Sourced from @​unbrained/pm-cli's releases.

v2026.10.24

@​unbrained/pm-cli 2026.10.24

Source range: v2026.10.23...v2026.10.24

Changelog

Fixed

• GH-1564: align SDK bulk rollback checkpoint types and runtime admission (pm-gh1564)
• GH-1563: preserve later peer edits during bulk checkpoint rollback (pm-gh1563)
• Refuse assignment-only shell lists and command terminators (pm-g7cup8)
• Keep aggregate test execution complete when legacy commands are refused (pm-s32gcz)
• Reuse SDK command admission before offering positional test retries (pm-qi7v2j)
• Preserve structured test recovery and refuse comment-only verification (pm-3mefuq)
• PR1559: keep command admission linear and recovery startup lightweight (pm-5md8n7)
• Declare current pm-changelog commands in the SDK grammar census (pm-4pzw7i)
• GH-1547: correct linked-resource positional misuse in refusal recovery (pm-t2dqzijokl31)
• GH-1555: refuse assignment-only linked-test commands before recording false passes (pm-gh1555)
• GH-1552: charge SDK read budgets using compact JSON envelopes (pm-gh1552)
• GH-1551: expose omission and budget receipts on precise SDK read results (pm-gh1551)

Security

• Remediate independent-feed development dependency advisories (pm-zod466)

PM Tracker Evidence

Closed pm items in release window: 14 By type: Issue=13, Task=1 By status: closed=14

Selected release-related tracker items:

• No release-tagged pm items found in the selected window.

v2026.10.23

@​unbrained/pm-cli 2026.10.23

Source range: v2026.10.22...v2026.10.23

Changelog

Fixed

• GH-1516: queued writers fail at a fixed lock deadline even while the lock is changing hands (pm-iop1pg)
• GH-1549: fence item commits after an expired mutation lease is taken over (pm-gh1549)
• PR1548: preserve rollback diagnostic provenance and reject non-directory ancestry (pm-4vymxc)
• Bound complete nightly validation and exact coverage within existing job deadlines (pm-gxq0dt)
• Resolve aliased workspace paths before publishing tracker cache exclusions (pm-p8s5k7e6lhda)
• GH-1546: keep disabled package compatibility findings advisory (pm-5xn8we1wue0m)

... (truncated)

Sourced from @​unbrained/pm-cli's changelog.

2026.10.24 - 2026-10-24

Fixed

• GH-1564: align SDK bulk rollback checkpoint types and runtime admission (pm-gh1564)
• GH-1563: preserve later peer edits during bulk checkpoint rollback (pm-gh1563)
• Refuse assignment-only shell lists and command terminators (pm-g7cup8)
• Keep aggregate test execution complete when legacy commands are refused (pm-s32gcz)
• Reuse SDK command admission before offering positional test retries (pm-qi7v2j)
• Preserve structured test recovery and refuse comment-only verification (pm-3mefuq)
• PR1559: keep command admission linear and recovery startup lightweight (pm-5md8n7)
• Declare current pm-changelog commands in the SDK grammar census (pm-4pzw7i)
• GH-1547: correct linked-resource positional misuse in refusal recovery (pm-t2dqzijokl31)
• GH-1555: refuse assignment-only linked-test commands before recording false passes (pm-gh1555)
• GH-1552: charge SDK read budgets using compact JSON envelopes (pm-gh1552)
• GH-1551: expose omission and budget receipts on precise SDK read results (pm-gh1551)

Security

• Remediate independent-feed development dependency advisories (pm-zod466)

2026.10.23 - 2026-10-23

Fixed

• GH-1516: queued writers fail at a fixed lock deadline even while the lock is changing hands (pm-iop1pg)
• GH-1549: fence item commits after an expired mutation lease is taken over (pm-gh1549)
• PR1548: preserve rollback diagnostic provenance and reject non-directory ancestry (pm-4vymxc)
• Bound complete nightly validation and exact coverage within existing job deadlines (pm-gxq0dt)
• Resolve aliased workspace paths before publishing tracker cache exclusions (pm-p8s5k7e6lhda)
• GH-1546: keep disabled package compatibility findings advisory (pm-5xn8we1wue0m)
• GH-1545: preserve working package replacements through activation verification (pm-c9wz5ef4ulnv)
• GH-1540: MCP binaries ignore help and version probes before transport startup (pm-gh1540)

Other

• Retain original dependency advisory receipts on release workflow failures (pm-z20n3s)

2026.10.22 - 2026-10-22

Fixed

• MCP create drops advertised metadata outside its small top-level allowlist (pm-ap7ilf)
• Validate declared MCP boolean options before mutation normalization (pm-7qg4jz)
• Reject mixed-type MCP mutation arrays before CSV normalization (pm-gllxud)
• GH-1539: enforce command builder keys and preserve literal types (pm-gh1539)
• GH-1538: refuse or honor supplied MCP update fields before reporting success (pm-gh1538)
• GH-1535: report context test health over the matching population (pm-gh1535)
• GH-1534: retain root relationship evidence before optional context detail (pm-gh1534)
• Render literal and root-layout tracker paths safely in SDK cache ignore rules (pm-47wuv8awpqvj)

... (truncated)

• 1d176a8 chore(release): cut 2026.10.24
• 883d0d1 fix(sdk): guard bulk rollback and remediate dependency advisories (#1569)
• 6bffc0c fix(sdk): prevent false test evidence and repair resource recovery (#1559)
• ce94521 fix(sdk): expose read receipts and honor compact context budgets (#1557)
• 06eff3b chore(release): cut 2026.10.23
• abdbc50 fix(sdk): fence lock-lease commits and wait on lock progress, not a fixed dea...
• e72f828 fix(sdk): preserve verified package and physical workspace lifecycle (#1548)
• ec2e9db fix: make MCP probes safe and retain release advisory evidence (#1543)
• 0c07cfe chore(release): cut 2026.10.22
• 6812d11 fix(sdk): honor MCP mutation fields and type authoring builders (#1541)
• Additional commits viewable in compare view

Sourced from pm-changelog's releases.

pm-changelog v2026.10.23

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

• Track merge receipts so pm 2026.10.19+ can settle lossless merges (pmc-pnaq)
• A release run bumped and committed a new version every night while publishing was impossible, and the changelog-date verifier was never invoked by a gate (pmc-3u78)
• Let an item supply a release note the changelog prefers over its defect-shaped title (pmc-fzs6)
• Harden the release merge wait against mergeStateStatus deadlock (pmc-blj6)
• A test asserts an error that only occurs when no package.json exists anywhere above the OS temp directory, so it fails on a host where one does (pmc-6eau)
• List closed issues under Fixed only when a repair is recorded (pmc-txk1)
• This package generates its own changelog without the flag that stops the heading date coming from the clock (pmc-q22j)
• Link custom-type items to their registered tracker folders (pmc-rspo)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pmc-4xu9)

Security

• Consume the canonical attestation gate instead of carrying a copy of it (pmc-wf7n)

Other

• Record pi-land-a merge-readiness verification pass for PR 215 (pmc-wgte)
• Certify pm-changelog on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates (pmc-38z4)

pm-changelog v2026.10.21

No release notes provided.

Sourced from pm-changelog's changelog.

2026.10.23 - 2026-10-23

Changed

• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (pmc-6edv)
• Enable the gated GitHub issue sync (pmc-ctr2)

Fixed

• Track merge receipts so pm 2026.10.19+ can settle lossless merges (pmc-pnaq)
• A release run bumped and committed a new version every night while publishing was impossible, and the changelog-date verifier was never invoked by a gate (pmc-3u78)
• Let an item supply a release note the changelog prefers over its defect-shaped title (pmc-fzs6)
• Harden the release merge wait against mergeStateStatus deadlock (pmc-blj6)
• A test asserts an error that only occurs when no package.json exists anywhere above the OS temp directory, so it fails on a host where one does (pmc-6eau)
• List closed issues under Fixed only when a repair is recorded (pmc-txk1)
• This package generates its own changelog without the flag that stops the heading date coming from the clock (pmc-q22j)
• Link custom-type items to their registered tracker folders (pmc-rspo)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pmc-4xu9)

Security

• Consume the canonical attestation gate instead of carrying a copy of it (pmc-wf7n)

Other

• Record pi-land-a merge-readiness verification pass for PR 215 (pmc-wgte)
• Certify pm-changelog on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates (pmc-38z4)

2026.10.19-1 - 2026-10-19

Fixed

• Publish same-day calendar suffixes with an explicit latest dist-tag (pmc-udb5)
• Request the full list projection explicitly for whole-tracker changelog reads (pmc-zfyb)

2026.10.14 - 2026-10-14

Fixed

• Preserve shipped entries when completed items are reopened and closed again (pmc-reopened-history)

2026.10.12 - 2026-10-12

Added

• Changelog entries can use resolution prose, and --check warns about defect-shaped titles (pmc-d3ds)

Fixed

• Refuse explicit partial-read envelopes supplied to changelog generation (pmc-n4qu)

... (truncated)

• 78534d1 Release pm-changelog v2026.10.23
• d66d475 Track merge receipts so pm can settle lossless merges (#269)
• 600d9ff chore(deps-dev): bump the pm-toolchain group with 2 updates (#268)
• c043fb7 Generate release notes from immutable tracker milestones without Git (#265)
• 0bea2b5 Audit release-note claims against evidence before publication (#267)
• 77e47c6 Close 13 tracker items already delivered on main (#266)
• ff1418f chore(deps-dev): bump pm-ops from 2026.10.16 to 2026.10.18 in the pm-toolchai...
• 56f8536 Release pm-changelog v2026.10.21
• b3af5d5 List closed issues under Fixed only when a repair is recorded (#262)
• See full diff in compare view

Sourced from pm-ops's releases.

pm-ops v2026.10.23

Changelog

2026.10.23 - 2026-10-23

Added

• Freeze the merge-driver launcher and accept every released launcher revision (ops-m82r)
• One reusable daily release workflow for fleet packages (ops-reusable-daily-release)

Changed

• Enable the gated pm-github issue sync and remove the braces chain (ops-gated-issue-sync)
• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (ops-l7gb)

Fixed

• A release run bumped and committed a new version every night while publishing was impossible, because the only externally-failable step runs last (ops-e9g6)
• Fix release publish-before-protected-main-push ordering (ops-gitr)
• A parenthesised command inside a case arm is read as an arm label, refusing a publish the shell attests (ops-vkvy)
• Self-hosted pm-changelog is reported not ready because it does not depend on itself (ops-pksh)
• Adding a source file breaks the coverage gate in three places, and none of them says so (ops-cl0o)
• Recognize third-party publish wrappers (semantic-release, np, release-it, lerna publish, changeset publish) in the canonical attestation auditor (ops-third-party-publish-wrappers)
• A hardcoded fixture date aged out of the seven day window and broke the daily release (ops-i2iz)
• The release completeness audit reported a published version and its GitHub Release as missing, turning a successful release into a failed one (ops-fcow)
• Guarded merge-driver launcher: omit-dev clone installs complete instead of failing on the devDependency import (ops-mqdi)
• Duplication gate scans generated PM extension copies (ops-to4t)
• ops verify-release times out on real full package gate after five minutes (ops-3xyb)
• Preserve launcher resolution errors when presence probes fail (ops-85at)
• Keep multi-line quoted strings open in the publish-attestation scanner (ops-attestation-multiline-quotes)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (ops-cenj)

Other

• Enable GitHub CodeQL code scanning (ops-jasw)
• Characterize pre-existing fleet workflow scanner refusals (ops-0u7l)

2026.10.15 - 2026-10-15

Security

• Remove the unpatched braces chain with built-in fs.glob and jscpd 5 only (ops-braces-audit)

2026.10.14 - 2026-10-14

Fixed

• Reject unresolved alias and function publish indirection in canonical attestation auditor (ops-publish-indirection)
• Keep merge-driver prepare read-only during npm pack and publish (ops-pack-prepare)

... (truncated)

Sourced from pm-ops's changelog.

2026.10.23 - 2026-10-23

Added

• Freeze the merge-driver launcher and accept every released launcher revision (ops-m82r)
• One reusable daily release workflow for fleet packages (ops-reusable-daily-release)

Changed

• Enable the gated pm-github issue sync and remove the braces chain (ops-gated-issue-sync)
• Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs (ops-l7gb)

Fixed

• A release run bumped and committed a new version every night while publishing was impossible, because the only externally-failable step runs last (ops-e9g6)
• Fix release publish-before-protected-main-push ordering (ops-gitr)
• A parenthesised command inside a case arm is read as an arm label, refusing a publish the shell attests (ops-vkvy)
• Self-hosted pm-changelog is reported not ready because it does not depend on itself (ops-pksh)
• Adding a source file breaks the coverage gate in three places, and none of them says so (ops-cl0o)
• Recognize third-party publish wrappers (semantic-release, np, release-it, lerna publish, changeset publish) in the canonical attestation auditor (ops-third-party-publish-wrappers)
• A hardcoded fixture date aged out of the seven day window and broke the daily release (ops-i2iz)
• The release completeness audit reported a published version and its GitHub Release as missing, turning a successful release into a failed one (ops-fcow)
• Guarded merge-driver launcher: omit-dev clone installs complete instead of failing on the devDependency import (ops-mqdi)
• Duplication gate scans generated PM extension copies (ops-to4t)
• ops verify-release times out on real full package gate after five minutes (ops-3xyb)
• Preserve launcher resolution errors when presence probes fail (ops-85at)
• Keep multi-line quoted strings open in the publish-attestation scanner (ops-attestation-multiline-quotes)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (ops-cenj)

Other

• Enable GitHub CodeQL code scanning (ops-jasw)
• Characterize pre-existing fleet workflow scanner refusals (ops-0u7l)

2026.10.21 - 2026-10-21

No tracked changes.

• c952e50 Release pm-ops v2026.10.23 (#193)
• 08febd2 Close 22 tracker items already delivered on main (#188)
• a8b2fa9 Revalidate operational claims when scoped evidence expires or versions change...
• 3546c38 Show verified SDK read capabilities for every configured backend (#189)
• 5804578 Honor explicit metrics JSON and document registry activation (#190)
• eba7d52 Release pm-ops v2026.10.21
• 714fd95 Ship one reusable daily-release workflow for every fleet package (#183)
• See full diff in compare view