Close delivered items and return idle in-progress items to open (2026-11-14 sweep)

.agents/pm/chores/pm-github-dependabot-activation.toon

@@ -2,19 +2,18 @@ id: pm-github-dependabot-activation
 title: Verify live Dependabot merge safety and coordinate fleet activation
 description: "Read-only Actions API inspection now reports dependabot-auto-merge.yml active, superseding the earlier disabled snapshot. PR #221 delivers the reusable provenance policy, trusted default-branch caller and independent scheduled audit source. Workflow state alone does not prove safe runtime activation. Keep repository token, event-policy, protected-branch and live-acceptance verification and fleet caller adoption separate from this implementation. Coordinate with companion pm-cli-website-wis6."
 type: Chore
-status: blocked
+status: open
 priority: 2
 tags[4]: ci,dependabot,follow-up,security
 created_at: "2026-11-05T00:52:51.053Z"
-updated_at: "2026-11-05T11:10:09.277Z"
+updated_at: "2026-11-14T09:03:31.745Z"
 author: codex-agent
 acceptance_criteria: "After reviewed delivery and release, verify each selected caller pins a release containing the policy or uses the reviewed trusted local path.; Verify the active caller has a repository-scoped merge token as Actions and Dependabot secrets when needed, required Actions event policy permits its trusted trigger, and server-enforced protected-branch checks and review requirements prevent unreviewed merges.; With owner authorization record live bot-only arm, foreign-commit revocation and independent scheduled audit acceptance without permitting an unintended merge, and coordinate remaining fleet adoption separately."
-blocked_by: pm-github-dependabot-merge
-dependencies[1]{id,kind,created_at,author,source_kind,author_source}:
-  pm-github-dependabot-merge,blocked_by,"2026-11-05T00:52:51.053Z",codex-agent,"cli:create:blocked_by",detected
-comments[2]{created_at,author,text}:
+unblock_note: Auto-unblocked after blocker pm-github-dependabot-merge closed; all blockers resolved (pm-github-dependabot-merge).
+comments[3]{created_at,author,text}:
   "2026-11-05T10:29:37.084Z",codex-agent,"PRRT_kwDOTbN4pM6z_gYw verified: Actions API currently reports the existing workflow active. Updated title, description and acceptance criteria to remove the obsolete enable request. Item remains blocked on reviewed implementation and runtime token/protection/live acceptance; active workflow state is not proof of fleet activation. No live workflow or secret settings changed."
   "2026-11-05T11:10:03.277Z",codex-agent,"Round 2 source delivered and tested without changing live settings: activation snapshot corrected, trusted default-branch caller plus scheduled/manual provenance audit implemented. Focused regression covers this item and passes through the pinned pm runner; restoring the obsolete item fails it. Runtime token, event-policy, branch-protection, live arm/revoke/audit and fleet adoption checks remain blocked pending orchestrator verification. Releasing only my claim; this item remains open."
+  "2026-11-14T09:03:31.742Z",codex-sweep-1114,"2026-11-14 sweep: native pm close automatically moved this dependent from blocked to open when pm-github-dependabot-merge closed. https://github.com/unbraind/pm-github/pull/221 merged 2026-11-05T16:59:37Z; merge SHA a7e4d4bb3334f822ff2ecd726a3320f790fc7cb4; PR head 83abb9e2946a5cdfa7263f7d97d41ec172b8f2df. Delivered: Reusable Dependabot provenance policy, trusted caller and independent audit source. Green at that head: test (22), codeql, test (26), bun-release (22), bun-release (26), CodeQL, CodeRabbit, semgrep-cloud-platform/scan. Other check outcomes: cubic · AI code reviewer: NEUTRAL; Sourcery review: SKIPPED (not counted as green). Remaining: verify caller release pins, scoped token availability, trusted event policy and server-enforced branch protection; with owner authorization verify real bot-only arm, foreign-commit revocation and scheduled audits, then coordinate caller adoption. Active workflow state alone is not runtime acceptance; no live settings were changed."
 files[1]{path,scope}:
   .github/workflows/dependabot-auto-merge.yml,project
 tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:

.agents/pm/chores/pm-github-rv9m.toon

@@ -2,24 +2,54 @@ id: pm-github-rv9m
 title: Close delivered pm items and reserve in progress for active work (2026-10-24)
 description: "Review every in-progress and open record against merged delivery and current PR evidence. Preserve uncertain work as open, release stale claims, and submit the tracker changes for review."
 type: Chore
-status: open
+status: closed
 priority: 2
 tags[2]: maintenance,tracker-hygiene
 created_at: "2026-10-24T21:40:01.860Z"
-updated_at: "2026-10-24T21:54:53.731Z"
+updated_at: "2026-11-14T10:07:40.034Z"
+closed_at: "2026-11-14T08:53:06.253Z"
+completed_at: "2026-11-14T08:53:06.253Z"
 author: codex-agent
 estimated_minutes: 60
 acceptance_criteria: "Every original in-progress and open item is inspected; delivery closures name the implementing merged PR, date and merge SHA and match the recorded acceptance; inactive work is open with claims released; original history records remain append-only; tracker health, changelog and PR CI outcomes are recorded."
 risk: low
 confidence: high
-comments[3]{created_at,author,text}:
+comments[9]{created_at,author,text}:
   "2026-10-24T21:40:02.778Z",codex-agent,"Oriented context, searched existing hygiene work, and read the complete tracker. Checking every original in-progress and open item against PR title/body/commits, delivery links and acceptance. The owner authorizes evidence-backed closure in this sweep. Ambiguous claims remain open; no PR merge or history rewrite."
   "2026-10-24T21:53:34.413Z",codex-agent,Delivery closures are complete except pm-github-f1ev and pm-github-2o9k. The repo-pinned SDK refuses both records with project_runtime_item_format_incompatible because existing linked tests retain updated_by/updated_at metadata while the consumer floor is 2026.10.5. No evidence or history was removed. A prepared peer/manifest 2026.10.10 floor proposal passes 4/4 compatibility checks outside this tracker and awaits owner authorization because it changes consumer support. General bounded aggregation returns to open. Release this sweep claim while the compatibility decision is pending.
   "2026-10-24T21:54:53.731Z",codex-agent,"Local tracker verification passed: repository changelog generation and consistency check, pinned strict health with required merge drivers under isolated Git identity, changed-item history verification, independent original-history prefix checks and linked git diff --check. The audit claim is released. Remaining in-progress count: 2. Any preserved guarded records and the required owner compatibility decision are explicitly listed in the PR. No production function changed, so source-function revert proof is inapplicable; per-item merged ancestry and lifecycle/history checks are the evidence. The PR will carry the full before/after/evidence table. Complete npm/Bun release checks and native platform checks run in PR CI; their final outcome is reported separately, without treating queued or skipped checks as approval."
-files[1]{path,scope,note}:
-  .agents/pm,project,Tracker lifecycle and append-only evidence
-tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  "2026-11-14T08:48:56.606Z",codex-sweep-1114,"2026-11-14 sweep: inspected context, searched prior hygiene work, and read the complete tracker. Verify each in-progress item against acceptance, merged delivery, exact PR-head checks and linked issue state. Close complete delivery, reopen idle or partial work, preserve other live claims and all prior history."
+  "2026-11-14T08:51:31.821Z",codex-sweep-1114,"Sweep decisions: 6 delivered items closed, 3 idle or partial items reopened, 0 canceled, 0 left alone. Evidence and remaining work are recorded per item. Linked git diff --check passed. Final tracker and changelog validation follows; release gates and hosted CI are separate evidence."
+  "2026-11-14T08:55:19.606Z",codex-sweep-1114,"Audit correction: inspected merged PR 233 source and reran all five real-tracker URL-alias refresh regressions successfully. The alias follow-up meets its original acceptance and is closed despite the later generic deferred handoff. Caller rollout and blocker repository-hint follow-ups remain open. The earlier reopening and this correction both remain in append-only history. Final validation follows after this write."
+  "2026-11-14T09:03:36.294Z",codex-sweep-1114,"Native lifecycle accounting: closing pm-github-dependabot-merge also automatically unblocked pm-github-dependabot-activation from blocked to open. Its separate live runtime, token/protection and caller-adoption acceptance remains open and is now explicitly documented in the sweep table. This is one additional opened dependent beyond the original in-progress audit."
+  "2026-11-14T10:04:37.697Z",codex-sweep-1114,"Release-attribution correction continuation: use each delivered item's evidenced PR merge timestamp for completed_at and its first containing release tag for release. Preserve genuinely unreleased items without a release value, all statuses and existing claims. Sweep chore completion/release and reopened work are excluded. Regenerate and verify changelog placement, append-only history and health after the last write."
+  "2026-11-14T10:07:40.034Z",codex-sweep-1114,"Release metadata corrected for 7 delivered items: 7 attributed to first containing tags and 0 left genuinely unreleased. Linked diff check passed. Independent timestamp/tag/changelog-placement validation and regenerated changelog checks follow this final tracker write. No review thread replies, resolutions or reactions."
+files[10]:
+  - path: .agents/pm
+    scope: project
+    note: Tracker lifecycle and append-only evidence
+  - path: .agents/pm/chores/pm-github-toolchain-1110.toon
+    scope: project
+  - path: .agents/pm/features/pm-github-dependabot-merge.toon
+    scope: project
+  - path: .agents/pm/issues/pm-github-blocker-format-followup.toon
+    scope: project
+  - path: .agents/pm/issues/pm-github-gevp.toon
+    scope: project
+  - path: .agents/pm/issues/pm-github-mes8.toon
+    scope: project
+  - path: .agents/pm/issues/pm-github-o9r7.toon
+    scope: project
+  - path: .agents/pm/issues/pm-github-pr-url-alias-followup.toon
+    scope: project
+  - path: .agents/pm/issues/pm-github-samq.toon
+    scope: project
+  - path: .agents/pm/tasks/pm-github-vhi6.toon
+    scope: project
+tests[2]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
   git diff --check,project,codex-agent,"2026-10-24T21:54:22.795Z",local_mutation,chore/pm-in-progress-sweep
+  git -c core.quotePath=true diff --check,project,codex-sweep-1114,"2026-11-14T08:51:14.337Z",local_mutation,chore/in-progress-sweep-2026-11-14
 docs[1]{path,scope,note}:
   CHANGELOG.md,project,Regenerated package release notes
+close_reason: "2026-11-14 tracker sweep delivered by https://github.com/unbraind/pm-github/pull/244. Original in-progress items were audited against merged PRs, acceptance and linked issues; delivered work closed and idle work reopened with remaining work recorded. Live claims and append-only history preserved. Local changelog check, tracker health and history-prefix checks passed before this closure; regenerated final checks follow. The sweep PR is open for review; its CI is reported separately and no merge is claimed."
 body: ""

.agents/pm/chores/pm-github-toolchain-1110.toon

@@ -2,16 +2,20 @@ id: pm-github-toolchain-1110
 title: Bound lifecycle compensation quarantine to verified SDK pins
 description: "Adapt https://github.com/unbraind/pm-github/pull/227 using existing pm-github-quay evidence for unresolved upstream GH-1656."
 type: Chore
-status: in_progress
+status: closed
 priority: 2
 tags[1]: "gh:unbraind/pm-github#227"
 created_at: "2026-11-10T12:43:45.298Z"
-updated_at: "2026-11-10T17:49:07.937Z"
+updated_at: "2026-11-14T10:05:18.915Z"
+closed_at: "2026-11-14T08:49:08.195Z"
+completed_at: "2026-11-10T19:48:53.000Z"
 author: codex-toolchain-1110
-comments[3]{created_at,author,text}:
+release: 2026.11.11
+comments[4]{created_at,author,text}:
   "2026-11-10T12:43:48.205Z",codex-toolchain-1110,"Upstream pm-cli GH-1656 remains OPEN. Installed CHANGELOG 2026.11.5/2026.11.6 contains GH-1655, GH-1660, revision follow-ups and GH-1670, but no owned-finalization step or GH-1656 fix. Existing pm-github-quay and docs/atomic-finalization-197-recheck.md already prove 2026.11.4/.5/.6 all fail both lifecycle compensation guarantees. Reproduced on this 2026.11.6 worktree before changing the predicate: the real mixed import and recovered refresh still report incomplete compensation; the fresh no-op-finalizer control passes. Extend only the explicit verified-pin allowlist to .5/.6, preserve every assertion and keep future .7/unverified SDKs executing the checks. This is a quarantine maintenance change, not a rollback repair. Full coverage intentionally excluded per task instructions."
   "2026-11-10T12:45:37.105Z",codex-toolchain-1110,"Exact local counts: exposed SDK 2026.11.6 reproduction 3 tests: 1 passed, 2 failed, 0 skipped. After bounded quarantine maintenance: 5 tests: 3 passed, 0 failed, 2 skipped; these skips retain the unresolved guarantees rather than certify rollback. Linked predicate regression also runs through pm test. Auto-merge disabled before any push."
   "2026-11-10T17:49:07.279Z",codex-toolchain-1110,"Final focused run on SDK 2026.11.6 completed all three changed test files: 91 tests, 89 passed, zero failed/canceled, two skipped. Both skips are the existing unsupported lifecycle-compensation guarantees for GH-1656; they are not passing rollback evidence. Typecheck, build:test, lint and changelog:check pass. These test modules have no importing test-module consumers; the guard regression reads and evaluates the actual quarantine declarations and skip options. Upstream GH-1656 was rechecked and remains OPEN, and installed CHANGELOG 2026.11.5/2026.11.6 contains no owned-finalization fix. The earlier real SDK reproduction reports 1 passed and 2 failed without the waiver. Keep the exact verified 2026.11.4/.5/.6 allowlist and automatically execute assertions on unverified future versions. No production compensation implementation, assertion or coverage threshold changed. Per orchestrator instruction, CI certifies the full gate; full coverage was not run locally. Auto-merge disabled before push."
+  "2026-11-14T10:05:18.887Z",codex-sweep-1114,"Release-attribution correction: completed_at = 2026-11-10T19:48:53Z from https://github.com/unbraind/pm-github/pull/227 (merge SHA 3a69b475fbf83af0ac859bdf0bfe7afd9032241c); first containing release tag v2026.11.11, recorded release 2026.11.11."
 files[3]{path,scope}:
   test/atomic-finalization-quarantine.test.ts,project
   test/import-fidelity.test.ts,project
@@ -30,4 +34,5 @@ tests[2]:
       author: codex-toolchain-1110
       created_at: "2026-11-10T17:49:06.078Z"
       source_kind: local_mutation
+close_reason: "https://github.com/unbraind/pm-github/pull/227 merged 2026-11-10T19:48:53Z; merge SHA 3a69b475fbf83af0ac859bdf0bfe7afd9032241c; PR head d71db1566c710df98c982d52ab48f28c0110ab0e. Delivered: Bounded lifecycle-compensation quarantine to exactly verified SDK versions with regression guards; unresolved upstream guarantees remain explicitly skipped. Green at that head: test (22), codeql, verified-auto-merge / dependabot-merge, verified-auto-merge / dependabot-merge, test (26), bun-release (22), bun-release (26), CodeQL, semgrep-cloud-platform/scan. Other check outcomes: audit-armed-requests: SKIPPED; audit-armed-requests: SKIPPED; CodeRabbit: SKIPPED; Sourcery review: SKIPPED (not counted as green)."
 body: ""