[dependabot]

Bumps the pm-toolchain group with 3 updates in the / directory: @unbrained/pm-cli, pm-changelog and pm-ops.

Updates @unbrained/pm-cli from 2026.10.28 to 2026.11.1

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.11.1

@​unbrained/pm-cli 2026.11.1

Source range: v2026.10.31...v2026.11.1

Changelog

Fixed

• MCP read tools read every declared flat parameter, pm_search honours its keywords alias, and filtered pm context keeps dependency edges (pm-hke9z7)
• GH-1642: compact brief pm list and pm search TOON envelopes while keeping the effective default sort visible (pm-gh1642)
• GH-1644: disclose when a --for intent reduces an explicit --limit and recommend the measured canonical pm context --for orient (pm-gh1644)
• GH-1643: make pm claim --next --start one atomic select-claim-start write and type the claim-target refusals (pm-gh1643)

PM Tracker Evidence

Closed pm items in release window: 4 By type: Issue=4 By status: closed=4

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.31

@​unbrained/pm-cli 2026.10.31

Source range: v2026.10.30...v2026.10.31

Changelog

Changed

• Update Sentry CLI to 3.8.2 after seven-day cooldown (pm-sentry-cli-382)

Fixed

• Successful linked-test receipts carry non-actionable execution_context and all-zero failure_categories, even under --lean (pm-covpax)
• Unknown-option recovery drops a dash-leading prose value: the advertised replay closes, comments or creates without the user's text (pm-stq61b)
• GH-1633: accept comma-separated --unset field lists with per-field validation (pm-gh1633)
• GH-1630: bound selective linked-test receipts to the selected collection (pm-gh1630)
• GH-1626: offer same-command replay corrections for brief completeness spellings (pm-gh1626)
• GH-1609: recover killed commit owners and bound lock waits with a monotonic clock (pm-gh1609)
• GH-1624: define typed Unicode handling for extension output across JSON and TOON (pm-gh1624)
• GH-1625: align extension-refusal Sentry capture with declared contracts and telemetry source context (pm-gh1625)
• GH-1602: keep preflight warnings inside JSON error envelopes (pm-gh1602)
• Bound independent native receipt regression cases (pm-native-index-proof)
• GH-1558: Settle Windows generation-fixture rename rejections without weakening lock assertions (pm-gh1558)
• pm close clears the assignee but leaves claim_principal, so closed claimed items keep an active owner (pm-8xgg7i)
• GH-1618: prevent automated comment churn from misleading next-work priority (pm-gh1618)
• GH-1610: compact lean refusals and expose structured claim context (pm-gh1610)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.11.1 - 2026-11-01

Fixed

• MCP read tools read every declared flat parameter, pm_search honours its keywords alias, and filtered pm context keeps dependency edges (pm-hke9z7)
• GH-1642: compact brief pm list and pm search TOON envelopes while keeping the effective default sort visible (pm-gh1642)
• GH-1644: disclose when a --for intent reduces an explicit --limit and recommend the measured canonical pm context --for orient (pm-gh1644)
• GH-1643: make pm claim --next --start one atomic select-claim-start write and type the claim-target refusals (pm-gh1643)

2026.10.31 - 2026-10-31

Changed

• Update Sentry CLI to 3.8.2 after seven-day cooldown (pm-sentry-cli-382)

Fixed

• Successful linked-test receipts carry non-actionable execution_context and all-zero failure_categories, even under --lean (pm-covpax)
• Unknown-option recovery drops a dash-leading prose value: the advertised replay closes, comments or creates without the user's text (pm-stq61b)
• GH-1633: accept comma-separated --unset field lists with per-field validation (pm-gh1633)
• GH-1630: bound selective linked-test receipts to the selected collection (pm-gh1630)
• GH-1626: offer same-command replay corrections for brief completeness spellings (pm-gh1626)
• GH-1609: recover killed commit owners and bound lock waits with a monotonic clock (pm-gh1609)
• GH-1624: define typed Unicode handling for extension output across JSON and TOON (pm-gh1624)
• GH-1625: align extension-refusal Sentry capture with declared contracts and telemetry source context (pm-gh1625)
• GH-1602: keep preflight warnings inside JSON error envelopes (pm-gh1602)
• Bound independent native receipt regression cases (pm-native-index-proof)
• GH-1558: Settle Windows generation-fixture rename rejections without weakening lock assertions (pm-gh1558)
• pm close clears the assignee but leaves claim_principal, so closed claimed items keep an active owner (pm-8xgg7i)
• GH-1618: prevent automated comment churn from misleading next-work priority (pm-gh1618)
• GH-1610: compact lean refusals and expose structured claim context (pm-gh1610)
• GH-1627: bound the entire next response and compact optional TOON sections losslessly (pm-gh1627)
• GH-1628: preserve terminal timestamps for identical forced SDK updates (pm-gh1628)
• Pull-request CI requests 33 hosted-runner jobs per push against the account's 20-job concurrency cap, so required checks wait hours before they start (pm-m6ig79)
• Text refusals drop the specific What happened detail when an echoed argv overflows the diagnostic ceiling (pm-4oc353)
• GH-1622: investigate pm-presets SDK-loading fault blocking daily release (pm-gh1622)

Security

• Registry advisories GHSA-mrwp-f3q8-3g9p (follow-redirects 1.16.1, high) and GHSA-g3hv-75wg-m249 (minimatch 10.2.6, moderate) block the static gate on main and every PR (pm-irviv0)

2026.10.30 - 2026-10-30

Added

• GH-1597: expose host-bound item transaction status and safe abandonment or supersession (pm-gh1597)
• GH-1598: bind batch mutation APIs to PmClient and expose canonical staged preview records (pm-gh1598)

Fixed

... (truncated)

Commits

• 68fc20a chore(release): cut 2026.11.1
• 4bdd957 Merge pull request #1645 from unbraind/fix/agent-ux-orient-claim-envelopes
• 0c27ee6 chore(pm): scope the GH-1644 guidance criterion to the self-contradicting --f...
• e464087 docs(agent-ux): address review round 3 — ranking precedes the claim lock, acc...
• 7f24a7f fix(agent-ux): address cubic review — dangling start status, empty-id refusal...
• 8351a7a fix(agent-ux): address review round 2 — filtered context keeps dependency edg...
• 3e66b23 fix(agent-ux): address review — start into configured in-progress status, kee...
• e1ebcbb fix(agent-ux): atomic claim --next --start, disclosed intent limit overrides,...
• 9585ea6 chore(release): cut 2026.10.31
• 3ff44fb Merge pull request #1638 from unbraind/fix/next-priority-floor
• Additional commits viewable in compare view

Updates pm-changelog from 2026.10.28 to 2026.10.31

Release notes

Sourced from pm-changelog's releases.

pm-changelog v2026.10.31

2026.10.31 - 2026-10-31

Added

• Index declared agent contract changes across releases (pmc-agent-contract-drift)
• Preserve published claims with append-only release corrections (pmc-release-corrections)

Fixed

• Fail closed when requested release notes have no matching section (pmc-pending-version-notes)
• Use configured done status roles for immutable milestone generation (pmc-milestone-status-roles)
• Use supported lifecycle transitions in the empty-title fixture (pmc-lifecycle-repeat-closure)

Changelog

Sourced from pm-changelog's changelog.

2026.10.31 - 2026-10-31

Added

• Index declared agent contract changes across releases (pmc-agent-contract-drift)
• Preserve published claims with append-only release corrections (pmc-release-corrections)

Fixed

• Fail closed when requested release notes have no matching section (pmc-pending-version-notes)
• Use configured done status roles for immutable milestone generation (pmc-milestone-status-roles)
• Use supported lifecycle transitions in the empty-title fixture (pmc-lifecycle-repeat-closure)

Commits

• ff74b2c Release pm-changelog v2026.10.31
• ec6af5b chore(deps): bump unbraind/pm-github/.github/workflows/pm-github-sync.yml (#308)
• 3988f35 chore(deps): bump unbraind/pm-github/.github/workflows/pm-github-closeout.yml...
• 8c24ab6 chore: close merged pm-changelog items and attribute shipped work to its rele...
• 8a623cc Require notes for the explicitly requested release version (#302)
• ca3a197 chore(deps-dev): bump the pm-toolchain group across 1 directory with 2 update...
• 7878bb6 chore(deps-dev): bump marked (#305)
• 671c142 Show agent obligation changes across release ranges (#298)
• 5203ee3 chore(deps-dev): bump the pm-toolchain group with 2 updates (#300)
• cda9e95 Preserve published release claims with linked corrections (#291)
• See full diff in compare view

Updates pm-ops from 2026.10.29 to 2026.10.31

Release notes

Sourced from pm-ops's releases.

pm-ops v2026.10.31

Changelog

2026.10.31 - 2026-10-31

No tracked changes.

Changelog

Sourced from pm-ops's changelog.

2026.10.31 - 2026-10-31

No tracked changes.

Commits

• e4f4142 Release pm-ops v2026.10.31
• 0a68896 chore: close merged pm-ops items and attribute shipped work to its releases (...
• bd60143 chore(deps-dev): bump the pm-toolchain group with 2 updates (#229)
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9779fd97-8f49-4c27-841c-513a26a8b4b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[unbraind]

Updated the exact toolchain to @unbrained/pm-cli@2026.11.4, pm-ops@2026.11.4, and pm-changelog@2026.10.31.

Fix commit: 5d43bf3.

• Production — pm-cli 2026.10.30, GH-1614: forward creation and the shared create-plan supplied parent: "none", which typed callers now reject. Both use explicit unset for parent and ambient scopes. Actual SDK readback covers both paths under focus.
• Test — GH-1614: fixtures and independent reference models used the same obsolete clear controls. Migrate them without removing assertions or lowering coverage thresholds. Preserve the provider-value guard for the older declared minimum and clarify its documentation.
• Secondary pin: the packed estimate acceptance default now reads the declared development SDK version, retaining its explicit host-version override.

Validation: the new regression passes 2/2 and fails both cases when only the production fix is reverted. Typecheck, test compilation, docstrings, production audit (0 vulnerabilities), package dry-run, changelog check, release verifiers, and strict tracker health pass; health retains its existing provenance advisory.

The local 75-minute budget stopped the full coverage run: 166 passed, 0 failed, 20 cancelled (partial counts, including cancelled file placeholders). The completed 10002-item corpus case and both 500-sequence graph/import-export models passed. Aggregate coverage remains unmeasured; the unchanged 99/96/100 gate and Node22/26/npm/Bun release acceptance remain for CI. No new upstream defect established.

PM evidence: pm-linear-toolchain-1104, released and left in progress for orchestrator verification.

Resolves #207.

[unbraind]

@coderabbitai full review

Please review head 5d43bf3, including outside-diff findings.

[coderabbitai]

Action not completed

Review skipped.

[unbraind]

Fresh exact-head CI evidence for 5d43bf3 (SDK 2026.11.4): Node26 completed 459 tests, 458 passed and 1 failed. The failing 500-sequence ownership case reports start_blocked_by_open_dependency: “Cannot start ownership-selected: its blocker ownership-foreign is still open.”

The fixture creates an open foreign blocker, adds its blocked_by edge, then unconditionally performs random active/custom-status writes. The SDK's strict blocked-start refusal is expected; this fixture does not model it and aborts the acceptance sequence. This is new completed-CI evidence beyond the migration record's budget-stopped local run, not evidence that production ownership preview or the SDK is defective.

Suggested acceptance: preserve all 500 sequences and ownership guarantees, explicitly model legitimate blocked-start refusals and unchanged durable state rather than weakening governance/assertions, then rerun the focused case and unchanged 99/96/100 coverage/release gates. Hosted evidence and static fixture inspection only; I have not independently rerun the SDK suite.

[unbraind]

Superseded by #208.

Root cause: pm-cli 2026.11.4's pm-urzubi change enforces strict start admission for open declared blockers. Classification: test model contract migration; live imports already honor the SDK refusal. The ownership model now predicts refusals and keeps exercising permitted starts, retaining all 500 sequences and existing assertions (16 refused starts, 9 admitted starts).

Fix commit: 4d988a48c6b7d655062c2b1add4885de0b7cc288, including the typed parent-clear compatibility migration carried forward from this PR. Behavioral revert proofs are recorded on pm-linear-toolchain-1104.

Both complete nice npm and Bun release gates passed: 460 tests each, 0 failed/cancelled/skipped; 99.64% lines, 96.99% branches, 100% functions at unchanged thresholds. Replacement PR CI is queued. This PR remains open and its Dependabot branch is unchanged.