Gate CI on durable PM tracker health with pm 2026.8.6 - #29

Summary by CodeRabbit

• Bug Fixes

  • CI now performs strict project health checks immediately after installing dependencies.
  • Builds fail when tracked-state integrity issues are detected, helping prevent inconsistent changes from passing validation.
  • Merge configuration is handled more reliably, with missing setup reported as a warning instead of an unexpected failure.

• Documentation

  • Added an unreleased changelog entry describing the new CI integrity gating.

• Chores

  • Updated project maintenance tooling to improve health-check validation.

Walkthrough

The CI workflow runs pm health --strict-exit after dependency installation. CI fails when strict health findings occur. PM metadata, history, changelog, merge attributes, and development dependency versions document and support the gate.

Changes

CI integrity gate

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI
  participant npm
  participant PMHealth
  participant TrackedState
  CI->>npm: Install dependencies with npm ci
  CI->>PMHealth: Run pm health --strict-exit
  PMHealth->>TrackedState: Check tracked PM project health
  PMHealth-->>CI: Return success or failure

Possibly related issues

• Merge-decision receipts are clone-local and gitignored, so a commit that silently discarded a peer agent's edit passes pm health --strict-exit in CI pm-cli#922: The PR documents the clone-local merge-receipt limitation described by this issue but does not implement its proposed fix.
• Fresh-clone CI loses pending merge receipts; history-repair makes a lossy merge pass pm health --strict-exit pm-cli#921: The PR implements CI gating with pm health --strict-exit and documents the fresh-clone receipt limitation.

Possibly related PRs

• unbraind/pm-github#5: Its PM metadata and merge-driver changes relate directly to this PR’s merge configuration and health gate.
• unbraind/pm-github#23: Both PRs update the @unbrained/pm-cli dependency in package.json.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Reviewer's Guide

Adds a CI gate that runs pm health --strict-exit to fail builds when there are unresolved pm merge decisions, plus documents the change in the changelog and records a corresponding pm chore/history entry.

File-Level Changes

Greptile Summary

This PR adds a strict CI health gate for durable, checkout-visible PM tracker failures while explicitly documenting that clone-local merge receipts cannot provide lossless CI attestation.

• Runs pm health --strict-exit after dependency installation.
• Updates PM tooling and lockfile resolutions to 2026.8.6.
• Records the corrected gate boundary in the PM tracker and changelog.
• Adds merge attributes for managed PM extensions.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported fresh-checkout receipt limitation is now explicitly and consistently documented.

_{Reviews (6): Last reviewed commit: "docs(ci): resolve exact-head health-gate..." | Re-trigger Greptile}

Correction pushed — re-review please.

@coderabbitai full review
@greptileai

Greptile's P1 was correct and is the reason for this push. The gate does not detect a
silently discarded peer edit, and cannot as built: merge-decision receipts live in the
gitignored .agents/pm/runtime/, so a fresh CI checkout has none. Verified on the same
commit — merge clone exits 1, fresh clone exits 0. Filed upstream as
pm-cli#922.

What changed: the overstated claim was removed everywhere it appeared — the step name
(now "Verify pm tracker integrity"), its comment, the tracker item, and this PR's title
and body. The step itself is kept for what it genuinely catches in a fresh checkout.

What is worth checking this round:

• Does the new comment now describe the gate accurately, without under- or
  over-claiming? It deliberately spells out what the step does not cover; if any part of
  that reads as still too confident, say so.
• Is --strict-exit genuinely sufficient to make the step fail on the conditions listed,
  or is there a health condition that reports warn without flipping ok and therefore
  passes silently?
• Anything else in this repo where a check's evidence lives in gitignored or clone-local
  state — that is the general pattern behind the P1 and it would be valuable to know if it
  appears elsewhere.

GitHub Actions is under a critical outage, so the checks here are absent for external
reasons; pm health --strict-exit and the full release:check were run locally.

Rate Limit Exceeded

@unbraind have exceeded the limit for the number of chat messages per hour. Please wait 17 minutes and 7 seconds before sending another message.

Fresh exact-head review requested for d3cd9cb5215712686858b0e9caba952b6b97f3bf after reconciling the concurrent correction, updating to pm CLI/SDK 2026.8.6, and rerunning package gates.

@greptileai
/gemini review
@coderabbitai full review

@unbraind: I will perform a full review of PR #29 at commit d3cd9cb5215712686858b0e9caba952b6b97f3bf.

Exact-head disposition for a590780c101cd63d0bcbd863ba86aec41dd2a407:

• accepted and fixed the attribution overclaim;
• added stale in-progress work to the documented failing conditions;
• linked the workflow and changelog on the canonical PM item;
• distinguished pm-cli #921 (repair bypass) from #922 (directly green fresh-clone shape);
• reran pm health --strict-exit and changelog:check (plus pm-vcs self-host verification where applicable).

Every inline bot finding has been reacted to and answered in-thread. CodeRabbit rate-limit messages are recorded as review limitations, not approvals.

@greptileai
/gemini review
@coderabbitai full review

Rate Limit Exceeded

@unbraind have exceeded the limit for the number of chat messages per hour. Please wait 13 minutes and 33 seconds before sending another message.