Make branch merge decisions recoverable, replayable, and CI-enforced

.agents/pm/extensions/.managed-extensions.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-07-26T21:13:42.525Z",
+  "updated_at": "2026-07-27T00:31:33.109Z",
   "entries": [
     {
       "name": "pm-changelog",

.agents/pm/features/pm-feecbs.toon

@@ -6,7 +6,7 @@ status: open
 priority: 1
 tags[6]: ecosystem,packages,quality,sdk,security,verified-tier
 created_at: "2026-07-24T12:02:58.234Z"
-updated_at: "2026-07-26T05:49:51.510Z"
+updated_at: "2026-07-26T23:42:51.853Z"
 author: claude-code-agent
 estimated_minutes: 960
 acceptance_criteria: "A machine-readable matrix inventories every official external package and future candidate; a reusable package-owned preset or workflow enforces typecheck, lint, complexity, dead-export analysis, tests, coverage, duplication ratchet, production dependency audit, pack verification, isolated install/activate/doctor, and runtime action-contract smoke; shared maintenance logic is versioned once instead of copied across repositories; intentional shared code is documented and large vendored implementations such as pm-graph inside pm-web are replaced by an explicit package/build dependency or separately justified boundary; public SDK imports only use supported exports and subprocess fallback is limited to explicit process boundaries; package service/renderer ownership produces zero unexplained doctor warnings; install latency is measured with a documented budget and retry/noise policy; published npm artifacts and exact default-branch heads are both proven; no quality threshold is weakened and no package feature is removed."
@@ -20,8 +20,9 @@ dependencies[6]{id,kind,created_at,author,source_kind}:
   pm-vnjh,related,"2026-07-24T12:03:39.331Z",null,null
   pm-t4d7nz,verifies,"2026-07-25T06:27:55.347Z",null,null
   pm-6ixn,implements,"2026-07-26T05:49:51.319Z",null,null
-comments[1]{created_at,author,text}:
+comments[2]{created_at,author,text}:
   "2026-07-24T12:02:58.234Z",claude-code-agent,"Duplicate-check evidence: all-status search found pm-vnjh for the shipped external smoke harness, pm-o8um for the open trust ladder, pm-quzx for dependency ranges and duplicate beads/todos homes, pm-92if for core-repo quality, and pm-usfg for the public SDK boundary. None owns a fleet-wide lint, coverage, duplication, dead-code, security, and install-latency conformance floor, so this focused child extends pm-o8um and relates to those canonical owners."
+  "2026-07-26T23:42:51.853Z","harness:codex","Current ecosystem evidence (2026-07-27): the package-owned isolated smoke passes pm-github, pm-changelog, and pm-jira but fails six current published packages at SDK activation because they redeclare host-owned globals: pm-context and pm-brief shadow --author; pm-csv, @unbrained/pm-web, pm-presets, and pm-slack shadow --json. Reproduced with explicit latest-package inputs after the default 10-package discovery reported the same 6/10 failures. This is external published-package remediation under this canonical unclaimed conformance lineage, not a regression in the current merge-governance PR; do not create a duplicate."
 notes[1]{created_at,author,text}:
   "2026-07-24T12:06:04.881Z",claude-code-agent,"Current fleet scope is exactly the 18 public repositories pm-beads, pm-brief, pm-changelog, pm-context, pm-csv, pm-gantt-chart, pm-github, pm-graph, pm-jira, pm-linear, pm-ops, pm-presets, pm-slack, pm-slack-standup, pm-starter, pm-todos, pm-ts-starter, and pm-web. The gate should discover this inventory from authoritative catalog metadata so the list cannot silently drift."
 learnings[1]{created_at,author,text}:

.agents/pm/history/pm-76dnfg.jsonl

@@ -5,3 +5,14 @@
 {"ts":"2026-07-26T05:55:47.597Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","op":"update","patch":[{"op":"add","path":"/metadata/dependencies/10","value":{"id":"pm-o2kc","kind":"implements","created_at":"2026-07-26T05:55:47.376Z"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T05:55:47.597Z"}],"before_hash":"a05e10c06e88e2eec47ba8b01fcd47f21237451935d673940674bfee8b220429","after_hash":"e8862b57ff491265591b420885500769615e21b4a93da8f44d665ed549083d8d","message":"Strategic reachability edge: mirror the hierarchy rung into the typed layer so every active item resolves to an outcome milestone through an explainable implements path (pm-bzmeaa invariant), which the parent chain alone cannot express because it terminates at the roadmap root rather than at an outcome"}
 {"ts":"2026-07-26T05:59:53.320Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","op":"update","patch":[{"op":"add","path":"/metadata/dependencies/11","value":{"id":"pm-9j2r3b","kind":"verifies","created_at":"2026-07-26T05:59:53.053Z"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T05:59:53.320Z"}],"before_hash":"e8862b57ff491265591b420885500769615e21b4a93da8f44d665ed549083d8d","after_hash":"402b04faa8f670b42b68d2ed92b1ba1788890d13ae9322fda1377a1c6cf91d3f","message":"Typed verification edge: record which claim this gate or harness proves, so graph queries can answer what evidence backs an outcome"}
 {"ts":"2026-07-26T10:52:29.299Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","op":"update","patch":[{"op":"add","path":"/metadata/dependencies/12","value":{"id":"pm-10l1vm","kind":"related","created_at":"2026-07-26T10:52:29.023Z"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T10:52:29.299Z"}],"before_hash":"402b04faa8f670b42b68d2ed92b1ba1788890d13ae9322fda1377a1c6cf91d3f","after_hash":"dd782c7da3830fd79ce31b31a303fe3aed617dba0a374bfecceb5a9b0b3852d9","message":"Randomized multi-branch merge properties need a causally sound order to assert against"}
+{"ts":"2026-07-26T22:50:29.457Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T22:50:29.457Z"},{"op":"add","path":"/metadata/assignee","value":"harness:codex"},{"op":"add","path":"/metadata/claim_principal","value":"harness:codex#983770245168f533a68a42dd"}],"before_hash":"dd782c7da3830fd79ce31b31a303fe3aed617dba0a374bfecceb5a9b0b3852d9","after_hash":"c1f7ce1925e05cb68e0a0292e402a371cf5cf142289942aa3695dc8bb5dc0428"}
+{"ts":"2026-07-26T22:50:30.661Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T22:50:30.661Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"c1f7ce1925e05cb68e0a0292e402a371cf5cf142289942aa3695dc8bb5dc0428","after_hash":"f1e7de3dc95ebfb27e6434197c11b539f198f07db1f7e866cfff6401852d9d5e","message":"Start cohesive auditable merge-history and conformance implementation"}
+{"ts":"2026-07-26T23:42:54.832Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:42:54.832Z"},{"op":"add","path":"/metadata/files","value":[{"path":"src/sdk/merge/three-way.ts","scope":"project","note":"deterministic multi-branch collection and scalar merge primitive"},{"path":"tests/fuzz/project-boundaries.fuzz.spec.ts","scope":"project","note":"randomized N-branch convergence property suite"}]}],"before_hash":"f1e7de3dc95ebfb27e6434197c11b539f198f07db1f7e866cfff6401852d9d5e","after_hash":"9ba037559368a19db236b08a3c55eb0064faf96e3c52eda78368e316af4ea164"}
+{"ts":"2026-07-26T23:46:53.584Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"docs_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:46:53.584Z"},{"op":"add","path":"/metadata/docs","value":[{"path":"docs/MERGE_SAFETY.md","scope":"project","note":"audited branch merge installation receipts reconciliation and CI contract"}]}],"before_hash":"9ba037559368a19db236b08a3c55eb0064faf96e3c52eda78368e316af4ea164","after_hash":"f331740915254f01f3bcc30ef372895ed3e68357ddb3f5192569322e17c2cc20"}
+{"ts":"2026-07-26T23:46:56.967Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:46:56.967Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"node scripts/run-tests.mjs test -- tests/fuzz/project-boundaries.fuzz.spec.ts","scope":"project","timeout_seconds":300}]}],"before_hash":"f331740915254f01f3bcc30ef372895ed3e68357ddb3f5192569322e17c2cc20","after_hash":"5ad6473bb9c33059a53e09ebcdadbada629514c2659bc3b2bf33890d0c78c91e"}
+{"ts":"2026-07-26T23:47:26.217Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:47:26.217Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-07-26T23:47:26.217Z","author":"harness:codex","text":"Implementation evidence: the property suite now generates randomized 2-6 branch append sets and proves deterministic item convergence under original and reversed merge order across 250 runs, alongside history reanchor/replay properties. The suite found and bounded serializer-level tag whitespace normalization rather than weakening the convergence contract. Full coverage is exact 100/100/100/100."}]}],"before_hash":"5ad6473bb9c33059a53e09ebcdadbada629514c2659bc3b2bf33890d0c78c91e","after_hash":"d199d1274ec424229e97e690b9caa2120ed42fa66c5c5fcc2df1b7a240525996"}
+{"ts":"2026-07-26T23:47:27.023Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"learning_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:47:27.023Z"},{"op":"add","path":"/metadata/learnings","value":[{"created_at":"2026-07-26T23:47:27.022Z","author":"harness:codex","text":"Multi-branch conformance should generate canonical domain values and vary branch count, order, and append ownership. Serializer normalization belongs in the generator boundary; merge-order differences must never change the canonical result."}]}],"before_hash":"d199d1274ec424229e97e690b9caa2120ed42fa66c5c5fcc2df1b7a240525996","after_hash":"b3082147c45e01f47f49d83b40748a2001bd415e4dba11bf31efd6452885285f"}
+{"ts":"2026-07-26T23:48:54.499Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"test_run_track","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:48:54.499Z"},{"op":"add","path":"/metadata/test_runs","value":[{"run_id":"test-local-ms2g8uhq-swjo4h","kind":"test","status":"passed","started_at":"2026-07-26T23:48:43.929Z","finished_at":"2026-07-26T23:48:54.494Z","recorded_at":"2026-07-26T23:48:54.494Z","passed":1,"failed":0,"skipped":0}]}],"before_hash":"b3082147c45e01f47f49d83b40748a2001bd415e4dba11bf31efd6452885285f","after_hash":"4aaa4f8456c1099489c92026cd855574da604a99956b53833bb04dbaaf63113a","message":"Track test run summary (test-local-ms2g8uhq-swjo4h)"}
+{"ts":"2026-07-26T23:49:55.292Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-07-26T23:49:55.292Z","author":"harness:codex","text":"Final local verification: linked PM tests pass; full sandboxed suite passes 376 files and 6,437 tests at exact 100% statements (44,398/44,398), branches (31,515/31,515), functions (9,082/9,082), and lines (43,135/43,135). Lint, zero-duplicate scan, 100% docstring/static quality, SDK surface/import/transport ratchets, docs/skills, secret scan, npm audit, compatibility, packed npx, 88-command package-first dogfood, and Sentry 14-day zero-critical/zero-high gate pass. Live tracker strict validation checked 2,117 items and 2,128 history streams with zero drift, duplicate IDs, config errors, driver drift, or pending receipts. Telemetry successfully flushed to the configured endpoint at 2026-07-26T23:49:30.656Z."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:49:55.292Z"}],"before_hash":"4aaa4f8456c1099489c92026cd855574da604a99956b53833bb04dbaaf63113a","after_hash":"0c4bc337eb93128e4e95308d8fb3a4406b9324f0288e2587f3729136a50efcaa"}
+{"ts":"2026-07-26T23:50:18.767Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:50:18.767Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-07-26T23:50:18.767Z"},{"op":"add","path":"/metadata/close_reason","value":"Delivered randomized N-branch merge-order convergence properties and complete coverage for the merge primitives."}],"before_hash":"0c4bc337eb93128e4e95308d8fb3a4406b9324f0288e2587f3729136a50efcaa","after_hash":"2b0a88a1bdce88cb6b032168d529046bf3279e9667abee1a21cc4eb2f741cdce"}
+{"ts":"2026-07-26T23:50:21.407Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"983770245168f533a68a42dd","op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T23:50:21.407Z"}],"before_hash":"2b0a88a1bdce88cb6b032168d529046bf3279e9667abee1a21cc4eb2f741cdce","after_hash":"b1cab360b25a4479d6e3e2a5e4738d33175231d9dccac81900834a98f0085b69"}