unbraind · unbraind · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026
diff --git a/.agents/pm/history/pm-github-7d1h.jsonl b/.agents/pm/history/pm-github-7d1h.jsonl
diff --git a/.agents/pm/issues/pm-github-7d1h.toon b/.agents/pm/issues/pm-github-7d1h.toon
@@ -0,0 +1,39 @@
+id: pm-github-7d1h
+title: "The manifest declared a pm CLI floor of 2026.7.28 while peerDependencies required 2026.8.3, so the CLI enforced a weaker minimum than npm"
+description: "package.json peerDependencies declares >=2026.8.3 and npm enforces that at install time, but npm never sees a globally installed host CLI. The pm CLI enforces a different declaration: a top-level pm_min_version in manifest.json, which here read 2026.7.28. The two systems therefore enforced different minimums, and the one that applies to a globally installed CLI was the weaker of the two. Verified against 2026.8.15 by installing an extension whose manifest declared 2099.1.1: install returned ok false, the command never registered, and pm health reported extension_pm_min_version_unmet."
+type: Issue
+status: closed
+priority: 2
+tags: []
+created_at: "2026-08-16T00:35:13.077Z"
+updated_at: "2026-08-16T03:00:52.637Z"
+closed_at: "2026-08-16T01:32:11.608Z"
+completed_at: "2026-08-16T01:32:11.608Z"
+author: claude-code
+acceptance_criteria: "manifest.json declares a top-level pm_min_version equal to the peerDependencies floor; the devDependency on the CLI is an exact pin at or above that floor; removing the manifest floor, loosening the pin to a caret range, or changing either floor independently each fail the test"
+resolution: "manifest.json declares pm_min_version 2026.8.3, equal to the peerDependencies floor, and devDependencies exact-pins the CLI at 2026.8.15. compatibility-floor.test.ts asserts three properties and each now has its own failing mutation: rewriting the peer range to an exact pin, removing or changing the manifest floor, and loosening the dev pin to a caret range. A fourth mutation covers the parse guard added during review."
+expected_result: "A host CLI older than the package's declared floor is refused before the extension loads, on every install path — including a globally installed CLI that npm never sees."
+actual_result: "npm refused a locally resolved dependency below 2026.8.3, while the pm CLI accepted any host at or above 2026.7.28 — a span of releases in which the package loaded against a CLI its own peer declaration says it does not support."
+comments[3]{created_at,author,text}:
+  "2026-08-16T01:32:10.991Z",claude-code,"Revert-proof run against this exact tree: baseline exit 0; manifest pm_min_version removed exit 1; dev pin loosened to a caret range exit 1; manifest floor set to a version other than the peer floor exit 1; restored exit 0. Enforcement was verified directly against pm-cli 2026.8.15 rather than assumed: an extension declaring pm_min_version 2099.1.1 was refused at install with ok false, its command never registered, and pm health reported extension_pm_min_version_unmet."
+  "2026-08-16T02:18:40.576Z",claude-code,"Complete revert-proof, one mutation per assertion, run against this exact tree. Baseline exit 0. Assertion one, the peer dependency must be a >= floor rather than an exact pin: rewriting the peer range to an exact pin exits 1. Assertion two, the manifest must declare a pm_min_version equal to the peer floor: removing it exits 1 and setting it to a different version exits 1. Assertion three, the development dependency must be an exact pin at or above the floor: loosening it to a caret range exits 1. The parse guard added in the review round: setting the manifest floor to a two-part version exits 1. Restored exit 0. Every assertion in the file now has a mutation that fails it, which was not true when this item was first closed: the peer-range assertion was asserted but never proved, and CodeRabbit caught the gap between the close-reason claim and the recorded evidence."
+  "2026-08-16T02:37:05.630Z",claude-code,"Lower-bound mutation, added to the evidence after review: pinning the development CLI to an exact 2026.8.2, one day below the declared floor 2026.8.3, exits 1. This is the case the repository's own values cannot reach, because the pin and the floor are the same version here, so the ordering half of the comparison is never executed by the assertion. It is now driven directly by a test over synthetic pairs, including the lexicographic trap in which 2026.8.7 must not satisfy a floor of 2026.8.15."
+notes[4]{created_at,author,text}:
+  "2026-08-16T02:19:32.917Z",claude-code,"Correction, appended rather than rewritten: the title of this item was changed twice after it was closed, and the close reason was corrected once. The first title stated the defect in the present tense, which pm-changelog emits verbatim and which therefore read in a shipped changelog as though the release still carried the defect. The second named each field only by its enforcer, which a reviewer read backwards. The close reason originally claimed all three assertions were proved to fail on revert; only two were, because the peer-range assertion was asserted but never mutated. Each of those corrections is an appended event in this item's history stream, so the record of what was claimed and when remains readable."
+  "2026-08-16T02:31:51.656Z",claude-code,"Correction appended after review: the earlier title said this package declared no pm_min_version at all. That was true of eight packages in this wave but not of this one, which declared 2026.7.28 — below its own peer floor of 2026.8.3. CodeRabbit caught the discrepancy between the title and the diff."
+  "2026-08-16T02:37:06.227Z",claude-code,"Correction to the earlier correction note, appended rather than rewritten. That note said this item's title changed twice after closure and that the close reason was corrected. Reading this item's own history stream: it closed at 2026-08-16T01:32:11, 0 update events precede the close and 4 follow it. The post-close updates changed the title and, in the last of them, the resolution field. The close_reason recorded at closure has not been altered. CodeRabbit caught that the note misstated both the field and, on some items, the chronology."
+  "2026-08-16T03:00:52.637Z",claude-code,"Third correction, and this one is derived from the patch entries of this item's own history stream rather than written as prose. Both earlier notes were inaccurate about which fields changed and when. The record, read from the stream: closed at 2026-08-16T01:32:11. Update events before the close: 0 (none). Update events after the close: 4 (2026-08-16T01:45:29 changed title; 2026-08-16T01:54:23 changed actual_result, expected_result, resolution, title; 2026-08-16T02:19:32 changed resolution; 2026-08-16T02:31:51 changed actual_result, description, title). Every one of those is an appended event; no prior entry was rewritten. CodeRabbit caught both earlier notes, and the reason both were wrong is the same: a claim about a history stream was composed from recollection of the commands issued instead of being read back out of the stream."
+files[4]{path,scope}:
+  manifest.json,project
+  package-lock.json,project
+  package.json,project
+  test/compatibility-floor.test.ts,project
+tests[1]:
+  - command: PM_PATH=/tmp/pm-cf-pm-github PM_GLOBAL_PATH=/tmp/pm-cf-g-pm-github node --test test/compatibility-floor.test.ts
+    path: test/compatibility-floor.test.ts
+    scope: project
+    timeout_seconds: 120
+    assert_stdout_regex[1]: "the peer dependency declares the CLI floor as a minimum, not an exact pin[\\s\\S]*the extension manifest declares the same floor the CLI actually enforces[\\s\\S]*the development dependency is an exact pin at or above the declared floor"
+    note: "Binds the three compatibility-floor assertions to their real node:test titles so a renamed or deleted test fails this linked check instead of passing silently."
+close_reason: "manifest.json now declares pm_min_version 2026.8.3, identical to the peerDependencies floor, and the development CLI is exact-pinned at 2026.8.15. Three assertions bind the declarations together and each was proved to fail on revert."
+body: ""
diff --git a/.gitattributes b/.gitattributes
@@ -1,4 +1,4 @@
-# pm-cli:merge-drivers:start
+# pm-cli:merge-drivers:v2:start
 ".agents/pm/**/*.toon" merge=pm-item-toon
 ".agents/pm/**/*.md" merge=pm-item-markdown
 ".agents/pm/chores/*.toon" merge=pm-item-toon
@@ -27,4 +27,6 @@
 ".agents/pm/history/*.jsonl" merge=pm-history
 ".agents/pm/settings.json" merge=pm-json
 ".agents/pm/**/*.json" merge=pm-json
-# pm-cli:merge-drivers:end
+".agents/pm/extensions/**" -merge
+".agents/pm/extensions/.managed-extensions.json" merge=pm-json
+# pm-cli:merge-drivers:v2:end
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixed
 
+- The manifest declared a pm CLI floor of 2026.7.28 while peerDependencies required 2026.8.3, so the CLI enforced a weaker minimum than npm ([pm-github-7d1h](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-7d1h.toon))
 - A github command can silently lose its preflight credential gate when the override scope drifts from the mutating command set ([pm-github-4ga9](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-4ga9.toon))
 
 ## 2026.8.15 - 2026-08-15

diff --git a/manifest.json b/manifest.json
@@ -1,11 +1,11 @@
 {
   "name": "pm-github",
   "version": "2026.8.16",
-  "description": "GitHub Issues + Projects v2 integration. Imports issues as pm items (`pm github import`), exports pm items as GitHub issues, syncs issue state, and bidirectionally syncs pm items with a GitHub Projects v2 board (`pm github project import/sync/list/fields`) — mapping pm status to the board Status column with idempotent, no-data-loss provenance.",
+  "description": "GitHub Issues + Projects v2 integration. Imports issues as pm items (`pm github import`), exports pm items as GitHub issues, syncs issue state, and bidirectionally syncs pm items with a GitHub Projects v2 board (`pm github project import/sync/list/fields`) \u2014 mapping pm status to the board Status column with idempotent, no-data-loss provenance.",
   "author": "@unbraind",
   "entry": "./dist/index.js",
+  "pm_min_version": "2026.8.3",
   "priority": 50,
-  "pm_min_version": "2026.7.28",
   "capabilities": [
     "commands",
     "importers",

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -43,7 +43,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.1",
-    "@unbrained/pm-cli": "^2026.8.6",
+    "@unbrained/pm-cli": "2026.8.15",
     "pm-changelog": "^2026.8.6",
     "pm-ops": "^2026.8.8",
     "typescript": "^7.0.2"