Certify pm-presets on PM CLI 2026.10.4 and consolidate pending dependency updates

Closed
UN
23d ago
+373-264

Pins PM CLI/SDK, pm-ops, pm-changelog and managed pm-github to 2026.10.4, with exact development versions and the unchanged 2026.9.30 SDK floor. Consolidates Dependabot #111, #112, #114 and #115, including the exact CodeQL SHA/comment bump. Copies the published merge-driver launcher unchanged and adds its real malformed-lookup regression. Tracks managed pm-github metadata and restores downloaded artifacts before CI health.

NOT READY: npm run release:check has 158/159 pass, zero skips. The unchanged replace-mode assertion exposes upstream pm-cli #1394: the audited SDK cannot remove omitted raw governance keys invisible to its normalized callback. Independent SDK-only disposable reproduction is committed as docs/SDK-1394-repro.mjs. No audit bypass, ignored failure, lower threshold or weakened assertion.

Other receipts (heavy commands serialized with the shared flock):

  • Launcher: 8/8 pass. Coverage: 100% lines / branches / functions for 16 configured files; statements unmeasured.
  • npm audit --omit=dev and npm audit: zero vulnerabilities.
  • npx pm health --strict-exit --require-merge-drivers: exit 0, one advisory stale-item finding.
  • Remaining audit, pack, changelog, publish-attestation and changelog-date steps pass separately.
  • npm pack installed into a copied real tracker. npm/npx and native Bun (bunx --bun @unbrained/pm-cli@2026.10.4) passed catalog/list, validate, show, diff, preview, export and all seven presets in merge/replace modes. Catalogs matched, both exports parsed, scratch deleted. This does not resolve the omitted-raw-key regression.
  • pm-github read-only dry-run: zero linked provenance cases; synced/skipped/planned all 0. No issue writes or scheduling changes.
  • Changelog regenerated after PM mutations; check passes.

Exact commands and receipts.

PM: certification pm-kewj, SDK blocker pm-yatu, existing quality owner pm-915f. Orchestrator verifies, merges and closes items after blockers are resolved.

Summary by Sourcery

Certify the project against PM tooling 2026.10.4 while hardening merge-driver setup and documenting the remaining upstream SDK replacement blocker.

New Features:

  • Add certification evidence and an isolated reproduction for the upstream SDK replacement bug.

Bug Fixes:

  • Make merge-driver preparation fail closed when module lookup paths are malformed or unreadable.

Enhancements:

  • Pin PM tooling and development dependencies to the 2026.10.4 release while preserving the existing SDK compatibility floor.
  • Restore and validate the managed pm-github extension during CI health checks.

Build:

  • Refresh the dependency lockfile for the consolidated exact-version updates.
  • Track managed extension metadata while ignoring downloaded artifacts.

CI:

  • Update CodeQL action references to the certified commit.
  • Install the verified pm-github extension before CI project health validation.

Documentation:

  • Document 2026.10.4 certification results, acceptance checks, and the SDK blocker.

Tests:

  • Add regression coverage for malformed merge-driver module lookup paths.

Chores:

  • Record certification and SDK-blocker tracking metadata.

Summary by cubic

Certifies the project against PM tooling 2026.10.4 releases, but the release gate stays red on one assertion blocked by an upstream SDK bug.

Pins @unbrained/pm-cli, pm-ops, pm-changelog, @types/node, and typescript to exact versions, consolidating Dependabot #111, #112, #114, and #115. The SDK compatibility floor in peerDependencies stays at 2026.9.30.

Not ready to merge

npm run release:check passes 158/159 tests with zero skips. The unchanged replace-mode assertion fails because the audited SDK cannot remove omitted raw governance keys: the callback and preview omit the key, but the persisted file retains it. This is reproduced independently in docs/SDK-1394-repro.mjs and filed upstream as pm-cli#1394. The assertion is not weakened, no audit bypass is used, and certification is blocked on the upstream fix. Manual CodeRabbit and Greptile reviews at the reviewed head report no actionable findings with zero unresolved threads; the missing review evidence is Sourcery quota, cubic neutral status, and absent Gemini/Copilot responses.

Other changes:

  • Hardens prepare-merge-driver.ts to fail closed when a module lookup path is unreadable or malformed, with regression coverage.
  • Adds CI steps that restore managed pm-github artifacts before the health check and tracks the extension registry; downloaded artifacts are gitignored.
  • Updates the CodeQL action references to the certified commit.
  • Adds certification receipts (docs/certification-2026.10.4.md) and PM tracking items.