Exclude Git metadata from local extension installs

.agents/pm/chores/pm-e9zh.toon

@@ -6,7 +6,7 @@ status: closed
 priority: 2
 tags[5]: metadata,normalization,pm-cli,resolution,tracker-governance
 created_at: "2026-06-25T04:57:09.804Z"
-updated_at: "2026-09-08T06:45:06.155Z"
+updated_at: "2026-09-27T10:38:24.373Z"
 closed_at: "2026-09-08T06:45:04.537Z"
 completed_at: "2026-09-08T06:45:04.537Z"
 author: codex-pm-ecosystem-audit-20260625
@@ -40,7 +40,7 @@ dependencies[5]:
     author: "harness:claude-code"
     source_kind: "cli:update:dep"
     author_source: detected
-comments[21]{created_at,author,text}:
+comments[22]{created_at,author,text}:
   "2026-06-25T04:57:09.804Z",codex-pm-ecosystem-audit-20260625,"Duplicate check: status-all searches for terminal resolution metadata backfill and active planning metadata found closed governance tooling items pm-yq7m, pm-fryg, pm-wbak-class work, and pm-6bz1, but no open execution item for historical backfill."
   "2026-07-04T20:56:40.819Z",codex-agent,"Audit evidence 2026-07-04 continuation: pm validate --check-resolution --check-history-drift --json is ok:true for history_drift across 1506 checked items and warns only validate_resolution_missing_fields:268 across closed historical items. This confirms pm-e9zh remains the canonical open remediation for terminal resolution/expected/actual backfill; no duplicate item created. The earlier list --filter-resolution-missing projection showed 198 closed rows because it counts a narrower filter than validate resolution details. Keep the existing no-placeholder and changelog-drag rules."
   "2026-07-05T05:51:00.468Z",claude-code-agent,"Live validation handoff from pm-lodl/pm-8778 lane: pm validate --check-resolution --check-history-drift --json on 2026-07-05 returned ok:true with history_drift ok across 1536 checked items and the pre-existing validate_resolution_missing_fields:268 warning. This confirms pm-e9zh remains the canonical open remediation for historical terminal resolution metadata; no duplicate item created from this lane."
@@ -62,6 +62,7 @@ comments[21]{created_at,author,text}:
   "2026-09-04T20:53:39.830Z","harness:codex","2026-09-04 validation refresh: the live resolution check inspected 2327 closed items and reports exactly 295 historical items missing one or more structured resolution fields, unchanged from the established 2026-08 baseline. No placeholder values or duplicate cleanup item were introduced. The history scan overlapped active mutations; its three current-item hash mismatches were individually rechecked through history --verify --strict-exit and all three chains and current documents match. A frozen final corpus drift scan is still required for delivery closeout."
   "2026-09-07T07:05:43.085Z","harness:codex","Live validation refresh 2026-09-07: resolution checks inspected all 2362 closed items and identified 295 with missing structured resolution fields. This is the existing evidence-backfill population, not a new defect in the planning primitives. Current delivery closures will include resolution/expected/actual atomically. The no-placeholder policy remains applicable; this pass did not manufacture historical outcomes."
   "2026-09-08T05:30:34.329Z","harness:codex","Reviewed recovery plan: all 295 flagged closed items read with full live pm get; full history stream inspected. 285 items have evidence-backed additions: 221 missing resolutions and 274 missing actual results can copy their own substantive close_reason, and 127 missing expected results can copy their own recorded acceptance criteria. No description of a defect is repurposed as an expected outcome. 170 residual items retain honest missing fields. Apply oldest-first in 25-item atomic CLI transactions; preserve release/status/close timestamps and verify package-owned changelog stability."
+  "2026-09-27T10:38:24.373Z","harness:codex","2026-09-27 live validation refresh: pm validate --check-resolution --check-history-drift returned ok:true and zero drift across 2,815 item histories. It warned that 170 of 2,522 closed items still lack at least one structured resolution/expected/actual field. This is the historical residual after the bounded source-grounded backfill, not a new closure in this tranche; no placeholder values were written."
 notes[3]{created_at,author,text}:
   "2026-07-04T18:50:14.133Z",maintainer-agent,"Scope addition from 2026-07-04 backlog audit (pm-y904): duplicate issue-code pair GH-209 (pm-1byt canonical, pm-25se follow-up) involves two CLOSED items, so per the changelog updated_at invariant it must be resolved in this careful backfill pass (set duplicate_of on pm-25se or retitle) together with the changelog regen, not in a create-only audit."
   "2026-07-06T13:13:56.245Z",maintainer-agent,"Audit #10 2026-07-06: validate_resolution_missing_fields grew 268 -> 269. The new entry is ADR pm-muhw (accepted+closed 2026-07-05 without resolution/expected_result/actual_result). Do NOT touch it now (changelog drag — it sits in the shipped 2026.7.6 bucket); fold it into this dedicated backfill pass. Real evidence exists: acceptance rationale is in its comments and the SDK-first epic pm-usfg body."

.agents/pm/extensions/.managed-extensions.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-09-27T09:24:00.162Z",
+  "updated_at": "2026-09-27T10:35:46.561Z",
   "entries": [
     {
       "name": "pm-changelog",

.agents/pm/history/pm-7wmq.jsonl

@@ -5,3 +5,4 @@
 {"ts":"2026-07-26T22:20:22.694Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","agent_instance":"7fa8395835d01e2fa37ea950","op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-07-26T22:20:22.694Z"},{"op":"add","path":"/metadata/dependencies","value":[{"id":"pm-doxj","kind":"blocks","created_at":"2026-07-26T22:20:22.446Z"}]}],"before_hash":"ca5f82289ecb835072904d72054458b6b1015fe1b0008a550b5f56ddb47cff5e","after_hash":"50894be9ab26e20e703e97da78230caab92551d40f91baaff25244e9f19264cf","message":"Historical graph enrichment 2026-07-27: derive epoch lineage for terminal items so the full timeline is reachable by graph traversal"}
 {"ts":"2026-08-10T12:02:58.508Z","author":"harness:claude-code","author_source":"detected","agent_harness":"claude-code","agent_model":"claude-opus-5","agent_model_source":"probe","agent_instance":"b006a2086429d635675530d7","agent_provenance":{"model":{"value":"claude-opus-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":{"value":"pm-7wmq","source":"argv"},"version":{"value":"2.1.226","source":"probe"}},"op":"update","patch":[{"op":"add","path":"/metadata/dependencies/1","value":{"id":"pm-33cw","kind":"implements","created_at":"2026-08-10T12:02:58.355Z","author":"harness:claude-code","source_kind":"cli:update:dep","author_source":"detected"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-10T12:02:58.508Z"}],"before_hash":"50894be9ab26e20e703e97da78230caab92551d40f91baaff25244e9f19264cf","after_hash":"da4f546d2165fb2fb6f0711e8cb95bf5a982404757a94dcd19ac05d8399d1c46"}
 {"hash_algorithm":"sha256","ts":"2026-09-19T08:39:41.941Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"e700c3209edd3b60c0371159","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-pivf","claim:pm-wrbe","lineage:pm-pivf","lineage:pm-33cw","lineage:pm-doxj"]},"topic":{"value":"workset:pm-pivf+pm-wrbe","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-pivf","claim:pm-wrbe","lineage:pm-pivf","lineage:pm-33cw","lineage:pm-doxj"]}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-19T08:39:41.941Z"},{"op":"add","path":"/metadata/closed_at","value":"2026-07-03T14:41:06.488Z"}],"before_hash":"da4f546d2165fb2fb6f0711e8cb95bf5a982404757a94dcd19ac05d8399d1c46","after_hash":"30bd6e89c5319550f63c6c53f4b4abbfd1b78517bec953f284c2806ac2468f5e","item_hash_version":3,"message":"Backfill closed_at from verified lifecycle history","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"70ec3edee314188ddcd25a38dcc7f9c1d5e550616f51538e74f63b78c4b5ab54"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:57:14.230Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:57:14.230Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-09-27T09:57:14.230Z","author":"harness:codex","text":"2026-09-27 merged-main Security and Script Quality run 36310034735 attempt 1 failed before analysis because PowerShell Gallery blocked the pinned PSScriptAnalyzer package download with a WAF response. A single failed-job rerun (attempt 2) completed successfully with every job green. This was an external fetch failure, not an analyzer finding; the required gate stayed enforced."}]}],"before_hash":"30bd6e89c5319550f63c6c53f4b4abbfd1b78517bec953f284c2806ac2468f5e","after_hash":"1d45fb3347bab858a46252a6f42098d93dc7aafdcd03b7b214506a9813fdd664","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"e41c483752af6fd1cc7501576fe6295527755ed4bdf5e8adf265f0297a3bec54"}

.agents/pm/history/pm-e70zh5.jsonl

@@ -64,3 +64,4 @@
 {"hash_algorithm":"sha256","ts":"2026-09-24T13:32:43.884Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"6086e1e4ff36a38bba6ecaf3","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"release-operator","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-e70zh5","release:pm-44u3wt"]},"topic":{"value":"pm-e70zh5","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-e70zh5","release:pm-44u3wt"]}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-24T13:32:43.884Z"}],"before_hash":"5587ed63a8c26b3572cf3a96d5eb1280225fc59efd0ababec7ef4327e4c6b23e","after_hash":"162f017dda7059ca90ce97d0c1eb95de8024f930efc87bccacb52c6a8e31adfd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"7e0d107a92a7c55bf3194af49965934622e06b66b7a713c857dd26c2fb5c6d7f"}
 {"hash_algorithm":"sha256","ts":"2026-09-24T13:40:41.544Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"6086e1e4ff36a38bba6ecaf3","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"add","path":"/metadata/dependencies/12","value":{"id":"pm-z3ez","kind":"related","created_at":"2026-09-24T13:40:41.250Z","author":"harness:codex","source_kind":"cli:update:dep","author_source":"detected"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-24T13:40:41.544Z"}],"before_hash":"162f017dda7059ca90ce97d0c1eb95de8024f930efc87bccacb52c6a8e31adfd","after_hash":"1cce814d88919ed03eb703c50e3e013f3c08d3ce092028aa4f3b252cc6738e6a","item_hash_version":3,"message":"Connect the agent distribution feature referenced in intake evidence: version-coherent plugins depend on observable daily delivery, while onboarding criteria remain separately open. This is contextual linkage, not implementation or verification of the whole feature.","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"3f605845a5c0900b9fda6e0e09e51b53fe51fc3c62003cc940cc46d06ab78dc7"}
 {"hash_algorithm":"sha256","ts":"2026-09-24T13:48:35.150Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-astra","agent_model_source":"probe","agent_instance":"6086e1e4ff36a38bba6ecaf3","agent_provenance":{"model":{"value":"gpt-6-astra","source":"probe"},"effort":{"value":"medium","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/28","value":{"created_at":"2026-09-24T13:48:35.150Z","author":"harness:codex","text":"PR 1302 review follow-up: accepted CodeRabbit finding that receipt write/upload failures must not turn an already published release into a failed run. Both evidence steps are now non-blocking; a workflow contract assertion failed before the fix and passes afterward. Missing receipts remain unknown_success, not publication proof. Fixed the prose-reference graph regression with an honest contextual distribution-feature edge; full tracker assertions pass. Initial hosted CI passed all checks except that graph regression, including exact full-source coverage. Local transport budgets passed on retry unchanged; mutation gate killed 323 of 330 with seven documented equivalent mutants. Sourcery review is quota-limited and Greptile has not responded."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-24T13:48:35.150Z"}],"before_hash":"1cce814d88919ed03eb703c50e3e013f3c08d3ce092028aa4f3b252cc6738e6a","after_hash":"29c75d37f3024585a3106dd4a57864939301c1615eecf82dab2757a9e7f647bd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"aa85b01cec88ef55bc287f0cc2865f3977c7993d42f229fb62b8ca9e406a692f"}
+{"hash_algorithm":"sha256","ts":"2026-09-27T09:57:02.802Z","author":"harness:codex","author_source":"detected","agent_harness":"codex","agent_model":"gpt-6-sol","agent_model_source":"probe","agent_instance":"d47f0e0d79925f50a0df2359","agent_provenance":{"model":{"value":"gpt-6-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]},"topic":{"value":"pm-k7nxaz","source":"inferred","confidence":"medium","rule_version":"v2","evidence":["claim:pm-k7nxaz","lineage:pm-k7nxaz","lineage:pm-x6jf","lineage:pm-usfg","lineage:pm-ugqx","lineage:pm-doxj"]}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/29","value":{"created_at":"2026-09-27T09:57:02.802Z","author":"harness:codex","text":"2026-09-27 live hosted evidence: Release Reliability run 36306444764 reported 13 failures among 31 completed scheduled attempts in its 30-day window (41.94% versus 10% policy), plus dispatch-window violation. Scheduled Auto Release run 36306417214 succeeded at 08:30 UTC, about 356 minutes after the nominal 02:35 UTC occurrence, and verified the same-day release already produced by an earlier manual dispatch. Exactly one v2026.9.27 release was visible. The rolling reporter is functioning; the historical failure rate and hosted schedule lateness remain unresolved, and 16 older successes lack complete outcome receipts."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-27T09:57:02.802Z"}],"before_hash":"29c75d37f3024585a3106dd4a57864939301c1615eecf82dab2757a9e7f647bd","after_hash":"37b20d4728a1bb7b711b89e316e3d0195622ffdea61ff279298ba996c545895f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"9a4a776f562019b92f4503911bf939ff203a5e367705788f6c565d6fd1f7fdbf"}