Fixed
- GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably elemento pm-r97901
Security
- GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable elemento pm-dn8rwl
Added
- GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item elemento pm-83cz0o
- Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract elemento pm-3g3f8z
Fixed
- The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either elemento pm-jjqyzd
- GH-1166: root help hides the --all discovery option that reveals the full command surface elemento pm-7f9zkh
- GH-1104: health must not certify pending lossless merge receipts as reconciled elemento pm-baksix
- GH-1135: item_hash_version 2 still masks writer hash divergence as corruption elemento pm-2qahia
Other
- Document the measured canonical agent cold-start across docs and generated guidance elemento pm-ka6d
- Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require elemento pm-wenq
Added
- Workspace position read: one bounded answer to where this workspace stands in the branch-and-merge workflow and what to run next, replacing a protocol the agent must remember elemento pm-bq0ii8
Fixed
- Custom statuses registered without a lifecycle role are silently orphaned from every work-selection surface elemento pm-0mhspz
- GH-1158: Windows Node 24 nightly receipt fixture derives a root-relative expectation from a drive-qualified path elemento pm-46hpx8
- GH-1154: linked-test sandbox guard is command-shape inconsistent and undocumented elemento pm-s8cth5
- The local preflight token-budget gate is red on a workstation and green in hosted CI for the same commit again, because the earlier remediation closed the one ambient channel that had bitten instead of closing the fixture's environment elemento pm-4o7tlx
- The bounded legacy MCP compatibility set stops one revision short of the spec's own legacy boundary, so every current host is refused at initialize and the dual-era guarantee is unmet elemento pm-edywqn
Deprecated
- The project's own agent-facing documentation and skills instruct deprecated command spellings, so the alias-usage signal that decides when a spelling can be retired is manufactured by the instructions rather than observed from callers elemento pm-q2n4vd
Other
- Adopt eslint-plugin-unicorn 74 with strict lint and packed-consumer proof elemento pm-6f66vu
Fixed
- GH-1144: hash-only merge receipts contradict report output and cannot reconcile truthfully elemento pm-z1z96w
- GH-1146/1147: external blockers remain stale and validation recommends deleting them elemento pm-yhle2e
- GH-1140: reject ambiguous bare comma tuples for linked file and test mutations elemento pm-nc94mk
- GH-1148: cached drift mismatch can falsely report tracker corruption elemento pm-sxg7wl
- GH-1138: linked test name filters can pass after executing zero tests elemento pm-ntnv4k
- GH-1136: npm 12 object-form npm pack receipts break registry package installs elemento pm-xrjy8o
- GH-1135: item_hash_version 2 still masks writer hash divergence as corruption elemento pm-2qahia
- The annotation key=value grammar has three divergent comma behaviours, two of which silently corrupt the evidence text before it is made immutable elemento pm-hu92i3
- GH-1150: health remediation for pending merge receipts must perform the repair elemento pm-r0p3at
- GH-1134: required collection recovery omits truthful --clear-\* intent elemento pm-t7wl00
- GH-1143: Claude session-file provenance resolver ignores real nested stream fields elemento pm-f60039
- GH-1137: linked docs writes silently persist nonexistent workspace paths elemento pm-hiqlkh
- Sentry release gate aborts valid API queries at a fixed 15-second deadline elemento pm-b9g2cs
Other
- Close the jscpd/CodeFactor sensitivity gap: minTokens 115 misses low-token table clones the CodeFactor bot still files elemento pm-xspd
- Refresh @sentry/node 10.72 with packed SDK and release proof elemento pm-mwhv33
- Refresh compatible 2026-08-29 dependency releases elemento pm-vwuidf
Fixed
- Repository test runner inherits production Sentry and turns negative CLI fixtures into release-blocking incidents elemento pm-5ug5xq
- Broad squash commits overflow hosted-analysis tree lookup and falsely lose reviewed PR provenance elemento pm-gactwj
- Golden agent-transcript replay: measure tokens-per-completed-task as a CI-visible DX regression gate elemento pm-8pnj
- Unknown-option refusal textual flags bypass structured global-option filtering elemento pm-x4wbui
- Agent-task transcript recovery accepts a refusal as a successful retry elemento pm-o360q6
- Close lifecycle bypasses reproducible process clock elemento pm-hmpu4p
- GH-1132: opt-in idempotent annotation append (ifAbsent/--if-absent) prevents retry-driven context duplication; duplicate appends remain available by default elemento pm-ea1yh2
- Agent-task transcripts accept declared no-effect and partial-effect successful exits elemento pm-wanwyc
- Agent-task baselines accept missing task and composite token ceilings elemento pm-aksavu
- Agent-task closeout claims lack linked full-verification commands elemento pm-ervmsc
- CLI transport-floor RSS admission false-fails on single-sample page noise elemento pm-pz49xc
- Unknown-option refusals identify the actual rejected flag and fail closed at delimiters elemento pm-fo8g7j
- Agent-task gate accepts incidental substrings as required-field completeness elemento pm-o7u08u
- Completed-task transcripts require terminal success, exclusive refusal metadata, and complete recovery elemento pm-wa39rl
- Agent-task token replay trusts missing or incorrect accounting estimates elemento pm-ok2kdn
Security
- GH-1131: macOS Node 24 nightly cannot create the Skills-over-MCP special-file socket fixture elemento pm-k23c4c
Added
- Tiered contract-driven help: one-screen core help, full surface via pm help --all, generated from the contract table elemento pm-e2bq
- Skills over MCP: discoverable version-coherent pm workflows with progressive disclosure, capability requirements, and token budgets elemento pm-8nzivt
- MCP Apps for pm: interactive graph, context, plan, assurance, and long-operation views with consent-safe action boundaries elemento pm-pznhee
Fixed
- GH-859: pm-beads source export can omit Beads comment bodies and events elemento pm-tpwde6
- pm get silently discards --output-include field names because entity reads bind the flag to sections while collection reads bind it to fields, and the omission receipt reports no omissions either way elemento pm-0k19l7
- GH-860: pm-beads --preserve-source-ids changes source ID casing elemento pm-f7jj9b
- GH-862: pm-beads must map Beads close reasons into native resolution metadata elemento pm-gus5ft
- GH-1118: natural-language word-number titles trigger duplicate issue-code false positives elemento pm-blvfye
- Published-artifact verification rejects the new pm-mcp-http bin before executing its healthy published entrypoint elemento pm-fpdne3
Other
- Consolidate package lifecycle: extension/package/install/upgrade under a single pm package namespace elemento pm-tnud
- Refresh compatible ESLint 10.9.1 and Node type 26.3 patches elemento pm-crkmmr
- MCP 2026-07-28 conformance and release gate: official schema matrix, protocol-era adapters, real transports, adversarial cases, and published consumers elemento pm-55yf1t
Added
- MCP subscriptions and transports: subscriptions/listen, request-scoped streams, Streamable HTTP headers, retry semantics, and stdio parity elemento pm-v7e337
- MCP server surface and cache contracts: deterministic tools, prompts, resources, JSON Schema 2020-12, ttlMs, cacheScope, and change coherence elemento pm-hv1x1x
- Official MCP tasks extension for pm: asynchronous long operations, tasks/get polling, tasks/update input, durable handles, and lifecycle convergence elemento pm-rzs24j
- MCP multi round-trip requests: input_required results, elicitation, retry state, and removal of server-initiated request assumptions elemento pm-rz9gep
- Stateless MCP core: request-local version and capabilities, mandatory server/discover, typed result envelopes, and deterministic identity elemento pm-vae5ec
Changed
- SDK-first architecture: pm CLI (and MCP) become thin layers over a complete public pm SDK elemento pm-usfg
Fixed
- GH-1091: surface extension manifest schema lint separately from version compatibility elemento pm-gh1091
- GH-1109: tracker-context seeding writes an empty settings history document elemento pm-2ga1g7
- GH-1112: Windows Node 24 merge-receipt boundary test relies on POSIX name-length failure elemento pm-v3umtp
Security
- MCP remote authorization and observability: issuer-bound credentials, client metadata documents, consent, header security, and OpenTelemetry propagation elemento pm-3zh9s4
Deprecated
- MCP 2026-07-28 deprecation and removal migration: roots, sampling, logging, dynamic registration, HTTP+SSE, includeContext, ping, and legacy sessions elemento pm-vzcisw
- ADR: MCP 2026-07-28 is canonical and legacy interoperability is a bounded stateless adapter, not connection-local session state elemento pm-sqvshj
Other
- Refresh Sentry 10.71 and TypeScript-ESLint 8.68 with packed-consumer proof elemento pm-7xfndr
Fixed
- GH-1104: health must not certify pending lossless merge receipts as reconciled elemento pm-baksix
- Dynamic-read continuation cursors are born stale: pm health emits a cursor that its next invocation rejects elemento pm-oahhyc
- GH-1105: contracts must declare each command projection vocabulary before invocation elemento pm-q4isdq
- The outcome-milestone ladder is a sibling set rather than a layer: 1,024 terminal items reach the roadmap apex through 154 typed roots without traversing any outcome milestone elemento pm-h6b73t
Fixed
- Structured release-failure causes are preserved in blocked-release alerts elemento pm-x63izf
- Bulk writes accept newline/comma IDs from argv, stdin, and @path with effect-aware exits elemento pm-3oq022
- update-many --dry-run allows filter-only preview for review and bulk-selection workflows elemento pm-kexu
- Releases from the default branch are supported with analyzer evidence elemento pm-u1baah
Other
- Uniform stdin convention: body-file and annotation --file flags accept '-' for stdin elemento pm-iktj
- Single source of surface tiering: one contract-declared tier per command drives CLI help, MCP tool profiles, completions, and docs together elemento pm-kxci8x