feat(sdk): ship defect recurrence and boundary evidence contracts

.agents/pm/assurance.json

@@ -694,6 +694,16 @@
         "key": "recovery-reference"
       },
       "max_cost": 1
+    },
+    {
+      "id": "repository-defect-evidence-pass",
+      "description": "Captured boundary, defect escape evidence, and recurrence-family policy pass receipt.",
+      "source": {
+        "kind": "provider",
+        "provider": "repository-quality",
+        "key": "defect-evidence"
+      },
+      "max_cost": 1
     }
   ],
   "assertions": [
@@ -1899,6 +1909,29 @@
           }
         ]
       }
+    },
+    {
+      "id": "repository-defect-evidence-required",
+      "measurement_id": "repository-defect-evidence-pass",
+      "owner_item_id": "pm-rtn5h6",
+      "scope": {
+        "kind": "all"
+      },
+      "equals": 1,
+      "lifetime": "hold",
+      "enforcement": "block",
+      "negative_control": {
+        "cases": [
+          {
+            "observed": 1,
+            "expected": "pass"
+          },
+          {
+            "observed": 0,
+            "expected": "fail"
+          }
+        ]
+      }
     }
   ],
   "gates": [
@@ -1987,13 +2020,14 @@
         "repository-absence-tolerance-required",
         "repository-token-budget-required",
         "repository-context-intent-calibration-required",
-        "repository-docs-skills-required"
+        "repository-docs-skills-required",
+        "repository-defect-evidence-required"
       ],
       "triggers": [
         "ci",
         "pre-release"
       ],
-      "description": "SDK-native composition of deterministic repository static-quality providers.",
+      "description": "SDK-native composition of deterministic repository static-quality, boundary-evidence, and recurrence-policy providers.",
       "provider_policy": {
         "allowed_providers": [
           "repository-quality"

.agents/pm/chores/pm-do5b.toon

@@ -6,7 +6,7 @@ status: open
 priority: 3
 tags[2]: "area:toolchain",upstream-gated
 created_at: "2026-07-17T04:42:09.880Z"
-updated_at: "2026-08-14T08:51:37.864Z"
+updated_at: "2026-08-16T18:36:24.123Z"
 author: maintainer-agent
 estimated_minutes: 480
 acceptance_criteria: "typescript 7.x is the sole compiler in devDependencies; strict ESLint gate runs (typescript-eslint TS7-compatible or successor adopted); static-quality-gate.mts produces identical violation baselines under the new parser (docstrings, complexity, boundary ratchet all byte-identical or intentionally re-baselined with evidence); dependabot major-version ignore for typescript lifted; CI fully green on all legs"
@@ -19,7 +19,7 @@ dependencies[5]{id,kind,created_at}:
   pm-onpb,related,"2026-07-17T04:42:09.880Z"
   pm-tll8,related,"2026-07-17T04:42:09.880Z"
   pm-92if,implements,"2026-07-26T05:56:03.771Z"
-comments[14]{created_at,author,text}:
+comments[15]{created_at,author,text}:
   "2026-07-29T22:24:52.434Z","harness:codex","Live dependency refresh 2026-07-30: pnpm outdated still reports TypeScript 7.0.2 while the repository remains on 6.0.3. The canonical typescript-eslint/compiler-API compatibility blockers recorded here remain the current disposition; pnpm audit reports no known vulnerabilities."
   "2026-07-29T22:44:15.387Z","harness:codex","Date convention clarification: the preceding dependency refresh was executed on 2026-07-30 in the configured Europe/Vienna project timezone; its append-only history event is correctly timestamped 2026-07-29T22:24:52Z in UTC."
   "2026-08-01T05:38:48.697Z","harness:codex","Live dependency disposition 2026-08-01: TypeScript 7.0.2 remains incompatible with the latest typescript-eslint 8.65.0 peer contract (TypeScript >=4.8.4 <6.1.0), and the recorded compiler-API migration remains open and unclaimed. The repository stays on TypeScript 6.0.3; pnpm audit and all GitHub security alert inventories are clean."
@@ -34,4 +34,5 @@ comments[14]{created_at,author,text}:
   "2026-08-09T07:49:41.041Z","harness:codex","2026-08-09 live dependency refresh: pnpm outdated still reports TypeScript 7.0.2 while the repository remains on 6.0.3. This item's parser/compiler-API migration remains the canonical open, unclaimed major path; the current broad SDK/CLI tranche adopted only compatible updates. pnpm audit and all three GitHub security inventories are zero."
   "2026-08-11T08:31:44.318Z","harness:codex","2026-08-11 live dependency disposition: TypeScript latest remains 7.0.2, while installed/current typescript-eslint 8.66.0 declares TypeScript >=4.8.4 <6.1.0 and the recorded static-quality compiler-API migration remains unresolved. This canonical major-migration item remains open and deliberately unclaimed; compatible tsx/esbuild patches are tracked separately under pm-67b84b."
   "2026-08-14T08:51:37.864Z","harness:codex","2026-08-14 live dependency disposition: pnpm outdated reports TypeScript 7.0.2, while typescript-eslint 8.67.0 and @typescript-eslint/parser 8.67.0 still declare TypeScript >=4.8.4 <6.1.0. The recorded parser/compiler-API migration remains unsatisfied, so this canonical item stays open and deliberately unclaimed. Typecheck passes on TypeScript 6.0.3 and pnpm audit reports no known vulnerabilities."
+  "2026-08-16T18:36:24.123Z","harness:codex","2026-08-16 live dependency disposition: pnpm outdated reports TypeScript 7.0.2. The installed typescript-eslint 8.67.0 peer range remains >=4.8.4 <6.1.0, so the canonical compiler/static-quality migration is still incompatible and remains open and deliberately unclaimed. Production audit and all GitHub Dependabot, code-scanning, and secret-scanning inventories are zero."
 body: ""

.agents/pm/chores/pm-ksr40d.toon

@@ -6,7 +6,7 @@ status: open
 priority: 3
 tags[4]: dependencies,node,package-install,runtime-floor
 created_at: "2026-07-26T08:28:38.948Z"
-updated_at: "2026-08-14T08:51:37.337Z"
+updated_at: "2026-08-16T18:36:24.675Z"
 author: "harness:codex"
 estimated_minutes: 90
 acceptance_criteria: The documented pm Node floor satisfies npm-package-arg 14 engines; Node 22/24/26 package install and source parsing tests pass; security and packed-consumer gates remain green; the major is adopted without narrowing support accidentally.
@@ -20,7 +20,7 @@ dependencies[6]{id,kind,created_at}:
   pm-pae3wo,related,"2026-07-26T10:51:34.792Z"
   pm-u9d0,implements,"2026-07-26T10:51:34.792Z"
   pm-xp1xsw,verifies,"2026-07-26T10:51:34.792Z"
-comments[16]{created_at,author,text}:
+comments[17]{created_at,author,text}:
   "2026-07-26T08:28:38.948Z","harness:codex","Duplicate-check evidence: all-status searches for npm-package-arg and npm-package-arg 14 found prior refresh/security items but no active major-upgrade owner. Live npm metadata on 2026-07-26 requires ^22.22.2, ^24.15.0, or >=26.0.0; package.json still supports >=22.18.0, so the major is engine-incompatible today."
   "2026-07-27T05:36:41.562Z","harness:codex","Live dependency disposition 2026-07-27: npm-package-arg 14.0.0 still requires Node ^22.22.2 || ^24.15.0 || >=26 while pm promises >=22.18.0. Dependabot PR #761 was closed with this PM link after all checks and bot reports were acknowledged; no package change or accidental runtime-floor narrowing was made."
   "2026-07-29T22:24:53.182Z","harness:codex","Live dependency refresh 2026-07-30: pnpm outdated still reports npm-package-arg 14.0.0 while pm promises Node >=22.18.0 and the recorded upstream floor starts at Node 22.22.2. pnpm audit reports no known vulnerabilities; adoption remains correctly open and unclaimed until the runtime-floor acceptance criteria are satisfied."
@@ -37,4 +37,5 @@ comments[16]{created_at,author,text}:
   "2026-08-09T07:49:41.505Z","harness:codex","2026-08-09 live dependency refresh: pnpm outdated still reports npm-package-arg 14.0.0 while pm publishes Node >=22.18.0 and the major requires Node ^22.22.2 || ^24.15.0 || >=26.0.0. This canonical runtime-floor migration remains open and unclaimed; pnpm audit and all three GitHub security inventories are zero."
   "2026-08-11T08:31:43.714Z","harness:codex","2026-08-11 live dependency disposition: npm-package-arg latest remains 14.0.0 and declares Node ^22.22.2 || ^24.15.0 || >=26.0.0, while pm-cli still publishes Node >=22.18.0. Adoption would violate the supported Node 22 floor, so this canonical major-migration item remains open and deliberately unclaimed; pnpm audit reports zero vulnerabilities."
   "2026-08-14T08:51:37.337Z","harness:codex","2026-08-14 live dependency disposition: pnpm outdated reports npm-package-arg 14.0.0; registry engines remain ^22.22.2 || ^24.15.0 || >=26.0.0 while pm-cli still publishes Node >=22.18.0. Adoption would violate the supported runtime floor, so this canonical item remains open and deliberately unclaimed. pnpm audit reports no known vulnerabilities and GitHub Dependabot/code/secret alert inventories are zero open."
+  "2026-08-16T18:36:24.675Z","harness:codex","2026-08-16 live dependency disposition: pnpm outdated reports npm-package-arg 14.0.0 while pm-cli still publishes Node >=22.18.0 and the canonical item records the upstream ^22.22.2 || ^24.15.0 || >=26 floor. Adoption would narrow the supported runtime contract, so this remains open and deliberately unclaimed. Production audit and all GitHub security alert inventories are zero."
 body: ""

.agents/pm/decisions/pm-4smp5b.toon

@@ -0,0 +1,32 @@
+id: pm-4smp5b
+title: "Decision: adopt reviewed defect-evidence field constraints into audited workspace history"
+description: Authorize append-only reconciliation of schema/fields.json after code review validated the semantic escape_class and gate_evidence constraints. The on-disk document is the intended public contract; restoration to the prior snapshot would remove the review-required fail-closed validation.
+type: Decision
+status: closed
+priority: 1
+tags: []
+created_at: "2026-08-16T22:49:00.290Z"
+updated_at: "2026-08-16T23:36:36.987Z"
+closed_at: "2026-08-16T22:49:07.548Z"
+completed_at: "2026-08-16T22:49:07.548Z"
+author: "harness:codex"
+acceptance_criteria: Decision is terminal before reconciliation; reconciliation appends forward and names this decision; pm history _workspace --verify reports replay-to-disk agreement
+goal: project management = context management
+objective: Keep customizable semantic field policy and workspace audit history in exact agreement
+value: Preserves the reviewed schema contract without rewriting immutable history
+impact: Restores record-integrity gates and makes the schema change reconstructable
+outcome: The reviewed disk value is appended as the next _workspace state
+why_now: Exact-head record-integrity detected schema/fields.json replay drift before merge
+parent: pm-1qkivy
+resolution: Authorize forward-only reconciliation of the reviewed schema/fields.json value into _workspace history.
+expected_result: Semantic field constraints remain on disk and become the verified latest audited workspace state.
+actual_result: Append-only workspace reconciliation completed through the public SDK; pm history _workspace --verify confirmed the latest replayed schema/fields.json state exactly matches disk.
+dependencies[3]{id,kind,created_at,author,source_kind,author_source}:
+  pm-1qkivy,discovered_from,"2026-08-16T22:49:00.290Z","harness:codex","cli:create:dep",detected
+  pm-klo8,implements,"2026-08-16T22:49:00.290Z","harness:codex","cli:create:dep",detected
+  pm-vhbf,verifies,"2026-08-16T23:02:36.289Z","harness:codex","cli:update:dep",detected
+comments[2]{created_at,author,text}:
+  "2026-08-16T22:49:00.290Z","harness:codex","Duplicate check 2026-08-17: all-status searches for workspace schema history reconciliation found the general closed workspace-history and schema-management capabilities,but no decision authorizing this reviewed semantic field snapshot. This record authorizes only schema/fields.json from PR #1043."
+  "2026-08-16T23:36:36.987Z","harness:codex","Clarification: the duplicate-check label used the local Europe/Vienna calendar date (2026-08-17); the immutable created_at timestamp is UTC on 2026-08-16. The search itself covered all statuses before this Decision was created."
+close_reason: Reviewed schema snapshot is explicitly authorized for append-only reconciliation; no history row may be rewritten.
+body: ""

.agents/pm/extensions/.managed-extensions.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-08-16T16:38:24.384Z",
+  "updated_at": "2026-08-17T01:15:42.158Z",
   "entries": [
     {
       "name": "pm-changelog",