chore(release): public launch hardening for @unbrained/pm-cli

.agents/pm/chores/pm-1h88.md

@@ -0,0 +1,59 @@
+{
+  "id": "pm-1h88",
+  "title": "Cut public release 2026.3.9",
+  "description": "Create final release commit/PR messaging, switch GitHub repository visibility to public, and publish @unbrained/pm-cli.",
+  "type": "Chore",
+  "status": "in_progress",
+  "priority": 0,
+  "tags": [
+    "pm-cli",
+    "publishing",
+    "release",
+    "security"
+  ],
+  "created_at": "2026-03-09T13:02:02.787Z",
+  "updated_at": "2026-03-09T13:02:08.582Z",
+  "deadline": "2026-03-10T13:02:02.787Z",
+  "assignee": "maintainer-agent",
+  "author": "maintainer-agent",
+  "estimated_minutes": 90,
+  "acceptance_criteria": "Repository set public intentionally; release commit pushed; PR opened with final messaging; tag v2026.3.9 pushed; release workflow publishes @unbrained/pm-cli successfully; no credential leaks detected.",
+  "comments": [
+    {
+      "created_at": "2026-03-09T13:02:02.787Z",
+      "author": "maintainer-agent",
+      "text": "Execute final launch operations with explicit leak checks and release guardrails."
+    }
+  ],
+  "notes": [
+    {
+      "created_at": "2026-03-09T13:02:02.787Z",
+      "author": "maintainer-agent",
+      "text": "Prefer tag-driven publish workflow using release environment secret NPM_TOKEN."
+    }
+  ],
+  "files": [
+    {
+      "path": ".github/workflows/release.yml",
+      "scope": "project",
+      "note": "tag-driven publish pipeline"
+    }
+  ],
+  "tests": [
+    {
+      "command": "pnpm security:scan",
+      "scope": "project",
+      "timeout_seconds": 120,
+      "note": "final leak check before release"
+    }
+  ],
+  "docs": [
+    {
+      "path": "docs/RELEASING.md",
+      "scope": "project",
+      "note": "release runbook"
+    }
+  ]
+}
+
+Operational release execution task for today's production launch.

.agents/pm/chores/pm-1hm2.md

@@ -0,0 +1,208 @@
+{
+  "id": "pm-1hm2",
+  "title": "Release hardening: scoped npm + version policy + CI",
+  "description": "Audit for leaked private data, enforce calendar SemVer policy, and harden GitHub/npm release automation for scoped package publishing.",
+  "type": "Chore",
+  "status": "closed",
+  "priority": 0,
+  "tags": [
+    "ci",
+    "pm-cli",
+    "release-readiness",
+    "security"
+  ],
+  "created_at": "2026-03-09T12:42:13.949Z",
+  "updated_at": "2026-03-09T12:56:34.722Z",
+  "deadline": "2026-03-10T12:42:13.949Z",
+  "author": "maintainer-agent",
+  "estimated_minutes": 180,
+  "acceptance_criteria": "No leaked credentials in tracked files/pm data; package/versioning follows YYYY.M.D[-N] policy; CI/release pipelines enforce policy and support @unbrained/pm-cli publishing + npx usage; contributor release docs updated.",
+  "comments": [
+    {
+      "created_at": "2026-03-09T12:42:13.949Z",
+      "author": "maintainer-agent",
+      "text": "Initiate final release hardening sweep before public launch."
+    },
+    {
+      "created_at": "2026-03-09T12:56:28.657Z",
+      "author": "maintainer-agent",
+      "text": "Evidence: release hardening validations passed. Commands: pnpm version:next => 2026.3.9; pnpm version:check => passed; pnpm security:scan => no credential-like secrets in tracked files (including .agents/pm tracked data); pnpm smoke:npx => passed (2026.3.9); node scripts/run-tests.mjs test -- tests/integration/ci-workflow-contract.spec.ts tests/integration/help-readme-contract.spec.ts tests/integration/release-readiness-contract.spec.ts => 48/48 passing; pnpm test => 54 files, 541 tests passing; node scripts/run-tests.mjs coverage => 54 files, 541 tests passing at 100% lines/branches/functions/statements."
+    }
+  ],
+  "notes": [
+    {
+      "created_at": "2026-03-09T12:42:13.949Z",
+      "author": "maintainer-agent",
+      "text": "Implement version policy checks and release workflow guardrails."
+    }
+  ],
+  "files": [
+    {
+      "path": ".github/ISSUE_TEMPLATE/bug-report.yml",
+      "scope": "project",
+      "note": "calendar version placeholder"
+    },
+    {
+      "path": ".github/PULL_REQUEST_TEMPLATE.md",
+      "scope": "project",
+      "note": "new release safety checklist items"
+    },
+    {
+      "path": ".github/workflows/ci.yml",
+      "scope": "project",
+      "note": "version/security/npx gates in CI"
+    },
+    {
+      "path": ".github/workflows/nightly.yml",
+      "scope": "project",
+      "note": "nightly version and security checks"
+    },
+    {
+      "path": ".github/workflows/release.yml",
+      "scope": "project",
+      "note": "release environment publish flow with tag guard"
+    },
+    {
+      "path": "AGENTS.md",
+      "scope": "project",
+      "note": "scoped package-spec recursion examples"
+    },
+    {
+      "path": "CHANGELOG.md",
+      "scope": "project",
+      "note": "release hardening changelog entries"
+    },
+    {
+      "path": "CONTRIBUTING.md",
+      "scope": "project",
+      "note": "link release runbook"
+    },
+    {
+      "path": "docs/RELEASING.md",
+      "scope": "project",
+      "note": "maintainer release runbook"
+    },
+    {
+      "path": "package.json",
+      "scope": "project",
+      "note": "scope package + version policy"
+    },
+    {
+      "path": "PRD.md",
+      "scope": "project",
+      "note": "scoped package-spec recursion examples"
+    },
+    {
+      "path": "README.md",
+      "scope": "project",
+      "note": "scoped install docs and release checklist"
+    },
+    {
+      "path": "scripts/check-secrets.mjs",
+      "scope": "project",
+      "note": "tracked-file secret leak scanner"
+    },
+    {
+      "path": "scripts/install.ps1",
+      "scope": "project",
+      "note": "scoped installer default package"
+    },
+    {
+      "path": "scripts/install.sh",
+      "scope": "project",
+      "note": "scoped installer default package"
+    },
+    {
+      "path": "scripts/release-version.mjs",
+      "scope": "project",
+      "note": "calendar SemVer policy and registry sequencing checks"
+    },
+    {
+      "path": "scripts/smoke-npx-from-pack.mjs",
+      "scope": "project",
+      "note": "packaged npx smoke test"
+    },
+    {
+      "path": "tests/integration/ci-workflow-contract.spec.ts",
+      "scope": "project",
+      "note": "workflow contract assertions"
+    },
+    {
+      "path": "tests/integration/help-readme-contract.spec.ts",
+      "scope": "project",
+      "note": "README installer and package assertions"
+    },
+    {
+      "path": "tests/integration/release-readiness-contract.spec.ts",
+      "scope": "project",
+      "note": "version policy and packaging assertions"
+    }
+  ],
+  "tests": [
+    {
+      "command": "node scripts/run-tests.mjs coverage",
+      "scope": "project",
+      "timeout_seconds": 1200,
+      "note": "full regression gate"
+    },
+    {
+      "command": "node scripts/run-tests.mjs test -- tests/integration/ci-workflow-contract.spec.ts tests/integration/help-readme-contract.spec.ts tests/integration/release-readiness-contract.spec.ts",
+      "scope": "project",
+      "timeout_seconds": 1200,
+      "note": "targeted contract verification"
+    },
+    {
+      "command": "pnpm security:scan",
+      "scope": "project",
+      "timeout_seconds": 120,
+      "note": "tracked credential leak scan"
+    },
+    {
+      "command": "pnpm smoke:npx",
+      "scope": "project",
+      "timeout_seconds": 180,
+      "note": "packaged npx executable smoke"
+    },
+    {
+      "command": "pnpm version:check",
+      "scope": "project",
+      "timeout_seconds": 120,
+      "note": "calendar version policy validation"
+    }
+  ],
+  "docs": [
+    {
+      "path": "AGENTS.md",
+      "scope": "project",
+      "note": "dogfood command contract package-spec update"
+    },
+    {
+      "path": "CHANGELOG.md",
+      "scope": "project",
+      "note": "unreleased release hardening notes"
+    },
+    {
+      "path": "CONTRIBUTING.md",
+      "scope": "project",
+      "note": "release runbook linkage"
+    },
+    {
+      "path": "docs/RELEASING.md",
+      "scope": "project",
+      "note": "maintainer release process"
+    },
+    {
+      "path": "PRD.md",
+      "scope": "project",
+      "note": "canonical package-spec recursion examples"
+    },
+    {
+      "path": "README.md",
+      "scope": "project",
+      "note": "public release/install contract"
+    }
+  ],
+  "close_reason": "Release management hardening completed: scoped package + calendar version policy + CI/release gates validated."
+}
+
+Prepare repository for public production release without publishing yet.

.agents/pm/history/pm-1h88.jsonl

@@ -0,0 +1,3 @@
+{"ts":"2026-03-09T13:02:02.787Z","author":"maintainer-agent","op":"create","patch":[{"op":"replace","path":"/body","value":"Operational release execution task for today's production launch."},{"op":"add","path":"/front_matter/id","value":"pm-1h88"},{"op":"add","path":"/front_matter/title","value":"Cut public release 2026.3.9"},{"op":"add","path":"/front_matter/description","value":"Create final release commit/PR messaging, switch GitHub repository visibility to public, and publish @unbrained/pm-cli."},{"op":"add","path":"/front_matter/type","value":"Chore"},{"op":"add","path":"/front_matter/status","value":"open"},{"op":"add","path":"/front_matter/priority","value":0},{"op":"add","path":"/front_matter/tags","value":["pm-cli","publishing","release","security"]},{"op":"add","path":"/front_matter/created_at","value":"2026-03-09T13:02:02.787Z"},{"op":"add","path":"/front_matter/updated_at","value":"2026-03-09T13:02:02.787Z"},{"op":"add","path":"/front_matter/deadline","value":"2026-03-10T13:02:02.787Z"},{"op":"add","path":"/front_matter/author","value":"maintainer-agent"},{"op":"add","path":"/front_matter/estimated_minutes","value":90},{"op":"add","path":"/front_matter/acceptance_criteria","value":"Repository set public intentionally; release commit pushed; PR opened with final messaging; tag v2026.3.9 pushed; release workflow publishes @unbrained/pm-cli successfully; no credential leaks detected."},{"op":"add","path":"/front_matter/comments","value":[{"created_at":"2026-03-09T13:02:02.787Z","author":"maintainer-agent","text":"Execute final launch operations with explicit leak checks and release guardrails."}]},{"op":"add","path":"/front_matter/notes","value":[{"created_at":"2026-03-09T13:02:02.787Z","author":"maintainer-agent","text":"Prefer tag-driven publish workflow using release environment secret NPM_TOKEN."}]},{"op":"add","path":"/front_matter/files","value":[{"path":".github/workflows/release.yml","scope":"project","note":"tag-driven publish pipeline"}]},{"op":"add","path":"/front_matter/tests","value":[{"command":"pnpm security:scan","scope":"project","timeout_seconds":120,"note":"final leak check before release"}]},{"op":"add","path":"/front_matter/docs","value":[{"path":"docs/RELEASING.md","scope":"project","note":"release runbook"}]}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"c522fb3160fa0fc074074e6d589a9c09c5dba18d537648c71a3c30682c08ff29","message":"Create operational release execution chore | explicit_unset=dependencies,learnings,assignee"}
+{"ts":"2026-03-09T13:02:08.116Z","author":"maintainer-agent","op":"claim","patch":[{"op":"replace","path":"/front_matter/updated_at","value":"2026-03-09T13:02:08.116Z"},{"op":"add","path":"/front_matter/assignee","value":"maintainer-agent"}],"before_hash":"c522fb3160fa0fc074074e6d589a9c09c5dba18d537648c71a3c30682c08ff29","after_hash":"7d44bb314021fffcf565b64f6677bab26e4af2e9582775af0d56eb8fb3cdeeb9","message":"Claim public release execution"}
+{"ts":"2026-03-09T13:02:08.582Z","author":"maintainer-agent","op":"update","patch":[{"op":"replace","path":"/front_matter/updated_at","value":"2026-03-09T13:02:08.582Z"},{"op":"replace","path":"/front_matter/status","value":"in_progress"}],"before_hash":"7d44bb314021fffcf565b64f6677bab26e4af2e9582775af0d56eb8fb3cdeeb9","after_hash":"6138dd22e640768d8fe5c91f7eb35cd7e21a8da1deb92e72a8bcdb10b99b9671","message":"Begin release execution"}