feat(sdk): own schema primitives and modernize init prefixes

.agents/pm/chores/pm-2a9n.toon

@@ -6,18 +6,19 @@ status: closed
 priority: 2
 tags[4]: codeql,dependencies,github-actions,typescript
 created_at: "2026-07-10T09:40:10.713Z"
-updated_at: "2026-07-10T10:14:23.217Z"
+updated_at: "2026-07-14T20:01:09.326Z"
 closed_at: "2026-07-10T10:14:21.780Z"
 author: codex-root
 resolution: completed
 expected_result: "Keep CodeQL init/analyze pinned in lockstep to official v4.37.0, retain type-level enforcement of the Node 22 minimum runtime, and pass every required quality gate."
 actual_result: CodeQL v4.37.0 resolves to commit 99df26d4f13ea111d4ec1a7dddef6063f76b97e9; @types/node updates safely from 22.20.0 to 22.20.1 while the incompatible 26.x major is rejected. Typecheck and workflow contracts pass after the correction.
 dependencies[1]{id,kind,created_at,author,source_kind}:
   pm-2czc,related_to,"2026-07-10T09:40:20.682Z",codex-root,canonical_lineage
-comments[3]{created_at,author,text}:
+comments[4]{created_at,author,text}:
   "2026-07-10T09:40:10.713Z",codex-root,"Duplicate check: pm search --status all for @types/node 26.1.0/26.1.1, CodeQL 4.37.0, Dependabot #462/#465 found canonical historical unblocking lineage pm-2czc but no item for the current version refresh. This concrete batch links to that closed precedent and supersedes the two stale bot branches."
   "2026-07-10T09:58:01.513Z",codex-root,"Evidence: npm registry latest @types/node is 26.1.1 and lockfile integrity matches the registry. Official github/codeql-action v4.37.0 annotated tag peels to immutable commit 99df26d4f13ea111d4ec1a7dddef6063f76b97e9. Frozen install, TypeScript 6 typecheck, CI workflow contract suite, production audit, contract snapshot, ESLint, jscpd 0 clones, static/docstring gate, token budget, docs/skills, secret scan, and 88-command package-first dogfood all pass. Full coverage: 270 files, 5,506 tests, statements 34380/34380, branches 24588/24588, functions 6882/6882, lines 33039/33039."
   "2026-07-10T10:07:14.948Z",codex-root,"Pre-push review correction: Greptile c3c227b6-2938-4f6a-b779-27fe90419cdc correctly identified that @types/node 26 would weaken the Node >=22.18.0 compile-time compatibility guard. Accepted: moved to current Node-22 patch 22.20.1 instead, retained engines.node, re-ran typecheck and workflow contracts, and removed the security tag so pm-changelog routes the maintenance entry accurately."
+  "2026-07-14T20:01:09.326Z",codex-root,"Live follow-up 2026-07-14: Dependabot reopened the rejected major as PR #540 (@types/node 26.1.1); build foundation and Docs fail while downstream CI is skipped. The closed decision remains current: preserve the Node 22 compile-time compatibility guard and do not merge the Node 26 declarations without an intentional runtime-floor migration. This SDK lane does not claim or modify that dependency branch."
 notes[1]{created_at,author,text}:
   "2026-07-10T09:58:02.248Z",codex-root,"GitHub consolidation: this batch supersedes stale Dependabot PR #462 (@types/node 26.1.0, while registry latest is 26.1.1) and behind-main PR #465 (CodeQL v4.37.0). Close both only after this combined current-version PR merges."
 learnings[1]{created_at,author,text}:

.agents/pm/epics/pm-qwoy.toon

@@ -6,14 +6,15 @@ status: open
 priority: 2
 tags[5]: capability,code-scanning,dependabot,security,semgrep
 created_at: "2026-07-06T21:07:27.273Z"
-updated_at: "2026-07-14T10:18:55.307Z"
+updated_at: "2026-07-14T20:01:08.602Z"
 author: maintainer-agent
 estimated_minutes: 2400
 acceptance_criteria: All code-scanning findings (Semgrep/CodeQL/dependabot/secrets) are tracked as pm issues under this epic with source links and triage state; recurring scanner imports parent their batch tasks here; epic stays OPEN as a living backlog even at 0 open children.
 parent: pm-doxj
 risk: high
 confidence: high
-comments[2]{created_at,author,text}:
+comments[3]{created_at,author,text}:
   "2026-07-13T19:42:42.258Z",codex-root,"Live GitHub security/dependency sweep 2026-07-13: Dependabot alert API contains 39 fixed and 0 open alerts; code-scanning contains 10 fixed and 0 open alerts; secret-scanning contains 0 alerts; pnpm audit reports 0 vulnerabilities at every severity. Five dependency-update PRs are open and remain isolated for their own review: #537 dev-dependencies group, #538 @sentry/node 10.64.0, #539 TypeScript 7.0.2, #540 @types/node 26.1.1, #541 eslint-plugin-unicorn 71.1.0. No duplicate pm item created and none were claimed in this context implementation lane."
   "2026-07-14T10:18:55.307Z",codex-gpt5,"Live GitHub security/dependency sweep 2026-07-14: Dependabot, code-scanning, and secret-scanning APIs each return zero open alerts; pnpm audit --audit-level high reports no known vulnerabilities. Open dependency PRs are #552 grouped dev dependencies, #541 eslint-plugin-unicorn 71.1.0, #540 @types/node 26.1.1, #539 TypeScript 7.0.2, and #538 @sentry/node 10.65.0. They remain isolated/unclaimed for their own compatibility review."
+  "2026-07-14T20:01:08.602Z",codex-root,"Live GitHub security/dependency reconciliation 2026-07-14 22:00 CEST: Dependabot, code-scanning, and secret-scanning APIs each report 0 open alerts. Open dependency PRs remain isolated and unclaimed: #552 and #541 are fully green; #538 is fully green; #539 TypeScript 7.0.2 fails static, coverage-shard, and Windows compatibility gates; #540 @types/node 26.1.1 fails build/docs and is incompatible with the repository's Node >=22.18 declaration contract already decided in pm-2a9n. No duplicate security or dependency item created by this SDK lane."
 body: "# Capability: Security & code scanning (living backlog)\n\nOwns repository security posture work that previously had no capability home:\n- Semgrep Code finding triage batches (first import: pm-oz8u, 40 findings from 2026-07-06 CSV — 6 High spawn-shell-true, 34 Medium prototype-pollution/non-literal-RegExp/dependabot-cooldown).\n- Dependabot dependency hygiene (pm-2czc closed the 2026-07-06 unblock: @types/node 26, pnpm cooldown, codeql-action lockstep group).\n- Secret guardrails and history-redact usage policy (see 2026-05-22 history-repair learning: never quote secret-pattern literals into pm text).\n- Future CodeQL / scanner integrations.\n\nConvention: each scanner import creates one batch Task parented here, with one Issue per platform finding (Semgrep ID as issue code) so findings stay individually triageable. Sibling epic pm-92if owns CodeFactor (maintainability) findings; this epic owns security-class findings."

.agents/pm/features/pm-3mna.toon

@@ -6,7 +6,7 @@ status: open
 priority: 2
 tags[4]: architecture,"area:config","area:schema","area:sdk"
 created_at: "2026-07-05T04:54:11.971Z"
-updated_at: "2026-07-12T09:50:13.504Z"
+updated_at: "2026-07-14T20:44:57.242Z"
 author: maintainer-agent
 estimated_minutes: 360
 acceptance_criteria: SDK exports typed schema/config/profile/init primitives with the same validation + never-block errors as the CLI; corresponding commands consume only these primitives; docstrings + linked tests + SDK reference docs; zero behavior change
@@ -17,7 +17,7 @@ dependencies[3]{id,kind,created_at,author,source_kind}:
   pm-lodl,blocked_by,"2026-07-05T04:55:07.462Z",null,null
   pm-muhw,blocked_by,"2026-07-05T04:55:08.057Z",null,null
   pm-69nl,related,"2026-07-10T17:32:56.925Z",null,null
-comments[9]{created_at,author,text}:
+comments[13]{created_at,author,text}:
   "2026-07-07T20:44:47.549Z",codex-agent,"Implementation start: bundled with pm-zwpp, pm-oxrw, pm-m4iu, pm-cbwg, pm-w89s, and pm-usfg. Live duplicate/context check found no closed schema/config/profile SDK primitive completion; prior read/lifecycle/package primitives remain separate shipped or in-progress domains."
   "2026-07-07T22:45:27.701Z",claude-code-agent,"Evidence: post-review docs/API cleanup keeps package authors on the correct context-management primitive shapes: linked file/doc adds use string arrays and top-level note, while SchemaResult documents the generic schema customization result union. Verified through docs gate, typecheck, focused SDK tests, and packed installed SDK proof."
   "2026-07-07T23:52:21.378Z",claude-code-agent,"Review follow-up evidence: the generic SDK schema() return type now explicitly includes all concrete inspect results as well as schema mutation results, preserving compile-time safety for customization primitive consumers. Focused SDK test and full coverage passed."
@@ -27,23 +27,39 @@ comments[9]{created_at,author,text}:
   "2026-07-11T23:15:37.998Z",codex-root,"Progress evidence: promoted workspace cache scaffolding into a typed public SDK primitive consumed by pm init, documented and packed-consumer tested. The broader schema/config/profile/init command-to-core extraction remains open; this PR does not claim full pm-3mna completion."
   "2026-07-12T08:31:32.782Z",codex-root,"Implementation start: active wide SDK bundle promotes schema mutation orchestration behind typed public primitives after the runtime dispatch decomposition; live blockers pm-lodl and pm-muhw are closed with shipped evidence."
   "2026-07-12T09:50:10.298Z",codex-root,"Scope reconciliation: no schema mutation primitive implementation landed in this branch; item returned to open so only actively delivered annotation work remains completed/in review."
+  "2026-07-14T19:24:55.099Z",codex-gpt5,"Implementation start 2026-07-14: live full-tracker/all-status and GitHub reconciliation selected the schema domain extraction as the broad SDK-first lane. This run will move schema primitive/types ownership out of src/cli, make CLI registration a presentation adapter, update public SDK docs/tests, and preserve behavior."
+  "2026-07-14T19:40:59.373Z",codex-gpt5,"Progress evidence: schema inspection/mutation ownership now lives in src/sdk/schema.ts; the CLI module is a compatibility re-export and SDK runtime imports schema primitives directly. Focused schema/SDK tests, 100% docstring static gate, package boundary, token budget, docs/skills, and governed contract checks pass."
+  "2026-07-14T20:19:47.964Z",codex-root,"Final branch evidence: schema inspection/mutation ownership moved from the CLI into src/sdk/schema.ts; the CLI is now a compatibility re-export and SDK runtime/MCP consume the SDK-owned engine. The import-boundary ratchet removed 17 schema edges, stale suppressions were deleted, and the hard suppression budget fell 174 -> 170. Exact verification on the final source: 290 files / 5,701 tests; 36,848/36,848 statements, 26,463/26,463 branches, 7,438/7,438 functions, 35,963/35,963 lines; typecheck, strict lint, zero-clone, 100% module/export/member docstrings, package boundary, token budget, docs, contracts, security, version, packed npm smoke, 88-command dogfood, and fresh external PmClient schema/custom-type lifecycle all pass. Broader config/profile/init implementation ownership remains for this feature, so it returns to open."
+  "2026-07-14T20:44:53.761Z",codex-root,"PR #563 round-1 review: accepted both CodeRabbit maintainability findings. runSchemaAddType and loadSchemaInspectionContext now share ensureInitialized; all eight mutation results use finalizeWarnings for stable dedupe/sort. Focused schema/init/MCP tests, typecheck, static quality, and exact 100/100/100/100 coverage pass. The CodeRabbit external docstring heuristic warning is contradicted by the repository's mandatory 100% module/export/member docstring gate, which remains green."
 notes[3]{created_at,author,text}:
   "2026-07-10T17:32:56.449Z",maintainer-agent,"Implementation slicing 2026-07-10 (grounded in current src state). Already public — do NOT redo: profile read-side (presets/plan/describe/lint exported via src/sdk/index.ts), schema runtime registries (resolveRuntimeFieldRegistry/resolveRuntimeStatusRegistry via src/sdk/runtime.ts), and generic PmClient.runTyped wrappers for the schema/config/profile/init actions. The actual gap: domain logic lives in CLI command modules — src/cli/commands/schema.ts (1973 lines), config.ts (1576), init.ts (955) + init-agent-guidance.ts (566), ~5.1k lines total — so SDK consumers reach these domains only through generic action dispatch, not typed primitives. Suggested slices: S1 schema mutation primitives (~150m) — extract add-type/add-field/status-def write paths into src/core/schema (fields-file/item-types-file/status-defs-file already own the file formats); command becomes parse+render. S2 config/settings primitives (~90m) — extract read/write/validate onto src/core/config/nested-settings; preserve the settings validator's unknown-key-stripping semantics (PR#314). S3 init + workspace-discovery primitive (~90m) — single source of truth for discovery; this is where the GH-501/pm-69nl class (init target invisible to discovery) gets fixed at the primitive level — coordinate with pm-69nl, do not duplicate its fix. S4 typed PmClient facades + SDK reference docs/tests (~60m) — replace generic payloads with typed inputs/outputs; each primitive must match the equivalent runAction result shape (semantics oracle, pm-usfg 07-06 note). Order: S1 first (schema gates the pm-w89s universality story); S2/S3 independent; S4 last."
   "2026-07-12T06:11:44.315Z",maintainer-agent,"Adjacent ship, scope intact: PR#520 (2026-07-12) promoted the FIRST workspace-customization primitive through the public SDK (ensurePmGitignore/getPmGitignoreBlock in src/sdk/workspace.ts) and made init consume it — proof the init-adjacent SDK boundary works end-to-end (packed-tarball external-consumer proof in PR verification). This does NOT deliver S1: schema/config/profile/init command families are still CLI-owned. Use src/sdk/workspace.ts as the pattern exemplar when starting S1."
   "2026-07-12T08:43:59.620Z",codex-root,"Execution rule from user escalation (23rd recurrence): this active delivery lane must not stop at partial implementation, local verification, commit, PR creation, pending checks, or pending bot review. Continue through the requested green reviewed PR, merge, merged-head/release/Sentry/telemetry proof, tracker closure, claim release, and return to main; only a genuine exhausted blocker permits stopping."
-files[4]{path,scope,note}:
+learnings[1]{created_at,author,text}:
+  "2026-07-14T20:19:48.566Z",codex-root,"Moving a CLI command engine into the SDK must also migrate its lint baseline, residual test mocks, and runtime imports; keeping a tiny CLI re-export preserves compatibility while the SDK becomes the single implementation owner."
+files[9]{path,scope,note}:
+  eslint-suppressions.json,project,Remove stale CLI schema suppressions after SDK extraction and lint cleanup
+  scripts/release/sdk-import-boundary-baseline.json,project,schema CLI private-core edges removed from ratchet baseline
+  scripts/release/static-quality-gate.mjs,project,Ratchet ESLint suppressions budget from 174 to 170 after schema CLI suppressions are eliminated
+  src/cli/commands/schema.ts,project,presentation compatibility re-export over SDK schema engine
   src/sdk/index.ts,project,SDK barrel exports customization primitive contracts
   src/sdk/runtime.ts,project,SDK runtime exposes init/config/schema/profile customization primitives
+  src/sdk/schema.ts,project,SDK-owned schema inspection and mutation engine
   src/sdk/workspace.ts,project,Public workspace customization primitive
   tests/unit/sdk/sdk-context-primitives.spec.ts,project,SDK customization primitive coverage
-tests[2]:
+tests[3]:
   - command: node scripts/run-tests.mjs test -- tests/unit/core/workspace/gitignore.spec.ts tests/unit/sdk/sdk-index.spec.ts
     scope: project
     timeout_seconds: 240
   - command: node scripts/run-tests.mjs test -- tests/unit/sdk/sdk-context-primitives.spec.ts
     scope: project
     timeout_seconds: 120
     pm_context_mode: tracker
+  - command: node scripts/run-tests.mjs test -- tests/unit/sdk/sdk-context-primitives.spec.ts tests/unit/commands/schema-command.spec.ts
+    scope: project
+    timeout_seconds: 240
+test_runs[1]{run_id,kind,status,started_at,finished_at,recorded_at,passed,failed,skipped}:
+  test-local-mrl3gn11-idibzy,test,passed,"2026-07-14T20:18:03.384Z","2026-07-14T20:18:58.069Z","2026-07-14T20:18:58.069Z",3,0,0
 docs[1]{path,scope,note}:
   docs/SDK.md,project,SDK customization primitive reference docs
 body: ""

.agents/pm/history/pm-2a9n.jsonl

@@ -36,3 +36,4 @@
 {"ts":"2026-07-10T10:14:19.973Z","author":"codex-root","op":"comment_delete","patch":[{"op":"remove","path":"/metadata/comments/3"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-10T10:14:19.973Z"}],"before_hash":"520be207369003d212765a45b048e343582142cf0a511db895f721659d611250","after_hash":"aaf7b46a42990c0bebd673812d4e6c3f83e0ea23cae406c7695d3e13b2d79fe3"}
 {"ts":"2026-07-10T10:14:21.781Z","author":"codex-root","op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-10T10:14:21.781Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-07-10T10:14:21.780Z"},{"op":"add","path":"/metadata/close_reason","value":"Updated CodeQL to v4.37.0 and @types/node to compatible 22.20.1; rejected Node 26, preserved Node 22 type safety, and removed duplicate tracker evidence identified in review."}],"before_hash":"aaf7b46a42990c0bebd673812d4e6c3f83e0ea23cae406c7695d3e13b2d79fe3","after_hash":"f4c4cbe7198b97e3200773a2f67704b299ccecd24f130db48cad5b8e11d47de6"}
 {"ts":"2026-07-10T10:14:23.217Z","author":"codex-root","op":"release","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-10T10:14:23.217Z"}],"before_hash":"f4c4cbe7198b97e3200773a2f67704b299ccecd24f130db48cad5b8e11d47de6","after_hash":"b42c20b80a0e1c20c059fc1777dd758fdf4560674c525ae121f34a55aad0dfe3"}
+{"ts":"2026-07-14T20:01:09.326Z","author":"codex-root","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-07-14T20:01:09.326Z","author":"codex-root","text":"Live follow-up 2026-07-14: Dependabot reopened the rejected major as PR #540 (@types/node 26.1.1); build foundation and Docs fail while downstream CI is skipped. The closed decision remains current: preserve the Node 22 compile-time compatibility guard and do not merge the Node 26 declarations without an intentional runtime-floor migration. This SDK lane does not claim or modify that dependency branch."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-14T20:01:09.326Z"}],"before_hash":"b42c20b80a0e1c20c059fc1777dd758fdf4560674c525ae121f34a55aad0dfe3","after_hash":"c911e5688a7760d5ce4a619fde89ee8654469154fcfd91f84992debab8253984"}