OH MY PM v0.2.0

OH MY PM v0.2.0

Release status

Prepared, not yet published. The source tree is at version 0.2.0 and the
stable v0.2.0 assets have been built and rehearsed locally, but no stable
tag or GitHub Release has been created. Publication happens only through the
manually gated Release v0.2 Stable workflow (workflow_dispatch) and requires
a separate, explicit owner approval; see
the stable publishing guide.

Until stable publication:

• the currently published, validated prerelease is v0.2.0-rc.1 (immutable);
• the latest stable release remains v0.1.0;
• there is no stable v0.2.0 tag or release, and nothing is published to any
  registry.

When published, v0.2.0 is a non-draft, non-prerelease GitHub Release marked
"latest", carrying exactly three assets, and targeting the workflow commit. This
document is used verbatim as the stable release notes.

Validated RC lineage

v0.2.0 promotes the exact scope validated in v0.2.0-rc.1. No feature,
command, provider, Skill, MCP tool, Kernel, extraction, installer, archive, or
runtime behavior changed between the RC and this stable preparation — only the
version string moved from 0.2.0-rc.1 to 0.2.0.

• The RC was published as an immutable GitHub prerelease (tag v0.2.0-rc.1 at
  fd03cce…, draft=false, prerelease=true, exactly three assets).
• Post-publication validation of the public prerelease passed: public-artifact
  installation, source independence, prefix relocation, all four local Markdown
  workflows on three project shapes, the strict configuration matrix, tokenless
  live GitHub read-only workflows, and all ten stdio MCP tools.
• No Blocker, High, or Medium defects. Decision: GO for stable preparation
  (Low-only findings, documented follow-up).

See the RC release notes and
the post-publication validation report.

Highlights

v0.2 adds an explicit, read-only GitHub provider and richer deterministic
project intelligence on top of the local Markdown workflows from v0.1.0, plus
a portable, preview-first installer with cross-platform verification. It is a
self-contained, versioned portable artifact that runs on Node.js 20+ with no
Rust toolchain, pnpm, or repository checkout required, and no registry
publication.

Local Markdown workflows

• oh-my-pm brief|risks|next|handoff <root> analyze a local Markdown project
  directory and emit deterministic Markdown/JSON/brief output.
• Fully offline: no network, no token, no project writes. Output is
  byte-deterministic (fixed clock) for repeatable results.

Read-only GitHub provider

• Strictly read-only, explicitly opt-in access to api.github.com: GET-only,
  fixed origin, fixed REST API version (2026-03-10), single page per request,
  optional token. No writes, GraphQL, retries, pagination, caching, or sync.
• oh-my-pm github <brief|risks|next|handoff> runs the same four workflows over
  a selected GitHub source.

GitHub source modes

Six explicit source modes for the GitHub workflows:

• overview (default), repository, issues, pull-requests,
• a single item (issue or PR with type auto-detection), and
• repository-scoped search.

Each supports open/closed/all state selection and search kind filtering.
The default stays overview + open; user search terms can never override the
injected repository/state/kind scope.

Bounded comments/reviews/review comments

For the item source only, and disabled by default:

• ordinary issue/PR conversation comments — one page of at most 50, via a single
  extra GET /repos/{owner}/{repo}/issues/{number}/comments;
• pull-request review submissions — one page of at most 20 (PR items only);
• inline review comments — one page of at most 20 (PR items only).

Timeline events, thread resolution, reactions, diffs, files, and commits are
excluded. The MCP projection exposes identity/author/state/timestamps/file
provenance but never a body, diff hunk, or commit identifier. An issue selected
with review options fails after exactly one item-identification request.

Provider configuration and diagnostics

• Strict, read-only provider configuration (providers.json) with optional
  GitHub enabled / defaultRepository / defaultLimit / defaultSource /
  defaultState defaults. No secret is ever stored in configuration.
• Offline providers status and an explicitly confirmed, single-request
  providers doctor GitHub access diagnostic.

CLI

• Local: status, brief, risks, next, handoff.
• Providers: providers status, providers doctor.
• GitHub: github brief|risks|next|handoff with --source, --state,
  --limit, --query, --kind, and the bounded discussion flags
  --include-comments/--comment-limit, --include-reviews/--review-limit,
  --include-review-comments/--review-comment-limit (item source; reviews are
  pull-request-only).
• Coded, leak-free error UX (no stack traces, paths, or tokens). Unsupported
  commands exit 2 with a coded message.

MCP exact ten-tool surface

stdio transport only, with exactly ten tools in this fixed order:

1. project_brief
2. project_risks
3. project_next
4. project_handoff
5. github_project_brief
6. github_project_risks
7. github_project_next
8. github_project_handoff
9. provider_status
10. github_provider_diagnostics

No write-style tools; no HTTP transport. Sanitized public projections only —
never a raw provider object, token, header, config path, runtime trace, or
planner graph.

Kernel and portability

• The real Rust/WASM Kernel is bundled prebuilt and Node-loadable on Ubuntu,
  macOS, and Windows; installation never rebuilds the Kernel.
• Every archive ships a preview-first installer at bin/oh-my-pm-install.mjs.
  Preview is the default; --apply is required to write; installation targets
  an explicit --prefix. The installed prefix is source-independent and
  relocatable.

Deterministic English/Persian extraction

• Source-aware, line-level risk / next-task / decision extraction for Markdown
  and GitHub context, with English and Persian headings and markers, exact
  GitHub label/status rules, overdue inference from an injected timestamp, one
  risk/task per GitHub item, and bounded risk/task limits (20 risks, 10 tasks).
• Rule-based only — no LLM, embedding, or fuzzy scorer. Fenced code blocks are
  excluded from signal extraction.

Security and privacy guarantees

• Local Markdown workflows are fully offline and read no token.
• GitHub access is explicit, read-only, GET-only, single fixed origin
  (https://api.github.com), fixed API version, single page; the optional
  OH_MY_PM_GITHUB_TOKEN is environment-only, never accepted as a CLI/MCP
  argument, and never printed or persisted.
• No raw comment/review/review-comment bodies, diff hunks, or commit identifiers
  are exposed through the MCP projections.
• The installer performs no PATH, shell-profile, project, or MCP-client-config
  edits; it writes only under the explicit prefix.
• No telemetry, no project-file writes, no context upload. All packages private;
  no registry publication.

Compatibility and runtime requirements

• Node.js 20+; no Rust toolchain, pnpm, or repository checkout required by the
  installed commands.
• No npm package and no crates.io publication; distribution is by verifiable
  release archives only.

Artifact names

The stable release publishes exactly three assets, and each archive extracts to
exactly one top-level directory oh-my-pm-v0.2.0/:

• oh-my-pm-v0.2.0.tar.gz
• oh-my-pm-v0.2.0.zip
• oh-my-pm-v0.2.0-SHA256SUMS.txt

Verification commands

Verify the downloaded assets before extracting, then preview and apply:

# Verify checksums (both archives):
sha256sum --check oh-my-pm-v0.2.0-SHA256SUMS.txt

# Extract (tar.gz or zip):
tar -xzf oh-my-pm-v0.2.0.tar.gz          # or: unzip oh-my-pm-v0.2.0.zip

# Preview (writes nothing; the prefix is not created):
node ./oh-my-pm-v0.2.0/bin/oh-my-pm-install.mjs --prefix "$HOME/.local"

# Apply (writes only under the prefix):
node ./oh-my-pm-v0.2.0/bin/oh-my-pm-install.mjs --prefix "$HOME/.local" --apply

# After adding <prefix>/bin to PATH:
oh-my-pm status                          # reports version 0.2.0, kernel 0.2.0

Known Low-severity follow-ups

Carried forward from the RC post-publication validation; none blocks stable:

• L1 — No --help surface. The CLI has a defined, documented command
  surface but offers no conventional --help/help. Deferred beyond v0.2.0.
• L2 — No installed MCP client-config generator. Generating a client config
  relies on a repository-only development script; the installed release has no
  equivalent command. Deferred to distribution/UX.
• L4 — Stale fixture path in docs. Corrected: current operational
  documentation now refers to the shipped fixture path examples/markdown-project
  (the historical validation report keeps the stale path where it records the
  finding itself).

The governance follow-up (L3, a required reviewer on the github-release
environment) is a pre-publication gate; see the stable publishing guide for its
status.

Deferred beyond v0.2

Intentionally not part of v0.2:

• timeline events
• review-thread graph / resolution
• reactions
• commits / files / diffs
• provider aliases / profiles
• controlled write-back
• HTTP MCP transport
• telemetry, dashboard, registry publishing, self-update, automatic MCP client
  configuration

Upgrade path from v0.1.0

• v0.2 is backward-compatible for the local Markdown workflows. The bundle
  name, archive layout, and preview-first installer follow the same shape as
  v0.1.0, with the version string updated to 0.2.0.
• The GitHub provider, provider configuration/diagnostics, and the six
  additional MCP tools (four GitHub workflows + two diagnostics) are new and
  strictly opt-in; existing offline usage is unchanged.
• Install into a distinct --prefix to keep a v0.1.0 installation alongside
  v0.2.0 if desired.

Release evidence

• RC published as an immutable prerelease and validated from its public assets;
  see the post-publication validation report.
• Stable preparation on main: version promoted to 0.2.0 across version.json,
  all workspace manifests, runtime version constants, and the Rust/WASM Kernel;
  source diffs limited to version constants; full validation, TypeScript and
  Rust test suites, MCP smoke, and a local stable bundle/archive/install
  rehearsal (preview, apply, source removal, prefix relocation, installed
  ten-tool MCP) all passed.
• The stable assets are prepared locally only; the stable tag and release are
  created solely by the manually gated Release v0.2 Stable workflow after a
  separate explicit approval.