Add a reusable gated workflow that opens daily closeout PRs for items delivered by merged pull requests
Merged pull requests need a reviewed tracker closeout change in each caller repository. This adds a reusable daily workflow and caller template that prepare one gated review PR from verified deliveries.
The workflow installs an exact pm-github version in a contained caller npm project, requires the caller default branch, runs closeout on the fixed pm-github/closeout branch, regenerates the caller changelog when configured, checks changed-path scope and privacy, verifies strict PM health, and publishes only the leased bot branch. It creates or updates one owned PR and dispatches caller CI. Zero closes publish nothing. The existing sync workflow retains its behavior and safety-helper parity tests.
Review round 1 fixes the confirmed major finding: unrelated selected PRs with unavailable head evidence previously failed the whole run. Automation now filters local tracker plan rows by stable decision codes. Unlinked PRs and foreign, terminal or excluded links do not cause that refusal. A local blocked item still refuses publication. Incomplete merge facts have their own code and diagnostic before any head-check lookup.
Default TOON lists actionable close/refuse rows individually and counts routine skips by reason. JSON and --full retain every row. The workflow PR body uses the same compact decisions and counts, and scans that public summary before publication. A real read-only pm-brief sweep since 2026-10-01 shrank from 76 to 25 default-output lines (67.1%): the identical full selection contains 47 rows, 2 closes, and skipped counts of already_terminal=9, other_repository=35, duplicate_selection=1.
Behavioral revert proof: restoring only the old PR-check workflow predicate fails 3 selected regressions; restoring only uncompacted report behavior and rebuilding fails both output regressions. Restored behavior is covered with real SDK trackers, isolated Git remotes, workflow bash, HTTP fixtures and packed CLI acceptance, including full JSON/full flag preservation and malicious summary rejection.
Validation at unchanged thresholds:
npm run release:check: 702/702 tests passed, zero failures/skips/cancellations/todos.bun run release:check: 702/702 tests passed, zero failures/skips/cancellations/todos.- Both runs used isolated HOME/Git identity and passed exact 100/100/100/100 coverage across all 13 authored modules, plus typecheck/build/docstrings/lint, configured zero duplication, privacy, production audit, pack, changelog and publish-attestation checks.
Consumers must pin a pm-github release that emits the new decision codes.
Delivery and detailed evidence: pm-github-0x3y.