Added
- Lifecycle field-completeness contract: each item type declares the fields required at each status transition, machine-checked by pm validate 条目 pm-htbetn
- Declarative policy engine: item-level transition, approval, and authorship rules declared as data and enforced consistently at the SDK layer 条目 pm-mj42og
Fixed
- Explain binding token budgets beside read-output alias migration hints 条目 pm-8kzfc4
- Preserve dependency kind constraints in rendered enum errors 条目 pm-lk0qhn
- pm search defaults to keyword on a workspace whose vector index is complete, so the shipped Ollama semantic default never reaches the default query path 条目 pm-n8a6e7
Security
- GHSA-crvj-82cr-hjcx: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials 条目 pm-vnv467
- GHSA-g6gw-c38x-mqfc: Hono: Unbounded dot-notation nesting in
parseBody() can cause memory exhaustion 条目 pm-gxt0mx - GHSA-gqvv-2mrq-wpjv: Hono: Incomplete fix for CVE-2026-39408:
toSSG() still writes files outside the output directory 条目 pm-rc8708
Added
- Derived scheduling: propagate milestone deadlines backward through the ordering graph so every gating item carries a latest-start date instead of only six dates existing in the whole plan 条目 pm-d2wfig
Changed
- Unify history maintenance with one verified SDK snapshot and rewrite pipeline 条目 pm-34w8za
Fixed
- GH-1218: expose local package copy scope and packed-install alternatives 条目 pm-5bsofk
- GH-1219: report truthful package update coverage for skipped and failed checks 条目 pm-gf5zw8
- Claim ownership response repeats full metadata despite the compact mutation contract 条目 pm-eqdo85
- Reject repository-local test scratch roots before sandbox fixtures can mutate the real Git workspace 条目 pm-bukwmy
- GH-1214: Bound complete item reads and isolate Git newline fixtures on Windows 条目 pm-hrhfgi
- GH-1216: Preserve diagnostic identity and sanitize short and bounded error text 条目 pm-m4uyyj
- GH-1215: Preserve original source maps through aliased build roots 条目 pm-zk67yf
- Grouping by a set-valued field groups by the whole set: pm aggregate --group-by tags returns 2,022 tag-tuple rows for 2,467 items, so the governance question the command exists to answer cannot be asked 条目 pm-398z0u
- The graph completeness audit scopes every coverage metric to active nodes, so it certifies a saturated graph while 1,796 of 2,079 nodes are unmeasured 条目 pm-6olc95
Other
- MCP 2026-07-28 per-request log level is neither read nor negatively controlled, and the conformance matrix has no row for it 条目 pm-pd7nh0
- Backfill terminal resolution evidence without placeholder metadata 条目 pm-e9zh
- Consolidate history commands: history-redact/history-repair/history-compact/activity/restore under pm history subcommands 条目 pm-tqel
- Compact unbundled runtime JavaScript while preserving SDK declarations and Sentry source maps 条目 pm-fx0rcb
- Adopt PR 1212 release and secret-scanner action pins with matching workflow contracts 条目 pm-shpocu
Fixed
- Release preparation omits the calendar date and fails post-tag main CI 条目 pm-071wg4
Fixed
- GH-1207: Make advisory health checks and strict verdict authority explicit 条目 pm-fkohe8
- The tracker's recurrence edges and the CI recurrence policy are two ledgers with no join, so 59 of the 75 items in a recorded recurrence lineage produce no gate anywhere 条目 pm-7c27ep
- Refresh review acknowledgements when bot feedback changes 条目 pm-8we38i
- pm health --check-only, the diagnostic AGENTS.md routes agents to, reduces nothing: it costs 33k tokens where --summary states the same verdict in 142 条目 pm-du93sr
- GH-1203: Offer actionable acceptance-evidence backfill after a warning close 条目 pm-ub1ott
- GH-1202: Classify abandoned merge receipts without losing durable provenance 条目 pm-466m0j
- GH-1200: Preview exact receipt proof before merge reconciliation 条目 pm-ao0bu9
- GH-1206: Verify legacy receipt redactions across hash encodings 条目 pm-v66zir
- GH-1205: Declare root-only versus inherited extension flag reservation scope 条目 pm-2h8t6y
- GH-1201: Recover invalid pending receipt evidence across release upgrades 条目 pm-2xtv84
- The linked-file staleness check has no holder-lifecycle partition, so 1,220 links on closed holders warn forever while its worklist truncation hides the actionable subset behind a path count reported as a row count 条目 pm-zw9188
- 2026.8.1 regression: governance dedupe audit rejects the restored all-lifecycle status sentinel 条目 pm-449do9
- Normalize local parent shorthand consistently with dependency identifiers 条目 pm-olcoon
- Every pm next and pm context read writes one usage-ledger row per open item under a single global lock, and the compaction trigger is a byte threshold that a count-based retention can never satisfy 条目 pm-bab3gb
- Reading one item by its primary key scans the whole workspace: pm get is O(corpus) and the projection flags bound the output but not the work 条目 pm-ydshl9
- Telemetry worker permanently retries JSONB-incompatible Unicode events 条目 pm-xlb6aw
- Telemetry worker: no Postgres reconnect — ingestion stalls with events stuck in RabbitMQ after postgres restart 条目 pm-rj3w
- Metadata index rebuilds and mutations repeatedly scan an unindexed FTS identity column 条目 pm-gtw5zh
- Read sessions emit invalid continuation identities from workspace activity rows 条目 pm-s8ybl9
- Scale fixtures silently omit unregistered Story items from metadata reads 条目 pm-fx80w2
Other
- Cross-process reproducibility gate: prove CLI and MCP deterministic runs are byte-identical and fail on ambient time leaks 条目 pm-vklr99
- The docs gate enforces link resolution but not doc reachability, so orphaned docs pass CI and the advertised docs map silently drifts 条目 pm-s4y3z4
- docs-skills-gate: validate anchor fragments in relative links 条目 pm-esbt
Fixed
- Tag-push Release must regenerate the exact-tag changelog before immutable publication 条目 pm-e63v1x
- pm next recommends outcome-milestone gates as actionable work, and summary.containers counts a bucket the envelope never emits 条目 pm-08mt4k
- Windows published-release verifier test can preempt its own readiness and cleanup contract 条目 pm-euqm7x
- Commander usage refusals omit token_accounting even when --token-accounting is parsed 条目 pm-bfa1ob
- flag-invocation-parity only iterates declared flags, so 21 runtime options across 8 core commands have no flag contract 条目 pm-2bqgs7
- pm release leaves the item in_progress with no owner: offer --status open (or hint) so released work does not linger as phantom WIP 条目 pm-ugld
- GH-1169: the unknown-command hint routes to the 15-command root help that hides the target, and test is the only singular collection verb 条目 pm-u4t9gp
- pm context summary counts are denominated in the returned slice, so the canonical orient cold-start reports 4 open items in a 291-item backlog 条目 pm-79gv6q
- GH-1171: restore parses the on-disk item before consulting history, so a zero-byte or corrupted item file with an intact stream cannot be rebuilt 条目 pm-96fsma
- history-compact renumbers version identifiers, so pm get --at N and pm restore N address a different recorded state after compaction with exit 0 and no signal 条目 pm-m0yjtg
- A deleted item's id is immediately re-mintable, so one immutable history stream can hold two unrelated items and every integrity check still reports verified 条目 pm-e3gn0z
- Point-in-time reconstruction crashes with an unstructured runtime error when a history stream opens without a baseline entry, so the restore-any-version guarantee fails with no diagnosable condition 条目 pm-qw1uw6
- Agent skills instruct flags and spellings the runtime refuses, and no guide topic routes the evidence or automation families 条目 pm-4957pz
- Sentry-injected release artifacts exceed the CI package budget because pre- and post-injection packlists share one ceiling 条目 pm-llbnua
- GH-1190: Windows nightly can publish the event index after an unlocked fallback append 条目 pm-a7207g
Other
- Upgrade Greptile review tooling to 3.5.0 with compatible dependency evidence 条目 pm-o3mczz
- Point-in-time reconstruction gate: prove every item at every recorded version replays exactly from its history stream alone 条目 pm-wlqxg3
- Refresh compatible jscpd 5.1.2 and reconcile the 2026-09-04 dependency census 条目 pm-gredf1
Added
- Verdict contract: one declared vocabulary of reproducible predicates over recorded state, composable into a score, with reward shaping explicitly refused 条目 pm-e1vkee
Fixed
- Packed npx smoke timeout rejects valid slow dependency reification 条目 pm-8eebb6
- GH-1186: unrecoverable legacy merge-receipt references block strict health with diagnostic-only remediation 条目 pm-cf4t42
- GH-1185: hash-only merge receipts make discarded scalar values unreachable to the reviewing agent 条目 pm-mg13iz
- GH-1184: scalar merge conflict ordering ignores recency and requested preference 条目 pm-7wzb6d
- Acceptance criteria are documented as merging like tags but are stored as one delimiter-joined scalar, so concurrent criteria additions from different branches are silently discarded 条目 pm-inn5y5
- GH-1183: Windows nightly event-index lock acquisition and fallback publication are nondeterministic 条目 pm-fqlocp
- GH-1177: Claude session provenance path is derived from invocation cwd instead of the session-start workspace 条目 pm-l7m7k5
- GH-1179: legacy merge-receipt shape is misclassified as a gate-failing missing history reference with no remedy 条目 pm-wn3ee5
- Re-anchoring overwrites the original hash pair, so the immutability proof for every pre-merge entry is destroyed by the operation that repairs the chain 条目 pm-aka8m7
Security
- GH-1178: history hashes exclude record author and agent provenance, so attribution can be rewritten without detection 条目 pm-javbsq
Fixed
- A read whose result was omitted for budget still records those items as served and included, so the usage-affinity signal learns from context the agent never received 条目 pm-wv47pf
- Shape-qualified scale baselines drifted from current CLI/SDK output contracts and supported runtime 条目 pm-r8yytk
- Context recency is computed from updated_at, so every governance write the project mandates erases the freshness signal it ranks on 条目 pm-07pt16
Security
- OSSF Scorecard alert \#29: qs denial-of-service advisories in the MCP Apps development dependency tree 条目 pm-mlpn91
Other
- Refresh compatible 2026-09-01 jscpd 5.1.1 tooling 条目 pm-ur4swu
- Refresh Sentry 10.73 and TypeScript-ESLint 8.69 with exact coverage 条目 pm-92tp12
Fixed
- GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably 条目 pm-r97901
Security
- GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable 条目 pm-dn8rwl
Added
- GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item 条目 pm-83cz0o
- Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract 条目 pm-3g3f8z
Fixed
- The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either 条目 pm-jjqyzd
- GH-1166: root help hides the --all discovery option that reveals the full command surface 条目 pm-7f9zkh
- GH-1104: health must not certify pending lossless merge receipts as reconciled 条目 pm-baksix
- GH-1135: item_hash_version 2 still masks writer hash divergence as corruption 条目 pm-2qahia
Security
- Refresh compatible GitHub Actions and tsx tooling dependencies 条目 pm-k47gdd
Other
- Document the measured canonical agent cold-start across docs and generated guidance 条目 pm-ka6d
- Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require 条目 pm-wenq
Added
- Workspace position read: one bounded answer to where this workspace stands in the branch-and-merge workflow and what to run next, replacing a protocol the agent must remember 条目 pm-bq0ii8
Fixed
- Custom statuses registered without a lifecycle role are silently orphaned from every work-selection surface 条目 pm-0mhspz
- GH-1158: Windows Node 24 nightly receipt fixture derives a root-relative expectation from a drive-qualified path 条目 pm-46hpx8
- GH-1154: linked-test sandbox guard is command-shape inconsistent and undocumented 条目 pm-s8cth5
- The local preflight token-budget gate is red on a workstation and green in hosted CI for the same commit again, because the earlier remediation closed the one ambient channel that had bitten instead of closing the fixture's environment 条目 pm-4o7tlx
- The bounded legacy MCP compatibility set stops one revision short of the spec's own legacy boundary, so every current host is refused at initialize and the dual-era guarantee is unmet 条目 pm-edywqn
Deprecated
- The project's own agent-facing documentation and skills instruct deprecated command spellings, so the alias-usage signal that decides when a spelling can be retired is manufactured by the instructions rather than observed from callers 条目 pm-q2n4vd