Confirm sync and closeout CI dispatch without holding runners for completion

.agents/pm/issues/pm-github-workflow-own-release.toon

@@ -0,0 +1,51 @@
+id: pm-github-workflow-own-release
+title: "Default reusable workflows to their own release (migration: drop pm-github-version); warn on explicit holds"
+description: "Fix #238: derive the default extension from package.json at job.workflow_sha, preserve validated explicit holds with a two-version warning, and preflight registry existence before tracker writes. Migration: callers must drop pm-github-version so Dependabot workflow updates also select the extension version, including the curated identity fix in 2026.11.14."
+type: Issue
+pm_format_version: 2
+status: in_progress
+priority: 1
+tags[3]: changelog-unreleased,"gh:unbraind/pm-github#238",workflows
+created_at: "2026-11-14T09:04:23.981Z"
+updated_at: "2026-11-14T20:21:27.457Z"
+author: codex-github238-1114
+comments[9]{created_at,author,text}:
+  "2026-11-14T09:04:30.564Z",codex-github238-1114,"Plan: replace tag enumeration with a public package.json fetch at the reusable job workflow SHA, normalize exact numeric versions, honor explicit holds and warn with both versions, then check the selected exact registry release before any tracker write. Execute extracted workflow bash with real scratch pm trackers, cover the issue regression cases and behavioral reverts, document caller migration, and inventory public fleet callers through the contents API without changing them. Targeted gates follow the task brief; CI runs the full gate."
+  "2026-11-14T09:12:12.957Z",codex-github238-1114,"Design verified against GitHub Actions job context documentation: job.workflow_sha identifies the reusable job commit for both tag and SHA pins. Both workflows fetch their own package.json at that SHA, validate and normalize its version, honor explicit exact holds, and warn with both versions on a mismatch. Exact public registry metadata is checked before checkout/setup or tracker writes. Live transport smoke: omitted input resolved 2026.11.14; explicit 2026.10.16 remained 2026.10.16 with both versions in the warning; 2099.1.1 returned a refusal with no exported install version. Migration is in the item description and README: callers should drop pm-github-version."
+  "2026-11-14T09:12:15.097Z",codex-github238-1114,"Behavioral revert proofs ran in disposable copies, leaving the fixed checkout untouched. Reverting only default selection: 4/4 selected tests fail. Ignoring explicit holds: 2/2 fail. Removing the two-version warning: 2/2 fail. Removing registry preflight: 2/2 fail, including a real tracker mutation sentinel. Restoring the entire origin/main resolver: all 8 selected issue regressions fail (omitted, padded default, older hold, unavailable version across both workflows). Each refusal case snapshots every real tracker byte including native history; successes perform a real pinned-pm local fixture extension installation. Baseline focused run: 58/58; additional malformed metadata cases are in the linked final run."
+  "2026-11-14T09:15:57.370Z",codex-github238-1114,"Caller inventory complete: 217 workflow files read via public contents API across 37 canonical fleet repository names, zero unavailable reads; 51 calls in 28 repositories still provide pm-github-version. docs/workflow-version-callers.md records every caller file, exact reusable workflow pin, pin comment, input version, and contents blob SHA. No callers changed. Existing caller-adoption follow-up pm-github-samq can carry the later migration sweep. Focused workflow-order checks passed 2/2; typecheck, build:test and lint passed; privacy audited 9288 Git objects without findings; docstrings checked 33 files and 315 declarations. actionlint is unavailable. No authored TypeScript/JavaScript source modules changed (34 inventoried); full CI retains unchanged 100/100/100/100 coverage thresholds. The first linked run reached its default 120-second deadline; retry uses 300 seconds. A request to disable linked pm context in the source workspace was correctly refused, so the retry retains schema isolation."
+  "2026-11-14T09:19:26.367Z",codex-github238-1114,"Final linked focused run passed 64/64 tests, zero failures/skips/cancellations, in 286.7 seconds using pm test --run --progress --timeout 300. This passing run followed the final disposable revert proofs (default 4 failures, hold 2, warning 2, existence 2, full old resolver 8). Linked-test timeout is now 600 seconds for slower shared execution; the first 120-second deadline was execution overhead, not an assertion failure. Additional workflow-order tests passed 2/2. npm run typecheck, npm run build:test, npm run lint, npm run privacy, npm run docstring and git diff --check passed; both changed workflows parse as YAML. actionlint was not installed. Full npm/Bun release and all-source coverage gates remain CI responsibilities under the targeted task brief. Remaining rollout work is caller pin adoption and removal of the 51 explicit holds; raw manifest/registry transport failure deliberately stops before writes. No pm SDK defect was observed; linked execution requires an explicit timeout for this real-installer test file."
+  "2026-11-14T09:20:41.960Z",codex-github238-1114,"Changelog generator renders item titles, so the migration instruction is also in this item title and is visible in release notes. Supplemental read-only strict health found one pre-existing local gate failure: pinned host pm-cli 2026.11.6 versus installed global pm-github host requirement 2026.11.13; tracker settings/directories/values/locks/integrity passed and seven older in-progress items are advisory. No dependency pin or global extension was changed. This environment condition is already recorded by the reference-identity work; clean CI owns the full gate. Changelog generation and check are rerun after this final tracker write."
+  "2026-11-14T09:50:05.380Z",codex-github238-1114,"CI closeout at 2026-11-14 09:49 UTC after approximately 28 minutes of the 30-minute wait window: PR https://github.com/unbraind/pm-github/pull/245, implementation commit 0f58f1096c33a9fa3d0e9482d64c7a01fc23a16d. CI https://github.com/unbraind/pm-github/actions/runs/43580183069 still has test (22), test (26), bun-release (22), and bun-release (26) queued. CodeQL https://github.com/unbraind/pm-github/actions/runs/43580183044 completed successfully on that implementation head. Greptile and Semgrep checks succeeded; CodeRabbit/Sourcery skipped and cubic neutral are missing review approval. No review comments were returned and no threads were replied to, resolved or reacted to. This final evidence-only commit changes no implementation or test source; fresh final-head checks remain pending under the original wait cutoff. Once replacement checks register, cancel only the superseded queued CI run to avoid duplicate runner consumption. Orchestrator must verify the final-head full npm/Bun gates and unchanged 100/100/100/100 coverage; local strict-health environment skew remains recorded above. The item remains released and in_progress for orchestrator verification."
+  "2026-11-14T20:19:11.380Z",codex-followups-1114,"Review follow-up for PR 245: the merged source shifted ownership anchors. Before regeneration, identity-inventory.test.ts reproduces four failures and one pass. Regenerate only with node scripts/identity-inventory.ts --write, run the complete inventory-related test files plus typecheck and lint, then carry the fix into PR 246. Targeted local gates follow the brief; full gates remain in CI."
+  "2026-11-14T20:21:23.562Z",codex-followups-1114,"Generated fix changes one auxiliary workflow anchor from line 466 to 440. Before generation the inventory file caused 4/5 inventory tests to fail; after generation the complete test/identity-inventory.test.ts and test/round-twelve.test.ts run passes 37/37 with no skipped or failed tests via pinned pm test. npm run typecheck, npm run lint and npm run build:test pass. The existing stale-anchor and line-shift regressions remain intact; no generator or anchor hand edits. Full release certification remains in CI."
+files[5]{path,scope}:
+  .github/workflows/pm-github-closeout.yml,project
+  .github/workflows/pm-github-sync.yml,project
+  docs/scheduled-workflow-watch-1106.md,project
+  test/identity-inventory.test.ts,project
+  test/self-versioned-workflows.test.ts,project
+tests[2]:
+  - command: node --test --test-concurrency=2 test/self-versioned-workflows.test.ts
+    scope: project
+    timeout_seconds: 600
+    provenance:
+      author: codex-github238-1114
+      created_at: "2026-11-14T09:09:34.220Z"
+      source_kind: local_mutation
+      source_ref: fix/workflow-installs-own-release
+    updated_by: codex-github238-1114
+    updated_at: "2026-11-14T09:19:21.734Z"
+  - command: node --test --test-concurrency=2 test/identity-inventory.test.ts test/round-twelve.test.ts
+    scope: project
+    timeout_seconds: 600
+    provenance:
+      author: codex-followups-1114
+      created_at: "2026-11-14T20:19:18.462Z"
+      source_kind: local_mutation
+      source_ref: fix/workflow-installs-own-release
+docs[3]{path,scope}:
+  docs/identity-ownership-inventory.md,project
+  docs/workflow-version-callers.md,project
+  README.md,project
+body: ""