2026.9.2

Fixed

  • GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably 条目 pm-r97901

Security

  • GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable 条目 pm-dn8rwl

2026.9.1

Added

  • GH-796: duplicate recurrence now reopens the canonical terminal item instead of creating a second item 条目 pm-83cz0o
  • Progressive MCP discovery and canonical tool results: reveal the minimum relevant catalog and deliver one unambiguous model-facing output contract 条目 pm-3g3f8z

Fixed

  • The two-call agent cold start proposed as canonical costs more tokens than the four-call protocol it replaces, and no gate measures either 条目 pm-jjqyzd
  • GH-1166: root help hides the --all discovery option that reveals the full command surface 条目 pm-7f9zkh
  • GH-1104: health must not certify pending lossless merge receipts as reconciled 条目 pm-baksix
  • GH-1135: item_hash_version 2 still masks writer hash divergence as corruption 条目 pm-2qahia

Security

Other

  • Document the measured canonical agent cold-start across docs and generated guidance 条目 pm-ka6d
  • Close-time completeness signal for structured resolution fields (resolution/expected/actual) — config-gated warn or require 条目 pm-wenq

2026.8.31

Added

  • Workspace position read: one bounded answer to where this workspace stands in the branch-and-merge workflow and what to run next, replacing a protocol the agent must remember 条目 pm-bq0ii8

Fixed

  • Custom statuses registered without a lifecycle role are silently orphaned from every work-selection surface 条目 pm-0mhspz
  • GH-1158: Windows Node 24 nightly receipt fixture derives a root-relative expectation from a drive-qualified path 条目 pm-46hpx8
  • GH-1154: linked-test sandbox guard is command-shape inconsistent and undocumented 条目 pm-s8cth5
  • The local preflight token-budget gate is red on a workstation and green in hosted CI for the same commit again, because the earlier remediation closed the one ambient channel that had bitten instead of closing the fixture's environment 条目 pm-4o7tlx
  • The bounded legacy MCP compatibility set stops one revision short of the spec's own legacy boundary, so every current host is refused at initialize and the dual-era guarantee is unmet 条目 pm-edywqn

Deprecated

  • The project's own agent-facing documentation and skills instruct deprecated command spellings, so the alias-usage signal that decides when a spelling can be retired is manufactured by the instructions rather than observed from callers 条目 pm-q2n4vd

2026.8.30

Other

  • Adopt eslint-plugin-unicorn 74 with strict lint and packed-consumer proof 条目 pm-6f66vu

2026.8.29

Fixed

  • GH-1144: hash-only merge receipts contradict report output and cannot reconcile truthfully 条目 pm-z1z96w
  • GH-1146/1147: external blockers remain stale and validation recommends deleting them 条目 pm-yhle2e
  • GH-1140: reject ambiguous bare comma tuples for linked file and test mutations 条目 pm-nc94mk
  • GH-1148: cached drift mismatch can falsely report tracker corruption 条目 pm-sxg7wl
  • GH-1138: linked test name filters can pass after executing zero tests 条目 pm-ntnv4k
  • GH-1136: npm 12 object-form npm pack receipts break registry package installs 条目 pm-xrjy8o
  • GH-1135: item_hash_version 2 still masks writer hash divergence as corruption 条目 pm-2qahia
  • The annotation key=value grammar has three divergent comma behaviours, two of which silently corrupt the evidence text before it is made immutable 条目 pm-hu92i3
  • GH-1150: health remediation for pending merge receipts must perform the repair 条目 pm-r0p3at
  • GH-1134: required collection recovery omits truthful --clear-\* intent 条目 pm-t7wl00
  • GH-1143: Claude session-file provenance resolver ignores real nested stream fields 条目 pm-f60039
  • GH-1137: linked docs writes silently persist nonexistent workspace paths 条目 pm-hiqlkh
  • Sentry release gate aborts valid API queries at a fixed 15-second deadline 条目 pm-b9g2cs

Other

  • Close the jscpd/CodeFactor sensitivity gap: minTokens 115 misses low-token table clones the CodeFactor bot still files 条目 pm-xspd
  • Refresh @sentry/node 10.72 with packed SDK and release proof 条目 pm-mwhv33
  • Refresh compatible 2026-08-29 dependency releases 条目 pm-vwuidf

2026.8.28

Fixed

  • Repository test runner inherits production Sentry and turns negative CLI fixtures into release-blocking incidents 条目 pm-5ug5xq
  • Broad squash commits overflow hosted-analysis tree lookup and falsely lose reviewed PR provenance 条目 pm-gactwj
  • Golden agent-transcript replay: measure tokens-per-completed-task as a CI-visible DX regression gate 条目 pm-8pnj
  • Unknown-option refusal textual flags bypass structured global-option filtering 条目 pm-x4wbui
  • Agent-task transcript recovery accepts a refusal as a successful retry 条目 pm-o360q6
  • Close lifecycle bypasses reproducible process clock 条目 pm-hmpu4p
  • GH-1132: opt-in idempotent annotation append (ifAbsent/--if-absent) prevents retry-driven context duplication; duplicate appends remain available by default 条目 pm-ea1yh2
  • Agent-task transcripts accept declared no-effect and partial-effect successful exits 条目 pm-wanwyc
  • Agent-task baselines accept missing task and composite token ceilings 条目 pm-aksavu
  • Agent-task closeout claims lack linked full-verification commands 条目 pm-ervmsc
  • CLI transport-floor RSS admission false-fails on single-sample page noise 条目 pm-pz49xc
  • Unknown-option refusals identify the actual rejected flag and fail closed at delimiters 条目 pm-fo8g7j
  • Agent-task gate accepts incidental substrings as required-field completeness 条目 pm-o7u08u
  • Completed-task transcripts require terminal success, exclusive refusal metadata, and complete recovery 条目 pm-wa39rl
  • Agent-task token replay trusts missing or incorrect accounting estimates 条目 pm-ok2kdn

Security

  • GH-1131: macOS Node 24 nightly cannot create the Skills-over-MCP special-file socket fixture 条目 pm-k23c4c

2026.8.27

Added

  • Tiered contract-driven help: one-screen core help, full surface via pm help --all, generated from the contract table 条目 pm-e2bq
  • Skills over MCP: discoverable version-coherent pm workflows with progressive disclosure, capability requirements, and token budgets 条目 pm-8nzivt
  • MCP Apps for pm: interactive graph, context, plan, assurance, and long-operation views with consent-safe action boundaries 条目 pm-pznhee

Fixed

  • GH-859: pm-beads source export can omit Beads comment bodies and events 条目 pm-tpwde6
  • pm get silently discards --output-include field names because entity reads bind the flag to sections while collection reads bind it to fields, and the omission receipt reports no omissions either way 条目 pm-0k19l7
  • GH-860: pm-beads --preserve-source-ids changes source ID casing 条目 pm-f7jj9b
  • GH-862: pm-beads must map Beads close reasons into native resolution metadata 条目 pm-gus5ft
  • GH-1118: natural-language word-number titles trigger duplicate issue-code false positives 条目 pm-blvfye
  • Published-artifact verification rejects the new pm-mcp-http bin before executing its healthy published entrypoint 条目 pm-fpdne3

Other

  • Consolidate package lifecycle: extension/package/install/upgrade under a single pm package namespace 条目 pm-tnud
  • Refresh compatible ESLint 10.9.1 and Node type 26.3 patches 条目 pm-crkmmr
  • MCP 2026-07-28 conformance and release gate: official schema matrix, protocol-era adapters, real transports, adversarial cases, and published consumers 条目 pm-55yf1t

2026.8.26

Added

  • MCP subscriptions and transports: subscriptions/listen, request-scoped streams, Streamable HTTP headers, retry semantics, and stdio parity 条目 pm-v7e337
  • MCP server surface and cache contracts: deterministic tools, prompts, resources, JSON Schema 2020-12, ttlMs, cacheScope, and change coherence 条目 pm-hv1x1x
  • Official MCP tasks extension for pm: asynchronous long operations, tasks/get polling, tasks/update input, durable handles, and lifecycle convergence 条目 pm-rzs24j
  • MCP multi round-trip requests: input_required results, elicitation, retry state, and removal of server-initiated request assumptions 条目 pm-rz9gep
  • Stateless MCP core: request-local version and capabilities, mandatory server/discover, typed result envelopes, and deterministic identity 条目 pm-vae5ec

Changed

  • SDK-first architecture: pm CLI (and MCP) become thin layers over a complete public pm SDK 条目 pm-usfg

Fixed

  • GH-1091: surface extension manifest schema lint separately from version compatibility 条目 pm-gh1091
  • GH-1109: tracker-context seeding writes an empty settings history document 条目 pm-2ga1g7
  • GH-1112: Windows Node 24 merge-receipt boundary test relies on POSIX name-length failure 条目 pm-v3umtp

Security

  • MCP remote authorization and observability: issuer-bound credentials, client metadata documents, consent, header security, and OpenTelemetry propagation 条目 pm-3zh9s4

Deprecated

  • MCP 2026-07-28 deprecation and removal migration: roots, sampling, logging, dynamic registration, HTTP+SSE, includeContext, ping, and legacy sessions 条目 pm-vzcisw
  • ADR: MCP 2026-07-28 is canonical and legacy interoperability is a bounded stateless adapter, not connection-local session state 条目 pm-sqvshj

Other

  • Refresh Sentry 10.71 and TypeScript-ESLint 8.68 with packed-consumer proof 条目 pm-7xfndr

2026.8.25

Fixed

  • GH-1104: health must not certify pending lossless merge receipts as reconciled 条目 pm-baksix
  • Dynamic-read continuation cursors are born stale: pm health emits a cursor that its next invocation rejects 条目 pm-oahhyc
  • GH-1105: contracts must declare each command projection vocabulary before invocation 条目 pm-q4isdq
  • The outcome-milestone ladder is a sibling set rather than a layer: 1,024 terminal items reach the roadmap apex through 154 typed roots without traversing any outcome milestone 条目 pm-h6b73t

Security

2026.8.24

Fixed

  • Structured release-failure causes are preserved in blocked-release alerts 条目 pm-x63izf
  • Bulk writes accept newline/comma IDs from argv, stdin, and @path with effect-aware exits 条目 pm-3oq022
  • update-many --dry-run allows filter-only preview for review and bulk-selection workflows 条目 pm-kexu
  • Releases from the default branch are supported with analyzer evidence 条目 pm-u1baah

Other

  • Uniform stdin convention: body-file and annotation --file flags accept '-' for stdin 条目 pm-iktj
  • Single source of surface tiering: one contract-declared tier per command drives CLI help, MCP tool profiles, completions, and docs together 条目 pm-kxci8x