Use canonical unbounded pm 2026.8.20 tracker reads

Closed
UN
2mo ago
+141-26

Summary

  • replace deprecated list-all reads with canonical list --all reads under pm CLI/SDK 2026.8.20
  • force both --output-budget unbounded and --output-limit unbounded after caller global args while preserving fail-closed completeness receipts
  • align the exact dev pin, peer floor, manifest host floor, docs, tests, and built package bytes
  • reconcile stale package PM state and track the distinct missing fourth statement-coverage metric without overstating compliance

Closes #147.

PM evidence

Verification

  • npm run release:check: 387 tests; all nine measured production sources at exact 100.00% lines, branches, and functions; 143 documented declarations; zero production audit vulnerabilities; clean pack; deterministic changelog
  • packed npx --no-install pm-changelog and bunx --bun pm-changelog acceptance against a real 137-item tracker: byte-identical 10,111-byte Markdown, empty stderr
  • real installed pm CLI receipt: count=total, no truncation/pagination/omissions/unreadables, and legacy_aliases_used=[]
  • pm health --strict-exit: green with three existing provenance advisories
  • pm merge reconcile --dry-run: 138 streams, zero drift or pending decisions
  • pm validate: history/storage/lifecycle/current references clean; existing legacy metadata, terminal references, and stale file-link warnings remain
  • git diff --check: clean

Delivery boundary

Trivy is not installed on this host, so no Trivy result is claimed. This PR must remain unmerged and unpublished until pmc-t8tj resolves reachable historical host paths and non-public Git identities; the daily release workflow could otherwise publish the merge.

Summary by Sourcery

Adopt canonical unbounded pm tracker reads with fail-closed completeness validation and require pm CLI 2026.8.20 or newer.

Bug Fixes:

  • Replace deprecated tracker reads with canonical unbounded pm list --all reads and refuse incomplete or internally inconsistent responses.
  • Prevent caller-supplied output limits from truncating correctness-critical tracker reads.

Enhancements:

  • Raise the required pm CLI version to 2026.8.20 and align the manifest, package metadata, documentation, tests, and built artifacts.
  • Increase production coverage gates to 100% for lines, branches, and functions while tracking statement coverage separately.

Documentation:

  • Update usage and development documentation to show canonical unbounded tracker reads.

Tests:

  • Expand coverage for argument ordering, output-limit precedence, real tracker receipts, and invalid completeness counts.

Chores:

  • Reconcile and record package manager issue and coverage metadata.

Summary by cubic

Replaces the deprecated tracker read with the canonical unbounded whole-tracker read. Old: pm list-all --json could truncate under budgets; New: pm --output-budget unbounded --output-limit unbounded list --all --json with fail-closed validation that also verifies counts vs totals and returned rows. Side effect: hosts below @unbrained/pm-cli 2026.8.20 are refused.

  • Review and rollout

    • Centralizes argv in buildPmListArgs: --pm-path is prepended; caller globals (--pm-arg) follow; host-owned unbounded output controls are appended (last-value wins); canonical command is list --all --json; optional --include-body is preserved. Tests cover ordering and that host controls override bounded caller budgets.
    • Strengthens completeness checks: still refuse truncated/partial/omitted receipts; now also reject missing/invalid counts, count≠total, and items.length≠count. --include-body, stdin/--input, and large-buffer behavior unchanged.
    • Updates CLI help, docs, and examples to show the full unbounded argv; replaces “list-all” terminology.
    • Raises floors and pins: peer dep @unbrained/pm-cli >= 2026.8.20, manifest pm_min_version 2026.8.20, dev pin to 2026.8.20. Coverage gates remain 100/100/100; a separate statements metric is tracked.

  • Migration

    • Require @unbrained/pm-cli 2026.8.20+.
    • If piping pm output, pass the unbounded flags above or let this tool invoke pm.
    • Stop using list-all; wrappers cannot re-bind output budgets via --pm-arg.
    • Do not merge until the history privacy/identity blocker resolves (release gate).