Certify pm-github on PM CLI SDK 2026.9.26

.agents/pm/chores/pm-github-6vcq.toon

@@ -0,0 +1,54 @@
+id: pm-github-6vcq
+title: Certify pm-github with PM CLI SDK 2026.9.26
+description: "Refresh the extension development SDK and release tools to current published PM CLI, pm-changelog, and pm-ops versions. Preserve the supported host compatibility floor unless a real API incompatibility requires a change. Verify the canonical merge-driver launcher, full release gate, and real GitHub issue import contract."
+type: Chore
+status: in_progress
+priority: 2
+tags: []
+created_at: "2026-09-26T16:33:06.566Z"
+updated_at: "2026-10-02T23:36:02.502Z"
+author: codex
+acceptance_criteria: "Manifest and lockfile exact-pin the current developer SDK and release-tool versions; installed package readback matches; canonical pm-ops launcher is copied byte for byte; release:check, strict PM health, and a real issue-import dry run pass; source and hosted user data stay outside the public diff."
+actual_result: "npm ci and npm run release:check PASS: 308/308 tests, zero skipped; configured lines/branches/functions 92.57/82.94/92.27 across two measured sources, retaining existing 88/79/89 floors. Typecheck/build/docstrings/privacy/production audit/pack/changelog/attestation pass; all-dependency audit zero; Bun install and strict CI health pass. Reviewed/acknowledged linked-test provenance; actual launcher run passes 7/7, correcting the preceding receipt count through appended history. pm validate retains existing advisory metadata/link findings. Exact 100 percent all-source coverage remains open in pm-github-9cjx. Historical issue-35 completion retained. Final-head CI and substantive review remain separate; item released in_progress, no closure or publication."
+comments[8]:
+  - created_at: "2026-09-28T05:54:00.603Z"
+    author: claude-hub
+    text: "2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch."
+  - created_at: "2026-09-28T06:01:01.290Z"
+    author: claude-hub
+    text: "2026-09-28 06:00 UTC, final pins (pm-ops 2026.9.28, launcher re-copied): npm run release:check passed (308/308 tests) and changelog:check is clean; strict PM health ok=true with exit 0 under both the repo-pinned pm 2026.9.26 (./node_modules/.bin/pm) and the global pm 2026.9.28, advisory only (2 stale in-progress items); linked prepare-hook suite node --test test/prepare-merge-driver.test.ts 7/7. Real issue-import dry run with THIS branch's packed extension (npm pack at 769d60c, installed into a scratch pm workspace with pm install <tgz> --project): pm github import unbraind/pm-cli --dry-run found 3 open issues (#1312, #1311, #1246), would import 3, update 0, skip 0, and wrote nothing."
+    edited_at: "2026-09-28T06:01:21.363Z"
+  - created_at: "2026-10-02T18:24:49.681Z"
+    author: pi-land-a
+    text: "Merge-readiness verification pass by pi-land-a (fleet PR landing session): exact head 24ac4b4 is up to date with origin/main (merge-base equals main tip), mergeable and CLEAN; Node 22/26, CodeQL, Greptile and Semgrep CI are green and Sourcery completed and approved this head; all five review threads are resolved, including the two exact-head CodeRabbit findings that were verified refusals and withdrawn by the reviewer. Gemini not active on this repository."
+  - created_at: "2026-10-02T23:23:35.295Z"
+    author: codex-sol
+    text: "Restart codex-sol: clean pushed cc6dcf8 and earlier feedback/replies preserved. Revalidate full release:check, privacy, strict CI health and Bun install. Historical issue-35 completion is retained without new closures; all-source coverage stays pm-github-9cjx. Capture and fix bounded transitive audit advisories before the gate, preserving exact PM tool pins."
+  - created_at: "2026-10-02T23:26:49.065Z"
+    author: codex-sol
+    text: "Full direct release gate passes. Existing linked launcher command was refused because its recorded branch is chore/pm-github-sdk-2026-9-26 while retained worktree is land-99. Reviewed that exact command and its test source; acknowledge it for this clone via the CLI-supported trust receipt, then retry. No untrusted-test allowance or gate/config relaxation."
+  - created_at: "2026-10-02T23:35:10.263Z"
+    author: codex-sol
+    text: "npm ci and npm run release:check PASS: 308/308 tests, zero skipped; configured lines/branches/functions 92.57/82.94/92.27 across two measured sources, retaining existing 88/79/89 floors. Typecheck/build/docstrings/privacy/production audit/pack/changelog/attestation all pass; all-dependency audit zero; Bun install and strict CI health pass. Reviewed and acknowledged saved linked-test commands for retained branch, then launcher test passes 2/2. pm validate retains existing advisory metadata/link findings. Exact 100 percent all-source coverage remains open in pm-github-9cjx. Historical issue-35 completion is retained. History prefixes preserved; CI and substantive final-head review remain separate; item released in_progress, no closure or publication."
+  - created_at: "2026-10-02T23:36:00.467Z"
+    author: codex-sol
+    text: "Correction to immediately preceding restart receipt: the launcher linked run passed 7/7, not the incorrectly transcribed 2/2. The actual run output is authoritative. Preserve the earlier JSONL receipt and append this correction; current actual_result and PR description will use 7/7. Full release gate remains 308/308 with zero skipped; no source or gate changed."
+  - created_at: "2026-10-02T23:36:01.883Z"
+    author: codex-sol
+    text: "npm ci and npm run release:check PASS: 308/308 tests, zero skipped; configured lines/branches/functions 92.57/82.94/92.27 across two measured sources, retaining existing 88/79/89 floors. Typecheck/build/docstrings/privacy/production audit/pack/changelog/attestation pass; all-dependency audit zero; Bun install and strict CI health pass. Reviewed/acknowledged linked-test provenance; actual launcher run passes 7/7, correcting the preceding receipt count through appended history. pm validate retains existing advisory metadata/link findings. Exact 100 percent all-source coverage remains open in pm-github-9cjx. Historical issue-35 completion retained. Final-head CI and substantive review remain separate; item released in_progress, no closure or publication."
+notes[4]{created_at,author,text}:
+  "2026-09-26T16:37:52.017Z",codex,"2026-09-26: devDependency and lock exact-pin @unbrained/pm-cli 2026.9.26, pm-changelog 2026.9.25, and pm-ops 2026.9.26; installed package readback matches. Copied current pm-ops canonical merge-driver launcher. Full npm run release:check and PM linked rerun passed, including typecheck, build, docstrings, privacy, coverage floor, production audit, pack, changelog, and publish attestation. Companion installed pm-github dry-run on real public unbraind/pm-cli issue #1316 proposed 0 creates, 1 update, 0 skips, without mutation. The direct package checkout does not self-register its extension; real GitHub dry-run evidence belongs to the companion installed extension. Measured lcov is 5,618/6,069 lines (92.57%), 972/1,172 branches (82.94%), 179/194 functions (92.27%); exact 100% remains open under pm-github-9cjx. No hosted data or telemetry source/config touched."
+  "2026-09-26T16:38:47.633Z",codex,"Package candidate proposed in https://github.com/unbraind/pm-github/pull/99 at first head 248da98. CI checks, exact-head bot reviews, merge, and publication remain pending independent gates. The pinned development SDK is current; the existing host minimum remains supported and is not claimed raised."
+  "2026-09-26T16:55:14.837Z",codex,CodeRabbit exact-head review 5326615917 found the consumer lacked a fixture for an existing node_modules/pm-ops without package.json. Added a real prepare-hook child-checkout regression; 7/7 targeted tests pass. The hoisted resolution fix remains in canonical pm-ops ops-jzp5 and will be copied after its published release.
+  "2026-09-26T17:02:58.084Z",codex,"2026-09-26 17:02 UTC: after adding CodeRabbit’s real child-checkout test for a present incomplete local pm-ops install, npm run release:check passed (308/308 tests, 0 skipped, 0 production audit vulnerabilities), strict PM health ok=true with two stale-item advisories, and linked prepare-hook suite 7/7 passed. Canonical hoisted fix remains open in https://github.com/unbraind/pm-ops/pull/124 and not yet published; this consumer launcher cannot be refreshed byte-for-byte until then."
+files[4]{path,scope,note}:
+  package-lock.json,project,resolved package versions and integrity
+  package.json,project,exact development toolchain pins
+  scripts/prepare-merge-driver.ts,project,canonical pm-ops launcher
+  test/prepare-merge-driver.test.ts,project,Consumer regression for incomplete installed pm-ops
+tests[2]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref}}:
+  "npm run release:check",project,300,codex,"2026-09-26T16:35:47.449Z",local_mutation,chore/pm-github-sdk-2026-9-26
+  node --test test/prepare-merge-driver.test.ts,project,120,codex,"2026-09-26T16:55:15.403Z",local_mutation,chore/pm-github-sdk-2026-9-26
+docs[1]{path,scope}:
+  README.md,project
+body: ""