pm test tracker sandbox loses source Git workspace identity #682

Summary

pm test <id> --run can seed every source tracker item into tracker context yet produce different results for a Git-aware PM command because the sandboxed PM_PATH is detached from the source repository.

This makes a release gate pass directly and fail only when the same command is executed as a linked PM test.

Environment

• @unbrained/pm-cli: 2026.7.24-3
• Linux x64
• Bun 1.3.11
• Linked-test contexts reproduced: tracker and schema
• Project extension used to expose the mismatch: pm-changelog@2026.7.24

Reproduction

In a Git repository with released tags and closed PM items whose release attribution depends on those tags:

pm test <id> --add "command=bun run validate:release,pm_context_mode=tracker"
pm test <id> --run --only-last --progress

The release command ends with a deterministic changelog check equivalent to:

pm changelog generate --output CHANGELOG.md --mode replace --all-release-tags --status closed --check

Direct execution passes:

action: unchanged
item_count: 36
check: true

The linked tracker run reports source_project_item_count: 41, sandbox_project_item_count: 41, and mismatch_detected: false, but the same check fails as out of date.

A minimal manual reproduction is to copy the tracker to a temporary PM_PATH outside the Git worktree and run the generator from the original repository cwd. All 36 closed items are present, but historical release sections collapse into one current Unreleased section because tag/workspace context is resolved from the detached tracker root rather than the linked command working directory or a preserved source-workspace identity.

Observed

• The linked command cwd remains the actual repository.
• PM_PATH points to /tmp/pm-linked-test-.../tracker/project/.agents/pm.
• Tracker item parity is exact.
• Git release/tag context is not preserved in the PM runtime context.
• The command therefore produces a different artifact despite identical source data and cwd.

Expected

Tracker-context linked tests should isolate tracker writes while preserving a distinct read-only source workspace or VCS root identity for commands and packages that need repository metadata.

Possible contracts include a documented source-workspace environment variable/context field, or resolving VCS context from the linked command cwd independently of the sandboxed tracker storage root.

Impact

PM-governed release acceptance cannot faithfully run commands whose PM output combines tracker data with Git tags/history. Teams must either omit the release gate from linked PM tests or accept a false failure, weakening the goal that PM linked tests are authoritative acceptance evidence.

Duplicate search

Searched all open and closed issues for:

• linked test sandbox PM_PATH git context
• pm test changelog sandbox
• tracker context repository root
• PM_PATH cwd git
• release tags linked test
• VCS workspace PM_PATH
• sandbox outside git repository
• all-release-tags pm test

Issue #678 concerns extension discovery across child processes and is distinct: here the extension is loaded and executes successfully, but receives a detached workspace identity and generates different content.