SDK lifecycle provenance and context-rich CLI primitives

.agents/pm/chores/pm-77bmeu.toon

@@ -0,0 +1,42 @@
+id: pm-77bmeu
+title: Refresh compatible 2026-07-29 development dependencies
+description: "Adopt the current @types/node and jscpd patch releases while retaining Sentry, npm-package-arg, and TypeScript on their live canonical compatibility deferrals."
+type: Chore
+status: closed
+priority: 3
+tags[3]: dependencies,quality,release
+created_at: "2026-07-28T23:19:18.831Z"
+updated_at: "2026-07-29T01:06:05.237Z"
+closed_at: "2026-07-29T01:02:55.843Z"
+completed_at: "2026-07-29T01:02:55.843Z"
+author: "harness:codex"
+estimated_minutes: 60
+acceptance_criteria: "@types/node and jscpd use latest compatible patches; lockfile is current; canonical Sentry/npm-package-arg/TypeScript incompatibility decisions remain linked; build, coverage, static quality, security, and packed consumer gates pass"
+resolution: Compatible development dependencies were refreshed while incompatible majors remain on their canonical evidence-backed items and the suppression ceiling was lowered.
+expected_result: The supported dependency graph remains vulnerability-free and all quality contracts pass without weakening compatibility.
+actual_result: "@types/node 26.1.2 and jscpd 5.0.14 pass audit lint typecheck contracts dogfood and 6,497 tests at exact 100 percent coverage; suppression budget is 130."
+dependencies[4]{id,kind,created_at,author,source_kind,author_source}:
+  pm-r31390,related_to,"2026-07-28T23:19:18.831Z","harness:codex","cli:create:dep",detected
+  pm-do5b,related,"2026-07-28T23:20:02.694Z","harness:codex","cli:update:dep",detected
+  pm-ksr40d,related,"2026-07-28T23:20:02.694Z","harness:codex","cli:update:dep",detected
+  pm-feecbs,verifies,"2026-07-29T01:01:36.773Z","harness:codex","cli:update:dep",detected
+comments[3]{created_at,author,text}:
+  "2026-07-28T23:19:18.831Z","harness:codex","Duplicate check: searched all statuses for the exact dependency names and current outdated inventory. Historical refreshes are terminal; pm-r31390, pm-do5b, and pm-ksr40d remain the canonical disposition records for incompatible candidates. This item owns only the two newly available compatible patches."
+  "2026-07-29T00:42:32.105Z","harness:codex","Verification note: the production audit linked test passed. A nested pnpm test:coverage run under pm test failed because the linked-test sandbox deliberately injects an outer PM_PATH and broad root-fixture ownership tests then observe the sandbox tracker. This is harness-context contamination rather than a product failure; the unsafe recursive link was removed and the complete suite is rerun directly from the repository root."
+  "2026-07-29T01:01:42.876Z","harness:codex","Delivery evidence: adopted compatible @types/node 26.1.2 and jscpd 5.0.14 patches, refreshed the lockfile, and burned the ESLint suppression ceiling from 131 to 130. Production audit reports no vulnerabilities. Sentry 10.68 remains rejected by closed pm-r31390, TypeScript 7 remains on pm-do5b, and npm-package-arg 14 remains on pm-ksr40d because their live compatibility evidence is unresolved. Final direct coverage passed 6,497 tests at exact 100/100/100/100."
+files[6]{path,scope,note}:
+  eslint-suppressions.json,project,compatible dependency patches and pruned quality baseline
+  package.json,project,compatible dependency patches and pruned quality baseline
+  pnpm-lock.yaml,project,compatible dependency patches and pruned quality baseline
+  scripts/release/static-quality-gate.mts,project,burned down ESLint suppression ratchet from 131 to 130 with contract proof
+  tests/integration/release-automation-contract.spec.ts,project,burned down ESLint suppression ratchet from 131 to 130 with contract proof
+  tests/integration/release-readiness-runtime.spec.ts,project,runtime release gate pins the tightened suppression baseline
+tests[1]{command,scope,timeout_seconds}:
+  pnpm audit --prod,project,240
+test_runs[2]{run_id,kind,status,started_at,finished_at,recorded_at,passed,failed,skipped}:
+  test-local-ms5d11q6-qq0ffl,test,failed,"2026-07-29T00:38:24.402Z","2026-07-29T00:42:10.303Z","2026-07-29T00:42:10.303Z",1,1,0
+  test-local-ms5dvsx7-7ki76g,test,passed,"2026-07-29T01:06:02.154Z","2026-07-29T01:06:05.228Z","2026-07-29T01:06:05.228Z",1,0,0
+docs[1]{path,scope,note}:
+  CHANGELOG.md,project,package-generated dependency and quality delivery ledger
+close_reason: Compatible dependency patches and stricter quality ratchet verified
+body: ""

.agents/pm/extensions/.managed-extensions.json

@@ -1,12 +1,12 @@
 {
   "version": 1,
-  "updated_at": "2026-07-28T18:03:16.452Z",
+  "updated_at": "2026-07-29T01:46:04.903Z",
   "entries": [
     {
       "name": "pm-changelog",
       "directory": "pm-changelog",
       "scope": "project",
-      "manifest_version": "2026.7.28",
+      "manifest_version": "2026.7.29",
       "manifest_entry": "./dist/extension.js",
       "capabilities": [
         "commands",
@@ -15,13 +15,13 @@
         "schema"
       ],
       "installed_at": "2026-05-23T20:26:03.509Z",
-      "updated_at": "2026-07-28T11:15:35.337Z",
+      "updated_at": "2026-07-29T01:03:28.501Z",
       "source": {
         "kind": "npm",
         "input": "npm:pm-changelog",
         "location": "package",
         "package": "pm-changelog",
-        "version": "2026.7.28"
+        "version": "2026.7.29"
       }
     }
   ]

.agents/pm/history/pm-5ecnar.jsonl

@@ -3,3 +3,12 @@
 {"ts":"2026-07-26T05:59:19.719Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","op":"update","patch":[{"op":"add","path":"/metadata/dependencies/3","value":{"id":"pm-33cw","kind":"implements","created_at":"2026-07-26T05:59:19.546Z"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T05:59:19.719Z"}],"before_hash":"3360678b5f6f1e9c49c8544baab6eb148ffe81920c322f380fa1a5cca6f7a28d","after_hash":"807575bb89445fcefbc5f1293d834912051bf48eb41e7fe566bdf7247aec4429","message":"Typed strategic edge: connect the outcome ladder so milestone reachability is computable by graph traversal instead of inferred from untyped related edges"}
 {"ts":"2026-07-26T10:56:04.669Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","op":"update","patch":[{"op":"add","path":"/metadata/dependencies/4","value":{"id":"pm-pim7","kind":"discovered_from","created_at":"2026-07-26T10:56:04.444Z"}},{"op":"replace","path":"/metadata/parent","value":"pm-mpbb"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T10:56:04.669Z"},{"op":"add","path":"/metadata/estimated_minutes","value":180}],"before_hash":"807575bb89445fcefbc5f1293d834912051bf48eb41e7fe566bdf7247aec4429","after_hash":"2a27292500b27cd26edc013221ec03a8a79e9808e1d15e07905d73d9aac2611a","message":"Re-parent off the closed mutation-guard item to the live CLI-surface epic, preserving lineage; the work is config help and output rendering"}
 {"ts":"2026-07-28T15:15:26.301Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","agent_instance":"f2bb9c2fdaed86b50270c7c8","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-28T15:15:26.301Z"},{"op":"add","path":"/metadata/risk","value":"low"},{"op":"add","path":"/metadata/confidence","value":90}],"before_hash":"2a27292500b27cd26edc013221ec03a8a79e9808e1d15e07905d73d9aac2611a","after_hash":"0a3d50368584224c1100663bdc2e6f797727a054c53c036e956384b9ebcc16b3","message":"Backfill risk and confidence for active-item metadata completeness"}
+{"ts":"2026-07-28T22:57:11.531Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-28T22:57:11.531Z"},{"op":"add","path":"/metadata/assignee","value":"harness:codex"},{"op":"add","path":"/metadata/claim_principal","value":"harness:codex#87347b071d1305e7d9cbbd27"}],"before_hash":"0a3d50368584224c1100663bdc2e6f797727a054c53c036e956384b9ebcc16b3","after_hash":"838911720cb247d12b4fd9092f93a2b767bd963f6ccfdd150f1ade7d9142e1b7"}
+{"ts":"2026-07-28T22:57:12.435Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-28T22:57:12.435Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"838911720cb247d12b4fd9092f93a2b767bd963f6ccfdd150f1ade7d9142e1b7","after_hash":"cd2874f46b541cd0f77ef234e58bb4b6c48f5eef6320223d1ac9e6777dddc60e","message":"Start SDK-first lifecycle and context fidelity bundle"}
+{"ts":"2026-07-29T00:23:09.793Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"files_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T00:23:09.793Z"},{"op":"add","path":"/metadata/files","value":[{"path":"src/cli/register-setup.ts","scope":"project","note":"mutation guard configuration discovery implementation and regression proof"},{"path":"src/sdk/config.ts","scope":"project","note":"mutation guard configuration discovery implementation and regression proof"},{"path":"tests/unit/commands/config-key-aliases-search.spec.ts","scope":"project","note":"mutation guard configuration discovery implementation and regression proof"}]}],"before_hash":"cd2874f46b541cd0f77ef234e58bb4b6c48f5eef6320223d1ac9e6777dddc60e","after_hash":"4feea70a8ddad6571265bbdbbfc6b5cf9cc21bb36b4fafa5f4e1234ae7161b0e","message":"Link configuration delivery artifacts"}
+{"ts":"2026-07-29T00:23:14.406Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"docs_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T00:23:14.406Z"},{"op":"add","path":"/metadata/docs","value":[{"path":"docs/CONFIGURATION.md","scope":"project","note":"canonical mutation guard configuration guidance"}]}],"before_hash":"4feea70a8ddad6571265bbdbbfc6b5cf9cc21bb36b4fafa5f4e1234ae7161b0e","after_hash":"56b5175db9eb5321469eccd7db8099bbc2fefd55e111508260a2464796b1368a","message":"Link configuration documentation"}
+{"ts":"2026-07-29T00:23:33.786Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T00:23:33.786Z"},{"op":"add","path":"/metadata/tests","value":[{"command":"node scripts/run-tests.mjs test -- tests/unit/commands/config-key-aliases-search.spec.ts","scope":"project","timeout_seconds":240}]}],"before_hash":"56b5175db9eb5321469eccd7db8099bbc2fefd55e111508260a2464796b1368a","after_hash":"ad3ee0fe4eae70075b3c32ad3393a639684373d5a892144c65c0b660726f0907","message":"Link focused config discoverability suite"}
+{"ts":"2026-07-29T00:37:50.780Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"test_run_track","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T00:37:50.780Z"},{"op":"add","path":"/metadata/test_runs","value":[{"run_id":"test-local-ms5cvhh3-b5ij79","kind":"test","status":"passed","started_at":"2026-07-29T00:37:42.351Z","finished_at":"2026-07-29T00:37:50.775Z","recorded_at":"2026-07-29T00:37:50.775Z","passed":1,"failed":0,"skipped":0}]}],"before_hash":"ad3ee0fe4eae70075b3c32ad3393a639684373d5a892144c65c0b660726f0907","after_hash":"500085e3ef3eef614deeebedfee55a3a4928ae145de3626498aba69b189f5915","message":"Track test run summary (test-local-ms5cvhh3-b5ij79)"}
+{"ts":"2026-07-29T01:01:40.389Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-07-29T01:01:40.389Z","author":"harness:codex","text":"Delivery evidence: mutation guard nested settings are now present in canonical config inventory and help with canonical keys, paths, types, choices, defaults, and kebab-case guidance. The linked 24-test config suite passed; packed acceptance found mutation-guard-secret-guard with value advise in project config JSON."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T01:01:40.389Z"}],"before_hash":"500085e3ef3eef614deeebedfee55a3a4928ae145de3626498aba69b189f5915","after_hash":"8a20a316b16dc1dd479285186be66e7d09f65c45e28a2ba3023e1e7e9c6ce344"}
+{"ts":"2026-07-29T01:02:33.597Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T01:02:33.597Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-07-29T01:02:33.592Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-07-29T01:02:33.592Z"},{"op":"add","path":"/metadata/resolution","value":"Canonical config help and inventory now expose mutation guard nested settings with typed metadata and supported choices."},{"op":"add","path":"/metadata/expected_result","value":"Operators can discover and configure author attribution secret guard and stale-work thresholds from pm config."},{"op":"add","path":"/metadata/actual_result","value":"Focused tests and packed config inventory expose all mutation-guard keys including secret-guard advise/block choices."},{"op":"add","path":"/metadata/close_reason","value":"Mutation guard configuration discovery implemented and verified"}],"before_hash":"8a20a316b16dc1dd479285186be66e7d09f65c45e28a2ba3023e1e7e9c6ce344","after_hash":"9b55bb05b263a4206c02e3ad7c6405d1c7417a2fa1918a66ab87a73672bfeee6"}
+{"ts":"2026-07-29T01:02:36.840Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_instance":"87347b071d1305e7d9cbbd27","agent_provenance":{"model":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-07-29T01:02:36.840Z"}],"before_hash":"9b55bb05b263a4206c02e3ad7c6405d1c7417a2fa1918a66ab87a73672bfeee6","after_hash":"dc82d2316c65f1f2ee8c4580556b806368610dc33ff7527f84c29e4e56bd8506","message":"Release completed config discovery implementation"}