[github-actions]

Closes #1858. Submitted by @ActiveChooN.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1858.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Kanban needs one Git-installation fix before publication, @ActiveChooN. I pinned your source, completed activechoon/kanban-md with your categories and attribution, and removed the intake file. Your overview, description and three interface images are retained.

Please add this field to the root paseo-plugin.json, push the revision, and reply here with its branch or commit:

"build": [["npm", "ci", "--omit=dev", "--ignore-scripts"]]

server/reads.ts imports yaml, but Git installation does not automatically install npm dependencies. Your npm-shrinkwrap.json already locks it; the missing preparation command leaves it unavailable in a fresh installation. Verify the command and Git installation before replying. Git preparation guidance. No new screenshot or overview is needed.

Review data

• Main REVIEW.md blob: 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Completed registry head: dfe6ac8 (full SHA in PR history). Read the PR, full discussion and submission #1858. Repository owner, commit author and submitter share GitHub API account ID 8168727.
• Artifact: root of https://github.com/ActiveChooN/kanban-md-paseo.git, exact main commit 77a9190cabd40fd87cc041594e88ad17aba3f793, version 0.1.0. Fetched without hooks/submodules; checked all archive member paths/types before confined extraction. Archive SHA-256: ee828aff7842fdb2e1776fd5ecc2703d94f2f56a0ca5a786c98292022db7870f.
• Inspected manifest/package/shrinkwrap, both entries, all server/shared modules, client launch/query/draft/activity flows and UI access/execution paths, README, overview and three images. Runtime entry/local import files are present. No plugin or dependency installed, built, imported or executed.
• Packaging: server/reads.ts:6 imports YAML at entry loading; the manifest has no build. Paseo's Git acquisition checks out the tree and returns its manifest build commands, without an implicit npm install; server host modules provide SDKs and Zod, not YAML. This is a source-derived installation defect, not a claimed live test failure. Shrinkwrap v3 has 319 entries; all dependency entries have npm-registry resolved sources and integrity. YAML 2.9.1 is the sole production dependency and has no dependencies or install-script flag. The development-only fsevents install flag is not relevant to the proposed omit-dev, ignore-scripts preparation. YAML's implementation has not been separately audited; dependency review and fresh-install verification remain incomplete while this artifact is blocked.
• Files/execution: server/board.ts derives canonical board paths from registered project roots, resolving symlinks. server/reads.ts reads board config; ticket operations use the existing kanban-md executable. server/cli.ts:93 uses execFile with fixed executable, argv, shell disabled, timeout and output limit. Mutations check ticket revisions and serialize by physical board; uncertain writes require refresh. No direct ticket deletion, shell evaluation, software installer or independent network/credential collection found in these inspected paths. External kanban-md behavior remains outside this artifact review.
• Agent/data flows: server/launch.ts:183 handles explicit launch RPCs, validates host/project/workspace/ticket revision, claim/block state and provider/model, then creates an agent in the selected current/new workspace. UI uses provider default permissions; prompt delivery has a retained identity/recovery path. Ticket content and user instructions go to that agent's configured provider. Agent actions remain governed by provider permissions; instructions to respect claims are not enforcement of the external agent's behavior. Attachment search reads canonical boards across all registered projects, returns at most 20 snapshots and includes up to 12,000 description characters. No automatic claim, completion, push or merge call found.
• Listing: English description and shipped OVERVIEW.md retained, no translations. Viewed all three sample-data images, corresponding immutable raw URLs return HTTP 200 image/png. Overview discloses CLI/Git requirements and provider-bound prompts. Optional future clarification: note that attachment search spans project boards and launch recovery details persist in tab state, matching the README/runtime.
• Registry edits: exact root Git pin, requested categories, original issue time/submitter; removed submissions/1858.json. Trusted current-main changed-record online validation passed after commit: 465 well-formed records, one pinned match, zero skipped. Registry machinery matches main. Validation passing does not supply the missing preparation command. No approval or merge, listing remains unpublished. No factory-policy conflict or credible serious safety hold identified.
• Limits: static review only; no live UI/CLI, agent/provider execution or Git installation was run. Required author action is the manifest preparation change above; ordinary overview clarifications are next-release advice.

[ActiveChooN]

1b80b3bf8dc8e42d07ed45a843b03a7a77ed5d22

[paseo-bot]

Kanban is approved, @ActiveChooN. Your new revision adds the locked Git preparation command and clarifies cross-project attachment search and saved launch instructions. I updated the registry pin to that revision and retained your description, overview and three images. Nothing else is required from you.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head f67c34d718b2dd19d2f03bf7ae6d7ca29a4c9a9e. Read the full PR discussion and submission #1858, including the author's requested replacement commit. API account IDs for submission author, repository owner and replacement commit author all match 8168727.
• Artifact: root of https://github.com/ActiveChooN/kanban-md-paseo.git, exact requested commit 1b80b3bf8dc8e42d07ed45a843b03a7a77ed5d22, package version 0.1.0. Fetched both original and replacement commits without hooks/submodules; checked archive paths/types before confined extraction. Archive SHA-256 old ee828aff7842fdb2e1776fd5ecc2703d94f2f56a0ca5a786c98292022db7870f, new 3f67171381029f497ee2260519ceef4331a57856e7f2cd8f7c31f6128b384a7f.
• Independently compared trees: only OVERVIEW.md and paseo-plugin.json changed. The new build is exactly npm ci --omit=dev --ignore-scripts, consuming the committed npm-shrinkwrap.json. Root dependency/devDependency declarations match package.json; all 318 dependency entries have exact versions, npm-registry resolved sources and integrity. YAML 2.9.1 is the sole production dependency, with no transitive dependencies or acquisition lifecycle hooks. No invoked local build script. Development tools and their marked hooks are omitted/suppressed. This supplies the missing Git dependency preparation; no plugin/dependency installation or execution was performed.
• Independently fetched and SHA-512-verified the locked YAML tarball. SHA-256 4ef6c54cf559b8a207b7b518378230805a1c84af239b14960e8c67c7d59de5d3. Read metadata, parse entry and built-in tag selection; the plugin calls ordinary YAML.parse with no custom executable tags. This is not an exhaustive parser audit. Required runtime entries/local source remain present and unchanged from the prior review.
• Rechecked server entry, canonical board resolution, config reads, CLI invocation, mutation serialization/revision checks, complete launch path, cross-project attachment search and client launch submission/recovery flow. CLI uses fixed kanban-md with argv, shell disabled, timeout/output bounds. Writes are ticket operations on resolved project boards; uncertain writes require refresh. Launch revalidates host/project/workspace, ticket revision, claim/block and provider/model before explicit creation; the UI uses provider-default permissions. Ticket content and instructions reach that agent's provider. Prompt instructions about claims do not enforce the external agent's behavior. No automatic claim, completion, push/merge, software installer or independent credential collector found in those paths.
• Attachment search reads canonical boards across registered projects, returning at most 20 snapshots with at most 12,000 description characters each. Complete launch input is saved before creation for recovery. The revised English author overview now explains both; no translations. All three shipped sample-data interface images were viewed and retained. Requirements remain Paseo ^0.13.2, ^0.14.0 or ^0.15.0, Node >=24 from package metadata, kanban-md 0.39.x and Git for worktree launches.
• Registry edit: replaced both Git commit fields with the author's requested revision and refreshed review/publication dates. Categories and attribution remain; intake was already removed. Trusted current-main online changed-record validation passed after commit, one pinned artifact match and zero skipped; matching trusted registry tests passed (189). Exact-head CI checked before merge. No factory-policy incompatibility or serious safety hold found.
• Limits: static artifact review, no fresh Git installation, npm preparation, kanban-md command, live UI or agent/provider execution. Unchanged presentation/draft helpers retain the earlier review evidence; the external kanban-md executable and agent/provider implementations were not audited here.