2026.9.2

Fixed

  • GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably Eintrag pm-r97901

Security

  • GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable Eintrag pm-dn8rwl

2026.9.1

Added

  • GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item Eintrag pm-83cz0o
  • Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract Eintrag pm-3g3f8z

Fixed

  • The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either Eintrag pm-jjqyzd
  • GH-1166: root help hides the --all discovery option that reveals the full command surface Eintrag pm-7f9zkh
  • GH-1104: health must not certify pending lossless merge receipts as reconciled Eintrag pm-baksix
  • GH-1135: item_hash_version 2 still masks writer hash divergence as corruption Eintrag pm-2qahia

Security

Other

  • Document the measured canonical agent cold-start across docs and generated guidance Eintrag pm-ka6d
  • Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require Eintrag pm-wenq

2026.8.31

Added

  • Workspace position read: one bounded answer to where this workspace stands in the branch-and-merge workflow and what to run next, replacing a protocol the agent must remember Eintrag pm-bq0ii8

Fixed

  • Custom statuses registered without a lifecycle role are silently orphaned from every work-selection surface Eintrag pm-0mhspz
  • GH-1158: Windows Node 24 nightly receipt fixture derives a root-relative expectation from a drive-qualified path Eintrag pm-46hpx8
  • GH-1154: linked-test sandbox guard is command-shape inconsistent and undocumented Eintrag pm-s8cth5
  • The local preflight token-budget gate is red on a workstation and green in hosted CI for the same commit again, because the earlier remediation closed the one ambient channel that had bitten instead of closing the fixture's environment Eintrag pm-4o7tlx
  • The bounded legacy MCP compatibility set stops one revision short of the spec's own legacy boundary, so every current host is refused at initialize and the dual-era guarantee is unmet Eintrag pm-edywqn

Deprecated

  • The project's own agent-facing documentation and skills instruct deprecated command spellings, so the alias-usage signal that decides when a spelling can be retired is manufactured by the instructions rather than observed from callers Eintrag pm-q2n4vd

2026.8.30

Other

  • Adopt eslint-plugin-unicorn 74 with strict lint and packed-consumer proof Eintrag pm-6f66vu

2026.8.29

Fixed

  • GH-1144: hash-only merge receipts contradict report output and cannot reconcile truthfully Eintrag pm-z1z96w
  • GH-1146/1147: external blockers remain stale and validation recommends deleting them Eintrag pm-yhle2e
  • GH-1140: reject ambiguous bare comma tuples for linked file and test mutations Eintrag pm-nc94mk
  • GH-1148: cached drift mismatch can falsely report tracker corruption Eintrag pm-sxg7wl
  • GH-1138: linked test name filters can pass after executing zero tests Eintrag pm-ntnv4k
  • GH-1136: npm 12 object-form npm pack receipts break registry package installs Eintrag pm-xrjy8o
  • GH-1135: item_hash_version 2 still masks writer hash divergence as corruption Eintrag pm-2qahia
  • The annotation key=value grammar has three divergent comma behaviours, two of which silently corrupt the evidence text before it is made immutable Eintrag pm-hu92i3
  • GH-1150: health remediation for pending merge receipts must perform the repair Eintrag pm-r0p3at
  • GH-1134: required collection recovery omits truthful --clear-\* intent Eintrag pm-t7wl00
  • GH-1143: Claude session-file provenance resolver ignores real nested stream fields Eintrag pm-f60039
  • GH-1137: linked docs writes silently persist nonexistent workspace paths Eintrag pm-hiqlkh
  • Sentry release gate aborts valid API queries at a fixed 15-second deadline Eintrag pm-b9g2cs

Other

  • Close the jscpd/CodeFactor sensitivity gap: minTokens 115 misses low-token table clones the CodeFactor bot still files Eintrag pm-xspd
  • Refresh @sentry/node 10.72 with packed SDK and release proof Eintrag pm-mwhv33
  • Refresh compatible 2026-08-29 dependency releases Eintrag pm-vwuidf

2026.8.28

Fixed

  • Repository test runner inherits production Sentry and turns negative CLI fixtures into release-blocking incidents Eintrag pm-5ug5xq
  • Broad squash commits overflow hosted-analysis tree lookup and falsely lose reviewed PR provenance Eintrag pm-gactwj
  • Golden agent-transcript replay: measure tokens-per-completed-task as a CI-visible DX regression gate Eintrag pm-8pnj
  • Unknown-option refusal textual flags bypass structured global-option filtering Eintrag pm-x4wbui
  • Agent-task transcript recovery accepts a refusal as a successful retry Eintrag pm-o360q6
  • Close lifecycle bypasses reproducible process clock Eintrag pm-hmpu4p
  • GH-1132: opt-in idempotent annotation append (ifAbsent/--if-absent) prevents retry-driven context duplication; duplicate appends remain available by default Eintrag pm-ea1yh2
  • Agent-task transcripts accept declared no-effect and partial-effect successful exits Eintrag pm-wanwyc
  • Agent-task baselines accept missing task and composite token ceilings Eintrag pm-aksavu
  • Agent-task closeout claims lack linked full-verification commands Eintrag pm-ervmsc
  • CLI transport-floor RSS admission false-fails on single-sample page noise Eintrag pm-pz49xc
  • Unknown-option refusals identify the actual rejected flag and fail closed at delimiters Eintrag pm-fo8g7j
  • Agent-task gate accepts incidental substrings as required-field completeness Eintrag pm-o7u08u
  • Completed-task transcripts require terminal success, exclusive refusal metadata, and complete recovery Eintrag pm-wa39rl
  • Agent-task token replay trusts missing or incorrect accounting estimates Eintrag pm-ok2kdn

Security

  • GH-1131: macOS Node 24 nightly cannot create the Skills-over-MCP special-file socket fixture Eintrag pm-k23c4c

2026.8.27

Added

  • Tiered contract-driven help: one-screen core help, full surface via pm help --all, generated from the contract table Eintrag pm-e2bq
  • Skills over MCP: discoverable version-coherent pm workflows with progressive disclosure, capability requirements, and token budgets Eintrag pm-8nzivt
  • MCP Apps for pm: interactive graph, context, plan, assurance, and long-operation views with consent-safe action boundaries Eintrag pm-pznhee

Fixed

  • GH-859: pm-beads source export can omit Beads comment bodies and events Eintrag pm-tpwde6
  • pm get silently discards --output-include field names because entity reads bind the flag to sections while collection reads bind it to fields, and the omission receipt reports no omissions either way Eintrag pm-0k19l7
  • GH-860: pm-beads --preserve-source-ids changes source ID casing Eintrag pm-f7jj9b
  • GH-862: pm-beads must map Beads close reasons into native resolution metadata Eintrag pm-gus5ft
  • GH-1118: natural-language word-number titles trigger duplicate issue-code false positives Eintrag pm-blvfye
  • Published-artifact verification rejects the new pm-mcp-http bin before executing its healthy published entrypoint Eintrag pm-fpdne3

Other

  • Consolidate package lifecycle: extension/package/install/upgrade under a single pm package namespace Eintrag pm-tnud
  • Refresh compatible ESLint 10.9.1 and Node type 26.3 patches Eintrag pm-crkmmr
  • MCP 2026-07-28 conformance and release gate: official schema matrix, protocol-era adapters, real transports, adversarial cases, and published consumers Eintrag pm-55yf1t

2026.8.26

Added

  • MCP subscriptions and transports: subscriptions/listen, request-scoped streams, Streamable HTTP headers, retry semantics, and stdio parity Eintrag pm-v7e337
  • MCP server surface and cache contracts: deterministic tools, prompts, resources, JSON Schema 2020-12, ttlMs, cacheScope, and change coherence Eintrag pm-hv1x1x
  • Official MCP tasks extension for pm: asynchronous long operations, tasks/get polling, tasks/update input, durable handles, and lifecycle convergence Eintrag pm-rzs24j
  • MCP multi round-trip requests: input_required results, elicitation, retry state, and removal of server-initiated request assumptions Eintrag pm-rz9gep
  • Stateless MCP core: request-local version and capabilities, mandatory server/discover, typed result envelopes, and deterministic identity Eintrag pm-vae5ec

Changed

  • SDK-first architecture: pm CLI (and MCP) become thin layers over a complete public pm SDK Eintrag pm-usfg

Fixed

  • GH-1091: surface extension manifest schema lint separately from version compatibility Eintrag pm-gh1091
  • GH-1109: tracker-context seeding writes an empty settings history document Eintrag pm-2ga1g7
  • GH-1112: Windows Node 24 merge-receipt boundary test relies on POSIX name-length failure Eintrag pm-v3umtp

Security

  • MCP remote authorization and observability: issuer-bound credentials, client metadata documents, consent, header security, and OpenTelemetry propagation Eintrag pm-3zh9s4

Deprecated

  • MCP 2026-07-28 deprecation and removal migration: roots, sampling, logging, dynamic registration, HTTP+SSE, includeContext, ping, and legacy sessions Eintrag pm-vzcisw
  • ADR: MCP 2026-07-28 is canonical and legacy interoperability is a bounded stateless adapter, not connection-local session state Eintrag pm-sqvshj

Other

  • Refresh Sentry 10.71 and TypeScript-ESLint 8.68 with packed-consumer proof Eintrag pm-7xfndr

2026.8.25

Fixed

  • GH-1104: health must not certify pending lossless merge receipts as reconciled Eintrag pm-baksix
  • Dynamic-read continuation cursors are born stale: pm health emits a cursor that its next invocation rejects Eintrag pm-oahhyc
  • GH-1105: contracts must declare each command projection vocabulary before invocation Eintrag pm-q4isdq
  • The outcome-milestone ladder is a sibling set rather than a layer: 1,024 terminal items reach the roadmap apex through 154 typed roots without traversing any outcome milestone Eintrag pm-h6b73t

Security

2026.8.24

Fixed

  • Structured release-failure causes are preserved in blocked-release alerts Eintrag pm-x63izf
  • Bulk writes accept newline/comma IDs from argv, stdin, and @path with effect-aware exits Eintrag pm-3oq022
  • update-many --dry-run allows filter-only preview for review and bulk-selection workflows Eintrag pm-kexu
  • Releases from the default branch are supported with analyzer evidence Eintrag pm-u1baah

Other

  • Uniform stdin convention: body-file and annotation --file flags accept '-' for stdin Eintrag pm-iktj
  • Single source of surface tiering: one contract-declared tier per command drives CLI help, MCP tool profiles, completions, and docs together Eintrag pm-kxci8x