Keep GitHub reference tags out of import identity
Closes #230
A gh:<owner>/<repo>#<N> tag is a reference, never an import identity. Explicit GitHub provenance, compatible native declarations and verified importer IDs select owners; contradictory or competing ownership refuses writes. Curated items retain their content, while importer-created items continue mirroring GitHub.
Round 18 requires a positive owner before an add-issue board attachment, including after asynchronous node resolution. Zero-owner drafts and current board-tag associations remain allowed. Every separately locked SDK import/comment write reads a fresh certified peer snapshot; the namespace lease is reused, never a prior lock's ownership cache. Native guards for closeout, numeric identities, duplicate import identities, typed atomic errors and citation adoption are restored or proved at their earlier boundary.
The guard-by-guard audit records the disposition and native proof for every round-17 guard change. The ownership inventory is mechanically regenerated.
Validation on this source:
coverage-gate: 34 authored modules, exact 100/100/100/100 coverage.Counts: 15,549 lines/statements, 530 functions, 6,725 branches; unchanged thresholds, no source exemptions or ignore comments.- Final pm-linked round-18 file: 32/32. Ten intentional behavioral regression assertions fail in disposable copies; restored implementations and must-allow controls pass.
- Complete closeout/fixture rerun: 135/135; seeded models: 4/4; direct gate checks: 3/3. The complete import-gate file's 73 cases were validated as 64 completed cases before the 20-minute cap plus the nine unfinished cases passing separately.
- Lint, current typecheck, test compilation, 314 documented declarations, inventory check and changelog check pass.
npm run test:minimum-sdk: 1/1 at SDK 2026.10.23, checking the packed extension and authored sources. - Post-commit privacy gate: 9,136 objects audited, all identities approved, no secret or host-path matches. Author and committer are SteveBot with the required address.
- Two existing SDK compensation quarantines remain skipped. CI certifies the full release matrix.
Read-only replay of the same public snapshots, with zero extra creates and zero curated-field changes:
| Repository | Create | Update | Unchanged |
|---|---|---|---|
| pm-github | 22 | 2 | 0 |
| pm-review | 2 | 2 | 0 |
| pm-rust | 6 | 1 | 0 |
| pm-context | 7 | 3 | 0 |
| pm-linear | 8 | 1 | 0 |
No import was applied. Scratch clones were deleted and original tracker hashes verified. pm-github retains the known privacy-preflight refusal for existing public bodies; its counts are the read-only production-planner diagnostic, not a passing gated command. The other four gated previews pass.
Tracked in pm-github-reference-identity, including paired append-only history and revert evidence. The item remains in progress with its claim released.