Certify pm-ado on PM CLI 2026.10.4 and consolidate pending dependency updates

Merged
UN
19d ago
+284-273

Refresh PM CLI/SDK, pm-ops and pm-changelog to exact 2026.10.4 pins; pin Node types 26.6.4 and TypeScript 7.0.2. Copy the published canonical merge-driver template unchanged and add a real invalid global lookup-path regression (red against old launcher, green against published template). Upgrade CodeQL to the current exact v4.38.2 SHA/comment. There were no open Dependabot PRs.

The package remains unpublished at 2026.9.2. The owner PM_RELEASE_APPROVED release job guard is unchanged; no release approval setting, dispatch, publish, tag or Azure write occurred.

Validation:

  • Locked npm run release:check: PASS, 123/123 tests, zero skips; 100% measured lines/branches/functions across 4 sources. Docstring, production audit, pack contents, changelog, publish-attestation and release-date gates passed.
  • npm audit --omit=dev and npm audit: zero vulnerabilities; open security alerts [].
  • Canonical and linked launcher suites: 8/8 passed. CI's bun install --no-save passed.
  • Packed tarball in a copy of the real tracker, using npm npx and native Bun bunx on CLI 2026.10.4: offline ado validate passed with identical missing-config and synthetic-config JSON; missing inputs reported, synthetic token hidden, batch limit 200 and revision-assertion flag preserved. Scratch deleted.
  • npx pm health --strict-exit --require-merge-drivers --json: passed without warnings.
  • Managed pm-github 2026.10.4 github sync --repo unbraind/pm-ado --dry-run: 0 synced/0 skipped/0 planned, no provenance-linked items (zero-case preview).

NOT READY for 100/100/100/100: the pre-existing statement threshold is declared but not independently measured or enforced. README and gate comments now describe the measured scope accurately, and the threshold is preserved. Follow-up pm-ado-5w3m records actual enforcement work. Offline validation is the only shipped command; no live Azure sync/import/export, reverse relations or revision-reconciliation acceptance is claimed. Final-head CI and substantive reviews remain separate.

Exact commands and outputs: docs/certification-2026.10.4.md. PM: certification pm-ado-qq1p, statement enforcement pm-ado-5w3m. Items stay open; orchestrator merges and closes after verification.

Final head e71531111b916e69ad0098f483fd30e658b211cc: Node 22/26 and CodeQL CI passed; zero unresolved review threads. CodeRabbit completed a substantive final-head review with no actionable findings. Greptile, Gemini and Copilot supplied no response; Sourcery skipped and Cubic is neutral without substantive comments. The 25-minute review window ended with missing required review evidence. Statement enforcement remains open in pm-ado-5w3m; publication stays owner-gated.