2026.9.2
Fixed
- GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably item pm-r97901
Security
- GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable item pm-dn8rwl
Changelog
What changed in each pm release, with a link to the pm item that records every change.
2026.9.1
Added
- GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item item pm-83cz0o
- Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract item pm-3g3f8z
Fixed
- The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either item pm-jjqyzd
- GH-1166: root help hides the --all discovery option that reveals the full command surface item pm-7f9zkh
- GH-1104: health must not certify pending lossless merge receipts as reconciled item pm-baksix
- GH-1135: item_hash_version 2 still masks writer hash divergence as corruption item pm-2qahia
Security
- Refresh compatible GitHub Actions and tsx tooling dependencies item pm-k47gdd
Other
- Document the measured canonical agent cold-start across docs and generated guidance item pm-ka6d
- Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require item pm-wenq
2026.8.31
Added
- Workspace position read: one bounded answer to where this workspace stands in the branch-and-merge workflow and what to run next, replacing a protocol the agent must remember item pm-bq0ii8
Fixed
- Custom statuses registered without a lifecycle role are silently orphaned from every work-selection surface item pm-0mhspz
- GH-1158: Windows Node 24 nightly receipt fixture derives a root-relative expectation from a drive-qualified path item pm-46hpx8
- GH-1154: linked-test sandbox guard is command-shape inconsistent and undocumented item pm-s8cth5
- The local preflight token-budget gate is red on a workstation and green in hosted CI for the same commit again, because the earlier remediation closed the one ambient channel that had bitten instead of closing the fixture's environment item pm-4o7tlx
- The bounded legacy MCP compatibility set stops one revision short of the spec's own legacy boundary, so every current host is refused at initialize and the dual-era guarantee is unmet item pm-edywqn
Deprecated
- The project's own agent-facing documentation and skills instruct deprecated command spellings, so the alias-usage signal that decides when a spelling can be retired is manufactured by the instructions rather than observed from callers item pm-q2n4vd
2026.8.30
Other
- Adopt eslint-plugin-unicorn 74 with strict lint and packed-consumer proof item pm-6f66vu
2026.8.29
Fixed
- GH-1144: hash-only merge receipts contradict report output and cannot reconcile truthfully item pm-z1z96w
- GH-1146/1147: external blockers remain stale and validation recommends deleting them item pm-yhle2e
- GH-1140: reject ambiguous bare comma tuples for linked file and test mutations item pm-nc94mk
- GH-1148: cached drift mismatch can falsely report tracker corruption item pm-sxg7wl
- GH-1138: linked test name filters can pass after executing zero tests item pm-ntnv4k
- GH-1136: npm 12 object-form npm pack receipts break registry package installs item pm-xrjy8o
- GH-1135: item_hash_version 2 still masks writer hash divergence as corruption item pm-2qahia
- The annotation key=value grammar has three divergent comma behaviours, two of which silently corrupt the evidence text before it is made immutable item pm-hu92i3
- GH-1150: health remediation for pending merge receipts must perform the repair item pm-r0p3at
- GH-1134: required collection recovery omits truthful --clear-\* intent item pm-t7wl00
- GH-1143: Claude session-file provenance resolver ignores real nested stream fields item pm-f60039
- GH-1137: linked docs writes silently persist nonexistent workspace paths item pm-hiqlkh
- Sentry release gate aborts valid API queries at a fixed 15-second deadline item pm-b9g2cs
Other
- Close the jscpd/CodeFactor sensitivity gap: minTokens 115 misses low-token table clones the CodeFactor bot still files item pm-xspd
- Refresh @sentry/node 10.72 with packed SDK and release proof item pm-mwhv33
- Refresh compatible 2026-08-29 dependency releases item pm-vwuidf
2026.8.28
Fixed
- Repository test runner inherits production Sentry and turns negative CLI fixtures into release-blocking incidents item pm-5ug5xq
- Broad squash commits overflow hosted-analysis tree lookup and falsely lose reviewed PR provenance item pm-gactwj
- Golden agent-transcript replay: measure tokens-per-completed-task as a CI-visible DX regression gate item pm-8pnj
- Unknown-option refusal textual flags bypass structured global-option filtering item pm-x4wbui
- Agent-task transcript recovery accepts a refusal as a successful retry item pm-o360q6
- Close lifecycle bypasses reproducible process clock item pm-hmpu4p
- GH-1132: opt-in idempotent annotation append (ifAbsent/--if-absent) prevents retry-driven context duplication; duplicate appends remain available by default item pm-ea1yh2
- Agent-task transcripts accept declared no-effect and partial-effect successful exits item pm-wanwyc
- Agent-task baselines accept missing task and composite token ceilings item pm-aksavu
- Agent-task closeout claims lack linked full-verification commands item pm-ervmsc
- CLI transport-floor RSS admission false-fails on single-sample page noise item pm-pz49xc
- Unknown-option refusals identify the actual rejected flag and fail closed at delimiters item pm-fo8g7j
- Agent-task gate accepts incidental substrings as required-field completeness item pm-o7u08u
- Completed-task transcripts require terminal success, exclusive refusal metadata, and complete recovery item pm-wa39rl
- Agent-task token replay trusts missing or incorrect accounting estimates item pm-ok2kdn
Security
- GH-1131: macOS Node 24 nightly cannot create the Skills-over-MCP special-file socket fixture item pm-k23c4c
2026.8.27
Added
- Tiered contract-driven help: one-screen core help, full surface via pm help --all, generated from the contract table item pm-e2bq
- Skills over MCP: discoverable version-coherent pm workflows with progressive disclosure, capability requirements, and token budgets item pm-8nzivt
- MCP Apps for pm: interactive graph, context, plan, assurance, and long-operation views with consent-safe action boundaries item pm-pznhee
Fixed
- GH-859: pm-beads source export can omit Beads comment bodies and events item pm-tpwde6
- pm get silently discards --output-include field names because entity reads bind the flag to sections while collection reads bind it to fields, and the omission receipt reports no omissions either way item pm-0k19l7
- GH-860: pm-beads --preserve-source-ids changes source ID casing item pm-f7jj9b
- GH-862: pm-beads must map Beads close reasons into native resolution metadata item pm-gus5ft
- GH-1118: natural-language word-number titles trigger duplicate issue-code false positives item pm-blvfye
- Published-artifact verification rejects the new pm-mcp-http bin before executing its healthy published entrypoint item pm-fpdne3
Other
- Consolidate package lifecycle: extension/package/install/upgrade under a single pm package namespace item pm-tnud
- Refresh compatible ESLint 10.9.1 and Node type 26.3 patches item pm-crkmmr
- MCP 2026-07-28 conformance and release gate: official schema matrix, protocol-era adapters, real transports, adversarial cases, and published consumers item pm-55yf1t
2026.8.26
Added
- MCP subscriptions and transports: subscriptions/listen, request-scoped streams, Streamable HTTP headers, retry semantics, and stdio parity item pm-v7e337
- MCP server surface and cache contracts: deterministic tools, prompts, resources, JSON Schema 2020-12, ttlMs, cacheScope, and change coherence item pm-hv1x1x
- Official MCP tasks extension for pm: asynchronous long operations, tasks/get polling, tasks/update input, durable handles, and lifecycle convergence item pm-rzs24j
- MCP multi round-trip requests: input_required results, elicitation, retry state, and removal of server-initiated request assumptions item pm-rz9gep
- Stateless MCP core: request-local version and capabilities, mandatory server/discover, typed result envelopes, and deterministic identity item pm-vae5ec
Changed
- SDK-first architecture: pm CLI (and MCP) become thin layers over a complete public pm SDK item pm-usfg
Fixed
- GH-1091: surface extension manifest schema lint separately from version compatibility item pm-gh1091
- GH-1109: tracker-context seeding writes an empty settings history document item pm-2ga1g7
- GH-1112: Windows Node 24 merge-receipt boundary test relies on POSIX name-length failure item pm-v3umtp
Security
- MCP remote authorization and observability: issuer-bound credentials, client metadata documents, consent, header security, and OpenTelemetry propagation item pm-3zh9s4
Deprecated
- MCP 2026-07-28 deprecation and removal migration: roots, sampling, logging, dynamic registration, HTTP+SSE, includeContext, ping, and legacy sessions item pm-vzcisw
- ADR: MCP 2026-07-28 is canonical and legacy interoperability is a bounded stateless adapter, not connection-local session state item pm-sqvshj
Other
- Refresh Sentry 10.71 and TypeScript-ESLint 8.68 with packed-consumer proof item pm-7xfndr
2026.8.25
Fixed
- GH-1104: health must not certify pending lossless merge receipts as reconciled item pm-baksix
- Dynamic-read continuation cursors are born stale: pm health emits a cursor that its next invocation rejects item pm-oahhyc
- GH-1105: contracts must declare each command projection vocabulary before invocation item pm-q4isdq
- The outcome-milestone ladder is a sibling set rather than a layer: 1,024 terminal items reach the roadmap apex through 154 typed roots without traversing any outcome milestone item pm-h6b73t
Security
- Adopt Dependabot PR \#1103 pinned CodeQL 4.37.8 refresh item pm-rh0z9f
2026.8.24
Fixed
- Structured release-failure causes are preserved in blocked-release alerts item pm-x63izf
- Bulk writes accept newline/comma IDs from argv, stdin, and @path with effect-aware exits item pm-3oq022
- update-many --dry-run allows filter-only preview for review and bulk-selection workflows item pm-kexu
- Releases from the default branch are supported with analyzer evidence item pm-u1baah
Other
- Uniform stdin convention: body-file and annotation --file flags accept '-' for stdin item pm-iktj
- Single source of surface tiering: one contract-declared tier per command drives CLI help, MCP tool profiles, completions, and docs together item pm-kxci8x