me)
• 2026-05-02 Full Audit: All Systems Verified (pm-ss8d)
• Lower Sentry tracesSampleRate from 1.0 to 0.2 for free plan quota (pm-wvhs)
• Chore: Prune stuck telemetry queue entries (pm-wrbo)
• Decision: Cap telemetry result_summary payload size (pm-q9yt)
• Sentry CLI token needs broader scopes for issue analysis (pm-q4jp)
• Dead code: root-level facade re-export shims unused (pm-nr8k)
• Decision: 2026-05-02 Comprehensive Audit Results (pm-mve5)
• Telemetry: Backfill legacy source_context (pm-dqer)
• Telemetry: Create Grafana dashboard (pm-6js7)
• Release @unbrained/pm-cli 2026.5.2 (pm-5jw8)
• Docs: Create telemetry stack runbook (pm-2lbp)

2026.5.1-2 - 2026-05-01

Fixed

• Stabilize post-release cross-platform CI tests (pm-7d3m)

Other

• Release @unbrained/pm-cli after 2026.3.12 (pm-x6ni)

2026.5.1 - 2026-05-01

Added

• Add scoped audit override mode for pm update metadata mutations (pm-umhv)
• Add opt-in runtime probe mode for extension manage parity (pm-p0ij)
• Harden entry and add input resilience (pm-nhgt)
• Governance sweep 2026-04-03 net-new remediation (pm-r7t2)
• Add pm version and source classification to telemetry payloads (pm-3dd9)
• List command large-output ergonomics (pm-a4z3)
• Activate semantic defaults via local Ollama runtime detection (pm-zvn2)
• Add dependency mutation command for existing items (pm-zdec)
• Full registration runtime wiring (pm-zd6y)
• Add test-result tracking settings and config policy (pm-z9k7)
• Automatic migration and legacy format gate (pm-z8bl)
• Add create/update reminder flags and mutation paths (pm-ysgr)
• Add include-body support across list variants (pm-ykib)
• Add TOON migration tests docs and verification (pm-ybpq)
• Narrow contracts --command output by default and add projection modes (pm-xlzl)
• Add dependency visualization command (pm deps) (pm-x85o)
• Configurable item type registry (settings + extensions) (pm-x2k0)
• Strict skipped-test policy and linked-test assertion semantics (pm-wtq6)
• Add extension project scaffold command or template (pm-wsui)
• Feature: claim takeover on non-terminal items (pm-w9w4)
• Add governance normalize command with dry-run and apply modes (pm-vi2v)
• List parent filtering and get recovery guidance (pm-v7o7)
• Add notes and learnings command parity (pm-v1s1)
• Command integration tests and docs for TOON storage (pm-u919)
• Calendar command with markdown default and multi-view rendering (pm-tuhf)
• Compatibility docs and verification hardening (pm-tob5)
• Command-Aware Human Output Redesign (pm-t2hj)
• Remove none token semantics across command surfaces (pm-rl4e)
• Phase 2 docs, migration guidance, and release verification (pm-r9nf)
• Phase 2 pluggable core service kernel (pm-qlo0)
• Feature: SDK & Extension System Audit - Comprehensive (pm-qdha)
• Search UX and projection controls (pm-qb71)
• Stdin and PTY fail-safe behavior (pm-olxl)
• SDK publishing and stability contract (pm-oga6)
• Add AGENTS rule to check existing pm items before creating new ones (pm-o5uw)
• Add compact/full/fields search output controls with compact default (pm-nrxm)
• Add files discovery subcommand for referenced paths (pm-n2ts)
• Feature: update close_reason lifecycle integrity (pm-m4vu)
• Implement deterministic guard for ambiguous create log seeds (pm-m3mf)
• Add governance batch-mutation mode with explicit ownership override planning (pm-lwps)
• Implement flexible deadline/date parser behavior (pm-lau3)
• Config key discovery and export actions (pm-kslz)
• Implement missing-history stream policy and restore fallback (pm-kb21)
• Phase 2 parser and command-contract override engine (pm-k1zw)
• Implement governance query controls from 2026-04-06 issue report (pm-jqgc)
• Feature: Telemetry Pipeline Audit - Fully Operational (pm-jkip)
• Issue1: validate check-files full tracked scan mode (pm-j371)
• Help System Redesign Across All Commands (pm-j162)
• Implement context command runtime and surfaces (pm-iyqf)
• Add dependency-cycle diagnostics to pm validate lifecycle checks (pm-i4ef)
• Docs, Contracts, and Verification Hardening (pm-i0iy)
• Add option-policy schema and registry resolution (pm-gu1m)
• Validation command and close-time metadata checks (pm-gtdx)
• Implement managed extension state and lifecycle health surfaces (pm-grst)
• Dedicated extension doctor diagnostics surface (pm-gm9y)
• Support pm update body end-to-end (pm-ghha)
• Structured Error Guidance and Diagnostics (pm-frk8)
• Add event and recurrence schema normalization (pm-f0v0)
• Add calendar --full-period option and clarify period boundary wording (pm-euh6)
• Add create/update event and recurrence mutation flags (pm-enar)
• Background test service parity and release verification (pm-elsh)
• Issue2 Feature: Run-level env controls and shared-host-safe flags (pm-ec5o)
• Flexible parser and stdin ingestion foundation (pm-e7fd)
• Add files/docs repeated-add regressions and update flag guidance (pm-e0ab)
• Extend pm validate with low-signal metadata quality checks (pm-dw5s)
• Implement agent-first help/schema/error surfaces (pm-dqqa)
• External follow-up: add focused extension diagnostics triage summaries (pm-doek)
• Issue2 Feature: Per-linked-test env directives (pm-dlvv)
• Analyze persisted telemetry and add remote analysis skill (pm-cakn)
• Persistent reminder item fields and CLI mutation support (pm-c877)
• Linked-test sandbox project/global extension parity (pm-bkvx)
• Add deterministic linked-test replacement mode for update test mutations (pm-bjpo)
• Background linked-test orchestration and run management (pm-bi0z)
• Expand aggregate group-by to support priority, status, assignee, tags (pm-bhhe)
• Issue3 Feature: Extract PM-id references from linked commands (pm-bf54)
• Required-option guidance and docs parity (pm-b3id)
• Bulk comments audit query surface (pm-ayyt)
• Exit/output and subprocess runtime hardening (pm-axlr)
• Stability regressions and update/file UX guidance hardening (pm-ap8l)
• Core command-dispatch override engine (pm-al0h)
• Issue5: comments audit append policy path (pm-ahq1)
• Extend SDK contracts and Pi wrapper for extension lifecycle actions (pm-9ajy)
• Phase 2 preflight and lifecycle interception engine (pm-977j)
• Add history missing-stream policy setting and config support (pm-8wnm)
• Clarify ownership conflict guidance for force overrides (pm-8sgf)
• Calendar occurrence engine and advanced view filtering (pm-8m6s)
• Add advanced event filters and bounded recurrence controls (pm-8kxm)
• Linked-test PM context parity controls and mismatch guardrails (pm-8izv)
• Sunset pm install command and migrate to extension manager installs (pm-8a2s)
• Feature: comments force guidance parity (pm-7y8q)
• Health history drift detection (pm-7vr9)
• Automate duplicate-cluster detection and canonical mapping report (pm-7lum)
• Feature: Core Commands Audit - All Passing (pm-7kiy)
• Feature: Calendar Subsystem Audit - All Passing (pm-7k60)
• Implement pm extension lifecycle command surface (pm-7ghv)
• Add reusable item templates for pm create (pm-780f)
• Add lazy dynamic tag completion with optional eager expansion (pm-6qnu)
• Issue3: files add stable append diff mode (pm-6jps)
• Add tests and completion coverage for include-body list flag (pm-6e0p)
• Implement CLI telemetry consent and runtime pipeline (pm-5v5w)
• Add extension adopt workflow for unmanaged extensions (pm-5dia)
• Dual-format item codec and storage support (pm-5cbm)
• Policy-driven option controls for create/update (pm-5bwo)
• Wave 8/9: add test-all limit/offset blast-radius controls (pm-5a4f)
• Extension help and contracts runtime introspection (pm-4bhw)
• Enforce command-required linked tests at mutation time (pm-44iu)
• Issue4: create strict vs progressive policy mode (pm-431e)
• Add glob-based linked artifact additions for files/docs (pm-3eu2)
• Health vectorization status and targeted refresh (pm-3ebr)
• Add extension registration support for custom item types/options (pm-37pj)
• Add telemetry runtime diagnostics to pm health (pm-300m)
• Implement extension source resolver and installer engine (pm-2poj)
• Extended schema fields v1.1 - parent, reviewer, risk, sprint, release (pm-2p6q)
• Health optional directory strictness and compatibility (pm-2i0i)
• 2026-04-25 full dogfood audit remediation wave (pm-2hrt)
• Dynamic type integration across CLI, storage, and completion (pm-277p)
• Canonical status alias normalization across CLI surfaces (pm-1r6p)
• Configurable test-result tracking on PM items (pm-16f4)
• Agent integration and docs hardening for calendar/reminders (pm-122q)
• Phase 2 SDK v2 contracts with backward-compat adapters (pm-0u1y)
• Add activity filtering and stream mode for large program automation (pm-0g7a)
• Event and recurrence schema with mutation contracts (pm-0ab3)
• Add --parent filter support for list and list-* commands (pm-08zg)
• Calendar parity integrations and release hardening (pm-02gd)

Changed

• Update-many: improve error message when no mutation flags provided (pm-twtu)
• Update body backfill normalization parity (pm-ihfm)
• Parser update: support +m and flexible date strings (pm-y8a8)
• Implement atomic dependency replacement mode for pm update (pm-tixl)
• Improve update-command close and audit-owner failure guidance from telemetry (pm-syt7)
• Update completion and Pi wrapper for calendar/reminder support (pm-qze9)
• T5: Update docs for terminal compatibility guarantees (pm-qkva)
• Update docs and release evidence for default Ollama semantic behavior (pm-ptu0)
• Update docs and verify status alias release readiness (pm-posc)
• Implement pm update-many with dry-run checkpoints and rollback (pm-lf6s)
• Document update body support and ship verification evidence (pm-ipm8)
• Align update body contracts completion and regressions (pm-ha5a)
• Task: implement update close_reason flag and reopen auto-clear (pm-g8jp)
• Wire update body runtime mutation path (pm-eszd)
• Error2: Refactor commander usage mapping and dedupe error output (pm-eonv)
• Update linked-test regressions docs and verification evidence (pm-dk0a)
• Implement explicit clear/unassigned semantics and remove none token behavior (pm-d7id)
• Enforce option policies in create/update and help errors (pm-co62)
• Improve required option error/help guidance with examples (pm-bzyr)
• C3: Update docs and release notes for comments UX (pm-bx5r)
• Update docs and changelog for six audit findings (pm-9eaz)
• Update completion and Pi wrapper for event recurrence flags (pm-5hbj)
• Phase 2: update extension architecture and migration docs (pm-4epk)
• Align update-many status mutation support with help/contracts (pm-3cx8)
• Update docs and finalize calendar/reminder release changes (pm-2v01)
• Publish governance refactor report (2026-04-04) (pm-2r70)
• T2: Refactor CLI error exits to graceful exitCode flow (pm-1119)

Fixed

• Templates command: document correct invocation syntax (positional vs --name) (pm-6y6i)
• Validate UUID fields at telemetry ingestion boundary (pm-vhdc)
• Fix Grafana RabbitMQ queue panel metric selector mismatch (pm-r9ei)
• Implement local telemetry queue retention_days TTL cleanup (pm-pxx0)
• Auto-migrate previous-version trackers on first mutation (pm-yvwt)
• Cross-command regression verification for date parsing expansion (pm-x6l7)
• Allow unquoted multi-word search queries (pm-v6ob)
• Expand regression and release-readiness tests for calendar/reminders (pm-tyq3)
• Terminal compatibility regression suite and docs parity (pm-t6f7)
• Fix cross-platform CI regressions surfaced by GitHub checks (pm-skyg)
• Document resilient input formats and lock regression coverage (pm-s9hl)
• Ship regression tests docs and verification evidence (pm-r9dy)
• Regression and release hardening (pm-qwp7)
• Fix LanceDB vector dimension mismatch blocking default search (pm-oyt8)
• Replace invalid-id echo in get not-found guidance (pm-opbo)
• Include active extension commands/actions in contracts output (pm-nnfc)
• SDK starter example leaves extension health warning (pm-mwiz)
• Align default item types with Decision tracking guidance (pm-mpmv)
• Fix validate --check-files false-positive on linked project paths (pm-m9tv)
• Clarify strict create empty repeatable semantics (pm-k8i0)
• C2: Add comments shorthand regression coverage (pm-k0mr)
• Test1: Expand regression coverage for help/error/output UX (pm-jfpf)
• Fix integration test: health check list missing telemetry entry (pm-hb6x)
• Remove TOON front_matter wrapper from item files (pm-h3tp)
• Enforce telemetry capture_level setting in runtime event collection (pm-gusd)
• T4: Add terminal compatibility regression coverage (pm-gh7d)
• Reject undefined placeholder IDs in parent/dependency inputs (pm-g9yi)
• Expose extension command schema details in runtime help (pm-ek2h)
• Align templates-save Pi contracts with supported CLI flags (pm-eg0a)
• Fix pm test run exit semantics for failed linked tests (pm-c1bn)
• Strengthen SDK typing for extension registration contracts (pm-bqg4)
• Investigate search command latency from persisted telemetry (pm-bhmu)
• Add regression coverage for Ollama-backed semantic defaults (pm-9k33)
• Calendar: allow --full-period for agenda view or improve error message (pm-8qpc)
• Fix parser overrides for core commands without positional args (pm-7jkm)
• Linked-test PM command context can drift from workspace dataset (pm-6pij)
• Phase 2: parser override regression and docs coverage (pm-6024)
• Expand recurrence regression and runtime contract tests (pm-5xih)
• E1: Expand override and no-extension regression matrix (pm-5chf)
• Clarify or harden SDK import resolution for local extension installs (pm-1etl)
• Context blocked-fallback test uses date-sensitive default deadline (pm-0xhj)
• Add status alias regression tests (pm-0kga)

Removed

• Extend restore to recover missing or deleted item files from history (pm-g6qd)

Security

• Remediate open GitHub findings and recurring checks (pm-i7w2)
• Track GitHub Dependabot alert #26 for undici (GHSA-v9p9-hfj2-hcw8) (pm-ylg3)
• Track GitHub Dependabot alert #24 for undici (GHSA-2mjp-6q6p-2qxm) (pm-x4sy)
• Track GitHub Dependabot alert #25 for undici (GHSA-vrm6-8vpv-qv8q) (pm-s5vv)
• Track GitHub Dependabot alert #27 for undici (GHSA-4992-7rv2-5pvq) (pm-02c4)
• Issue: Private IP address in committed pm task files (pm-xk8b)
• Track GitHub Dependabot alert #8 for undici (GHSA-wqq4-5wpv-mx2g) (pm-v6vi)
• Track GitHub Dependabot alert #11 for undici (GHSA-9qxr-qj54-h672) (pm-tl4d)
• Track GitHub Dependabot alert #19 for undici (GHSA-f269-vfmq-vjvj) (pm-rb9v)
• Ignore local .env files for telemetry/security operations (pm-qgvj)
• Track GitHub Dependabot alert #12 for undici (GHSA-cxrh-j4jr-qwg3) (pm-pagj)
• Track GitHub Dependabot alert #5 for fast-json-patch (GHSA-8gh8-hqwg-xf34) (pm-pacx)
• Track GitHub Dependabot alert #1 for undici (GHSA-3cvr-822r-rqcc) (pm-ncbe)
• Track GitHub Dependabot alert #10 for undici (GHSA-m4v8-wqvr-p9f7) (pm-ipul)
• Track GitHub Dependabot alert #22 for undici (GHSA-vrm6-8vpv-qv8q) (pm-i1rm)
• Track GitHub Dependabot alert #4 for undici (GHSA-f772-66g8-q5h3) (pm-eu59)
• Track GitHub Dependabot alert #9 for undici (GHSA-3787-6prv-h9w3) (pm-d3i5)
• Track GitHub Dependabot alert #21 for undici (GHSA-4992-7rv2-5pvq) (pm-cg7l)
• Track GitHub Dependabot alert #3 for undici (GHSA-8qr4-xgw6-wmr3) (pm-bv2c)
• Track GitHub Dependabot alert #6 for undici (GHSA-r6ch-mqf9-qc9w) (pm-8m72)
• Track GitHub Dependabot alert #2 for undici (GHSA-q768-x9m6-m9qp) (pm-5p3z)
• Track GitHub Dependabot alert #29 for picomatch (GHSA-3v7f-55p6-f55p) (pm-5e88)
• Track GitHub Dependabot alert #23 for undici (GHSA-v9p9-hfj2-hcw8) (pm-53q4)
• Track GitHub Dependabot alert #13 for undici (GHSA-g9mf-h72j-4rw9) (pm-51y8)
• Track GitHub Dependabot alert #7 for zod (GHSA-m95q-7qp3-xv42) (pm-4ydh)
• D2: Update compatibility and security/trust guidance (pm-3949)
• Documentation, migration, and safety posture (pm-31fj)
• Track GitHub Dependabot alert #18 for undici (GHSA-2mjp-6q6p-2qxm) (pm-10no)
• Track GitHub Dependabot alert #20 for undici (GHSA-phc3-fgpg-7m6h) (pm-090w)

Other

• 2026-04-26 Comprehensive PM CLI Dogfood Audit - Full Results (pm-z87r)
• Run weekly GitHub findings review (pm-lou4)
• Core commands audit: full CRUD lifecycle verified with all item types (pm-ewxk)
• Extension system audit: install/manage/doctor/activate lifecycle fully working (pm-3s52)
• Implement search argument and projection mode changes (pm-0nxf)
• Health drift and vectorization integrity (pm-1hkq)
• TOON item storage migration (pm-bckz)
• History stream resilience and restore recovery hardening (pm-ofh9)
• Agent-optimized calendar and reminders (pm-qh3p)
• Calendar parity phase 2: events and recurrence (pm-vdrn)
• Configurable item types and required-option UX (pm-r15d)
• Auto-enable semantic search when local Ollama is available (pm-67uh)
• Agent context command ( / ) (pm-abhj)
• Linked-test parity and runnable command enforcement (pm-mf5z)
• Background linked-test service and item result tracking (pm-lm0j)
• Extension lifecycle manager and SDK parity rollout (pm-m9jc)
• Full Override SDK + Extensions Platform (pm-x395)
• Universal terminal compatibility hardening (pm-mudv)
• Deadline/date parsing compatibility hardening (pm-va6e)
• Status alias compatibility hardening (pm-g6a2)
• Configurable option policies for core commands (pm-00yy)
• List JSON Body Projection Contract (pm-0lbm)
• Agent-friendly comments command UX hardening (pm-v3g3)
• Agent-First CLI UX v3 follow-up (pm-pfn8)
• CLI UX and Integrity Hardening (pm-hp31)
• CLI UX Overhaul: Help, Errors, and Output (pm-izbd)
• Issue2: Shared-host linked-test determinism (pm-9dp3)
• Issue3: Validate stale PM-id command references (pm-br88)
• External audit Issue1 follow-up: log-seed ambiguity guard (pm-pb0g)
• External audit follow-up: linked-test evidence and extension diagnostics (pm-5z9r)
• External audit follow-up: validation and large-output ergonomics (pm-qfg8)
• External audit follow-up: unresolved UX and dependency visualization gaps (pm-iswo)
• External audit issue remediation and compatibility hardening (pm-my6o)
• External issue report remediation 2026-04-05 (pm-gt8u)
• Telemetry and observability rollout (pm-lnq3)
• PM CLI governance and documentation overhaul (pm-wtsp)
• Continuous governance automation and policy enforcement (pm-5rjn)
• Epic: 2026-04-28 Full PM CLI Dogfood Audit (pm-wg1d)
• PM CLI 2026-04-06 audit findings remediation (pm-o7be)
• Execute telemetry + observability rollout implementation (pm-ny6y)
• 2026-04-26 comprehensive dogfood audit stabilization (pm-mb4n)
• Backfill telemetry documentation files referenced in tracker links (pm-35wb)
• Track open Dependabot PR #14 (pm-0jpx)
• Make lifecycle validate patterns configurable (pm-urxb)
• Differentiate pm list (active-only) from pm list-all (all items) (pm-zzt1)
• Document and verify health drift/vectorization changes (pm-yo5m)
• External audit follow-up docs sync and verification gate (pm-ykgu)
• Ship1: Full verification, closure evidence, commit, and push (pm-y76e)
• Implement Issue3 files stable-append mutation mode (pm-xv39)
• GC safety ergonomics: dry-run and scoped cleanup (pm-xrm7)
• Governance standards alignment follow-up 2026-04-04 (pm-xjf9)
• Generate shell completion flags from command contracts (pm-xhot)
• Output1: Implement command-aware non-JSON result summaries (pm-x3fh)
• Implement health history drift diagnostics (pm-x0vj)
• Issue3 Task: Contracts Pi docs and tests parity (pm-wvr0)
• Implement Ollama-aware semantic default resolution in runtime (pm-wn3r)
• Enforce command-required linked test mutations (pm-wn34)
• Implement comments-audit command with filters/latest (pm-w1j3)
• Implement include-body retrieval in list command pipeline (pm-vsux)
• Implement PM-context parity mode and mismatch metadata for linked tests (pm-vrsn)
• Help1: Centralize help composer and command narratives (pm-vf7n)
• Implement Issue4 create progressive policy mode (pm-v7aw)
• Implement health vectorization targeted refresh (pm-v48k)
• Decision: PM CLI audit confirms production readiness (pm-unbq)
• Track open Dependabot PR #9 (pm-u4hy)
• Document recurrence features and finalize release evidence (pm-tytr)
• B3: Executable extension migration lifecycle (pm-twpm)
• Sync docs/contracts/wrapper parity for unresolved external audit additions (pm-tcx8)
• Implement health optional-directory defaults and strict mode (pm-t7xl)
• A2: Core override precedence and collision diagnostics (pm-t6xf)
• B1: Wire registerItemFields into runtime validation (pm-t0yd)
• Implement extension help and contracts runtime integration (pm-sucq)
• Phase 2: implement extension preflight override pipeline (pm-sh14)
• Implement automatic migration and mutation gate (pm-s0ne)
• Support type-aware storage routing and safe type moves (pm-rv63)
• E2: Final verification and closure evidence (pm-rl7j)
• T6: Run full verification, close items, and ship (pm-r4t0)
• Drive repository coverage gate back to 100 percent (pm-r28k)
• Implement sandbox seeding for project/global extension parity (pm-qtvv)
• SDK docs: document cli-contracts exports and extension capability requirements (pm-qrxb)
• M5 follow-up: validate extension registration handler types (pm-qkx0)
• Docs1: Refresh README/PRD/architecture/extensions/changelog (pm-qhcw)
• Implement centralized status alias normalization (pm-ptal)
• M4: Keyword indexing and search command (pm-pmd)
• M2: RFC6902 patch generation per mutation (pm-p9z)
• Follow-up: expand built-in item types for calendar-native work (pm-p5q3)
• A3: Hook context parity and lifecycle symmetry (pm-osk5)
• Implement background start paths and test-runs command surface (pm-ormq)
• Implement dual-format codec and store lookup (pm-oex4)
• M5: Built-in beads import extension (pm-odt)
• Consolidate 2026-04-25 dogfood audit evidence and tracker links (pm-odcr)
• Phase 2: compatibility adapters and migration diagnostics (pm-ngdf)
• Phase 2: wire parser override contracts in runtime (pm-nfii)
• Track open Dependabot PR #7 (pm-n8w4)
• Wave 8/9: restore replay patch compatibility and diagnostics (pm-n5cw)
• Release @unbrained/pm-cli 2026.3.12 (pm-lz4m)
• Implement tolerant entry parser and stdin token utility (pm-luay)
• Phase 2: integrate service overrides into core modules (pm-leol)
• Code/test/docs for create log-seed ambiguity guard (pm-l5tr)
• C1: Publish explicit extension SDK exports (pm-l16r)
• Implement Issue1 validate scan-mode and candidate totals (pm-kshe)
• Follow-up: enhance calendar UX for agents and LLM parsing (pm-kglq)
• Implement pm validate and --validate-close behavior (pm-k6ml)
• Implement list parent filter and get guidance updates (pm-jlsh)
• Phase 2: publish SDK contracts for parser/preflight/services (pm-j24z)
• Run latest-build temp-project dogfood audit and remediate findings (pm-j16d)
• Implement list offset pagination and JSON stream mode (pm-ice4)
• Persist bounded test run summaries on item records (pm-i2pc)
• M5 hardening: unknown extension capability diagnostics (pm-hzh6)
• Implement extension doctor summary/deep diagnostics command (pm-hjrr)
• C1: Implement intuitive comments argument parsing (pm-hcco)
• Align extension hook docs with runtime types and SDK surface (pm-hbtn)
• Track extension GitHub shorthand source documentation parity (pm-h8j3)
• Align extension metadata and completion/wrapper parity (pm-h2eo)
• Build and wire runtime item type registry (pm-h1no)
• Document include-body list contract and capture validation evidence (pm-gudp)
• Error1: Introduce structured error model and builders (pm-gggs)
• Wave 8/9: clarify get --json body field behavior (pm-gb25)
• T1: Implement stdin and PTY fail-safe behavior (pm-fas4)
• Implement and verify pm context command (pm-f583)
• Implement calendar command core views and filtering (pm-ezri)
• Track open Dependabot PR #10 (pm-eoil)
• T3: Harden linked-test subprocess anti-hang behavior (pm-dzrj)
• Retire pm install path semantics with command removal (pm-cxn3)
• Wave 8/9: non-interactive help paging safeguards and --no-pager (pm-crk9)
• Overhaul extension and SDK documentation with install equivalence examples (pm-cdsf)
• Sync docs and contracts for external audit remediation (pm-c8dz)
• Implement pm notes and pm learnings command stack (pm-c465)
• C2: Backward-safe extension SDK compatibility shims (pm-bw3h)
• Harden mutation-triggered vector refresh coverage across write paths (pm-bgd8)
• Execute Agent-First CLI UX v3 implementation (pm-b21u)
• Implement fail-on-skipped policy and linked-test assertions (pm-au2z)
• Track open Dependabot PR #5 (pm-akty)
• Run full verification and release evidence for audit remediation (pm-ac8x)
• Wave 8/9: event parse errors with field-specific attribution (pm-a3eq)
• External follow-up: reduce tracked-all orphaned noise from PM internals (pm-a228)
• Generate unknown-command remediation examples from runtime registry (pm-a01m)
• Docs/help refresh for expanded deadline/date inputs (pm-9sg4)
• Run background-service release verification and closure evidence (pm-9ik7)
• Clarify config policy value ergonomics for strict modes (pm-9ayo)
• Implement item_format settings model (pm-9689)
• D1: Rewrite extension and architecture docs for full override (pm-8qne)
• 2026-04-26 comprehensive pm CLI dogfood audit (pm-8pzn)
• Task: harden comments force guidance across help/docs/completion (pm-8k83)
• Implement Issue5 comments audit append path (pm-8k10)
• Implement reminder schema validation and deterministic ordering (pm-7e6n)
• Track open Dependabot PR #6 (pm-7akk)
• Phase 2: implement service override contracts and runtime registry (pm-78jt)
• Calendar audit: all views verified working, reminders and deadlines render correctly (pm-71sj)
• Docs, contracts, and verification sweep for external audit follow-up (pm-64f1)
• Phase 2: lifecycle mutation safety and compatibility tests (pm-5mqd)
• Implement config list/export command actions (pm-5lmj)
• Full-repo audit hardening pass (warnings + metadata alignment) (pm-4vm7)
• Implement pm dedupe-audit command modes and merge suggestions (pm-4n1a)
• Sync contracts/completion/Pi for background test-run surfaces (pm-4moz)
• M4 follow-up: exact-title lexical boost for deterministic search ranking (pm-4iga)
• Issue2 Task: Structured linked-test failure classification (pm-4g5i)
• External follow-up: suppress EPIPE stack traces in piped output (pm-4emi)
• Expose start-task pause-task close-task as first-class CLI aliases (pm-3www)
• M5: Built-in todos import export extension (pm-3s0)
• Verify extension manager rollout and deliver release evidence (pm-3gzy)
• M1: Item schema model and validation (pm-3gi)
• Telemetry pipeline verified: all [redacted_service_count] services healthy, E2E event ingestion working (pm-3akm)
• Integrate command and extension format behavior (pm-3aga)
• Chore: Telemetry queue steady-state has 100 pending entries (pm-2gmr)
• A1: Unified extension-first command router (pm-2bxh)
• Issue3 Task: Default-on validate command reference check (pm-2ajr)
• Implement shared history-stream policy helper and command enforcement (pm-1tyv)
• Phase 2: full verification matrix and closure evidence (pm-1had)
• Track open Dependabot PR #12 (pm-16pn)
• B2: Wire search providers and vector adapters (pm-14qs)
• Finalize tests docs verification and release evidence for history hardening (pm-0vnr)
• Wire resilient entry ingestion across mutation commands (pm-0pvk)
• Implement recurrence occurrence expansion in calendar views (pm-0c0g)
• Task: allow claim takeover without force for non-terminal items (pm-05u4)

2026.3.12 - 2026-03-13

Fixed

• Fix Beads Import Lossiness (pm-axl0)

Security

• Track and commit imported pm issue/history files (pm-rbdu)
• Sanitize publishable worktree before push (pm-mcli)
• Cut public release 2026.3.9 (pm-1h88)

Other

• Maintain release readiness 2026-03-09 (Run 9) (pm-7vr0)
• Maintain release readiness 2026-03-09 (Run 7) (pm-zre8)
• Rewrite README for public users (pm-uc33)
• Replace docs-as-contract tests with pm-data/runtime checks (pm-sevn)
• Expand README quick start create example to full field surface (pm-mltd)
• Maintain release readiness 2026-03-09 (Run 6) (pm-j0o4)
• Maintain release readiness 2026-03-09 (Run 5) (pm-6k5l)
• Generalize CLI help text for universal positioning (pm-30zl)
• Maintain release readiness 2026-03-09 (Run 8) (pm-2cr5)

2026.3.9 - 2026-03-09

Added

• Add README badges and update CONTRIBUTING.md to reference docs/ (pm-x4f9)
• Add --title and -t support for pm update (pm-w1r6)
• Add --ac alias for create acceptance criteria (pm-vyqe)
• Add issue-specific metadata fields to item schema and CLI (pm-rs40)
• Pi wrapper action parity: add completion action (pm-oqe0)
• Add automated npm release workflow and Node 24 CI coverage (pm-mwe8)
• Add snake_case aliases for create/update acceptance and estimate flags (pm-mfza)
• Add confidence metadata flag support for create/update (pm-kpz5)
• Add definition-of-done config baseline (pm-jdt8)
• Add package.json npm metadata and GitHub community files (pm-ixbk)
• M5 roadmap: Pi agent extension advanced ergonomics (pm-hbc1)
• Add integration test for pm list active-only behavior (pm-gus1)
• Add list-draft command parity for draft status (pm-ex1y)
• Add Node 25 to nightly CI and create docs/ architecture+extension guides (pm-aa6w)
• Add med alias for risk flag values (pm-7w60)
• Add pm completion command for bash/zsh/fish shell completion (pm-7hx6)
• Add --ac alias parity for pm update acceptance criteria (pm-3qrp)
• Repo restructure and module boundaries (pm-2c8)

Changed

• Release readiness refactor (pm-ote)
• Installer scripts and update path (pm-tq1)
• Promote strategic metadata flags into canonical create/update contract (pm-phob)
• Release-readiness guard for update help/contract parity (pm-cujj)
• Pi wrapper all-fields create/update parity (pm-096j)
• M1: Core command set init create get update append delete claim release close (pm-06t)

Fixed

• Release-readiness contract audit and next fix (2026-03-06 run) (pm-qkj9)
• Release-readiness contract audit and next fix (2026-03-06 run 5) (pm-x89f)
• Deduplicate test-all linked test execution across items (pm-v6e)
• Release readiness contract audit and next fix (pm-oadl)
• Release-readiness contract audit and next fix (2026-03-06 run 3) (pm-eamp)
• Fix sandbox runner passthrough for targeted test commands (pm-2rl)
• Release-readiness contract audit and next fix (2026-03-06 run 4) (pm-2joy)

Removed

• M4 follow-up: remove deleted items from semantic vector indexes (pm-fdla)
• Remove session-based ownership model (pm-5rh2)
• Implement pm delete command (pm-4yl0)

Security

• Fix devDependency security vulnerabilities via c8 and rollup updates (pm-r3fi)
• Harden include-linked path containment (pm-q35x)
• Add npm provenance attestation to release workflow (pm-mwap)
• Harden include-linked symlink containment (pm-lxa0)
• M5: Enforce symlink-resolved extension entry boundary (pm-fsyv)
• Release hardening: scoped npm + version policy + CI (pm-1hm2)

Other

• Milestone 6 - Hardening + Release Readiness (pm-jiw)
• Milestone 5 - Extension System + Built-ins (pm-b1w)
• Milestone 4 - Search (pm-f45)
• Milestone 3 - Query + Operations (pm-54d)
• Milestone 2 - History + Restore (pm-c0r)
• Milestone 1 - Core Item CRUD + Locking (pm-u9r)
• Milestone 0 - Foundations (pm-2xl)
• Build pm-cli v1 (pm-j7a)
• Release-readiness maintenance loop 2026-03-08 run 1 (pm-vz16)
• Release-readiness maintenance loop 2026-03-07 run 2 (pm-phpq)
• Preserve confidence in todos import mapping (pm-zoyg)
• M4: Mutation-triggered search cache invalidation (pm-zgkk)
• M3: stats health and gc commands (pm-zau)
• M4: Embedding provider abstraction (pm-yv2)
• M5 follow-up: activity history directory read hook dispatch (pm-xyv3)
• CI workflows and quality gates (pm-wo8)
• Release-readiness maintenance loop 2026-03-07 run 7 (pm-wjdr)
• Sync prompt-03 create template with canonical contract (pm-wi28)
• Harden chained sandbox env detection per segment (pm-wdgn)
• Sync prompt docs with close workflow (pm-vx7l)
• M5 follow-up: surface registerFlags on dynamic command help (pm-vqam)
• M0: Deterministic serializer utilities (pm-vdh)
• Release-readiness loop: enforce global install bootstrap contract (pm-uh4d)
• Release-readiness maintenance loop 2026-03-07 run 10 (pm-u8fr)
• Release-readiness maintenance loop 2026-03-06 (pm-tkie)
• M0: Error model and exit code mapping (pm-siz)
• M6: Fixture corpus for restore import and search (pm-si1)
• Release-readiness verification and baseline dogfood sweep (pm-scca)
• M4: Strict keyword search filter validation parity (pm-r5ku)
• Release readiness maintenance sweep (pm-r59c)
• M3: list and list-* filters with deterministic sort (pm-r0m)
• M4 roadmap: Broader multi-factor tuning for hybrid search (pm-qyyv)
• M5 roadmap: Broader command sandbox API boundary (pm-qype)
• Harden sandbox guard for run-script test commands (pm-q813)
• M5 roadmap: Todos import/export extension parity polish (pm-pu4i)
• Docs contract sync for release readiness (pm-pq8)
• M5 follow-up: health extension activation probe (pm-pjj7)
• M2: Append-only history writer (pm-pg9)
• M5: Hook lifecycle (pm-p8p)
• Sync AGENTS Pi create example with explicit contract (pm-oie4)
• Maintain release readiness 2026-03-09 (pm-o4ky)
• M1: Lock acquire release with TTL and conflicts (pm-nkx)
• M4: Reindex command (pm-nj3)
• Pi wrapper numeric scalar flag parity (pm-ni7x)
• M5 follow-up: health history stream read hook dispatch (pm-ndb1)
• M5 hardening: enforce extension capability declarations (pm-mwwp)
• Release-readiness drift audit and sync (pm-mpd6)
• Release-readiness maintenance loop 2026-03-07 run 6 (pm-mn6w)
• Reject flagged package-manager test runners in pm test --add (pm-mlc3)
• Contributing maintainer bootstrap global-install parity (pm-m91u)
• M5 roadmap: Broader call-site expansion for hooks (pm-m6yd)
• Release-readiness audit and next hardening changeset (pm-lfae)
• M5 follow-up: include built-in extensions in health probe (pm-l88i)
• M1: Markdown item parser and serializer (pm-l4o)
• M3: comments files docs and test commands (pm-kwl)
• Release-readiness maintenance loop 2026-03-08 run 1 (chore archival variant) (pm-knwz)
• M4: Vector store adapters for Qdrant and LanceDB (pm-kj4)
• M0: Project scaffolding CLI entrypoint config loader (pm-k8v)
• Maintain release readiness 2026-03-09 (Run 3) (pm-k4u5)
• Harden recursive test-all detection for global-flag invocation forms (pm-k3zx)
• M5 roadmap: Runtime wiring for extension registrations (pm-jvfw)
• Release-readiness maintenance loop 2026-03-07 run 4 (pm-iziy)
• M5 follow-up: Extension API registration surface baseline (pm-iuzs)
• M4 roadmap: Advanced provider optimization (pm-ip91)
• M5 roadmap: Beads import extension parity polish (pm-imob)
• M5: Built-in Pi tool wrapper extension (pm-igv)
• M4: Honor embedding batch + retry settings in semantic indexing (pm-i25f)
• Sync legacy prompt docs with create contract (pm-h22w)
• AGENTS closed-sweep guidance and contract guard (pm-gsd9)
• Harden settings serialization contract coverage (pm-gm5l)
• M5: Renderer and command extension points (pm-geq)
• Close-workflow contract guard across docs and runtime (pm-fvox)
• M5 follow-up: dispatch onWrite hooks for create and restore (pm-f3q4)
• M4 follow-up: resolve search sonar warnings (pm-f35q)
• Release-readiness maintenance loop 2026-03-07 run 5 (pm-f0e9)
• Maintain release readiness 2026-03-09 (Run 4) (pm-eyoz)
• Pi wrapper workflow preset: close-task (pm-ewoq)
• M3 follow-up: harden activity when history directory is missing (pm-er7n)
• Bootstrap dogfood backlog and execute highest-priority gap (pm-ep96)
• M4 roadmap: mutation-triggered semantic embedding refresh (pm-eg97)
• Restore full todos import metadata parity (pm-ecbn)
• Pi wrapper fallback path hardening (pm-e6qb)
• Release-readiness maintenance loop 2026-03-07 run 11 (pm-dyu6)
• Docs parity: mark Pi wrapper packaging polish as implemented (pm-du3c)
• M1: ID generation and normalization (pm-dgb)
• Normalize duplicate milestone epics in tracker (pm-d9yz)
• Packaging hardening for npm release (pm-cyj)
• M4: Hybrid ranking and include-linked option (pm-cwp)
• M5 follow-up: classify applied extension migrations (pm-cw6c)
• Optimize test-all dedupe across timeout variants (pm-cnil)
• M5 roadmap: Broader override surfaces (pm-bfd9)
• M5 roadmap: Pi tool wrapper packaging/distribution polish (pm-bdz5)
• Make semantic search fully working using Ollama (pm-b4pb)
• Create contract verification sample (pm-awo)
• Release-readiness maintenance loop 2026-03-07 run 9 (pm-acx9)
• Release-readiness maintenance loop 2026-03-07 run 8 (pm-a5ea)
• M2: Restore by timestamp or version with replay and hash validation (pm-9lc)
• Testing strategy and 100 percent coverage gates (pm-912)
• M6: CI matrix finalized (pm-8z7)
• README maintainer bootstrap parity with AGENTS (pm-8mkp)
• M4 roadmap: Broader adapter optimization and persistence refinements (pm-8ikr)
• Harden recursive test-all detection for npx package specs (pm-8fvl)
• M5 follow-up: isolate override and renderer contexts (pm-8d71)
• M5: Extension manifest loader and sandbox boundary (pm-7sd)
• Record explicit acceptance_criteria unset in create history metadata (pm-7pp6)
• M4 follow-up: semantic/hybrid search limit=0 deterministic empty result (pm-6mn1)
• M5 follow-up: dispatch lock lifecycle hooks (pm-671u)
• M3: test-all orchestration and dependency-failed exit handling (pm-66o)
• Guard todos import hierarchical ID preservation (pm-57lj)
• M5 follow-up: normalize extension command path whitespace (pm-433d)
• M5 follow-up: report pending extension migrations in health (pm-42oa)
• Release-readiness maintenance loop 2026-03-08 run 2 (pm-3tjx)
• M5 follow-up: isolate hook execution contexts (pm-3ses)
• Enforce close-command closure path (pm-3nv9)
• M5 follow-up: dispatch onIndex hooks in gc command (pm-3aeu)
• Release-readiness maintenance loop 2026-03-09 (pm-36zp)
• M5 follow-up: validate extension hook registration handlers (pm-30lh)
• M5 follow-up: enforce mandatory extension migration write gate (pm-2p5x)
• M2: History and activity commands (pm-2fj)
• Release-readiness maintenance loop 2026-03-07 run 3 (pm-204c)
• Promote unblock-note to canonical workflow field (pm-1p6f)
• M6: Command help and README examples validated in tests (pm-15o)
• Harden recursive test-all detection for pnpm dlx and npm exec launchers (pm-11t5)
• M5: Harden extension command handler context sandbox (pm-0e8w)