PR #48 - unbraind/pm-github

Summary

replace production list-all subprocess argv with host-owned unbounded controls followed by canonical list --all --json
preserve strict full/body/read receipts, count reconciliation, duplicate-ID refusal, and the shell-free Windows launcher
align the exact development CLI/SDK pin, peer floor, and manifest floor on 2026.8.20; remove the ignored manifest compatibility envelope
disclose the breaking host floor in the generated changelog, remove unsafe complete-corpus narrowing advice, and run the real installed envelope through the production decoder
force unbounded changelog reads while public pm-changelog remains on its pre-#148 reader

PM evidence

Verification

TDD initial migration: exact reader acceptance failed 2/6 before implementation, then passed 6/6
TDD review fixes: targeted compatibility and complete-corpus tests failed on the missing breaking disclosure and unsafe buffer advice, then passed 10/10
npm run release:check: pass; 261 tests
current measured production sources: 92.09% lines, 82.47% branches, 91.75% functions across index.ts and projects.ts
docstring gate: 92 documented declarations
production npm audit: zero vulnerabilities
pack: 13 intended files
packed npm and Bun clients: two open/closed items, items.length === count === total, no truncation/pagination/list-all, empty child stderr
packed npm extension: authenticated public GitHub validation HTTP 200; real unbraind/pm-github import dry-run completed without writes
pm health --strict-exit: pass with three existing provenance advisories
pm merge reconcile --dry-run: 82 clean streams, no drift or pending decisions
GitHub Dependabot and secret-scanning: no open alerts; code scanning has no analysis

Review disposition

CodeRabbit posted four findings on prior head fd44926b24ede93149792b4d84f6e84d2b002a63. Three were accepted and fixed on c46083f2fbb85f5864bbd71e08e871c902df3099: breaking-floor disclosure, safe ENOBUFS guidance, and production-decoder installed-CLI acceptance. The dependency-upgrade request was verified but cannot be performed: npm latest remains pm-changelog 2026.8.17 and no release contains privacy-blocked PR #148. Every thread was reacted to, replied to, and resolved before exact-head re-review.

Delivery boundary

Do not merge or publish this PR. Historical privacy/identity gate pm-github-zqad, release publish-order issue pm-github-v2kt, and exact all-source 100/100/100/100 item pm-github-9cjx remain open. The current three-metric ratchet is not represented as compliance. The unresolved pm-changelog release dependency is also not represented as green. Trivy is unavailable and code scanning has no analysis. One live pm-changelog dry-run timed out at 30 seconds before a smaller real-repo retry passed; both outcomes are recorded in PM history.

Summary by Sourcery

Migrate pm-github to the canonical unbounded pm list --all host contract and require pm CLI 2026.8.20 or newer.

Bug Fixes:

Use the canonical unbounded pm list --all --json read contract instead of the deprecated list-all alias while preserving complete-corpus validation and fail-closed behavior.

Enhancements:

Align the manifest, peer dependency, and development CLI version floor at 2026.8.20 and remove the obsolete compatibility envelope.
Prevent unsafe advice to narrow complete-corpus reads and improve buffer-overflow guidance.
Run changelog generation with unbounded host-owned output controls and validate the installed CLI through the production decoder.

Build:

Update development and related package pins to the 2026.8.20 compatibility line.

Documentation:

Document the canonical complete-workspace read invocation and disclose the breaking CLI compatibility floor in the changelog.

Tests:

Update CLI integration coverage for canonical argument ordering, deprecated-alias removal, compatibility enforcement, and real installed-CLI completeness receipts.

Chores:

Record the associated PM delivery and release-ordering history updates.