diff --git a/.agents/pm/chores/pm-e9zh.toon b/.agents/pm/chores/pm-e9zh.toon
index 8b92f5425..232df5f71 100644
--- a/.agents/pm/chores/pm-e9zh.toon
+++ b/.agents/pm/chores/pm-e9zh.toon
@@ -6,7 +6,7 @@ status: closed
 priority: 2
 tags[5]: metadata,normalization,pm-cli,resolution,tracker-governance
 created_at: "2026-06-25T04:57:09.804Z"
-updated_at: "2026-09-08T06:45:06.155Z"
+updated_at: "2026-09-27T10:38:24.373Z"
 closed_at: "2026-09-08T06:45:04.537Z"
 completed_at: "2026-09-08T06:45:04.537Z"
 author: codex-pm-ecosystem-audit-20260625
@@ -40,7 +40,7 @@ dependencies[5]:
     author: "harness:claude-code"
     source_kind: "cli:update:dep"
     author_source: detected
-comments[21]{created_at,author,text}:
+comments[22]{created_at,author,text}:
   "2026-06-25T04:57:09.804Z",codex-pm-ecosystem-audit-20260625,"Duplicate check: status-all searches for terminal resolution metadata backfill and active planning metadata found closed governance tooling items pm-yq7m, pm-fryg, pm-wbak-class work, and pm-6bz1, but no open execution item for historical backfill."
   "2026-07-04T20:56:40.819Z",codex-agent,"Audit evidence 2026-07-04 continuation: pm validate --check-resolution --check-history-drift --json is ok:true for history_drift across 1506 checked items and warns only validate_resolution_missing_fields:268 across closed historical items. This confirms pm-e9zh remains the canonical open remediation for terminal resolution/expected/actual backfill; no duplicate item created. The earlier list --filter-resolution-missing projection showed 198 closed rows because it counts a narrower filter than validate resolution details. Keep the existing no-placeholder and changelog-drag rules."
   "2026-07-05T05:51:00.468Z",claude-code-agent,"Live validation handoff from pm-lodl/pm-8778 lane: pm validate --check-resolution --check-history-drift --json on 2026-07-05 returned ok:true with history_drift ok across 1536 checked items and the pre-existing validate_resolution_missing_fields:268 warning. This confirms pm-e9zh remains the canonical open remediation for historical terminal resolution metadata; no duplicate item created from this lane."
@@ -62,6 +62,7 @@ comments[21]{created_at,author,text}:
   "2026-09-04T20:53:39.830Z","harness:codex","2026-09-04 validation refresh: the live resolution check inspected 2327 closed items and reports exactly 295 historical items missing one or more structured resolution fields, unchanged from the established 2026-08 baseline. No placeholder values or duplicate cleanup item were introduced. The history scan overlapped active mutations; its three current-item hash mismatches were individually rechecked through history --verify --strict-exit and all three chains and current documents match. A frozen final corpus drift scan is still required for delivery closeout."
   "2026-09-07T07:05:43.085Z","harness:codex","Live validation refresh 2026-09-07: resolution checks inspected all 2362 closed items and identified 295 with missing structured resolution fields. This is the existing evidence-backfill population, not a new defect in the planning primitives. Current delivery closures will include resolution/expected/actual atomically. The no-placeholder policy remains applicable; this pass did not manufacture historical outcomes."
   "2026-09-08T05:30:34.329Z","harness:codex","Reviewed recovery plan: all 295 flagged closed items read with full live pm get; full history stream inspected. 285 items have evidence-backed additions: 221 missing resolutions and 274 missing actual results can copy their own substantive close_reason, and 127 missing expected results can copy their own recorded acceptance criteria. No description of a defect is repurposed as an expected outcome. 170 residual items retain honest missing fields. Apply oldest-first in 25-item atomic CLI transactions; preserve release/status/close timestamps and verify package-owned changelog stability."
+  "2026-09-27T10:38:24.373Z","harness:codex","2026-09-27 live validation refresh: pm validate --check-resolution --check-history-drift returned ok:true and zero drift across 2,815 item histories. It warned that 170 of 2,522 closed items still lack at least one structured resolution/expected/actual field. This is the historical residual after the bounded source-grounded backfill, not a new closure in this tranche; no placeholder values were written."
 notes[3]{created_at,author,text}:
   "2026-07-04T18:50:14.133Z",maintainer-agent,"Scope addition from 2026-07-04 backlog audit (pm-y904): duplicate issue-code pair GH-209 (pm-1byt canonical, pm-25se follow-up) involves two CLOSED items, so per the changelog updated_at invariant it must be resolved in this careful backfill pass (set duplicate_of on pm-25se or retitle) together with the changelog regen, not in a create-only audit."
   "2026-07-06T13:13:56.245Z",maintainer-agent,"Audit #10 2026-07-06: validate_resolution_missing_fields grew 268 -> 269. The new entry is ADR pm-muhw (accepted+closed 2026-07-05 without resolution/expected_result/actual_result). Do NOT touch it now (changelog drag — it sits in the shipped 2026.7.6 bucket); fold it into this dedicated backfill pass. Real evidence exists: acceptance rationale is in its comments and the SDK-first epic pm-usfg body."
diff --git a/.agents/pm/extensions/.managed-extensions.json b/.agents/pm/extensions/.managed-extensions.json
index 8980f57f0..4fb93e33e 100644
--- a/.agents/pm/extensions/.managed-extensions.json
+++ b/.agents/pm/extensions/.managed-extensions.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-09-27T09:24:00.162Z",
+  "updated_at": "2026-09-27T10:35:46.561Z",
   "entries": [
     {
       "name": "pm-changelog",
diff --git a/.agents/pm/history/pm-7wmq.jsonl b/.agents/pm/history/pm-7wmq.jsonl
index 0bb14fa2b..b32aef07c 100644
--- a/.agents/pm/history/pm-7wmq.jsonl
+++ b/.agents/pm/history/pm-7wmq.jsonl
@@ -5,3 +5,4 @@
 {"ts":"2026-07-26T22:20:22.694Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","agent_instance":"7fa8395835d01e2fa37ea950","op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T22:20:22.694Z"},{"op":"add","path":"/metadata/dependencies","value":[{"id":"pm-doxj","kind":"blocks","created_at":"2026-07-26T22:20:22.446Z"}]}],"before_hash":"ca5f82289ecb835072904d72054458b6b1015fe1b0008a550b5f56ddb47cff5e","after_hash":"50894be9ab26e20e703e97da78230caab92551d40f91baaff25244e9f19264cf","message":"Historical graph enrichment 2026-07-27: derive epoch lineage for terminal items so the full timeline is reachable by graph traversal"}
 {"ts":"2026-08-10T12:02:58.508Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","agent_model":"claude-opus-5","agent_model_source":"probe","agent_instance":"b006a2086429d635675530d7","agent_provenance":{"model":{"value":"claude-opus-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":{"value":"pm-7wmq","source":"argv"},"version":{"value":"2.1.226","source":"probe"}},"op":"update","patch":[{"op":"add","path":"/metadata/dependencies/1","value":{"id":"pm-33cw","kind":"implements","created_at":"2026-08-10T12:02:58.355Z","author":"harness:claude-code","source_kind":"cli:update:dep","author_source":"detected"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-10T12:02:58.508Z"}],"before_hash":"50894be9ab26e20e703e97da78230caab92551d40f91baaff25244e9f19264cf","after_hash":"da4f546d2165fb2fb6f0711e8cb95bf5a982404757a94dcd19ac05d8399d1c46"}
 {"hash_algorithm":"sha256","ts":"2026-09-19T08:39:41.941Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"e700c3209edd3b60c0371159","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-pivf","claim:pm-wrbe","lineage:pm-pivf","lineage:pm-33cw","lineage:pm-doxj"]},"topic":{"value":"workset:pm-pivf+pm-wrbe","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-pivf","claim:pm-wrbe","lineage:pm-pivf","lineage:pm-33cw","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-19T08:39:41.941Z"},{"op":"add","path":"/metadata/closed_at","value":"2026-07-03T14:41:06.488Z"}],"before_hash":"da4f546d2165fb2fb6f0711e8cb95bf5a982404757a94dcd19ac05d8399d1c46","after_hash":"30bd6e89c5319550f63c6c53f4b4abbfd1b78517bec953f284c2806ac2468f5e","item_hash_version":3,"message":"Backfill closed_at from verified lifecycle history","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"70ec3edee314188ddcd25a38dcc7f9c1d5e550616f51538e74f63b78c4b5ab54"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:57:14.230Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:57:14.230Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-09-27T09:57:14.230Z","author":"harness:codex","text":"2026-09-27 merged-main Security and Script Quality run 36310034735 attempt 1 failed before analysis because PowerShell Gallery blocked the pinned PSScriptAnalyzer package download with a WAF response. A single failed-job rerun (attempt 2) completed successfully with every job green. This was an external fetch failure, not an analyzer finding; the required gate stayed enforced."}]}],"before_hash":"30bd6e89c5319550f63c6c53f4b4abbfd1b78517bec953f284c2806ac2468f5e","after_hash":"1d45fb3347bab858a46252a6f42098d93dc7aafdcd03b7b214506a9813fdd664","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"e41c483752af6fd1cc7501576fe6295527755ed4bdf5e8adf265f0297a3bec54"}
diff --git a/.agents/pm/history/pm-e70zh5.jsonl b/.agents/pm/history/pm-e70zh5.jsonl
index 474390ea8..1b2152556 100644
--- a/.agents/pm/history/pm-e70zh5.jsonl
+++ b/.agents/pm/history/pm-e70zh5.jsonl
@@ -64,3 +64,4 @@
 {"hash_algorithm":"sha256","ts":"2026-09-24T13:32:43.884Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"6086e1e4ff36a38bba6ecaf3","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"release-operator","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-e70zh5","release:pm-44u3wt"]},"topic":{"value":"pm-e70zh5","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-e70zh5","release:pm-44u3wt"]}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-24T13:32:43.884Z"}],"before_hash":"5587ed63a8c26b3572cf3a96d5eb1280225fc59efd0ababec7ef4327e4c6b23e","after_hash":"162f017dda7059ca90ce97d0c1eb95de8024f930efc87bccacb52c6a8e31adfd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"7e0d107a92a7c55bf3194af49965934622e06b66b7a713c857dd26c2fb5c6d7f"}
 {"hash_algorithm":"sha256","ts":"2026-09-24T13:40:41.544Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"6086e1e4ff36a38bba6ecaf3","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"add","path":"/metadata/dependencies/12","value":{"id":"pm-z3ez","kind":"related","created_at":"2026-09-24T13:40:41.250Z","author":"harness:codex","source_kind":"cli:update:dep","author_source":"detected"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-24T13:40:41.544Z"}],"before_hash":"162f017dda7059ca90ce97d0c1eb95de8024f930efc87bccacb52c6a8e31adfd","after_hash":"1cce814d88919ed03eb703c50e3e013f3c08d3ce092028aa4f3b252cc6738e6a","item_hash_version":3,"message":"Connect the agent distribution feature referenced in intake evidence: version-coherent plugins depend on observable daily delivery, while onboarding criteria remain separately open. This is contextual linkage, not implementation or verification of the whole feature.","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"3f605845a5c0900b9fda6e0e09e51b53fe51fc3c62003cc940cc46d06ab78dc7"}
 {"hash_algorithm":"sha256","ts":"2026-09-24T13:48:35.150Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"6086e1e4ff36a38bba6ecaf3","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/28","value":{"created_at":"2026-09-24T13:48:35.150Z","author":"harness:codex","text":"PR 1302 review follow-up: accepted CodeRabbit finding that receipt write/upload failures must not turn an already published release into a failed run. Both evidence steps are now non-blocking; a workflow contract assertion failed before the fix and passes afterward. Missing receipts remain unknown_success, not publication proof. Fixed the prose-reference graph regression with an honest contextual distribution-feature edge; full tracker assertions pass. Initial hosted CI passed all checks except that graph regression, including exact full-source coverage. Local transport budgets passed on retry unchanged; mutation gate killed 323 of 330 with seven documented equivalent mutants. Sourcery review is quota-limited and Greptile has not responded."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-24T13:48:35.150Z"}],"before_hash":"1cce814d88919ed03eb703c50e3e013f3c08d3ce092028aa4f3b252cc6738e6a","after_hash":"29c75d37f3024585a3106dd4a57864939301c1615eecf82dab2757a9e7f647bd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"aa85b01cec88ef55bc287f0cc2865f3977c7993d42f229fb62b8ca9e406a692f"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:57:02.802Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/29","value":{"created_at":"2026-09-27T09:57:02.802Z","author":"harness:codex","text":"2026-09-27 live hosted evidence: Release Reliability run 36306444764 reported 13 failures among 31 completed scheduled attempts in its 30-day window (41.94% versus 10% policy), plus dispatch-window violation. Scheduled Auto Release run 36306417214 succeeded at 08:30 UTC, about 356 minutes after the nominal 02:35 UTC occurrence, and verified the same-day release already produced by an earlier manual dispatch. Exactly one v2026.9.27 release was visible. The rolling reporter is functioning; the historical failure rate and hosted schedule lateness remain unresolved, and 16 older successes lack complete outcome receipts."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:57:02.802Z"}],"before_hash":"29c75d37f3024585a3106dd4a57864939301c1615eecf82dab2757a9e7f647bd","after_hash":"37b20d4728a1bb7b711b89e316e3d0195622ffdea61ff279298ba996c545895f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"9a4a776f562019b92f4503911bf939ff203a5e367705788f6c565d6fd1f7fdbf"}
diff --git a/.agents/pm/history/pm-e9zh.jsonl b/.agents/pm/history/pm-e9zh.jsonl
index bbc806803..7dc6cdef2 100644
--- a/.agents/pm/history/pm-e9zh.jsonl
+++ b/.agents/pm/history/pm-e9zh.jsonl
@@ -35,3 +35,4 @@
 {"ts":"2026-09-08T06:23:08.407Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"22d7da348d66bb9f892a835e","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"release-operator","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-bukwmy","claim:pm-doxj","claim:pm-e9zh","claim:pm-g8t7b9","claim:pm-lnrk","claim:pm-pd7nh0","claim:pm-qnl2","claim:pm-wg07","release:pm-lvyd"]},"topic":{"value":"workset:pm-bukwmy+pm-doxj+pm-e9zh+pm-g8t7b9+pm-lnrk+pm-pd7nh0+pm-qnl2+pm-wg07","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-bukwmy","claim:pm-doxj","claim:pm-e9zh","claim:pm-g8t7b9","claim:pm-lnrk","claim:pm-pd7nh0","claim:pm-qnl2","claim:pm-wg07","release:pm-lvyd"]}},"op":"note_add","patch":[{"op":"add","path":"/metadata/notes/2","value":{"created_at":"2026-09-08T06:23:08.407Z","author":"harness:codex","text":"Terminal evidence recovery completed for this bounded pass: 285 existing closed items received 622 source-grounded fields (221 resolutions, 274 actual results, 127 expected results) in twelve oldest-first transactional batches. Sources were each item's own substantive close_reason and original acceptance criteria; comments explicitly distinguish historical restatement from current verification. No status, release attribution or authored close date was changed by recovery. Validation reduced the flagged population from 295 to 170. Residual: 163 expected_result gaps lack a defensible original expectation; 17 actual_result gaps lack a substantive observed outcome; 2 resolution gaps lack a substantive fix statement. Field counts overlap by item. Keep these unknown; generic placeholder remediation stays separately owned. Exact residual coordinates:\npm-0c0j:expected_result\npm-0g2p:expected_result\npm-0xix:expected_result\npm-0zn9:expected_result\npm-13nx:actual_result\npm-1lgy:expected_result\npm-1p2u:expected_result,actual_result\npm-1w0d:expected_result\npm-2bn5:expected_result\npm-2nqx:expected_result\npm-2nxe:expected_result\npm-2p38:expected_result,actual_result\npm-3cbk:resolution,expected_result,actual_result\npm-3l76:expected_result\npm-3mal:expected_result\npm-3puw:expected_result\npm-407c:expected_result\npm-4d1b:expected_result\npm-4ltc:expected_result\npm-4oww:resolution,actual_result\npm-4r5t:expected_result\npm-52eh:expected_result\npm-5fid:expected_result\npm-5teq:expected_result\npm-6bz1:expected_result\npm-6l17:expected_result\npm-6tch:expected_result\npm-6vy7:expected_result\npm-76r5:expected_result\npm-7by2:expected_result\npm-7c48:expected_result\npm-7qjk:expected_result\npm-7snq:expected_result\npm-7sq6:expected_result\npm-7tvx:expected_result\npm-7u4z:expected_result\npm-7v9s:expected_result\npm-7x8d:expected_result\npm-8c2s:expected_result\npm-8vul:expected_result\npm-90hp:expected_result\npm-a0w4:expected_result\npm-aabt:expected_result\npm-at83:expected_result\npm-b5r8:expected_result\npm-bd3u:expected_result\npm-bhmk:actual_result\npm-bpaj:expected_result\npm-bw70:expected_result\npm-byl1:expected_result\npm-bzgt:expected_result\npm-c97q:expected_result,actual_result\npm-cc04:expected_result\npm-cn0c:expected_result,actual_result\npm-cstl:actual_result\npm-cxi9:expected_result\npm-dg8j:expected_result\npm-dita:expected_result\npm-dlfq:expected_result\npm-dmuq:expected_result\npm-e2jt:expected_result\npm-e9ut:expected_result\npm-eifq:expected_result\npm-f2ne:expected_result\npm-fk84:expected_result\npm-fpod:expected_result\npm-frou:expected_result,actual_result\npm-fryg:expected_result\npm-g61e:expected_result\npm-g799:expected_result\npm-gcm3:expected_result\npm-gnnb:expected_result\npm-gq27:expected_result\npm-gqx7:expected_result\npm-gt82:expected_result\npm-haak:expected_result\npm-halx:expected_result\npm-hfli:expected_result\npm-high:expected_result,actual_result\npm-hm1q:expected_result\npm-hng2:expected_result\npm-hntj:expected_result\npm-i1mu:expected_result\npm-i1z6:expected_result\npm-i2xg:expected_result\npm-i35t:expected_result\npm-i84i:expected_result\npm-izid:expected_result\npm-j0vc:expected_result\npm-j2ig:expected_result\npm-jcyn:expected_result\npm-jd3v:expected_result\npm-jozc:expected_result\npm-js02:expected_result\npm-jvbt:expected_result\npm-k1im:expected_result\npm-k8ld:expected_result\npm-kbm9:expected_result\npm-kes3:expected_result\npm-kjmx:expected_result\npm-knma:expected_result\npm-kp1d:expected_result\npm-kx7v:expected_result\npm-l2ud:expected_result,actual_result\npm-l4c8:expected_result\npm-l709:expected_result\npm-lg65:expected_result\npm-m449:expected_result\npm-mdw6:expected_result\npm-mfl1:expected_result\npm-mhih:expected_result\npm-mo2v:expected_result\npm-mthy:expected_result\npm-nb68:expected_result\npm-nhby:expected_result\npm-nr5j:expected_result\npm-nvgy:expected_result,actual_result\npm-o0d2:expected_result\npm-oll8:expected_result\npm-oqgf:expected_result\npm-othr:actual_result\npm-oxq2:expected_result\npm-p99b:expected_result\npm-pfxi:expected_result\npm-php4:expected_result\npm-pktw:expected_result\npm-pwf1:expected_result\npm-q0kr:expected_result\npm-qawd:expected_result\npm-qvdj:expected_result\npm-r642:expected_result\npm-rav7:expected_result\npm-rkie:expected_result\npm-ryik:expected_result\npm-s3hl:expected_result\npm-s5pe:expected_result\npm-scvz:expected_result\npm-sjea:expected_result\npm-ss1d:expected_result\npm-t57d:expected_result\npm-t73k:expected_result\npm-tb42:expected_result\npm-tk1z:expected_result\npm-u42x:expected_result\npm-u5le:expected_result\npm-ud1x:expected_result\npm-uvxc:expected_result\npm-v37g:actual_result\npm-vhx6:expected_result\npm-vks9:expected_result\npm-w13j:expected_result\npm-wbak:expected_result\npm-wr74:expected_result\npm-wrqk:expected_result\npm-x3vi:expected_result\npm-xau3:expected_result\npm-xvzm:expected_result,actual_result\npm-y1z0:expected_result\npm-yf31:expected_result\npm-yffj:expected_result\npm-yjub:expected_result\npm-yq7m:expected_result\npm-z2gi:expected_result\npm-z36m:expected_result\npm-zcx9:expected_result\npm-zoe4:expected_result\npm-zqes:expected_result\npm-zro7:expected_result\npm-zyez:expected_result\npm-zyse:actual_result"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-08T06:23:08.407Z"}],"before_hash":"d2980b2aa9d2935d37bf2a8aca7f5d4a5a1ff42dd4225190b332de5a115c0688","after_hash":"84fd3677e02d0c07a3766d30b63772fa417bfe178f05ddba742a1ba00cabec06","item_hash_version":3,"context":{"agent_provenance_outcomes":{"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"dbb323b0cc2b979ad5f84ef0e34f453b47689dd459d99c7fb5ba6b777b6780a4"}
 {"ts":"2026-09-08T06:45:04.633Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"22d7da348d66bb9f892a835e","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"release-operator","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-bukwmy","claim:pm-e9zh","claim:pm-pd7nh0","release:pm-qnl2"]},"topic":{"value":"workset:pm-bukwmy+pm-e9zh+pm-pd7nh0","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-bukwmy","claim:pm-e9zh","claim:pm-pd7nh0","release:pm-qnl2"]}},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-08T06:45:04.633Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-09-08T06:45:04.537Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-09-08T06:45:04.537Z"},{"op":"add","path":"/metadata/resolution","value":"Recovered 622 source-grounded fields on 285 existing terminal records through twelve atomic PM transactions; preserved original release and closure attribution."},{"op":"add","path":"/metadata/expected_result","value":"Reduce or explicitly group missing terminal evidence without placeholder outcomes; preserve active readiness and valid history."},{"op":"add","path":"/metadata/actual_result","value":"Flagged terminal records reduced from 295 to 170; residual fields are individually enumerated with rationale. Stable prior all-stream verification passed; the latest concurrent validation read reported only a separately verified actively edited runner record."},{"op":"add","path":"/metadata/close_reason","value":"Completed the bounded historical evidence recovery and explicitly grouped the unrecoverable residual."}],"before_hash":"84fd3677e02d0c07a3766d30b63772fa417bfe178f05ddba742a1ba00cabec06","after_hash":"856bff6f44a732a1751616fd9e820c9540aae501a21734e95d2e881443dade0e","item_hash_version":3,"context":{"agent_provenance_outcomes":{"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"957bae0577e85fca0bfea582d38505ab268ee02f52708f0797f6056c66af0525"}
 {"ts":"2026-09-08T06:45:06.155Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"22d7da348d66bb9f892a835e","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"release-operator","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-bukwmy","claim:pm-e9zh","claim:pm-pd7nh0","release:pm-qnl2"]},"topic":{"value":"workset:pm-bukwmy+pm-e9zh+pm-pd7nh0","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-bukwmy","claim:pm-e9zh","claim:pm-pd7nh0","release:pm-qnl2"]}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-08T06:45:06.155Z"}],"before_hash":"856bff6f44a732a1751616fd9e820c9540aae501a21734e95d2e881443dade0e","after_hash":"b508cd12633bffcebb05b4f8e9568d655b8da379881ebd458ec98c30299b3046","item_hash_version":3,"context":{"agent_provenance_outcomes":{"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"2faef094e45b9d2a4dfdab6f16b210a9f72e2049eb7f2a1aec246425238cdccf"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:38:24.373Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/21","value":{"created_at":"2026-09-27T10:38:24.373Z","author":"harness:codex","text":"2026-09-27 live validation refresh: pm validate --check-resolution --check-history-drift returned ok:true and zero drift across 2,815 item histories. It warned that 170 of 2,522 closed items still lack at least one structured resolution/expected/actual field. This is the historical residual after the bounded source-grounded backfill, not a new closure in this tranche; no placeholder values were written."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:38:24.373Z"}],"before_hash":"b508cd12633bffcebb05b4f8e9568d655b8da379881ebd458ec98c30299b3046","after_hash":"9ef163ce1f88f2abe84d2a630c81723d0a6a2018867ce56789aaae90ad482c73","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"52ce2508809e8ecd3f76fc03635dc21df5c187aeae0268619a440c7980926aa5"}
diff --git a/.agents/pm/history/pm-k7nxaz.jsonl b/.agents/pm/history/pm-k7nxaz.jsonl
new file mode 100644
index 000000000..00801b97f
--- /dev/null
+++ b/.agents/pm/history/pm-k7nxaz.jsonl
@@ -0,0 +1,16 @@
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:42:32.830Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-k7nxaz"},{"op":"add","path":"/metadata/title","value":"Exclude Git metadata from local package directory installs"},{"op":"add","path":"/metadata/description","value":"GitHub #1324 reproduces a complete, successful local-directory package install that copies the source checkout .git config, refs, and object history into the managed extension. The installer and its SDK copy planner should share an every-depth Git-metadata exclusion policy, account for excluded entries, preserve runtime files and activation, and refuse unsafe .git symlink cases as appropriate."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":1},{"op":"add","path":"/metadata/tags","value":["area:extensions","area:packages","defect","github-issue","privacy","security"]},{"op":"add","path":"/metadata/created_at","value":"2026-09-27T09:42:32.830Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-09-27T09:42:32.830Z"},{"op":"add","path":"/metadata/author","value":"harness:codex"},{"op":"add","path":"/metadata/acceptance_criteria","value":"A real disposable Git checkout with sentinel config/ref installs without any .git metadata under the managed extension; Nested .git directories and symlinked Git metadata cannot enter the copy, and the plan reports excluded entries; Project and global installs, dry runs, packed archive recovery, and existing extension activation remain functional"},{"op":"add","path":"/metadata/goal","value":"project management = context management"},{"op":"add","path":"/metadata/objective","value":"Local package installs never carry source-control history into managed runtime artifacts"},{"op":"add","path":"/metadata/value","value":"Prevent accidental replication of repository history and config into install outputs"},{"op":"add","path":"/metadata/impact","value":"Reduce copied data and metadata exposure for local checkout installs"},{"op":"add","path":"/metadata/outcome","value":"Real Git checkout installs activate without .git metadata in the managed destination"},{"op":"add","path":"/metadata/parent","value":"pm-x6jf"},{"op":"add","path":"/metadata/risk","value":"high"},{"op":"add","path":"/metadata/severity","value":"high"},{"op":"add","path":"/metadata/affected_version","value":"2026.9.27"},{"op":"add","path":"/metadata/dependencies","value":[{"id":"pm-5bsofk","kind":"discovered_from","created_at":"2026-09-27T09:42:32.830Z","author":"harness:codex","source_kind":"cli:create:dep","author_source":"detected"},{"id":"pm-x6jf","kind":"discovered_from","created_at":"2026-09-27T09:42:32.830Z","author":"harness:codex","source_kind":"cli:create:dep","author_source":"detected"}]},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-09-27T09:42:32.830Z","author":"harness:codex","text":"Duplicate check across all PM statuses: searched Git metadata, local extension install, and GitHub #1324. Historical pm-5bsofk/pm-erogk1 cover copy planning and bounded scans, not the successful Git-history copy defect. Source: https://github.com/unbraind/pm-cli/issues/1324. The issue was created with no PM link and is now owned here."}]}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"b0a9babcb17cfcc94c8560a40c90c164c224430e1c7658b335f64204c277b75a","item_hash_version":3,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"fa01b7663770221f34d94769ddcc8f86becbb19c3044ddbd83aae834c55258e4"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:42:53.295Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:42:53.295Z"},{"op":"add","path":"/metadata/assignee","value":"harness:codex"},{"op":"add","path":"/metadata/claim_principal","value":"harness:codex#d47f0e0d79925f50a0df2359"}],"before_hash":"b0a9babcb17cfcc94c8560a40c90c164c224430e1c7658b335f64204c277b75a","after_hash":"30b8692bd8100c6a96604d9014f481a31955536b68b65806f9381c299f3b8c9d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"6f000df06913d4cfbdaf69bf68f092b1edd197e94140e7ff0e3a5b8712839867"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:42:53.500Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:42:53.500Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"30b8692bd8100c6a96604d9014f481a31955536b68b65806f9381c299f3b8c9d","after_hash":"2484e94fbc4e4ed41c5d1f13593e50f2b44564ff56776fbef570c64cab96a89a","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"de0dd7ad5618d1580a50fc8c7b0b43081ce6b60781aa03c22fdb6909a3127098"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:44:26.504Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"add","path":"/metadata/dependencies/2","value":{"id":"pm-erogk1","kind":"discovered_from","created_at":"2026-09-27T09:44:26.232Z","author":"harness:codex","source_kind":"cli:update:dep","author_source":"detected"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:44:26.504Z"}],"before_hash":"2484e94fbc4e4ed41c5d1f13593e50f2b44564ff56776fbef570c64cab96a89a","after_hash":"5376cea6ea6055e0709a4904c49f28760431d29db4d17dd0b8e8ae8fe0325a2c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"7c6f8e5bc828858edfa959d485d38288967584f5b91e5aa0d3820bf0bfc8a0b8"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:49:05.042Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-09-27T09:49:05.041Z","author":"harness:codex","text":"Red regression: a real disposable Git checkout installed and activated, but its install plan reported excluded_entries=0 while .git metadata was copied. Focused test failed on expected 3 excluded entries before the shared copy-policy fix. The source checkout and managed destination are isolated under temporary PM roots."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:49:05.042Z"}],"before_hash":"5376cea6ea6055e0709a4904c49f28760431d29db4d17dd0b8e8ae8fe0325a2c","after_hash":"cd74a56225b39f6035a4d1c105f6a3e53dc6c52e8b84ae4313e7a93fe5d307dd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"b311628bee91980953149b3592a54187d981a29a337caf1648f3dd6a72417c7a"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:49:16.517Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:49:16.517Z"},{"op":"add","path":"/metadata/files","value":[{"path":"src/sdk/extension/copy-scope.ts","scope":"project","note":"shared source snapshot exclusion policy"},{"path":"src/sdk/extension/install-plan.ts","scope":"project","note":"plan counts Git metadata exclusions"},{"path":"src/sdk/extension/install-runtime.ts","scope":"project","note":"project and global copy filter"},{"path":"tests/unit/extensions/extension-install-dry-run.spec.ts","scope":"project","note":"real Git checkout acceptance regression"}]},{"op":"add","path":"/metadata/tests","value":[{"command":"node scripts/run-tests.mjs test -- tests/unit/extensions/extension-install-dry-run.spec.ts tests/unit/extensions/extension-install-plan.spec.ts","scope":"project","timeout_seconds":2400,"provenance":{"author":"harness:codex","created_at":"2026-09-27T09:49:16.479Z","source_kind":"local_mutation","source_ref":"fix/exclude-git-metadata-from-local-package-installs"}}]},{"op":"add","path":"/metadata/docs","value":[{"path":"docs/PACKAGE_EVIDENCE.md","scope":"project","note":"install policy and receipt semantics"}]}],"before_hash":"cd74a56225b39f6035a4d1c105f6a3e53dc6c52e8b84ae4313e7a93fe5d307dd","after_hash":"d9d9cf4a0a6b0c6cdb2614236a781622b7494283229fb80c3e824f9f5643c228","item_hash_version":3,"message":"Link SDK implementation, acceptance test, and operator documentation for Git metadata exclusion","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"165f3d451372031e40acd31f684658cb61e97edff2d44d486f9c3a09ce6b65d5"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:50:57.402Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/2","value":{"created_at":"2026-09-27T09:50:57.402Z","author":"harness:codex","text":"Green focused regression: the SDK dry-run and actual project/global installs of a real temporary Git checkout report four excluded Git entries on Linux (root directory, nested directory, worktree file, and symlink), retain the runtime entrypoint, and activate. Both focused install-plan and install-acceptance test files pass (8 tests)."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:50:57.402Z"}],"before_hash":"d9d9cf4a0a6b0c6cdb2614236a781622b7494283229fb80c3e824f9f5643c228","after_hash":"58b4fd7c7f58c67bc24de9aa7d6fa1e39d1f276ffa07331089fdfae0d4aa1d02","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"15b8242616f5eacc76505e1791c681686d2a32a6c8a594fc002be4799ca009da"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:03:23.850Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/3","value":{"created_at":"2026-09-27T10:03:23.850Z","author":"harness:codex","text":"Independent manual CLI acceptance in a disposable directory passed after a fresh build: created and committed a real Git checkout, added a worktree-style nested .git file, then ran built pm package install with --project and --global under isolated PM_PATH/PM_GLOBAL_PATH. Both JSON receipts reported activated=true and excluded_entries=2; installed entrypoints remained present; neither destination contained root or nested Git metadata. The fixture and tracker were removed afterward."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:03:23.850Z"}],"before_hash":"58b4fd7c7f58c67bc24de9aa7d6fa1e39d1f276ffa07331089fdfae0d4aa1d02","after_hash":"252c010f1ffe622d0d3802663447c20eeb4ea125f9ddf738264e961ec7b55ab2","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"1f39086db97bf793da4008e29916224d254a8bf9c5500bc034add12e8c3d78a2"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:05:56.159Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"test_run_track","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:05:56.159Z"},{"op":"add","path":"/metadata/test_runs","value":[{"run_id":"test-local-mujnl5un-v0qxfq","kind":"test","status":"passed","started_at":"2026-09-27T09:51:09.545Z","finished_at":"2026-09-27T10:05:56.062Z","recorded_at":"2026-09-27T10:05:56.062Z","passed":1,"failed":0,"skipped":0,"executions":[{"command":"node scripts/run-tests.mjs test -- tests/unit/extensions/extension-install-dry-run.spec.ts tests/unit/extensions/extension-install-plan.spec.ts","requested_pm_context_mode":"schema","pm_context_mode":"schema","workspace_context_mode":"source","trust_reason":"local_source_ref"}]}]}],"before_hash":"252c010f1ffe622d0d3802663447c20eeb4ea125f9ddf738264e961ec7b55ab2","after_hash":"9b6e142933b7661db36b3b4075ff7667b9670d64a9d08133ebc77764c622146c","item_hash_version":3,"message":"Track test run summary (test-local-mujnl5un-v0qxfq)","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"b4411395935b256ff5e492fddfe910315783be9b77ab81bfe007a2ca5ccfc4e4"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:06:10.374Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"add","path":"/metadata/files/4","value":{"path":"tests/unit/extensions/extension-copy-safety.spec.ts","scope":"project","note":"maintain lexical containment test with new Git exclusion filter"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:06:10.374Z"}],"before_hash":"9b6e142933b7661db36b3b4075ff7667b9670d64a9d08133ebc77764c622146c","after_hash":"1ec2cad142dc838e09a928299c55fc5bf84b8b33093a39aa6c65b0dded91aac9","item_hash_version":3,"message":"Link copy-safety regression maintenance found by full coverage run","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"01fb80182dac08c7cdf30320ed25971bcc9da32897973531164f4b0c817ebb76"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:06:27.503Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/4","value":{"created_at":"2026-09-27T10:06:27.503Z","author":"harness:codex","text":"Full local suite first pass: 9,373 tests passed and one existing copy-safety test failed because it required the exact fs.cp options object without a filter. The test was updated to require a filter while keeping its missing-source lexical-containment assertion; this is a test expectation change caused by the SDK copy policy. Exact global coverage awaits the second full run."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:06:27.503Z"}],"before_hash":"1ec2cad142dc838e09a928299c55fc5bf84b8b33093a39aa6c65b0dded91aac9","after_hash":"205caf955d9fa4b0fccbbb6226fca84df82fba4a63ad766977cc4a227459928f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"6d87fb16155877108b4098101c28bc9305f0fb0472986b5d056255611703b76a"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:22:52.017Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/5","value":{"created_at":"2026-09-27T10:22:52.017Z","author":"harness:codex","text":"Final full local suite passed after the copy-safety expectation update: 748 test files passed, one platform-specific file skipped, 9,374 tests passed and two platform-specific tests skipped. Exact V8 coverage gate passed 100/100/100/100: 65,714/65,714 statements, 50,250/50,250 branches, 13,601/13,601 functions, 62,761/62,761 lines. The PM-linked focused test also passed in sandboxed PM roots; independent manual project and global CLI acceptance passed."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:22:52.017Z"}],"before_hash":"205caf955d9fa4b0fccbbb6226fca84df82fba4a63ad766977cc4a227459928f","after_hash":"2c80485c32c875a19fcd3e0b58abed79d48fcca79873dadd162a69e053f1fca8","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"28dfdad7c3a8ce4f5f42c54e013ae43e5ce6e4c221c75365c1b7555327290742"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:22:58.746Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:22:58.746Z"},{"op":"add","path":"/metadata/escape_class","value":"production_defect"},{"op":"add","path":"/metadata/gate_evidence","value":{"disposition":"gate_strengthened","owner":"pm-k7nxaz","gate_id":"CI / Gates (coverage)","negative_control":"With the shared .git filter removed, node scripts/run-tests.mjs test -- tests/unit/extensions/extension-install-dry-run.spec.ts fails because a real Git checkout installs with excluded_entries=0 and copied metadata.","local_checks":["node scripts/run-tests.mjs test -- tests/unit/extensions/extension-copy-safety.spec.ts tests/unit/extensions/extension-install-dry-run.spec.ts tests/unit/extensions/extension-install-plan.spec.ts","node scripts/run-tests.mjs coverage -- --maxWorkers=4"],"hosted_checks":["CI / Gates (coverage)","CI / Gates (static)"]}}],"before_hash":"2c80485c32c875a19fcd3e0b58abed79d48fcca79873dadd162a69e053f1fca8","after_hash":"10d244ba36c908f518c6542a37acefbd6af6fd8c2c7de512afd17e24bd6e3f99","item_hash_version":3,"message":"Record red Git-checkout regression and strengthened exact-coverage gate evidence","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"b14b34d45bb6b24aaab41c685c1ac4ed9dcb5cf19322a0d5898e99088d786d51"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:34:35.632Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/6","value":{"created_at":"2026-09-27T10:34:35.632Z","author":"harness:codex","text":"Verification closeout: docs-skills, build, focused tests, manual temporary project/global CLI installs, full exact coverage, packed nine-package npx/bunx smoke, graph composition, record integrity, defect evidence, and mutation (323 killed, 7 equivalent, score 97.88%) passed. Aggregate static progressed through its preceding checks but the local CLI transport floor missed by 12 ms on a host with load 22.70/8 CPUs; a standalone rerun missed a different operation by 13 ms. Strict budgets remain unchanged; exact-head hosted static and benchmark checks are required before merge."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:34:35.632Z"}],"before_hash":"10d244ba36c908f518c6542a37acefbd6af6fd8c2c7de512afd17e24bd6e3f99","after_hash":"0ba99088a701946aa56c61dac33e277b31142722fadc2d28f8d5ab78ddb93e51","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"117e00fcf564432112606cf2f82b4fe89cdf082627dbb88e67cca3bbb2671e28"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:34:42.324Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:34:42.324Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-09-27T10:34:42.302Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-09-27T10:34:42.302Z"},{"op":"add","path":"/metadata/resolution","value":"Shared extension copy policy filters .git directory, worktree file, and symlink entries for external and nested source snapshots; the SDK plan counts exclusions and runtime copy applies the same policy for project and global installs. Added real Git checkout regression and documented receipt semantics."},{"op":"add","path":"/metadata/expected_result","value":"A local Git checkout installs and activates without copying source-control metadata, with truthful excluded-entry receipts."},{"op":"add","path":"/metadata/actual_result","value":"Focused 16-test extension suite, PM-linked sandbox test, independent temporary project/global CLI installs, 9,374-test exact 100/100/100/100 coverage, packed nine-package npx/bunx smoke, graph/integrity/defect/mutation gates passed. Local aggregate static was limited by host-loaded transport-floor latency; hosted exact-head checks will decide delivery."},{"op":"add","path":"/metadata/close_reason","value":"Local and SDK package copy plans now exclude Git metadata at every depth"}],"before_hash":"0ba99088a701946aa56c61dac33e277b31142722fadc2d28f8d5ab78ddb93e51","after_hash":"524355405e280634e93cf19f741fa484bf83f72978759f3d4c086b1308954b87","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"74c9ec49616817d6f81539327adb75ac7eb0c4813bb69e235f4fa49d3f59cac8"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:34:47.218Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:34:47.218Z"}],"before_hash":"524355405e280634e93cf19f741fa484bf83f72978759f3d4c086b1308954b87","after_hash":"7e7e47f2b9c1d5fb849a50c58338eeebf1af1b65571cfccca95d7d0cfe642993","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4b5128b070e1924b5088d74434ce0c7ec71ea0651c3d5a5f7955affdb9edd038"}
diff --git a/.agents/pm/history/pm-yse5dt.jsonl b/.agents/pm/history/pm-yse5dt.jsonl
index 3eef95a64..879ff9fdb 100644
--- a/.agents/pm/history/pm-yse5dt.jsonl
+++ b/.agents/pm/history/pm-yse5dt.jsonl
@@ -53,3 +53,4 @@
 {"ts":"2026-08-31T20:11:20.358Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-5.6-sol","agent_model_source":"probe","agent_instance":"0d9569ee6e9be8244d1d8836","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-yse5dt","lineage:pm-yse5dt","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]},"topic":{"value":"pm-yse5dt","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-yse5dt","lineage:pm-yse5dt","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-31T20:11:20.358Z"},{"op":"add","path":"/metadata/resolution","value":"Cold-start admission now measures ten independent post-warmup processes per operation by default while preserving every immutable latency and RSS budget and every existing fail-closed comparison."},{"op":"add","path":"/metadata/expected_result","value":"The fixed CLI bootstrap floor remains strict but no longer false-fails when transient host contention consumes all three prior samples."},{"op":"add","path":"/metadata/actual_result","value":"The focused 12-test suite, real six-operation default benchmark, exact 8,193-test 100/100/100/100 coverage run, and complete CI-mode static suite pass with unchanged budgets."}],"before_hash":"efdd8318e1c2f5dab97eb58bc1ad0be270c6c829248697e4e2c285f5b3d15be7","after_hash":"e0364ad9b1b63214fca91df2f351b77f11bf86d0863c5954afeea8df10258ac7","item_hash_version":3,"context":{"agent_provenance_outcomes":{"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}}}
 {"ts":"2026-08-31T20:11:21.059Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-5.6-sol","agent_model_source":"probe","agent_instance":"0d9569ee6e9be8244d1d8836","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-yse5dt","lineage:pm-yse5dt","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]},"topic":{"value":"pm-yse5dt","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-yse5dt","lineage:pm-yse5dt","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]}},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-31T20:11:21.059Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-08-31T20:11:21.020Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-08-31T20:11:21.020Z"},{"op":"add","path":"/metadata/close_reason","value":"Ten-sample default measurement passes focused, live, exact-coverage, and full static verification without weakening any transport ratchet."}],"before_hash":"e0364ad9b1b63214fca91df2f351b77f11bf86d0863c5954afeea8df10258ac7","after_hash":"707bc65ae6f554a87fab7f514d11d64114cb3ed49e3b3f05327c6bd725423158","item_hash_version":3,"context":{"agent_provenance_outcomes":{"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}}}
 {"ts":"2026-08-31T20:11:21.595Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-5.6-sol","agent_model_source":"probe","agent_instance":"0d9569ee6e9be8244d1d8836","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-yse5dt","lineage:pm-yse5dt","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]},"topic":{"value":"pm-yse5dt","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-yse5dt","lineage:pm-yse5dt","lineage:pm-9rxu","lineage:pm-o2kc","lineage:pm-doxj"]}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-31T20:11:21.595Z"}],"before_hash":"707bc65ae6f554a87fab7f514d11d64114cb3ed49e3b3f05327c6bd725423158","after_hash":"829d7d2bac771e399c20d29947d0bd5e242169c2c1226d13da59b28d711f3563","item_hash_version":3,"context":{"agent_provenance_outcomes":{"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}}}
+{"hash_algorithm":"sha256","ts":"2026-09-27T10:33:49.180Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/13","value":{"created_at":"2026-09-27T10:33:49.180Z","author":"harness:codex","text":"2026-09-27 recurrence under local host load 22.70 on eight CPUs: full pnpm quality:static passed its preceding checks but CLI transport floor reported next best 452 ms over unchanged 440 ms admission; standalone ten-sample rerun then reported create best 411 ms over unchanged 398 ms admission. No transport budget or implementation change was made. This matches prior saturated-host latency-only observations; hosted exact-head static/benchmark results remain the delivery authority. Full exact coverage and packed npx/bunx smoke passed independently."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T10:33:49.180Z"}],"before_hash":"829d7d2bac771e399c20d29947d0bd5e242169c2c1226d13da59b28d711f3563","after_hash":"e12a9d64cbca6d773c4fd72c3cc4c03e3831db994673f3c3891d202ffaabc80c","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"9aa11d5f3e59267f0e55203b198660a5504f5bf8c1bec97cc61f381657b1e39d"}
diff --git a/.agents/pm/issues/pm-e70zh5.toon b/.agents/pm/issues/pm-e70zh5.toon
index 77fc5ea43..a2100d2ca 100644
--- a/.agents/pm/issues/pm-e70zh5.toon
+++ b/.agents/pm/issues/pm-e70zh5.toon
@@ -6,7 +6,7 @@ status: closed
 priority: 1
 tags[5]: "area:release",ci,observability,reliability,slo
 created_at: "2026-07-27T04:05:41.511Z"
-updated_at: "2026-09-24T13:48:35.150Z"
+updated_at: "2026-09-27T09:57:02.802Z"
 closed_at: "2026-09-24T13:32:42.761Z"
 completed_at: "2026-09-24T13:32:42.761Z"
 author: "harness:claude-code"
@@ -83,7 +83,7 @@ dependencies[13]:
     author: "harness:codex"
     source_kind: "cli:update:dep"
     author_source: detected
-comments[29]{created_at,author,text}:
+comments[30]{created_at,author,text}:
   "2026-07-27T13:01:11.067Z","harness:claude-code","Observation 2026-07-27 on the denominator used to compute the failure rate.\n\nThe Auto Release workflow has three triggers and they produce wildly different run volumes. The schedule fires once a day, which is the 84 runs this item measures. The workflow_dispatch fires on demand. The issues trigger fires on every issue closure in the repository, and because there is no concurrency key that collapses them, closing several issues at once produces a burst of near-simultaneous runs: four runs within one second at 12:09:44Z today, six at 08:45 on 2026-07-26, five at 08:54 today with one of them cancelled.\n\nThey are all correctly filtered at job level by the if condition that restricts issues-triggered runs to the bot-authored blocker recovery, so they skip in seconds and cannot cut a release. Two things still follow. The workflow run history is dominated by runs that were never going to do anything, which makes the pipeline look far busier and far healthier than the scheduled path actually is, and any rate computed over all runs rather than over event equals schedule will be wrong by an order of magnitude. And one of today's burst runs shows conclusion cancelled rather than skipped, which is the cancel-in-progress pattern that this project has already learned masks red gates elsewhere.\n\nNeither changes the 32 of 84 scheduled figure this item owns, which was measured on the schedule event alone. Recording it so the denominator is not silently recomputed the easy way later."
   "2026-07-31T06:14:42.055Z","harness:claude-code","Rate sample refreshed 2026-07-31: of the last eleven completed scheduled Auto Release runs, three concluded failure (2026-07-21, 2026-07-23, 2026-07-24) — 27 percent. Consistent with the 32-of-84 lifetime figure. Today's run succeeded and published 2026.7.31; npm latest, npx direct, npx --package and bunx --bun all resolve and execute the published artifact under bun 1.3.11. One scheduled cut today, so the one-release-per-day property held on this run."
   "2026-08-01T09:53:05.449Z","harness:claude-code","Scheduled-run health sampled live 2026-08-01. The most recent scheduled Auto Release runs (30686302858 at 05:41:09Z today, 51s, success; 30607915788 at 2026-07-31T05:50:49Z, 20m50s, success) both completed, and the daily cut is landing: v2026.7.29 through v2026.8.1 exist as consecutive daily tags with matching GitHub releases. The window observation from pm-44u3wt still holds -- the 05:41 and 05:50 start times are hours after the declared cron -- and remains a separate defect from the failure rate this item measures. The point that motivates this item is unchanged and visible in the same listing: the workflow also fires on issues events, and those runs report conclusion 'skipped' while occupying the same run history as real scheduled attempts, so any rate computed over gh run list without partitioning by event conflates three populations (schedule, workflow_dispatch, issues) whose expected outcomes differ."
@@ -113,6 +113,7 @@ comments[29]{created_at,author,text}:
   "2026-09-24T13:23:03.375Z","harness:codex","Verification scheduling evidence: concurrent full coverage held the shared build lease, so the linked focused command and package dogfood nested linked command timed out waiting for a rebuild. Preserve those failures; rerun them serially after the broad suite completes. This is not evidence that their assertions failed, and no timeout or gate is being weakened. Separate live Sentry one-day gate passed with zero critical/high issues; required telemetry gate passed at 2.03 percent finish errors and zero failures lacking error codes. Repository history validation covered 2801 items with zero drift; 170 historical resolution metadata advisories remain."
   "2026-09-24T13:31:56.087Z","harness:codex","Verification: all 51 focused tests pass; exact coverage of the four changed release modules is 337/337 statements, 259/259 branches, 59/59 functions, 308/308 lines. Linked sandbox verification, package-first authoring dogfood, and packed npx/bunx smoke pass. Both unrelated full-suite timeout cases pass in isolation (28 tests); the initial full coverage run is not claimed green. Live read-only census contains 30 completed original scheduled attempts, 13 failures, and 17 historical successes without outcome receipts. Sentry has zero current unresolved findings and telemetry gate passes; these do not establish historical schedule health."
   "2026-09-24T13:48:35.150Z","harness:codex","PR 1302 review follow-up: accepted CodeRabbit finding that receipt write/upload failures must not turn an already published release into a failed run. Both evidence steps are now non-blocking; a workflow contract assertion failed before the fix and passes afterward. Missing receipts remain unknown_success, not publication proof. Fixed the prose-reference graph regression with an honest contextual distribution-feature edge; full tracker assertions pass. Initial hosted CI passed all checks except that graph regression, including exact full-source coverage. Local transport budgets passed on retry unchanged; mutation gate killed 323 of 330 with seven documented equivalent mutants. Sourcery review is quota-limited and Greptile has not responded."
+  "2026-09-27T09:57:02.802Z","harness:codex","2026-09-27 live hosted evidence: Release Reliability run 36306444764 reported 13 failures among 31 completed scheduled attempts in its 30-day window (41.94% versus 10% policy), plus dispatch-window violation. Scheduled Auto Release run 36306417214 succeeded at 08:30 UTC, about 356 minutes after the nominal 02:35 UTC occurrence, and verified the same-day release already produced by an earlier manual dispatch. Exactly one v2026.9.27 release was visible. The rolling reporter is functioning; the historical failure rate and hosted schedule lateness remain unresolved, and 16 older successes lack complete outcome receipts."
 notes[7]:
   - created_at: "2026-08-10T16:05:25.318Z"
     author: "harness:claude-code"
diff --git a/.agents/pm/issues/pm-k7nxaz.toon b/.agents/pm/issues/pm-k7nxaz.toon
new file mode 100644
index 000000000..647ad9a4b
--- /dev/null
+++ b/.agents/pm/issues/pm-k7nxaz.toon
@@ -0,0 +1,69 @@
+id: pm-k7nxaz
+title: Exclude Git metadata from local package directory installs
+description: "GitHub #1324 reproduces a complete, successful local-directory package install that copies the source checkout .git config, refs, and object history into the managed extension. The installer and its SDK copy planner should share an every-depth Git-metadata exclusion policy, account for excluded entries, preserve runtime files and activation, and refuse unsafe .git symlink cases as appropriate."
+type: Issue
+status: closed
+priority: 1
+tags[6]: "area:extensions","area:packages",defect,github-issue,privacy,security
+created_at: "2026-09-27T09:42:32.830Z"
+updated_at: "2026-09-27T10:34:47.218Z"
+closed_at: "2026-09-27T10:34:42.302Z"
+completed_at: "2026-09-27T10:34:42.302Z"
+author: "harness:codex"
+acceptance_criteria: "A real disposable Git checkout with sentinel config/ref installs without any .git metadata under the managed extension; Nested .git directories and symlinked Git metadata cannot enter the copy, and the plan reports excluded entries; Project and global installs, dry runs, packed archive recovery, and existing extension activation remain functional"
+goal: project management = context management
+objective: Local package installs never carry source-control history into managed runtime artifacts
+value: Prevent accidental replication of repository history and config into install outputs
+impact: Reduce copied data and metadata exposure for local checkout installs
+outcome: Real Git checkout installs activate without .git metadata in the managed destination
+parent: pm-x6jf
+risk: high
+severity: high
+resolution: "Shared extension copy policy filters .git directory, worktree file, and symlink entries for external and nested source snapshots; the SDK plan counts exclusions and runtime copy applies the same policy for project and global installs. Added real Git checkout regression and documented receipt semantics."
+expected_result: "A local Git checkout installs and activates without copying source-control metadata, with truthful excluded-entry receipts."
+actual_result: "Focused 16-test extension suite, PM-linked sandbox test, independent temporary project/global CLI installs, 9,374-test exact 100/100/100/100 coverage, packed nine-package npx/bunx smoke, graph/integrity/defect/mutation gates passed. Local aggregate static was limited by host-loaded transport-floor latency; hosted exact-head checks will decide delivery."
+affected_version: 2026.9.27
+dependencies[3]{id,kind,created_at,author,source_kind,author_source}:
+  pm-5bsofk,discovered_from,"2026-09-27T09:42:32.830Z","harness:codex","cli:create:dep",detected
+  pm-x6jf,discovered_from,"2026-09-27T09:42:32.830Z","harness:codex","cli:create:dep",detected
+  pm-erogk1,discovered_from,"2026-09-27T09:44:26.232Z","harness:codex","cli:update:dep",detected
+comments[7]{created_at,author,text}:
+  "2026-09-27T09:42:32.830Z","harness:codex","Duplicate check across all PM statuses: searched Git metadata, local extension install, and GitHub #1324. Historical pm-5bsofk/pm-erogk1 cover copy planning and bounded scans, not the successful Git-history copy defect. Source: https://github.com/unbraind/pm-cli/issues/1324. The issue was created with no PM link and is now owned here."
+  "2026-09-27T09:49:05.041Z","harness:codex","Red regression: a real disposable Git checkout installed and activated, but its install plan reported excluded_entries=0 while .git metadata was copied. Focused test failed on expected 3 excluded entries before the shared copy-policy fix. The source checkout and managed destination are isolated under temporary PM roots."
+  "2026-09-27T09:50:57.402Z","harness:codex","Green focused regression: the SDK dry-run and actual project/global installs of a real temporary Git checkout report four excluded Git entries on Linux (root directory, nested directory, worktree file, and symlink), retain the runtime entrypoint, and activate. Both focused install-plan and install-acceptance test files pass (8 tests)."
+  "2026-09-27T10:03:23.850Z","harness:codex","Independent manual CLI acceptance in a disposable directory passed after a fresh build: created and committed a real Git checkout, added a worktree-style nested .git file, then ran built pm package install with --project and --global under isolated PM_PATH/PM_GLOBAL_PATH. Both JSON receipts reported activated=true and excluded_entries=2; installed entrypoints remained present; neither destination contained root or nested Git metadata. The fixture and tracker were removed afterward."
+  "2026-09-27T10:06:27.503Z","harness:codex","Full local suite first pass: 9,373 tests passed and one existing copy-safety test failed because it required the exact fs.cp options object without a filter. The test was updated to require a filter while keeping its missing-source lexical-containment assertion; this is a test expectation change caused by the SDK copy policy. Exact global coverage awaits the second full run."
+  "2026-09-27T10:22:52.017Z","harness:codex","Final full local suite passed after the copy-safety expectation update: 748 test files passed, one platform-specific file skipped, 9,374 tests passed and two platform-specific tests skipped. Exact V8 coverage gate passed 100/100/100/100: 65,714/65,714 statements, 50,250/50,250 branches, 13,601/13,601 functions, 62,761/62,761 lines. The PM-linked focused test also passed in sandboxed PM roots; independent manual project and global CLI acceptance passed."
+  "2026-09-27T10:34:35.632Z","harness:codex","Verification closeout: docs-skills, build, focused tests, manual temporary project/global CLI installs, full exact coverage, packed nine-package npx/bunx smoke, graph composition, record integrity, defect evidence, and mutation (323 killed, 7 equivalent, score 97.88%) passed. Aggregate static progressed through its preceding checks but the local CLI transport floor missed by 12 ms on a host with load 22.70/8 CPUs; a standalone rerun missed a different operation by 13 ms. Strict budgets remain unchanged; exact-head hosted static and benchmark checks are required before merge."
+files[5]{path,scope,note}:
+  src/sdk/extension/copy-scope.ts,project,shared source snapshot exclusion policy
+  src/sdk/extension/install-plan.ts,project,plan counts Git metadata exclusions
+  src/sdk/extension/install-runtime.ts,project,project and global copy filter
+  tests/unit/extensions/extension-install-dry-run.spec.ts,project,real Git checkout acceptance regression
+  tests/unit/extensions/extension-copy-safety.spec.ts,project,maintain lexical containment test with new Git exclusion filter
+tests[1]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}:
+  node scripts/run-tests.mjs test -- tests/unit/extensions/extension-install-dry-run.spec.ts tests/unit/extensions/extension-install-plan.spec.ts,project,2400,"harness:codex","2026-09-27T09:49:16.479Z",local_mutation,fix/exclude-git-metadata-from-local-package-installs
+test_runs[1]:
+  - run_id: test-local-mujnl5un-v0qxfq
+    kind: test
+    status: passed
+    started_at: "2026-09-27T09:51:09.545Z"
+    finished_at: "2026-09-27T10:05:56.062Z"
+    recorded_at: "2026-09-27T10:05:56.062Z"
+    passed: 1
+    failed: 0
+    skipped: 0
+    executions[1]{command,requested_pm_context_mode,pm_context_mode,workspace_context_mode,trust_reason}:
+      node scripts/run-tests.mjs test -- tests/unit/extensions/extension-install-dry-run.spec.ts tests/unit/extensions/extension-install-plan.spec.ts,schema,schema,source,local_source_ref
+docs[1]{path,scope,note}:
+  docs/PACKAGE_EVIDENCE.md,project,install policy and receipt semantics
+close_reason: Local and SDK package copy plans now exclude Git metadata at every depth
+escape_class: production_defect
+gate_evidence:
+  disposition: gate_strengthened
+  owner: pm-k7nxaz
+  gate_id: CI / Gates (coverage)
+  negative_control: "With the shared .git filter removed, node scripts/run-tests.mjs test -- tests/unit/extensions/extension-install-dry-run.spec.ts fails because a real Git checkout installs with excluded_entries=0 and copied metadata."
+  local_checks[2]: node scripts/run-tests.mjs test -- tests/unit/extensions/extension-copy-safety.spec.ts tests/unit/extensions/extension-install-dry-run.spec.ts tests/unit/extensions/extension-install-plan.spec.ts,node scripts/run-tests.mjs coverage -- --maxWorkers=4
+  hosted_checks[2]: CI / Gates (coverage),CI / Gates (static)
+body: ""
diff --git a/.agents/pm/tasks/pm-7wmq.toon b/.agents/pm/tasks/pm-7wmq.toon
index 95876535f..d954bd6a5 100644
--- a/.agents/pm/tasks/pm-7wmq.toon
+++ b/.agents/pm/tasks/pm-7wmq.toon
@@ -6,7 +6,7 @@ status: closed
 priority: 2
 tags[3]: ci,quality,security
 created_at: "2026-07-03T14:10:21.927Z"
-updated_at: "2026-09-19T08:39:41.941Z"
+updated_at: "2026-09-27T09:57:14.230Z"
 closed_at: "2026-07-03T14:41:06.488Z"
 author: maintainer-agent
 release: v2026.7.4
@@ -23,5 +23,7 @@ dependencies[2]:
     author: "harness:claude-code"
     source_kind: "cli:update:dep"
     author_source: detected
+comments[1]{created_at,author,text}:
+  "2026-09-27T09:57:14.230Z","harness:codex","2026-09-27 merged-main Security and Script Quality run 36310034735 attempt 1 failed before analysis because PowerShell Gallery blocked the pinned PSScriptAnalyzer package download with a WAF response. A single failed-job rerun (attempt 2) completed successfully with every job green. This was an external fetch failure, not an analyzer finding; the required gate stayed enforced."
 close_reason: completed
 body: ""
diff --git a/.agents/pm/tasks/pm-yse5dt.toon b/.agents/pm/tasks/pm-yse5dt.toon
index f6c3a9df8..a326a56dc 100644
--- a/.agents/pm/tasks/pm-yse5dt.toon
+++ b/.agents/pm/tasks/pm-yse5dt.toon
@@ -6,7 +6,7 @@ status: closed
 priority: 1
 tags[6]: agent-ux,"area:cli","area:sdk",performance,scale,startup
 created_at: "2026-07-25T07:09:44.499Z"
-updated_at: "2026-08-31T20:11:21.595Z"
+updated_at: "2026-09-27T10:33:49.180Z"
 closed_at: "2026-08-31T20:11:21.020Z"
 completed_at: "2026-08-31T20:11:21.020Z"
 author: unknown
@@ -63,7 +63,7 @@ dependencies[12]:
     author: "harness:codex"
     source_kind: "cli:update:dep"
     author_source: detected
-comments[13]{created_at,author,text}:
+comments[14]{created_at,author,text}:
   "2026-07-25T07:12:21.706Z","harness:claude-code","Duplicate-check evidence (all-status pm search over cold start, startup, latency, bootstrap, benchmark, transport): matched closed pm-gt82, pm-irp1, pm-7rlp, pm-mi2x, pm-hcrmye and open pm-9rxu, pm-801d, pm-5t33or. pm-irp1 is a closed Decision stating the sub-200ms strategy with no enforcement; pm-hcrmye restored the existing absolute budgets and its closing comment records the unaddressed gap verbatim (cli.create min 275ms vs SDK create 5-7ms); pm-801d is the data-scaling read index, a different axis. No open item owns the fixed floor or the CLI/SDK delta. Filed as a focused child of pm-9rxu."
   "2026-07-25T07:12:22.483Z","harness:claude-code","Measurement method for reproduction: Node 26.5.0, warm compile cache, dist/cli-bundle resolved via bin. Baselines: node -e '' 41ms; pm --version 71ms. Freshly initialised single-item sandbox workspace (PM_PATH/PM_GLOBAL_PATH isolated): pm --help 325ms, pm get 319-370ms, pm context 325ms, pm next 309ms, pm validate 352ms, pm stats 318ms — the floor is identical whether or not the command reads data. Entry import cost in isolation: dist/cli-bundle/main.js 286ms, dist/cli-bundle/sdk.js 289ms. Real 1,984-item workspace for contrast: get 995-1168ms, list-open 908-1005ms, context 1129ms, next 1265ms, stats 1365ms, validate 5981ms. CPU profile of pm get attributes roughly 250ms of the run to Node ESM machinery (loader, resolve, package_json_reader, compileSourceTextModule) plus 67ms GC, before any workspace read."
   "2026-07-25T09:14:33.815Z","harness:codex","Evidence update: the first 10k check exposed that adding focused SDK entrypoints to the executable esbuild graph fragmented eager CLI chunks and breached the existing create/claim floor. The bundle now builds the CLI plus compatibility SDK graph separately from focused SDK entrypoints. The unchanged 10k absolute, RSS, product, and CLI-minus-SDK gates pass on the repository's authoritative Node 24.12 runtime; Node 26.5 remains above the historical create/claim RSS envelope and is recorded as runtime-specific evidence rather than weakening budgets. CLI benchmark mutations no longer inject PM_AUTHOR and exercise automatic author resolution."
@@ -77,6 +77,7 @@ comments[13]{created_at,author,text}:
   "2026-08-31T19:36:27.199Z","harness:codex","TDD red: the focused transport-floor suite now requires ten default post-warmup samples and fails because the implementation reports three. Command: node scripts/run-tests.mjs test -- tests/unit/scripts/cli-transport-floor.spec.ts; result 11 passed, 1 failed at the default-iterations assertion. No budget or admission margin was changed."
   "2026-08-31T19:39:22.028Z","harness:codex","Implementation evidence: the default cold-floor depth is now ten independent post-warmup processes per operation; the comparator, immutable budgets, 25ms latency margin, 512KiB RSS margin, best-latency statistic, and median-RSS fail-closed policy are unchanged. Focused suite passes 12/12, ESLint passes, and the real six-operation default check passes on the same host where three-sample checks repeatedly false-failed."
   "2026-08-31T20:11:19.783Z","harness:codex","Terminal local evidence on d2da44b1dd0a6da5d5049803ea1f14b4f7daae9b: exact repository coverage passed 593 files and 8,193 tests at 100% statements 60,561/60,561, branches 45,742/45,742, functions 12,603/12,603, and lines 58,310/58,310. CI=1 pnpm quality:static passed all lint, duplication, build, contracts, SDK, refusal, token, graph, integrity, and ten-sample transport gates. Hosted static reached only the deterministic changelog check and correctly failed because this recurrence was intentionally still in_progress; closing it now makes the generated changelog authoritative before the final exact-head preflight."
+  "2026-09-27T10:33:49.180Z","harness:codex","2026-09-27 recurrence under local host load 22.70 on eight CPUs: full pnpm quality:static passed its preceding checks but CLI transport floor reported next best 452 ms over unchanged 440 ms admission; standalone ten-sample rerun then reported create best 411 ms over unchanged 398 ms admission. No transport budget or implementation change was made. This matches prior saturated-host latency-only observations; hosted exact-head static/benchmark results remain the delivery authority. Full exact coverage and packed npx/bunx smoke passed independently."
 notes[1]{created_at,author,text}:
   "2026-07-25T21:41:47.886Z","harness:claude-code","Bootstrap floor re-measured 2026-07-25 on the real 2,037-item tracker rather than on an empty workspace, which changes the number this item gates on.\n\npm --version returns in 85 ms. Every data command lands between 650 ms and 1,900 ms, and the gap is close to constant across commands of very different work profiles: pm history <id> (one stream file, no workspace walk) 658 ms; pm list-open --limit 5 919 ms; pm get <id> 882 to 1,204 ms; pm contracts --command create 785 ms, which touches no item data at all. A command that reads nothing from the tracker still costs about 700 ms.\n\nSo the floor this item owns is not the ~280 ms measured on an empty workspace. On a real workspace it is roughly 600 to 800 ms, and it dominates every interactive command except validate and health. That is the number a gate should hold, and it is also the number that decides whether the product can claim to feel instant: pm-801d's read index removes the scan on top of the floor, not the floor.\n\nInstrument caveat that affects how this gets measured: the built-in --profile timer starts inside the command handler and therefore excludes exactly this span. On pm list it reports 200 ms against a 1,004 ms wall clock. Any ratchet for this item must not be built on --profile output until pm-ag9nka lands."
 learnings[1]{created_at,author,text}:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 189f7c5c0..fb7d82105 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@
 - Preserve every tracker merge fence during nested init and detect lost active mappings ([pm-kynkl8](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-kynkl8.toon))
 - Refuse local package installation when source scan stops at entry limit ([pm-erogk1](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-erogk1.toon))
 
+### Security
+
+- Exclude Git metadata from local package directory installs ([pm-k7nxaz](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-k7nxaz.toon))
+
 ### Other
 
 - Claude plugin spec-alignment hygiene vs 2026-07-11 official docs (minor, non-blocking) ([pm-dudr](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-dudr.toon))
diff --git a/docs/PACKAGE_EVIDENCE.md b/docs/PACKAGE_EVIDENCE.md
index 330efda5e..803c0c1c9 100644
--- a/docs/PACKAGE_EVIDENCE.md
+++ b/docs/PACKAGE_EVIDENCE.md
@@ -3,7 +3,8 @@
 Tracked by [pm-erogk1](../.agents/pm/issues/pm-erogk1.toon),
 [pm-5bsofk](../.agents/pm/issues/pm-5bsofk.toon) and
 [pm-gf5zw8](../.agents/pm/issues/pm-gf5zw8.toon), with claim controls tracked by
-[pm-eqdo85](../.agents/pm/issues/pm-eqdo85.toon).
+[pm-eqdo85](../.agents/pm/issues/pm-eqdo85.toon) and Git metadata exclusion by
+[pm-k7nxaz](../.agents/pm/issues/pm-k7nxaz.toon).
 
 ## Install planning
 
@@ -11,8 +12,11 @@ Preview an install with `pm package install ./local-package --project --dry-run`
 The `details.install_plan` receipt distinguishes directory, archive, npm, and
 GitHub sources and reports logical file bytes, file/directory/link counts, and
 the copy policy. External local directories are directory snapshots, including
-development artifacts; nested destinations exclude `.agents`, `node_modules`,
-and installer backup directories at every depth using the installer's filter.
+development artifacts other than `.git`. All copied directory sources exclude
+`.git` entries at every depth, including worktree files and symlinks, and count
+those entries in `excluded_entries`. Nested destinations also exclude `.agents`,
+`node_modules`, and installer backup directories at every depth using the
+installer's filter.
 The bounded planner can return lower-bound counts with `complete: false` and a
 `stop_reason` when called directly. Installing a local directory now refuses
 that incomplete scan in both dry-run and real modes before writing or
diff --git a/src/sdk/extension/copy-scope.ts b/src/sdk/extension/copy-scope.ts
index c84e847cf..f5feeb165 100644
--- a/src/sdk/extension/copy-scope.ts
+++ b/src/sdk/extension/copy-scope.ts
@@ -2,12 +2,14 @@
 import path from "node:path";
 import { isPathWithinDirectory } from "../../core/fs/path-utils.js";
 
-/** Decide whether a lexical source path belongs in a nested-destination snapshot. Symlinks remain links. */
-export function includesExtensionCopyPath(source: string, destination: string, candidate: string): boolean {
+/** Decide whether a lexical source path belongs in an extension snapshot. Git metadata is always excluded; symlinks remain links. */
+export function includesExtensionCopyPath(source: string, destination: string, candidate: string, nestedDestination: boolean): boolean {
   const relative = path.relative(source, candidate);
   if (relative !== "" && !isPathWithinDirectory(source, candidate)) return false;
   if (candidate === destination || isPathWithinDirectory(destination, candidate)) return false;
   const segments = relative.split(path.sep);
+  if (segments.includes(".git")) return false;
+  if (!nestedDestination) return true;
   return !segments.some(
     (segment) => segment === ".agents" || segment === "node_modules" || segment.startsWith(".pm-extension-install-backup-"),
   );
diff --git a/src/sdk/extension/install-plan.ts b/src/sdk/extension/install-plan.ts
index 6958e4e19..91c48df0f 100644
--- a/src/sdk/extension/install-plan.ts
+++ b/src/sdk/extension/install-plan.ts
@@ -156,7 +156,7 @@ async function scanExtensionCopyDirectory(directory: string, depth: number, plan
     }
     plan.scanned_entries += 1;
     const candidate = path.join(directory, entry.name);
-    if (plan.copy_scope === "nested_filtered_snapshot" && !includesExtensionCopyPath(plan.source_directory, plan.destination_directory, candidate)) {
+    if (!includesExtensionCopyPath(plan.source_directory, plan.destination_directory, candidate, plan.copy_scope === "nested_filtered_snapshot")) {
       plan.excluded_entries += 1;
       continue;
     }
diff --git a/src/sdk/extension/install-runtime.ts b/src/sdk/extension/install-runtime.ts
index 35d7baf41..f9d6a5a06 100644
--- a/src/sdk/extension/install-runtime.ts
+++ b/src/sdk/extension/install-runtime.ts
@@ -166,6 +166,10 @@ export const copyExtensionDirectoryWithoutSelfNesting = async (
     await copyDirectory(canonicalSource, destinationDirectory, {
       recursive: true,
       force: true,
+      filter: (sourcePath) => includesExtensionCopyPath(
+        canonicalSource, canonicalDestination,
+        path.resolve(sourcePath), false,
+      ),
     });
     return;
   }
@@ -199,7 +203,7 @@ export const copyExtensionDirectoryWithoutSelfNesting = async (
       force: true,
       filter: (sourcePath) => includesExtensionCopyPath(
         canonicalSource, canonicalDestination,
-        path.resolve(sourcePath),
+        path.resolve(sourcePath), true,
       ),
     });
     await copyDirectory(stagedDirectory, destinationDirectory, {
diff --git a/tests/unit/extensions/extension-copy-safety.spec.ts b/tests/unit/extensions/extension-copy-safety.spec.ts
index 7a00a5ea1..447614b00 100644
--- a/tests/unit/extensions/extension-copy-safety.spec.ts
+++ b/tests/unit/extensions/extension-copy-safety.spec.ts
@@ -38,10 +38,11 @@ describe("extension install copy containment", () => {
       destination,
       copyDirectory,
     );
-    expect(copyDirectory).toHaveBeenCalledWith(source, destination, {
+    expect(copyDirectory).toHaveBeenCalledWith(source, destination, expect.objectContaining({
       recursive: true,
       force: true,
-    });
+      filter: expect.any(Function),
+    }));
   });
 
   it("stages a symlinked source whose real install destination is nested inside it", async () => {
diff --git a/tests/unit/extensions/extension-install-dry-run.spec.ts b/tests/unit/extensions/extension-install-dry-run.spec.ts
index b05ad40a4..efe7ee42b 100644
--- a/tests/unit/extensions/extension-install-dry-run.spec.ts
+++ b/tests/unit/extensions/extension-install-dry-run.spec.ts
@@ -10,6 +10,44 @@ import { writeTestExtension } from "../../helpers/extensions.js";
 import { withTempPmPath } from "../../helpers/withTempPmPath.js";
 
 describe("package install dry run", () => {
+  it("installs a real Git checkout without copying its source-control metadata", async () => {
+    await withTempPmPath(async (context) => {
+      const source = path.join(context.tempRoot, "git-source");
+      await writeTestExtension({ root: source, name: "git-source" });
+      const git = (args: string[]) => spawnSync("git", ["-C", source, ...args], { encoding: "utf8" });
+      expect(git(["init", "-q"]).status).toBe(0);
+      expect(git(["config", "local.sentinel", "do-not-copy"]).status).toBe(0);
+      expect(git(["add", "manifest.json", "index.js"]).status).toBe(0);
+      expect(git(["-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-qm", "sentinel"]).status).toBe(0);
+      await fs.mkdir(path.join(source, "assets", ".git"), { recursive: true });
+      await fs.writeFile(path.join(source, "assets", ".git", "sentinel"), "do-not-copy");
+      await fs.mkdir(path.join(source, "worktree"));
+      await fs.writeFile(path.join(source, "worktree", ".git"), "gitdir: ../.git/worktrees/example\n");
+      if (process.platform !== "win32") {
+        await fs.mkdir(path.join(source, "linked"));
+        await fs.symlink(path.join(source, ".git"), path.join(source, "linked", ".git"), "dir");
+      }
+
+      const client = new PmClient({ pmRoot: context.pmPath });
+      const dryRun = await client.packageInstall(source, { project: true, dryRun: true });
+      expect(dryRun.details.install_plan?.copy).toMatchObject({ complete: true, excluded_entries: process.platform === "win32" ? 3 : 4 });
+      for (const scope of ["project", "global"] as const) {
+        const installed = await client.packageInstall(source, { [scope]: true });
+        expect(installed.ok).toBe(true);
+        expect(installed.details.activated).toBe(true);
+        expect(installed.details.install_plan?.copy).toMatchObject({
+          complete: true,
+          excluded_entries: process.platform === "win32" ? 3 : 4,
+        });
+        const destination = path.join(scope === "project" ? context.pmPath : context.env.PM_GLOBAL_PATH, "extensions", "git-source");
+        expect(await fs.readFile(path.join(destination, "index.js"), "utf8")).toContain("activate()");
+        for (const gitPath of [".git", path.join("assets", ".git"), path.join("worktree", ".git"), path.join("linked", ".git")]) {
+          await expect(fs.lstat(path.join(destination, gitPath))).rejects.toMatchObject({ code: "ENOENT" });
+        }
+      }
+    });
+  });
+
   it("refuses incomplete directory scans before dry runs or real installs can publish a package", async () => {
     await withTempPmPath(async (context) => {
       const source = path.join(context.tempRoot, "limited-source");