chore(deps-dev): bump @unbrained/pm-cli from 2026.8.20 to 2026.8.25

.agents/pm/history/pm-github-5igz.jsonl

@@ -4,3 +4,5 @@
 {"ts":"2026-08-28T12:38:54.925Z","author":"claude","author_source":"asserted","agent_harness":"claude-code","agent_instance":"2017cd99c91bf11aa4148ca1","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null},"op":"docs_add","patch":[{"op":"add","path":"/metadata/docs/1","value":{"path":"test/verify-release-publish-attestation.test.ts","scope":"project","note":"regression cases for every runner spelling plus the attested-runner and two-word-runner mirrors"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T12:38:54.925Z"}],"before_hash":"dee2bf6b33007af5d1f7c1d9c6c4355c3b6861d8180acd049e05537203de9f84","after_hash":"498c4cd79a156faa0a17c730c2ee762f80119a18d724b180cb1710599a1fb786","item_hash_version":2,"context":{"agent_provenance_outcomes":{"model":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"}}}}
 {"ts":"2026-08-28T12:52:01.213Z","author":"claude","author_source":"asserted","agent_harness":"claude-code","agent_instance":"2017cd99c91bf11aa4148ca1","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T12:52:01.213Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-08-28T12:52:01.213Z","author":"claude","text":"A second bypass of the same class, raised by Greptile on PR 57 and confirmed: a shell string handed over through a combined short-option cluster was never inspected. POSIX shells accept bash -ec and bash -euc, which run the string exactly as bash -c does, but the executor resolver matched -c as a whole token only. Measured before the fix: bash -c is caught, while bash -ec, bash -euc and sh -ec all read as clean over an unattested publish, because the workflow's ordinary attested publish still satisfies the non-vacuity guard. The resolver now recognises -c inside a single-dash short-option cluster, and excludes long options deliberately so that --command is not misread as a cluster containing c. Reverting the change fails two of the thirty-two cases."}]}],"before_hash":"498c4cd79a156faa0a17c730c2ee762f80119a18d724b180cb1710599a1fb786","after_hash":"d7e1d06b1ab0d85a7409bfdca076085116ab96559c55f3829dbf78143accb06d","item_hash_version":2,"context":{"agent_provenance_outcomes":{"model":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"}}}}
 {"ts":"2026-08-28T20:48:39.553Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-luna","agent_model_source":"environment","agent_instance":"91352467fd2ac156a36ecf8a","agent_provenance":{"model":{"value":"gpt-5.6-luna","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-08-28T20:48:39.523Z","author":"pi-agent","text":"Verified pull request 57 before merge. Its required CI checks are green and review threads are resolved. The published gate and its package-runner regression coverage are present on the current head."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T20:48:39.553Z"},{"op":"add","path":"/metadata/notes","value":[{"created_at":"2026-08-28T20:48:39.523Z","author":"pi-agent","text":"Local verification passed: npm test, npm run release:check, npm run changelog:full, npm run changelog:check, and pinned pm health --strict-exit. npm run lint is unavailable because package.json has no lint script."}]},{"op":"add","path":"/metadata/tests","value":[{"command":"npm run release:check","scope":"project","timeout_seconds":300,"note":"full release gate for pull request 57"}]}],"before_hash":"d7e1d06b1ab0d85a7409bfdca076085116ab96559c55f3829dbf78143accb06d","after_hash":"f3dccf8455b0a0e2fc7e84bcc666b0001bd16e8fc592088b68b5149030170369","item_hash_version":2,"message":"Verify pull request 57 for merge"}
+{"ts":"2026-08-28T21:09:11.057Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-luna","agent_model_source":"environment","agent_instance":"91352467fd2ac156a36ecf8a","agent_provenance":{"model":{"value":"gpt-5.6-luna","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"add","path":"/metadata/tests/1","value":{"command":"./node_modules/.bin/pm health --strict-exit","scope":"project","timeout_seconds":120,"provenance":{"author":"pi-agent","created_at":"2026-08-28T21:09:11.007Z","source_kind":"local_mutation","source_ref":"dependabot/npm_and_yarn/unbrained/pm-cli-2026.8.25"},"note":"retargeted pm CLI exact pin health verification"}},{"op":"add","path":"/metadata/notes/1","value":{"created_at":"2026-08-28T21:09:11.007Z","author":"pi-agent","text":"The retargeted dependency install was verified with npm ci, npm test, npm run release:check, npm run changelog:full, npm run changelog:check, and the pinned pm health command. npm run lint remains unavailable because package.json has no lint script."}},{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-08-28T21:09:11.007Z","author":"pi-agent","text":"Pull request 58 was retargeted from @unbrained/pm-cli 2026.8.25 to exact 2026.8.28. The pinned binary now reports 2026.8.28 and strict health exits 0; lockfile transitive updates are the dependency's declared requirements."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T21:09:11.057Z"}],"before_hash":"f3dccf8455b0a0e2fc7e84bcc666b0001bd16e8fc592088b68b5149030170369","after_hash":"315fe2dea07ef3c699f1630bc8401b56190e40772d8290de3945f76a9f0a4e5e","item_hash_version":2,"message":"Retarget pull request 58 to the fleet CLI"}
+{"ts":"2026-08-28T21:13:07.650Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-luna","agent_model_source":"environment","agent_instance":"91352467fd2ac156a36ecf8a","agent_provenance":{"model":{"value":"gpt-5.6-luna","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-08-28T21:13:07.650Z","author":"pi-agent","text":"Pull request 58 review found compatibility-floor.test.ts still required the development CLI to equal the old 2026.8.20 floor. The invariant now keeps 2026.8.20 as the consumer minimum while allowing the exact-pinned CI dependency to use fleet release 2026.8.28."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T21:13:07.650Z"}],"before_hash":"315fe2dea07ef3c699f1630bc8401b56190e40772d8290de3945f76a9f0a4e5e","after_hash":"d47ef2e9414b58d0960aa61afd61502b9a432201da4a4981e017d6ffe73a9136","item_hash_version":2,"message":"Reconcile compatibility floor with fleet pin"}

.agents/pm/history/pm-github-j8zh.jsonl

@@ -0,0 +1,6 @@
+{"ts":"2026-08-29T05:27:44.724Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-j8zh"},{"op":"add","path":"/metadata/title","value":"Validate pm CLI development dependency bump"},{"op":"add","path":"/metadata/description","value":"Track PR #58 compatibility review and post-rebase quality gates."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":[]},{"op":"add","path":"/metadata/created_at","value":"2026-08-29T05:27:44.724Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-08-29T05:27:44.724Z"},{"op":"add","path":"/metadata/author","value":"pi-agent"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"4cc32419e2774f8ad8a7a8a952b2c3ff447e8a12f45d755deabfccedd05cd0a8","item_hash_version":2,"message":""}
+{"ts":"2026-08-29T05:27:54.863Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T05:27:54.863Z"},{"op":"add","path":"/metadata/assignee","value":"pi-agent"},{"op":"add","path":"/metadata/claim_principal","value":"pi-agent"}],"before_hash":"4cc32419e2774f8ad8a7a8a952b2c3ff447e8a12f45d755deabfccedd05cd0a8","after_hash":"8bce95b0d2db1d095142de471db06bf944578af66de8292201d4d234fb94e21b","item_hash_version":2}
+{"ts":"2026-08-29T05:27:55.287Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T05:27:55.287Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"8bce95b0d2db1d095142de471db06bf944578af66de8292201d4d234fb94e21b","after_hash":"bbc06866274e940ba752d4fbf7643a28bf80b9a2958af7b1f74026c4a9aa531a","item_hash_version":2}
+{"ts":"2026-08-29T05:30:11.696Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T05:30:11.696Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-08-29T05:30:11.696Z","author":"pi-agent","text":"Rebased onto PR #60 merge; compatibility test already accepts an exact development pin at or above the 2026.8.20 floor. Coverage, changelog, and strict health passed after clearing stale generated metadata caches."}]}],"before_hash":"bbc06866274e940ba752d4fbf7643a28bf80b9a2958af7b1f74026c4a9aa531a","after_hash":"90d88ef0e98fc3e742454f3a1c8a7805ace8f96f9fb9a8718e2f87f10d50e4ad","item_hash_version":2}
+{"ts":"2026-08-29T05:30:12.273Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T05:30:12.273Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-08-29T05:30:12.257Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-08-29T05:30:12.257Z"},{"op":"add","path":"/metadata/close_reason","value":"PR #58 dependency bump validated after rebase."}],"before_hash":"90d88ef0e98fc3e742454f3a1c8a7805ace8f96f9fb9a8718e2f87f10d50e4ad","after_hash":"197ec205294f51e232e2e56a489072f47d9bdc7057e12f9e64c241164c0493d0","item_hash_version":2}
+{"ts":"2026-08-29T05:30:12.768Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T05:30:12.768Z"}],"before_hash":"197ec205294f51e232e2e56a489072f47d9bdc7057e12f9e64c241164c0493d0","after_hash":"1854b1811cb131ca3631b2a7a8047e83fdb9d0cc946ab81320e529cc88d46779","item_hash_version":2}

.agents/pm/issues/pm-github-5igz.toon

@@ -6,7 +6,7 @@ status: open
 priority: 0
 tags[4]: "area:gates","area:release","area:supply-chain","type:defect"
 created_at: "2026-08-28T12:38:36.013Z"
-updated_at: "2026-08-28T20:48:39.553Z"
+updated_at: "2026-08-28T21:13:07.650Z"
 author: claude
 acceptance_criteria: "npx, bunx, pnpx and the two-word pnpm dlx, yarn dlx, npm exec and bun x forms are all judged as publishes; a runner-prefixed publish that does carry the attestation flag still passes; the two-word runners are consumed only when the second word matches so a plain npm publish is unaffected; and reverting the skip-list change makes the new tests fail."
 risk: critical
@@ -16,13 +16,28 @@ expected_result: "A publish is judged on what it does, not on how it is spelled,
 actual_result: "A runner-prefixed publish was not recognised as a publish, was never checked, and left the gate reporting clean."
 component: scripts/verify-release-publish-attestation.ts executableIndex
 customer_impact: "A release could publish an unattested artifact while every gate reported green, defeating the supply-chain guarantee the gate exists to provide."
-comments[2]{created_at,author,text}:
+comments[4]{created_at,author,text}:
   "2026-08-28T12:52:01.213Z",claude,"A second bypass of the same class, raised by Greptile on PR 57 and confirmed: a shell string handed over through a combined short-option cluster was never inspected. POSIX shells accept bash -ec and bash -euc, which run the string exactly as bash -c does, but the executor resolver matched -c as a whole token only. Measured before the fix: bash -c is caught, while bash -ec, bash -euc and sh -ec all read as clean over an unattested publish, because the workflow's ordinary attested publish still satisfies the non-vacuity guard. The resolver now recognises -c inside a single-dash short-option cluster, and excludes long options deliberately so that --command is not misread as a cluster containing c. Reverting the change fails two of the thirty-two cases."
   "2026-08-28T20:48:39.523Z",pi-agent,Verified pull request 57 before merge. Its required CI checks are green and review threads are resolved. The published gate and its package-runner regression coverage are present on the current head.
-notes[1]{created_at,author,text}:
+  "2026-08-28T21:09:11.007Z",pi-agent,Pull request 58 was retargeted from @unbrained/pm-cli 2026.8.25 to exact 2026.8.28. The pinned binary now reports 2026.8.28 and strict health exits 0; lockfile transitive updates are the dependency's declared requirements.
+  "2026-08-28T21:13:07.650Z",pi-agent,Pull request 58 review found compatibility-floor.test.ts still required the development CLI to equal the old 2026.8.20 floor. The invariant now keeps 2026.8.20 as the consumer minimum while allowing the exact-pinned CI dependency to use fleet release 2026.8.28.
+notes[2]{created_at,author,text}:
   "2026-08-28T20:48:39.523Z",pi-agent,"Local verification passed: npm test, npm run release:check, npm run changelog:full, npm run changelog:check, and pinned pm health --strict-exit. npm run lint is unavailable because package.json has no lint script."
-tests[1]{command,scope,timeout_seconds,note}:
-  "npm run release:check",project,300,full release gate for pull request 57
+  "2026-08-28T21:09:11.007Z",pi-agent,"The retargeted dependency install was verified with npm ci, npm test, npm run release:check, npm run changelog:full, npm run changelog:check, and the pinned pm health command. npm run lint remains unavailable because package.json has no lint script."
+tests[2]:
+  - command: "npm run release:check"
+    scope: project
+    timeout_seconds: 300
+    note: full release gate for pull request 57
+  - command: ./node_modules/.bin/pm health --strict-exit
+    scope: project
+    timeout_seconds: 120
+    provenance:
+      author: pi-agent
+      created_at: "2026-08-28T21:09:11.007Z"
+      source_kind: local_mutation
+      source_ref: dependabot/npm_and_yarn/unbrained/pm-cli-2026.8.25
+    note: retargeted pm CLI exact pin health verification
 docs[2]{path,scope,note}:
   scripts/verify-release-publish-attestation.ts,project,executableIndex now skips package runners before choosing the executable
   test/verify-release-publish-attestation.test.ts,project,regression cases for every runner spelling plus the attested-runner and two-word-runner mirrors

.agents/pm/issues/pm-github-j8zh.toon

@@ -0,0 +1,16 @@
+id: pm-github-j8zh
+title: Validate pm CLI development dependency bump
+description: Track PR #58 compatibility review and post-rebase quality gates.
+type: Issue
+status: closed
+priority: 2
+tags: []
+created_at: "2026-08-29T05:27:44.724Z"
+updated_at: "2026-08-29T05:30:12.768Z"
+closed_at: "2026-08-29T05:30:12.257Z"
+completed_at: "2026-08-29T05:30:12.257Z"
+author: pi-agent
+comments[1]{created_at,author,text}:
+  "2026-08-29T05:30:11.696Z",pi-agent,"Rebased onto PR #60 merge; compatibility test already accepts an exact development pin at or above the 2026.8.20 floor. Coverage, changelog, and strict health passed after clearing stale generated metadata caches."
+close_reason: PR #58 dependency bump validated after rebase.
+body: ""

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Fixed
 
+- Validate pm CLI development dependency bump ([pm-github-j8zh](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-j8zh.toon))
 - The publish-attestation gate misses a publish routed through an unquoted shell variable ([pm-github-tko1](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-tko1.toon))
 - True round-trip GitHub sync: search provider, validate diagnostics, safe-by-default export, fix activation ([pm-github-9dqy](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-9dqy.toon))
 - A failed provenance publish silently falls back to an unattested one ([pm-github-i5b8](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-i5b8.toon))