OH MY PM v0.5.2

OH MY PM v0.5.2

Maintenance release. It fixes one internal architecture problem and adds no
user-facing capability.

The GitHub-backed project workflow was duplicated across presentation adapters.
@oh-my-pm/application already owned a shared GitHub use case, but the MCP
server reimplemented the same pipeline, and the CLI assembled its own Runtime
rather than consuming the shared one.

Everything you can observe is unchanged from v0.5.1. No migration is
required.

Release lineage

Latest published stable, and immutable base	v0.5.1
v0.5.0	superseded, unpublished source candidate — there is no v0.5.0 tag or release
v0.5.2	prepared; not yet published

No existing release tag is moved, replaced, recreated, or deleted. Merging the
v0.5.2 pull request publishes nothing.

What changed

One shared GitHub application use case

CLI and MCP are now genuinely presentation adapters over the same GitHub
workflow, matching the boundary v0.5.1 established for local Markdown workflows.

CLI GitHub adapter ──┐
                     ├──> @oh-my-pm/application GitHub use case
MCP GitHub adapter ──┘         │
                               ├──> injected provider configuration
                               ├──> lazy transport creation
                               ├──> injected clock
                               └──> Runtime / Kernel / Providers / Skills

@oh-my-pm/application owns workflow sequencing, effective provider settings,
repository validation, source selection, limit resolution, fail-closed ordering,
Runtime composition, request construction, execution, and output extraction.
@oh-my-pm/application/node owns the provider-config file load, the optional
token environment read, platform/cwd resolution, real transport construction,
and real clock access.

The adapters keep only what is theirs. The CLI owns its grammar, its
config-path allowance, output-mode selection, terminal formatting, stream
routing, and exit codes. The MCP server owns tool registration, input schemas,
annotations, agent-safe restrictions, strict source projection, structured
content, and protocol stdout safety.

Neither adapter composes a Kernel, Runtime, provider registry, skill registry,
or Node transport any more.

Fail-closed ordering is now enforced by construction

The shared dependency contract became lazy. Provider configuration resolves
first, then the effective repository, then the source selection — and only then
may a transport be created or a clock read.

The previous contract took an eagerly-resolved token, so composing the
dependencies read the environment before any validation ran. The token read now
happens inside the transport factory closure, which the use case invokes only
after every controlled input has validated. An injected transport skips it
entirely, so offline test suites never touch the environment.

A misconfigured call therefore reads no token, opens no transport, and reads no
clock. New tests count those dependency invocations directly.

Caller identity is injected, not assumed

The shared use case hardcoded caller: "mcp". It was only reachable from MCP, so
nothing had broken yet — but routing the CLI through it would have silently
mislabelled every CLI request identity and payload source. caller is now a
required injected value, and both surfaces are covered by tests.

Request identities are unchanged: cli-github-{brief,risks,next,handoff} and
mcp-github-{brief,risks,next,handoff}.

One canonical MCP version

The MCP GitHub runner declared MCP_GITHUB_RUNTIME_VERSION = "0.3.0" against a
0.5.1 source. Consolidating onto a single canonical constant surfaced a second
stale "0.3.0" in the provider diagnostics runner, and two further duplicated
literals in the server and project tool runner.

All four now derive from OH_MY_PM_MCP_VERSION in mcp-server/src/version.ts,
leaving exactly one place for a release bump to touch. These values only ever
fed the outbound user agent and the server handshake, so no observable output
changed.

Boundary guards

New validators keep the duplication from returning: neither GitHub adapter may
name the Kernel/Runtime/provider/skill/transport constructors or resolve
settings and selection itself, both must call the shared use case, the core use
case may not construct a Node transport or read process/clock/filesystem state
or hardcode a caller, and the MCP package may declare only one version literal.

The CLI purity test also got stricter: local-process.ts no longer reads the
environment or builds a transport, so its GitHub boundary exemption is gone and
both CLI GitHub files are held to the strictest rules.

Deterministic release-test execution

CI qualification was intermittently failing on unchanged source, in a different
suite each run. Every Vitest file ran with default file parallelism, so the
release, archive, and installation suites could each build a bundle at the same
time. Because that builder runs pnpm deploy and reads the shared workspace
build output while computing the bundle's internal SHA256SUMS, concurrent
suites could leave a bundle whose manifest no longer matched its own contents —
surfacing as source:sha256sums_checksum_mismatch.

v0.5.2 splits the test topology into a parallel unit project and a serialized
release project, so the release/archive/install suites never run concurrently
with one another or over the same build output. Pure tests keep full
parallelism. A regression guard fails when a new shared-resource suite is not
classified.

Archive utility probing was also wrong in two ways: any spawnSync failure was
reported as a missing prerequisite, so a transient error on a loaded machine
looked like an absent tool, and a utility that ran but exited non-zero counted
as available. Probes now classify as available, genuinely missing (ENOENT), or
probe-failed, with a bounded retry for transient errors only and a distinct
release_archive_prerequisite_probe_failed:<utility> reason. Genuinely missing
tools keep their existing reason.

Release fixture setup hooks now report the command, status, signal, spawn error
code, and bounded output instead of only an exit status.

This is test and CI infrastructure only. No product behavior, release artifact
format, or checksum algorithm changed.

Compatibility

This release is behavior-preserving. Verified by pre/post byte-parity fixtures
across 39 CLI cases and 25 MCP cases, plus a full protocol-surface capture over
real stdio JSON-RPC.

• no new command, no removed command
• no CLI syntax change
• no intentional JSON output change except version-bearing fields
• no MCP tool change, schema change, annotation change, or tool-order change
• no Project Brain schema change (schema 1)
• no Project Memory format change (store format 2)
• no data migration
• no Dashboard
• no npm publication
• no GitHub mutation capability — the provider stays GET-only against a fixed
  origin
• no HTTP MCP transport — stdio only

The twelve read-only MCP tools, zero write tools, eight installed shims, seven
memory subcommands, and the ohmypm-cli-namespace bundle profile are all
unchanged.

Verification

pnpm install --frozen-lockfile
pnpm build:contracts
pnpm build:kernel
pnpm build
pnpm test
pnpm validate
pnpm mcp:smoke
cargo test --workspace
cargo clippy --workspace --all-targets

Publication

v0.5.2 is prepared but unpublished. See
publishing-v0.5.2.md for the gated procedure.