@nanobpm/nano-workforce 0.85.2 → 0.86.0

package/operations/getAgenticVocab.test.ts

@@ -0,0 +1,48 @@
+// Tests for GET /app/api/agentic/vocab → operation `getAgenticVocab` (epic #152 / N1 #145).
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import type { AppApi } from "@nanobpm/urban";
+import { noopLog } from "../test/log.ts";
+import handler from "./getAgenticVocab.ts";
+
+const app = { log: noopLog() } as unknown as AppApi;
+
+function input(headers: Record<string, string> = {}) {
+  return {
+    req: { method: "GET", path: "/app/api/agentic/vocab", query: new URLSearchParams(), headers: new Headers(headers), text: async () => "" } as any,
+    params: {},
+    query: {},
+    body: undefined,
+  };
+}
+
+test("returns 200 with the published crew vocab view", async () => {
+  const res = (await handler(input(), app)) as any;
+  assertEquals(res.status, 200);
+  assert(typeof res.body.version === "number");
+  assert("planning" in res.body.networks, "networks tree is published");
+  const spar = res.body.requirements.find((r: any) => r.token === "planning.spar");
+  assert(spar !== undefined);
+  assertEquals(spar.seatsDistinctFamily, true);
+  assertEquals(spar.seats, ["red", "blue"]);
+  assert(spar.requires.includes("cognition=planning"));
+});
+
+test("shared-secret guard rejects a missing secret when configured", async () => {
+  // The delegate captures the secret at import time, so re-import a cache-busted copy with the env
+  // var set to exercise the guarded 401 path and the authorized 200 path.
+  const prev = process.env["NANO_PR_WEBHOOK_SECRET"];
+  process.env["NANO_PR_WEBHOOK_SECRET"] = "s3cr3t";
+  try {
+    const mod = await import(`./getAgenticVocab.ts?guard=${Date.now()}`);
+    const guarded = mod.default as typeof handler;
+    const bad = (await guarded(input(), app)) as any;
+    assertEquals(bad.status, 401);
+    const ok = (await guarded(input({ "x-hook-secret": "s3cr3t" }), app)) as any;
+    assertEquals(ok.status, 200);
+    assert(typeof ok.body.version === "number");
+  } finally {
+    if (prev === undefined) delete process.env["NANO_PR_WEBHOOK_SECRET"];
+    else process.env["NANO_PR_WEBHOOK_SECRET"] = prev;
+  }
+});

package/operations/getAgenticVocab.ts

@@ -0,0 +1,20 @@
+// GET /app/api/agentic/vocab → operationId `getAgenticVocab` (enrolment epic #152 / N1 #145, ADR 0059
+// revised). Publishes the crew vocabulary artifact — the ONE capability→token map a worker resolves
+// its SERVE set against — as `{ networks, requirements, version }`. Read-only and advisory; it never
+// gates control flow.
+//
+// The optional shared-secret guard stays HERE (the runtime does not enforce OpenAPI `security`): when
+// NANO_PR_WEBHOOK_SECRET is set, callers must present it via the x-hook-secret header. Unset → open.
+import { vocabView } from "../app/agentic/vocab/publish.ts";
+import { envVar } from "../app/version.ts";
+import { defineOperation } from "../nano-generated/operations.ts";
+
+const SECRET = envVar("NANO_PR_WEBHOOK_SECRET") ?? "";
+
+export default defineOperation("getAgenticVocab", ({ req }, app) => {
+  if (SECRET && req.headers.get("x-hook-secret") !== SECRET) {
+    app.log.warn("getAgenticVocab rejected: missing/invalid shared secret");
+    return { status: 401, body: { error: "unauthorized" } };
+  }
+  return { status: 200, body: vocabView() };
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.85.2",
+  "version": "0.86.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/board/board.css

@@ -0,0 +1,119 @@
+:root {
+  color-scheme: dark;
+}
+
+.board {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  color: #d7e0ea;
+  background: #0b0f14;
+  min-height: 100%;
+  box-sizing: border-box;
+  padding: 16px;
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+.board-head {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
+.board .card {
+  background: #121821;
+  border: 1px solid #223042;
+  border-radius: 10px;
+  padding: 14px 16px;
+}
+
+.board h2 {
+  margin: 0 0 8px;
+  font-size: 15px;
+  font-weight: 600;
+}
+
+.board .networks {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
+  gap: 14px;
+}
+
+.board table.grid {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 13px;
+}
+
+.board table.grid th,
+.board table.grid td {
+  text-align: left;
+  padding: 6px 8px;
+  border-bottom: 1px solid #1c2735;
+  vertical-align: top;
+}
+
+.board table.grid th {
+  color: #8aa0b8;
+  font-weight: 500;
+}
+
+.board td.num,
+.board th.num {
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+}
+
+.board code {
+  background: #0d141d;
+  border: 1px solid #223042;
+  border-radius: 4px;
+  padding: 1px 5px;
+  font-size: 12px;
+}
+
+.board .muted {
+  color: #6b7f95;
+}
+
+.board .red {
+  color: #ff6b6b;
+}
+
+.board .row-missing {
+  background: rgba(255, 107, 107, 0.06);
+}
+
+.pill {
+  display: inline-block;
+  border-radius: 999px;
+  padding: 1px 9px;
+  font-size: 11px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+.pill-green {
+  background: rgba(63, 185, 80, 0.18);
+  color: #56d364;
+  border: 1px solid rgba(63, 185, 80, 0.4);
+}
+
+.pill-amber {
+  background: rgba(210, 153, 34, 0.18);
+  color: #e3b341;
+  border: 1px solid rgba(210, 153, 34, 0.4);
+}
+
+.pill-red {
+  background: rgba(248, 81, 73, 0.18);
+  color: #ff7b72;
+  border: 1px solid rgba(248, 81, 73, 0.4);
+}
+
+.pill-unknown {
+  background: rgba(139, 148, 158, 0.18);
+  color: #8b949e;
+  border: 1px solid rgba(139, 148, 158, 0.4);
+}

package/pages/board/embed.html

@@ -0,0 +1,30 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Demand × supply board (App View embed)</title>
+    <link rel="stylesheet" href="./board.css" />
+    <style>
+      html, body { margin: 0; height: 100%; background: #0b0f14; }
+    </style>
+  </head>
+  <body>
+    <!--
+      Console App-View embed (ADR 0057). The console loads this document into its App-View surface and
+      hands it a host element; we mount the SAME demand×supply board via the SAME ./mount.js as the
+      standalone shell — only the host and the injected endpoint config differ, so the page renders
+      identically. When the console injects endpoint config via `window.__NANO_APP_VIEW__`, it wins.
+    -->
+    <main id="board-root"></main>
+    <script type="module">
+      import { mountBoard } from "./mount.js";
+
+      const cfg = window.__NANO_APP_VIEW__ ?? {};
+      mountBoard(cfg.host ?? document.getElementById("board-root"), {
+        reportUrl: cfg.reportUrl,
+        hookSecret: cfg.hookSecret,
+      });
+    </script>
+  </body>
+</html>

package/pages/board/mount.js

@@ -0,0 +1,131 @@
+// pages/board/mount.js — the demand×supply board (enrolment epic #152 / N2 #153, ADR 0056 §8–10,
+// ADR 0057 App View).
+//
+// A self-contained, dependency-free renderer: it polls the app's `GET /app/api/agentic/registry`
+// report and paints the demand×supply matrix by network, the missing-agent-type reds, and the
+// diversity-SLO lights. The SAME module renders embedded in the console (App View) and standalone on
+// a phone — only the host element and the injected endpoint config differ. Read-only and advisory;
+// it never gates a BPMN flow.
+//
+// The app has no browser build step, so the report projection is consumed straight off the wire
+// (the typed core that produces it lives app-side in `app/agentic/vocab/demand-report.ts`); this
+// module only renders it.
+
+const DEFAULT_REPORT_URL = "/app/api/agentic/registry";
+const POLL_MS = 5000;
+
+/** Escape untrusted report strings before they touch innerHTML. */
+function esc(value) {
+  return String(value ?? "").replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch]);
+}
+
+/** A status pill (green / amber / red) with a label. */
+function pill(status, label) {
+  const s = status === "green" || status === "amber" || status === "red" ? status : "unknown";
+  return `<span class="pill pill-${s}">${esc(label ?? s)}</span>`;
+}
+
+function renderDiversity(diversity) {
+  if (!diversity) return "";
+  const rows = (diversity.roles ?? [])
+    .map((role) => {
+      const seats = (role.assignments ?? [])
+        .map((a) => `<code>${esc(a.seat)}</code>=${esc(a.family)}${a.instance ? ` <span class="muted">(${esc(a.instance)})</span>` : ""}`)
+        .join(" · ");
+      const strict = role.seatsDistinctFamily ? '<span class="muted">strict</span>' : '<span class="muted">warn</span>';
+      const collide = (role.collidingFamilies ?? []).length ? ` — <span class="red">collision: ${esc(role.collidingFamilies.join(", "))}</span>` : "";
+      return `<tr>
+        <td>${pill(role.status)}</td>
+        <td><code>${esc(role.token)}</code> ${strict}</td>
+        <td>${seats || '<span class="muted">no seated workers</span>'}${collide}</td>
+      </tr>`;
+    })
+    .join("");
+  return `<section class="card">
+    <h2>Diversity SLO ${pill(diversity.status)}</h2>
+    <p class="muted">Seat families per role — the red/blue seats want distinct families (ADR 0056 §10). A same-family collision on a strict role is a violation (red).</p>
+    ${rows ? `<table class="grid"><thead><tr><th>SLO</th><th>Role</th><th>Seats</th></tr></thead><tbody>${rows}</tbody></table>` : '<p class="muted">No gradeable roles are seated yet.</p>'}
+  </section>`;
+}
+
+function renderNetwork(network) {
+  const rows = (network.tokens ?? [])
+    .map((token) => {
+      const status = token.satisfied ? "green" : "red";
+      const instances = (token.instances ?? []).length ? esc(token.instances.join(", ")) : '<span class="muted">—</span>';
+      return `<tr class="${token.satisfied ? "" : "row-missing"}">
+        <td>${pill(status, token.satisfied ? "supplied" : "missing")}</td>
+        <td><code>${esc(token.token)}</code></td>
+        <td class="num">${esc(token.supply)}</td>
+        <td>${instances}</td>
+      </tr>`;
+    })
+    .join("");
+  const missing = (network.missing ?? []).length
+    ? `<p class="red">Missing agent types: ${network.missing.map((m) => `<code>${esc(m)}</code>`).join(", ")}</p>`
+    : '<p class="muted">All demanded tokens supplied.</p>';
+  return `<section class="card">
+    <h2><code>${esc(network.network)}</code></h2>
+    <table class="grid"><thead><tr><th>Supply</th><th>Token</th><th class="num">#</th><th>Instances</th></tr></thead><tbody>${rows}</tbody></table>
+    ${missing}
+  </section>`;
+}
+
+function render(root, report) {
+  const networks = report.networks ?? [];
+  const overall = pill(report.status, `overall: ${report.status}`);
+  const demandNote = report.demandUnavailable
+    ? '<p class="red">Demand unavailable — the deployed models could not be read from the engine, so this reflects live supply only.</p>'
+    : "";
+  const missingAll = (report.missing ?? []).length
+    ? `<p class="red">Missing across all networks: ${report.missing.map((m) => `<code>${esc(m)}</code>`).join(", ")}</p>`
+    : '<p class="muted">No missing agent types.</p>';
+  const body = networks.length
+    ? networks.map(renderNetwork).join("")
+    : '<section class="card"><p class="muted">No demand to show.</p></section>';
+  root.innerHTML = `<div class="board">
+    <header class="board-head">
+      <div>${overall} <span class="muted">vocab v${esc(report.version)} · ${esc(report.generatedAt)}</span></div>
+      ${missingAll}
+      ${demandNote}
+    </header>
+    ${renderDiversity(report.diversity)}
+    <div class="networks">${body}</div>
+  </div>`;
+}
+
+function renderError(root, message) {
+  root.innerHTML = `<div class="board"><section class="card"><p class="red">Failed to load the demand×supply report: ${esc(message)}</p></section></div>`;
+}
+
+/**
+ * Mount the board into `host`, polling the registry report. `config.reportUrl` overrides the default
+ * endpoint; `config.hookSecret` is sent as `x-hook-secret` for a secured deployment.
+ */
+export function mountBoard(host, config = {}) {
+  const isElement = host != null && host.nodeType === 1 && typeof host.innerHTML === "string";
+  const root = isElement ? host : document.getElementById("board-root");
+  if (!root) return () => {};
+  const reportUrl = config.reportUrl ?? DEFAULT_REPORT_URL;
+  const headers = config.hookSecret ? { "x-hook-secret": config.hookSecret } : {};
+  let stopped = false;
+  let timer = null;
+
+  async function tick() {
+    try {
+      const res = await fetch(reportUrl, { headers });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const report = await res.json();
+      if (!stopped) render(root, report);
+    } catch (err) {
+      if (!stopped) renderError(root, err && err.message ? err.message : String(err));
+    }
+    if (!stopped) timer = setTimeout(tick, POLL_MS);
+  }
+  tick();
+
+  return () => {
+    stopped = true;
+    if (timer) clearTimeout(timer);
+  };
+}

package/pages/board/standalone.html

@@ -0,0 +1,37 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <title>Demand × supply board</title>
+    <link rel="stylesheet" href="./board.css" />
+    <style>
+      html, body { margin: 0; height: 100%; background: #0b0f14; }
+    </style>
+  </head>
+  <body>
+    <!--
+      Standalone shell (phone / direct link). Loads the SAME ./mount.js the console App-View embed
+      uses, so the standalone and embedded views render identically. Endpoints default to the current
+      origin; override the report endpoint via ?report=. For a secured deployment, pass the report
+      guard secret via the URL fragment #secret= (sent as x-hook-secret) — NOT the query string, so it
+      never leaks via server access logs, browser history, or the Referer header. The fragment is
+      stripped from the address bar immediately after it is read.
+    -->
+    <main id="board-root"></main>
+    <script type="module">
+      import { mountBoard } from "./mount.js";
+
+      const params = new URLSearchParams(location.search);
+      const secrets = new URLSearchParams(location.hash.slice(1));
+      const hookSecret = secrets.get("secret") ?? undefined;
+      if (location.hash) {
+        history.replaceState(null, "", location.pathname + location.search);
+      }
+      mountBoard(document.getElementById("board-root"), {
+        reportUrl: params.get("report") ?? undefined,
+        hookSecret,
+      });
+    </script>
+  </body>
+</html>

package/pages/board.page.json

@@ -0,0 +1,51 @@
+{
+  "schemaVersion": "1.0",
+  "title": "Board",
+  "nodes": [
+    {
+      "type": "nav",
+      "id": "nav",
+      "props": {
+        "variant": "bar",
+        "title": "Nano Workforce",
+        "items": [
+          { "label": "Overview", "page": "overview" },
+          { "label": "Lineage", "page": "lineage" },
+          { "label": "Convergence", "page": "home" },
+          { "label": "Epics", "page": "epic" },
+          { "label": "Feature", "page": "feature" },
+          { "label": "Tasks", "page": "tasks" },
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
+        ],
+        "sticky": true
+      }
+    },
+    {
+      "type": "text",
+      "id": "title",
+      "props": {
+        "text": "Demand \u00d7 supply board",
+        "variant": "heading"
+      }
+    },
+    {
+      "type": "text",
+      "id": "intro",
+      "props": {
+        "text": "The enrolment epic's demand\u00d7supply matrix: what the deployed models DEMAND (their taskDefinition leaves) diffed against live SUPPLY (the connected workers, resolved through the crew vocabulary), grouped by network. Missing agent types \u2014 a demanded leaf with no supplier \u2014 light RED, and the diversity SLO grades the red/blue seats (green when the seats are distinct families, red on a same-family collision). Read-only and advisory; it never gates a BPMN flow. The same view renders embedded here (App View) and standalone on a phone.",
+        "variant": "sub"
+      }
+    },
+    {
+      "type": "appView",
+      "id": "board",
+      "props": {
+        "title": "Demand \u00d7 supply",
+        "embed": "./board/embed.html",
+        "standalone": "./board/standalone.html",
+        "fill": true
+      }
+    }
+  ]
+}

package/pages/cockpit/embed.html

@@ -32,6 +32,7 @@
       const cfg = window.__NANO_APP_VIEW__ ?? {};
       mountCockpit(cfg.host ?? document.getElementById("cockpit-root"), {
         reportUrl: cfg.reportUrl,
+        transcriptsUrl: cfg.transcriptsUrl,
         relayUrl: cfg.relayUrl,
         hookSecret: cfg.hookSecret,
         relayToken: cfg.relayToken,

package/pages/cockpit/mount.js

@@ -318,7 +318,8 @@ function relaySocketFactory(url) {
  *
  * @param {Element} host — where the cockpit renders (standalone: document.body; embedded: the App-View host).
  * @param {object} [opts]
- * @param {string} [opts.reportUrl] — the supply JSON endpoint the app serves.
+ * @param {string} [opts.reportUrl] — the supply JSON endpoint the app serves (default
+ *   `"app/api/agentic/supply"`, base-relative).
  * @param {string} [opts.relayUrl]  — the agentic channel WebSocket URL (with auth token + capability query).
  * @param {string} [opts.hookSecret] — shared secret sent as `x-hook-secret` on the report fetch when the
  *   app's supply endpoint is guarded by NANO_PR_WEBHOOK_SECRET (omit for open deployments).
@@ -329,8 +330,8 @@ function relaySocketFactory(url) {
  *   least this many ms old (default 15000).
  * @param {number} [opts.pastFetchTimeoutMs] — upper bound (ms) on a single past-sessions transcripts
  *   fetch; the fetch is aborted past this so a hung endpoint can't wedge the past panel (default 15000).
- * @param {string} [opts.transcriptsUrl] — the captured-session list endpoint (default
- *   /app/api/agentic/transcripts) backing the always-on "past sessions" history + replay.
+ * @param {string} [opts.transcriptsUrl] — the captured-session list endpoint backing the always-on
+ *   "past sessions" history + replay (default `"app/api/agentic/transcripts"`, base-relative).
  * @returns a handle with `.dispose()`.
  */
 export function mountCockpit(host, opts = {}) {
@@ -340,8 +341,16 @@ export function mountCockpit(host, opts = {}) {
     );
   }
   const doc = document;
-  const reportUrl = opts.reportUrl ?? "/app/api/agentic/supply";
-  const transcriptsUrl = opts.transcriptsUrl ?? "/app/api/agentic/transcripts";
+  // Base-relative defaults (no leading slash) so the browser resolves them against the document's
+  // baseURI. Standalone (served at the app root) this is the origin root; through the Studio console
+  // App-View the document base is the app-view path (`/console/app-view/<AppName>/`) while the iframe
+  // ORIGIN is the console (:8080) — an absolute (leading-slash) path would resolve against the console
+  // origin root (`:8080/app/api/agentic/supply` → 404) instead of the app-view base that proxies the
+  // API, leaving the cockpit empty (#279). A base-relative default lands on the right endpoint both
+  // ways, so the cockpit populates identically standalone and embedded even though the console never
+  // injects window.__NANO_APP_VIEW__.
+  const reportUrl = opts.reportUrl ?? "app/api/agentic/supply";
+  const transcriptsUrl = opts.transcriptsUrl ?? "app/api/agentic/transcripts";
   const hookSecret = opts.hookSecret;
   const relayUrl = opts.relayUrl ?? defaultRelayUrl(opts.relayToken, opts.relayCapability);
   const refreshMs = opts.refreshMs ?? DEFAULT_REFRESH_MS;

package/pages/cockpit/standalone.html

@@ -31,15 +31,25 @@
       import { mountCockpit } from "./mount.js";
 
       // Standalone: mount into the page body. Endpoints default to the current origin; override via
-      // ?report= and ?relay= for a remote app. For a secured deployment, pass the report guard secret
-      // via ?secret= (sent as x-hook-secret) and the relay credentials via ?token= and ?capability=.
+      // ?report= and ?relay= for a remote app. For a secured deployment, pass the sensitive
+      // credentials via the URL fragment — the report guard secret via #secret= (sent as
+      // x-hook-secret) and the relay credentials via #token= and #capability= — NOT the query string,
+      // so they never leak via server access logs, browser history, or the Referer header. The
+      // fragment is stripped from the address bar immediately after it is read.
       const params = new URLSearchParams(location.search);
+      const secrets = new URLSearchParams(location.hash.slice(1));
+      const hookSecret = secrets.get("secret") ?? undefined;
+      const relayToken = secrets.get("token") ?? undefined;
+      const relayCapability = secrets.get("capability") ?? undefined;
+      if (location.hash) {
+        history.replaceState(null, "", location.pathname + location.search);
+      }
       mountCockpit(document.getElementById("cockpit-root"), {
         reportUrl: params.get("report") ?? undefined,
         relayUrl: params.get("relay") ?? undefined,
-        hookSecret: params.get("secret") ?? undefined,
-        relayToken: params.get("token") ?? undefined,
-        relayCapability: params.get("capability") ?? undefined,
+        hookSecret,
+        relayToken,
+        relayCapability,
       });
     </script>
   </body>

package/pages/cockpit.page.json

@@ -15,7 +15,8 @@
           { "label": "Epics", "page": "epic" },
           { "label": "Feature", "page": "feature" },
           { "label": "Tasks", "page": "tasks" },
-          { "label": "Cockpit", "page": "cockpit" }
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
         ],
         "sticky": true
       }

package/pages/epic-detail.page.json

@@ -16,7 +16,8 @@
           { "label": "Epics", "page": "epic" },
           { "label": "Feature", "page": "feature" },
           { "label": "Tasks", "page": "tasks" },
-          { "label": "Cockpit", "page": "cockpit" }
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
         ]
       }
     },

package/pages/epic.page.json

@@ -16,7 +16,8 @@
           { "label": "Epics", "page": "epic" },
           { "label": "Feature", "page": "feature" },
           { "label": "Tasks", "page": "tasks" },
-          { "label": "Cockpit", "page": "cockpit" }
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
         ]
       }
     },

package/pages/feature.page.json

@@ -16,7 +16,8 @@
           { "label": "Epics", "page": "epic" },
           { "label": "Feature", "page": "feature" },
           { "label": "Tasks", "page": "tasks" },
-          { "label": "Cockpit", "page": "cockpit" }
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
         ]
       }
     },

package/pages/home.page.json

@@ -36,6 +36,10 @@
           {
             "label": "Cockpit",
             "page": "cockpit"
+          },
+          {
+            "label": "Board",
+            "page": "board"
           }
         ],
         "sticky": true

package/pages/lineage.page.json

@@ -15,7 +15,8 @@
           { "label": "Epics", "page": "epic" },
           { "label": "Feature", "page": "feature" },
           { "label": "Tasks", "page": "tasks" },
-          { "label": "Cockpit", "page": "cockpit" }
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
         ],
         "sticky": true
       }

package/pages/overview.page.json

@@ -16,7 +16,8 @@
           { "label": "Epics", "page": "epic" },
           { "label": "Feature", "page": "feature" },
           { "label": "Tasks", "page": "tasks" },
-          { "label": "Cockpit", "page": "cockpit" }
+          { "label": "Cockpit", "page": "cockpit" },
+          { "label": "Board", "page": "board" }
         ]
       }
     },

package/pages/tasks.page.json

@@ -36,6 +36,10 @@
           {
             "label": "Cockpit",
             "page": "cockpit"
+          },
+          {
+            "label": "Board",
+            "page": "board"
           }
         ]
       }