From 3d17a0378791aff95e997a95061553ccd73b6834 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Mon, 2 Nov 2026 10:17:21 +0100 Subject: [PATCH 1/2] chore(pm): track missed-watch issues 193, 197, 199 and 202 --- .agents/pm/history/pm-github-gevp.jsonl | 1 + .agents/pm/history/pm-github-mes8.jsonl | 1 + .agents/pm/history/pm-github-quay.jsonl | 1 + .agents/pm/history/pm-github-xuw6.jsonl | 1 + .agents/pm/issues/pm-github-gevp.toon | 11 +++++++++++ .agents/pm/issues/pm-github-mes8.toon | 11 +++++++++++ .agents/pm/issues/pm-github-quay.toon | 11 +++++++++++ .agents/pm/issues/pm-github-xuw6.toon | 11 +++++++++++ 8 files changed, 48 insertions(+) create mode 100644 .agents/pm/history/pm-github-gevp.jsonl create mode 100644 .agents/pm/history/pm-github-mes8.jsonl create mode 100644 .agents/pm/history/pm-github-quay.jsonl create mode 100644 .agents/pm/history/pm-github-xuw6.jsonl create mode 100644 .agents/pm/issues/pm-github-gevp.toon create mode 100644 .agents/pm/issues/pm-github-mes8.toon create mode 100644 .agents/pm/issues/pm-github-quay.toon create mode 100644 .agents/pm/issues/pm-github-xuw6.toon diff --git a/.agents/pm/history/pm-github-gevp.jsonl b/.agents/pm/history/pm-github-gevp.jsonl new file mode 100644 index 000000000..24ebacd48 --- /dev/null +++ b/.agents/pm/history/pm-github-gevp.jsonl @@ -0,0 +1 @@ +{"hash_algorithm":"sha256","ts":"2026-11-02T09:17:16.438Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"7687d94a08e852f40579b9f7","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-gevp"},{"op":"add","path":"/metadata/title","value":"Minimum-SDK consumer fixture installs development-tool peers it cannot satisfy"},{"op":"add","path":"/metadata/description","value":"Tracks gh:unbraind/pm-github#199 (filed 2026-10-29, missed by the blind issue watch; the three failures already covered by gh:unbraind/pm-github#197 are tracked separately). test/minimum-sdk-consumer.test.ts spreads all devDependencies into the consumer root and then overrides the CLI to the declared minimum (2026.10.17), while the manifest now installs pm-ops 2026.10.26 whose peer requires CLI >=2026.10.20 — an unsatisfiable graph, npm ERESOLVE before any packed import or declaration check runs. The PR #194 checks still fail as of run 41330041504. Fix the fixture to install only runtime dependencies plus the enforced minimum CLI (isolating the witness from development-tool peer requirements) so the packed extension, authored SDK imports and shipped declarations are verified at the floor independently of the development lock."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["ci","fixtures","gh:unbraind/pm-github#199"]},{"op":"add","path":"/metadata/created_at","value":"2026-11-02T09:17:16.438Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-11-02T09:17:16.438Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"985c8ac4e50ac57f41e5ef8f6210b7be15b4eb6389eb32e55c3090c12cc2af5c","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"44a84b17974a4c164d5677f3c2aa636993e43314a3b0321d50d59fb10dffe552"} diff --git a/.agents/pm/history/pm-github-mes8.jsonl b/.agents/pm/history/pm-github-mes8.jsonl new file mode 100644 index 000000000..759766de1 --- /dev/null +++ b/.agents/pm/history/pm-github-mes8.jsonl @@ -0,0 +1 @@ +{"hash_algorithm":"sha256","ts":"2026-11-02T09:17:17.491Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"7687d94a08e852f40579b9f7","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-mes8"},{"op":"add","path":"/metadata/title","value":"Packed projection fixture cleanup can mask its own test outcome"},{"op":"add","path":"/metadata/description","value":"Tracks gh:unbraind/pm-github#202 (filed 2026-10-30, missed by the blind issue watch). test/import-projection.test.ts on current main still ends with a bare 'finally { rmSync(base, { recursive: true, force: true }) }' (line ~258), so an ENOTEMPTY from the isolated HOME teardown replaces an earlier exception from the protected body and the receipt proves neither that the packed import assertions passed nor that they failed. Observed once on the merged CodeQL-pin PR #200 head (Node 22, run 41029600935). Make the final cleanup non-fatal (or run it outside the assertion path and log residuals), so a teardown race cannot mask the actual test outcome; keep the two Bun lanes green."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["ci","fixtures","gh:unbraind/pm-github#202"]},{"op":"add","path":"/metadata/created_at","value":"2026-11-02T09:17:17.491Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-11-02T09:17:17.491Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"9d28489d1b8fd68f8743a9780ba16aaa73387a454dff27f20645cc494c51325c","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"2f836b78caefbef0ffac93bd83e65e82295baece59e5e1e5f683d4ff0eea27e4"} diff --git a/.agents/pm/history/pm-github-quay.jsonl b/.agents/pm/history/pm-github-quay.jsonl new file mode 100644 index 000000000..eec321d5b --- /dev/null +++ b/.agents/pm/history/pm-github-quay.jsonl @@ -0,0 +1 @@ +{"hash_algorithm":"sha256","ts":"2026-11-02T09:17:15.200Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"7687d94a08e852f40579b9f7","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-quay"},{"op":"add","path":"/metadata/title","value":"SDK 2026.10.26 adoption: three real-SDK compensation tests fail on the pending toolchain PR"},{"op":"add","path":"/metadata/description","value":"Tracks gh:unbraind/pm-github#197 (filed 2026-10-29, missed by the blind issue watch). The open toolchain PR #194 (head 858cb976dc) resolves SDK 2026.10.26 and its test(22)/test(26)/bun-release(22)/(26) checks still fail (latest run 41330041504, 2026-11-01). Three real-SDK atomic-compensation cases (import-fidelity restoration after finalization; terminal-failure plan cleanup, fresh and recovery variants) receive 'compensation was incomplete' instead of completed compensation when an ordinary error is injected at committing; the suspected interaction is source-lifecycle finalization appending a Persistent import event inside the commit hook before the injected transition. Diagnose whether the host finalization contract or the test injection changed, fix, and keep the 100% thresholds."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["ci","gh:unbraind/pm-github#197","sdk-adoption"]},{"op":"add","path":"/metadata/created_at","value":"2026-11-02T09:17:15.200Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-11-02T09:17:15.200Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"fac108df7956c114bb8e8b8af5d6fde93791fbaafa9fdb97f777be4f33ee6ce5","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"83cc9c7a2dfb49fbfae76a27369c317899daf6de03f3c53f92e35e8f35479f17"} diff --git a/.agents/pm/history/pm-github-xuw6.jsonl b/.agents/pm/history/pm-github-xuw6.jsonl new file mode 100644 index 000000000..59adc0183 --- /dev/null +++ b/.agents/pm/history/pm-github-xuw6.jsonl @@ -0,0 +1 @@ +{"hash_algorithm":"sha256","ts":"2026-11-02T09:17:13.926Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"7687d94a08e852f40579b9f7","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-xuw6"},{"op":"add","path":"/metadata/title","value":"Privacy gate still classifies generic procfs documentation as an absolute host path"},{"op":"add","path":"/metadata/description","value":"Tracks gh:unbraind/pm-github#193 (filed 2026-10-28, missed by the blind issue watch). The absolute-host-path rule on current main still lists proc among its sensitive roots with the same delimiter policy, so public Linux documentation like /proc/ examples produces findings that block gated issue sync (originally observed importing a reviewer repo's issue #56, whose daily sync is still failing as of 2026-11-02, run 41408058207). The 2026.10.30 'privacy precision' changes (PR #198) tightened other rules but not this classification. Needed: either narrow the proc root match to concrete host-like usage (account/pid-shaped paths) or document and default to the supported content-hash allowlist for affected repositories, with a regression fixture carrying generic procfs documentation."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["gate","gh:unbraind/pm-github#193","privacy"]},{"op":"add","path":"/metadata/created_at","value":"2026-11-02T09:17:13.926Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-11-02T09:17:13.926Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"ca8bd8a7dcb91e81b84b3d1481449d9c2405a967e7d142d281c80fcc17b6c452","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"2d519650a27d35dbf889a1cffd8891568ff247ae44b8f7fad3449ee664e6caf5"} diff --git a/.agents/pm/issues/pm-github-gevp.toon b/.agents/pm/issues/pm-github-gevp.toon new file mode 100644 index 000000000..e8ec302e4 --- /dev/null +++ b/.agents/pm/issues/pm-github-gevp.toon @@ -0,0 +1,11 @@ +id: pm-github-gevp +title: Minimum-SDK consumer fixture installs development-tool peers it cannot satisfy +description: "Tracks gh:unbraind/pm-github#199 (filed 2026-10-29, missed by the blind issue watch; the three failures already covered by gh:unbraind/pm-github#197 are tracked separately). test/minimum-sdk-consumer.test.ts spreads all devDependencies into the consumer root and then overrides the CLI to the declared minimum (2026.10.17), while the manifest now installs pm-ops 2026.10.26 whose peer requires CLI >=2026.10.20 — an unsatisfiable graph, npm ERESOLVE before any packed import or declaration check runs. The PR #194 checks still fail as of run 41330041504. Fix the fixture to install only runtime dependencies plus the enforced minimum CLI (isolating the witness from development-tool peer requirements) so the packed extension, authored SDK imports and shipped declarations are verified at the floor independently of the development lock." +type: Issue +status: open +priority: 2 +tags[3]: ci,fixtures,"gh:unbraind/pm-github#199" +created_at: "2026-11-02T09:17:16.438Z" +updated_at: "2026-11-02T09:17:16.438Z" +author: pi-glm +body: "" diff --git a/.agents/pm/issues/pm-github-mes8.toon b/.agents/pm/issues/pm-github-mes8.toon new file mode 100644 index 000000000..93a0a9e05 --- /dev/null +++ b/.agents/pm/issues/pm-github-mes8.toon @@ -0,0 +1,11 @@ +id: pm-github-mes8 +title: Packed projection fixture cleanup can mask its own test outcome +description: "Tracks gh:unbraind/pm-github#202 (filed 2026-10-30, missed by the blind issue watch). test/import-projection.test.ts on current main still ends with a bare 'finally { rmSync(base, { recursive: true, force: true }) }' (line ~258), so an ENOTEMPTY from the isolated HOME teardown replaces an earlier exception from the protected body and the receipt proves neither that the packed import assertions passed nor that they failed. Observed once on the merged CodeQL-pin PR #200 head (Node 22, run 41029600935). Make the final cleanup non-fatal (or run it outside the assertion path and log residuals), so a teardown race cannot mask the actual test outcome; keep the two Bun lanes green." +type: Issue +status: open +priority: 2 +tags[3]: ci,fixtures,"gh:unbraind/pm-github#202" +created_at: "2026-11-02T09:17:17.491Z" +updated_at: "2026-11-02T09:17:17.491Z" +author: pi-glm +body: "" diff --git a/.agents/pm/issues/pm-github-quay.toon b/.agents/pm/issues/pm-github-quay.toon new file mode 100644 index 000000000..043c2b22d --- /dev/null +++ b/.agents/pm/issues/pm-github-quay.toon @@ -0,0 +1,11 @@ +id: pm-github-quay +title: "SDK 2026.10.26 adoption: three real-SDK compensation tests fail on the pending toolchain PR" +description: "Tracks gh:unbraind/pm-github#197 (filed 2026-10-29, missed by the blind issue watch). The open toolchain PR #194 (head 858cb976dc) resolves SDK 2026.10.26 and its test(22)/test(26)/bun-release(22)/(26) checks still fail (latest run 41330041504, 2026-11-01). Three real-SDK atomic-compensation cases (import-fidelity restoration after finalization; terminal-failure plan cleanup, fresh and recovery variants) receive 'compensation was incomplete' instead of completed compensation when an ordinary error is injected at committing; the suspected interaction is source-lifecycle finalization appending a Persistent import event inside the commit hook before the injected transition. Diagnose whether the host finalization contract or the test injection changed, fix, and keep the 100% thresholds." +type: Issue +status: open +priority: 2 +tags[3]: ci,"gh:unbraind/pm-github#197",sdk-adoption +created_at: "2026-11-02T09:17:15.200Z" +updated_at: "2026-11-02T09:17:15.200Z" +author: pi-glm +body: "" diff --git a/.agents/pm/issues/pm-github-xuw6.toon b/.agents/pm/issues/pm-github-xuw6.toon new file mode 100644 index 000000000..11c5bd768 --- /dev/null +++ b/.agents/pm/issues/pm-github-xuw6.toon @@ -0,0 +1,11 @@ +id: pm-github-xuw6 +title: Privacy gate still classifies generic procfs documentation as an absolute host path +description: "Tracks gh:unbraind/pm-github#193 (filed 2026-10-28, missed by the blind issue watch). The absolute-host-path rule on current main still lists proc among its sensitive roots with the same delimiter policy, so public Linux documentation like /proc/ examples produces findings that block gated issue sync (originally observed importing a reviewer repo's issue #56, whose daily sync is still failing as of 2026-11-02, run 41408058207). The 2026.10.30 'privacy precision' changes (PR #198) tightened other rules but not this classification. Needed: either narrow the proc root match to concrete host-like usage (account/pid-shaped paths) or document and default to the supported content-hash allowlist for affected repositories, with a regression fixture carrying generic procfs documentation." +type: Issue +status: open +priority: 2 +tags[3]: gate,"gh:unbraind/pm-github#193",privacy +created_at: "2026-11-02T09:17:13.926Z" +updated_at: "2026-11-02T09:17:13.926Z" +author: pi-glm +body: "" From 0eb94be997ce0fb7c1a3264c51daee5801942f7c Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Mon, 2 Nov 2026 16:43:25 +0100 Subject: [PATCH 2/2] Leave issue 193 to the privacy-gate fix's own tracking item The privacy-gate precision fix (branch fix/gate-public-technical-forms) creates its own item for gh:unbraind/pm-github#193. Two items carrying the same issue tag would make the gated import refuse with multiple existing owners, so this triage no longer adds a second one. --- .agents/pm/history/pm-github-xuw6.jsonl | 1 - .agents/pm/issues/pm-github-xuw6.toon | 11 ----------- 2 files changed, 12 deletions(-) delete mode 100644 .agents/pm/history/pm-github-xuw6.jsonl delete mode 100644 .agents/pm/issues/pm-github-xuw6.toon diff --git a/.agents/pm/history/pm-github-xuw6.jsonl b/.agents/pm/history/pm-github-xuw6.jsonl deleted file mode 100644 index 59adc0183..000000000 --- a/.agents/pm/history/pm-github-xuw6.jsonl +++ /dev/null @@ -1 +0,0 @@ -{"hash_algorithm":"sha256","ts":"2026-11-02T09:17:13.926Z","author":"pi-glm","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.3:cloud","agent_model_source":"environment","agent_instance":"7687d94a08e852f40579b9f7","agent_provenance":{"model":{"value":"glm-5.3:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-xuw6"},{"op":"add","path":"/metadata/title","value":"Privacy gate still classifies generic procfs documentation as an absolute host path"},{"op":"add","path":"/metadata/description","value":"Tracks gh:unbraind/pm-github#193 (filed 2026-10-28, missed by the blind issue watch). The absolute-host-path rule on current main still lists proc among its sensitive roots with the same delimiter policy, so public Linux documentation like /proc/ examples produces findings that block gated issue sync (originally observed importing a reviewer repo's issue #56, whose daily sync is still failing as of 2026-11-02, run 41408058207). The 2026.10.30 'privacy precision' changes (PR #198) tightened other rules but not this classification. Needed: either narrow the proc root match to concrete host-like usage (account/pid-shaped paths) or document and default to the supported content-hash allowlist for affected repositories, with a regression fixture carrying generic procfs documentation."},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["gate","gh:unbraind/pm-github#193","privacy"]},{"op":"add","path":"/metadata/created_at","value":"2026-11-02T09:17:13.926Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-11-02T09:17:13.926Z"},{"op":"add","path":"/metadata/author","value":"pi-glm"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"ca8bd8a7dcb91e81b84b3d1481449d9c2405a967e7d142d281c80fcc17b6c452","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"2d519650a27d35dbf889a1cffd8891568ff247ae44b8f7fad3449ee664e6caf5"} diff --git a/.agents/pm/issues/pm-github-xuw6.toon b/.agents/pm/issues/pm-github-xuw6.toon deleted file mode 100644 index 11c5bd768..000000000 --- a/.agents/pm/issues/pm-github-xuw6.toon +++ /dev/null @@ -1,11 +0,0 @@ -id: pm-github-xuw6 -title: Privacy gate still classifies generic procfs documentation as an absolute host path -description: "Tracks gh:unbraind/pm-github#193 (filed 2026-10-28, missed by the blind issue watch). The absolute-host-path rule on current main still lists proc among its sensitive roots with the same delimiter policy, so public Linux documentation like /proc/ examples produces findings that block gated issue sync (originally observed importing a reviewer repo's issue #56, whose daily sync is still failing as of 2026-11-02, run 41408058207). The 2026.10.30 'privacy precision' changes (PR #198) tightened other rules but not this classification. Needed: either narrow the proc root match to concrete host-like usage (account/pid-shaped paths) or document and default to the supported content-hash allowlist for affected repositories, with a regression fixture carrying generic procfs documentation." -type: Issue -status: open -priority: 2 -tags[3]: gate,"gh:unbraind/pm-github#193",privacy -created_at: "2026-11-02T09:17:13.926Z" -updated_at: "2026-11-02T09:17:13.926Z" -author: pi-glm -body: ""