create-pmos 0.131.0 → 0.133.0

package/workspace/lib/routes-sources.js

@@ -0,0 +1,64 @@
+'use strict';
+/* routes-sources.js — how old each source of a workspace is, and Refresh now (workspace-data-freshness R6, R7).
+ *
+ *   GET  /api/sources?ws=<id>                → { ok, ws, version, sources: [row] }   lib/freshness.js sources()
+ *   POST /api/sources/refresh { ws, source } → { ok, source, started: 'rebuild'|'session', session? }
+ *   POST /api/sources/watch   { ws, on }     → { ok, watch }   the change detector on or off for this repository
+ *
+ * Both POSTs pass pm-guard requirePagePress: the PM's press from the page. An agent session cannot start a refresh or
+ * switch the detector off. A refresh of `repository` or `initiatives` rebuilds the facts in a child process; a refresh of
+ * an external source starts that source's skill as a session in the workspace, with the PM's own connections. The server
+ * itself calls nothing outside this machine.
+ */
+const guard = require('./pm-guard.js');
+const freshness = require('./freshness.js');
+
+function wsOf(ctx, id) {
+  const w = ctx.getWs(id || '');
+  return w && (!id || w.id === id) ? w : null;
+}
+const repoStateDir = (ctx, w) => { try { return ctx.stateDirFor ? ctx.stateDirFor(w) : null; } catch { return null; } };
+
+async function handle(req, res, url, ctx) {
+  const p = url.pathname;
+  const F = ctx.freshness;
+  if (!F) return false;
+  if (p === '/api/sources') {
+    if (req.method !== 'GET') { ctx.json(res, { ok: false, error: 'GET only' }, 405); return true; }
+    const w = wsOf(ctx, url.searchParams.get('ws'));
+    if (!w) { ctx.json(res, { ok: false, error: 'no such workspace' }, 404); return true; }
+    const sources = F.sources({ id: w.id, root: w.root, repoStateDir: repoStateDir(ctx, w) });
+    ctx.json(res, { ok: true, ws: w.id, version: F.versions()[w.id] || 0, sources });
+    return true;
+  }
+  if (p !== '/api/sources/refresh' && p !== '/api/sources/watch') return false;
+  if (req.method !== 'POST') { ctx.json(res, { ok: false, error: 'POST only' }, 405); return true; }
+  const got = await ctx.readJson(req);
+  if (!got.ok) { ctx.json(res, { ok: false, error: 'the body is not JSON' }, 400); return true; }
+  const body = got.body || {};
+  const g = guard.requirePagePress(req, body);
+  if (!g.ok) { ctx.json(res, { ok: false, error: g.error }, g.status); return true; }
+  const w = wsOf(ctx, typeof body.ws === 'string' ? body.ws : '');
+  if (!w) { ctx.json(res, { ok: false, error: 'no such workspace' }, 404); return true; }
+
+  if (p === '/api/sources/watch') {
+    if (typeof body.on !== 'boolean') { ctx.json(res, { ok: false, error: 'on must be true or false' }, 400); return true; }
+    if (!F.setEnabled(w.root, body.on)) { ctx.json(res, { ok: false, error: 'the setting could not be saved' }, 500); return true; }
+    ctx.json(res, { ok: true, watch: F.enabled(w.root) });
+    return true;
+  }
+
+  const src = freshness.SOURCES.find((s) => s.id === body.source);
+  if (!src) { ctx.json(res, { ok: false, error: 'source must be one of ' + freshness.SOURCES.map((s) => s.id).join(', ') }, 400); return true; }
+  if (!src.skill) {
+    ctx.factsRefresh(w.root);
+    ctx.json(res, { ok: true, source: src.id, started: 'rebuild' });
+    return true;
+  }
+  const r = ctx.startSkill(w.id, src.skill, `${src.label} · refresh`);
+  if (!r.ok) { ctx.json(res, { ok: false, error: r.error }, r.status || 500); return true; }
+  ctx.json(res, { ok: true, source: src.id, started: 'session', session: r.session });
+  return true;
+}
+
+module.exports = { prefixes: ['/api/sources'], handle };

package/workspace/lib/vendor/scripts/anchor-resolve.js

@@ -0,0 +1,351 @@
+#!/usr/bin/env node
+'use strict';
+/*
+ * PMOS anchor resolution — the one place a `parent_kr` string becomes a structured answer.
+ *
+ *   const A = require('./anchor-resolve');
+ *   const index = A.parseOkrIndex(root);          // what the OKR documents actually declare
+ *   const r     = A.resolveAnchor(raw, index);    // { kind, objective, kr, status, ... }
+ *   A.canonical(r)                                // the one normative written form
+ *
+ * WHY THIS EXISTS. Before this module, `parent_kr` was a string that nothing dereferenced. The
+ * ladder's R1 passed any non-empty value that did not contain `health:` as `done` without ever
+ * opening the OKR documents — so `parent_kr: banana` passed, and so did an anchor naming a KR that
+ * existed in no file (`q3-2026:integrity:kr-a` and `:kr-b` did exactly that for two days). The
+ * workspace's OKR surface, meanwhile, never read `parent_kr` at all. One field, several readers,
+ * none of them agreeing what it meant. See
+ * planning/explainers/okr-anchor-resolution-surface-explainer.md.
+ *
+ * THREE RULES, all load-bearing (planning/prd/anchor-normalization-spec.md R-2/R-3/R-4):
+ *
+ *   1. PERMANENTLY BACKWARD-COMPATIBLE (R-2). Every syntax present in the corpus at authoring time
+ *      is accepted, and keeps being accepted — not behind a migration window. The kit ships to
+ *      adopters as `create-pmos` (D55), so records written in the legacy forms exist in repos no
+ *      rewrite here can reach. ACCEPTED_FORMS below is that enumeration, and it is a promise.
+ *
+ *   2. HEALTH IS A FORM TEST, NEVER A SUBSTRING SEARCH (R-3). The corpus contains
+ *      `okrs-q3-2026 → O1.KR1    # or health:<id> from planning/okrs/health-budgets.md` — an OKR
+ *      anchor whose *commentary* mentions health. A substring search classifies it as a health
+ *      anchor and then rejects it as an undeclared budget: recognised, then refused, for a reason
+ *      that is not the reader's fault. Classification therefore tests the START of the value.
+ *
+ *   3. THE OBJECTIVE AND KR PATTERNS WIDEN TOGETHER (R-4). Widening the objective pattern alone
+ *      would let a previously-unmatched KR attach to the *previous matched* objective rather than
+ *      stay unmatched — a silent mis-filing, which is worse than the omission it replaces.
+ *
+ * HONESTY BY CONSTRUCTION. `status` is one of `resolved` · `unresolvable` · `empty` · `unknown`.
+ * `unknown` means the OKR documents could not be read and never collapses into either a pass or a
+ * failure — a resolver that cannot see its inputs says so rather than guessing. Nothing in this
+ * module blocks anything: per the spec's assumption A1 the gates keep accepting any non-empty
+ * anchor, and the RED belongs to the surface. This module reports; callers decide.
+ *
+ * Zero dependencies, stock Node. Runs in CI, in the ladder, and inside the workspace server.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/*
+ * The census, from the explainer, as executable documentation. Each entry is a real form found in
+ * planning/initiatives/ at authoring time (2026-07-28). Adding a form here without a matching
+ * pattern below, or vice versa, is the drift this list exists to make visible — the test suite
+ * asserts every example resolves.
+ */
+const ACCEPTED_FORMS = [
+  { example: 'health:tech',                    note: 'D59 registry form, bare' },
+  { example: 'health:tech (D59 — commentary)', note: 'registry form with trailing commentary' },
+  { example: 'q3-2026:o1:kr1',                 note: 'CANONICAL — colon triple' },
+  { example: 'q3-2026:integrity:kr-a',         note: 'canonical, non-numeric objective + KR ids' },
+  { example: 'Q3-2026:O1:KR2',                 note: 'canonical, upper-case variant' },
+  { example: 'okrs-q3-2026 → O1.KR1',          note: 'legacy arrow form, filename-prefixed' },
+  { example: 'okrs-q3-2026 → O1',              note: 'legacy arrow, objective only (no KR)' },
+  { example: 'q3-2026 → O1.KR2',               note: 'legacy arrow, period-prefixed' },
+  { example: 'O1.KR3',                         note: 'legacy bare objective.KR' },
+  { example: '**O1**',                         note: 'legacy bare objective, markdown-bolded' },
+  { example: "okrs-q3-2026 → O2.KR2 / B4 (Cohen's kappa)", note: 'trailing commentary after a slash' },
+  { example: 'okrs-q3-2026 → O1.KR1    # or health:<id> from planning/okrs/health-budgets.md',
+    note: 'R-3 trap: OKR anchor whose COMMENTARY mentions health — must classify as okr' },
+];
+
+/*
+ * Objective and KR tokens are deliberately NOT `O\w+` / `KR\w+`. The OKR document's own H1 is
+ * `# OKRs — Q3 2026`, and a loose objective pattern matches `OKRs` there, inventing an objective
+ * called `okrs` that every subsequent KR would then attach to. The shape is therefore pinned:
+ * an objective is `O` + digits, or `O-` + a word; a KR is `KR` + digits, or `KR-` + a word.
+ */
+const OBJ_TOKEN = '(O\\d+|O-[A-Za-z][A-Za-z0-9-]*)';
+const KR_TOKEN = '(KR\\d+|KR-[A-Za-z][A-Za-z0-9-]*)';
+const PERIOD = '((?:q|Q)[1-4]-\\d{4})';
+
+const RE_OBJ_HEADING = new RegExp('^#{1,3}\\s+' + OBJ_TOKEN + '\\s*(?:[—–:-]\\s*(.*))?$');
+const RE_KR_BULLET = new RegExp('^\\s*[-*]\\s*\\*\\*\\s*' + KR_TOKEN + '\\s*[—–:-]?\\s*(.+?)\\*\\*');
+
+// Anchor forms. Order matters only in that the colon forms are tried before the looser ones.
+const RE_HEALTH = /^health:([a-z0-9_-]+)/i;                       // START-anchored — rule 2
+const RE_DOMAIN = /^domain:([a-z0-9][a-z0-9_-]*)/i;               // D67 — the third anchor class
+const RE_COLON_KR = new RegExp('^(?:okrs-)?' + PERIOD + ':([a-z0-9][a-z0-9-]*):(kr-?[a-z0-9-]+)$', 'i');
+const RE_COLON_OBJ = new RegExp('^(?:okrs-)?' + PERIOD + ':([a-z0-9][a-z0-9-]*)$', 'i');
+const RE_ARROW = new RegExp('^(?:okrs-)?' + PERIOD + '\\s*(?:→|->)\\s*' + OBJ_TOKEN + '(?:\\.' + KR_TOKEN + ')?$', 'i');
+const RE_BARE = new RegExp('^' + OBJ_TOKEN + '(?:\\.' + KR_TOKEN + ')?$', 'i');
+
+/** Strip markdown emphasis and trailing commentary. `(`, `#` and `/` never appear inside an id. */
+function stripCommentary(raw) {
+  let s = String(raw == null ? '' : raw).replace(/\*\*/g, '').trim();
+  const cut = s.search(/[(#/]/);
+  if (cut >= 0) s = s.slice(0, cut);
+  return s.trim();
+}
+
+/** `O-INTEGRITY` → `integrity`; `O1` → `o1`. The anchors write `integrity`, the heading writes
+ *  `O-INTEGRITY`; the explainer flagged that a widened parser must pick one. This picks: the id is
+ *  the heading token minus a leading `O-`, lower-cased. */
+function objectiveId(token) {
+  const t = String(token || '').trim();
+  const m = /^O-(.+)$/i.exec(t);
+  return (m ? m[1] : t).toLowerCase();
+}
+
+/** `KR1` → `kr1`; `KR-C` → `kr-c`. Case only. */
+function krId(token) {
+  return String(token || '').trim().toLowerCase();
+}
+
+function listOkrFiles(root) {
+  const out = [];
+  const seen = new Set();
+  const walk = (dir, depth) => {
+    if (depth > 4) return;
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.name.startsWith('.') || e.name === 'node_modules') continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        if (e.name === 'okrs') {
+          let files;
+          try { files = fs.readdirSync(full); } catch { continue; }
+          for (const f of files) {
+            if (!f.endsWith('.md')) continue;
+            const p = path.join(full, f);
+            if (!seen.has(p)) { seen.add(p); out.push(p); }
+          }
+        } else walk(full, depth + 1);
+      }
+    }
+  };
+  walk(root, 0);
+  return out.sort();
+}
+
+/**
+ * Read every OKR document under `root` and return what they declare.
+ * → { ok, objectives: [{id, token, name, krs:[{id, token, name}], file}], files, error }
+ * `ok:false` is a genuine read failure and must render as an error, never as "no objectives".
+ */
+function parseOkrIndex(root) {
+  const files = listOkrFiles(root);
+  if (!files.length) {
+    return { ok: false, objectives: [], files: [], error: 'no OKR documents found under ' + root };
+  }
+  const objectives = [];
+  const byId = new Map();
+  let period = null;
+  for (const file of files) {
+    let text;
+    try { text = fs.readFileSync(file, 'utf8'); }
+    catch (e) {
+      return { ok: false, objectives: [], files, error: `could not read ${file}: ${String((e && e.message) || e).slice(0, 120)}` };
+    }
+    let cur = null;
+    for (const line of text.split('\n')) {
+      if (!period) {
+        const p = /^\s*[-*]?\s*period\s*:\s*(\d{4})-(Q[1-4])\s*$/i.exec(line);
+        if (p) period = `${p[2].toLowerCase()}-${p[1]}`;
+      }
+      const o = RE_OBJ_HEADING.exec(line);
+      if (o) {
+        const id = objectiveId(o[1]);
+        cur = byId.get(id);
+        if (!cur) {
+          cur = { id, token: o[1], name: (o[2] || '').replace(/\*\*/g, '').trim(), krs: [], file: path.relative(root, file) };
+          byId.set(id, cur);
+          objectives.push(cur);
+        }
+        continue;
+      }
+      const k = RE_KR_BULLET.exec(line);
+      // A KR with no open objective stays UNATTACHED (rule 3) — never inherited from a previous one.
+      if (k && cur && !cur.krs.some((x) => x.id === krId(k[1]))) {
+        cur.krs.push({ id: krId(k[1]), token: k[1], name: (k[2] || '').trim() });
+        continue;
+      }
+      // the KR's own measure — its `baseline: … → target: …` sub-bullet (overhaul-r2 B4)
+      const bl = /^\s+[-*]\s*baseline\s*:\s*(.+)$/i.exec(line);
+      if (bl && cur && cur.krs.length && !cur.krs[cur.krs.length - 1].line) cur.krs[cur.krs.length - 1].line = bl[1].trim();
+    }
+  }
+  return { ok: true, objectives, files: files.map((f) => path.relative(root, f)), period: period || null, error: null };
+}
+
+function readBudgets(root) {
+  const p = path.join(root, 'planning', 'okrs', 'health-budgets.md');
+  let out;
+  try { out = { ok: true, text: fs.readFileSync(p, 'utf8'), path: path.relative(root, p) }; }
+  catch { out = { ok: false, text: '', path: path.relative(root, p) }; }
+  return withDomains(out, path.dirname(p), root);
+}
+
+/**
+ * D67 — the domain registry, `domains.md` beside `health-budgets.md`. Closed and PM-edited, like the
+ * budgets: a domain exists only as a table row `| domain:<id> | standing goal | repositories |`.
+ * It rides on the budgets object every caller already passes, so the gate, the ladder, the sweep and
+ * the workspace all learn the class without a signature change. Absent file = no domains declared
+ * (`ok:false`), which makes any `domain:` anchor `unknown`, never silently resolved.
+ */
+function readDomains(dir, root) {
+  const p = path.join(dir, 'domains.md');
+  const rel = root ? path.relative(root, p) : p;
+  let text;
+  try { text = fs.readFileSync(p, 'utf8'); } catch { return { ok: false, path: rel, rows: [] }; }
+  const rows = [];
+  for (const line of text.split('\n')) {
+    const m = /^\|\s*`?domain:([a-z0-9][a-z0-9_-]*)`?\s*\|\s*([^|]*?)\s*\|\s*([^|]*?)\s*\|/i.exec(line);
+    if (m) rows.push({ id: m[1].toLowerCase(), goal: m[2], repos: m[3] });
+  }
+  return { ok: true, path: rel, rows };
+}
+
+/** Attach the domain registry to a budgets object (callers that build their own budgets use this). */
+function withDomains(budgets, dir, root) {
+  if (!budgets) return budgets;
+  return Object.assign(budgets, { domains: readDomains(dir, root) });
+}
+
+/**
+ * Resolve one raw `parent_kr` value.
+ * → { raw, kind, status, objective, kr, budget, period, form, reason }
+ *   kind   : 'health' | 'okr' | 'empty'
+ *   status : 'resolved' | 'unresolvable' | 'empty' | 'unknown'
+ * `index` comes from parseOkrIndex; `budgets` from readBudgets (optional — omit to skip the
+ * registry check, which callers that only need the FORM can do).
+ */
+/** Strip ONE layer of matching surrounding quotes.
+ *
+ *  `parent_kr` is a YAML scalar, and a value whose prose contains a colon-space MUST be quoted or
+ *  the document does not parse. The flat frontmatter reader hands the value through with its quotes
+ *  intact, so a legitimately-quoted anchor arrived here as `"health:security …` and matched no form.
+ *
+ *  This defect occurred TWICE — `sink-discipline-backport` on 2026-08-04 and
+ *  `separation-invariant-enforcement` on 2026-08-05 — and the first time it was fixed by unquoting
+ *  the one file. That is the wave's own lesson landing on the person who wrote it down: the unit of
+ *  attention was the file, the unit of the defect was the rule. "Do not quote it" is a rule that
+ *  lives in prose and depends on an author remembering; tolerating the quoting is a rule that lives
+ *  in code.
+ *
+ *  Only a MATCHING outer pair, and only one layer: a stray leading quote is still malformed, and
+ *  reporting it as such is the point. */
+function unquote(s) {
+  const t = s.trim();
+  if (t.length >= 2 && ((t[0] === '"' && t[t.length - 1] === '"') || (t[0] === "'" && t[t.length - 1] === "'"))) {
+    return t.slice(1, -1).trim();
+  }
+  return t;
+}
+
+function resolveAnchor(raw, index, budgets) {
+  const original = unquote(String(raw == null ? '' : raw).trim());
+  const base = { raw: original, kind: 'empty', status: 'empty', objective: null, kr: null, budget: null, period: null, form: null, reason: null,
+    // separate fields so no client has to parse `reason` (overhaul-r2 B1)
+    objective_name: null, kr_name: null, kr_line: null, domain: null, domain_goal: null };
+  if (!original) return Object.assign(base, { reason: 'parent_kr is empty — unanchored work is rejected (D59)' });
+
+  const d = RE_DOMAIN.exec(original);
+  if (d) {
+    const id = d[1].toLowerCase();
+    const out = Object.assign({}, base, { kind: 'domain', domain: id, form: 'domain:<id>' });
+    const reg = budgets && budgets.domains;
+    if (!reg) return Object.assign(out, { status: 'unknown', reason: 'domain registry not supplied to the resolver' });
+    if (!reg.ok) return Object.assign(out, { status: 'unknown', reason: `no domain registry at ${reg.path} — declare the domain there (D67)` });
+    const row = reg.rows.find((r) => r.id === id);
+    return row
+      ? Object.assign(out, { status: 'resolved', domain_goal: row.goal || null, reason: `domain:${id} — ${row.goal || 'no standing goal written'}`.slice(0, 160) })
+      : Object.assign(out, { status: 'unresolvable', reason: `domain:${id} is not a declared domain in ${reg.path} (D67)` });
+  }
+
+  // Rule 2: the FORM decides, not a substring. Commentary is stripped only for the OKR branch,
+  // because a health anchor's id must sit at the very start of the raw value.
+  const h = RE_HEALTH.exec(original);
+  if (h) {
+    const id = h[1].toLowerCase();
+    const out = Object.assign({}, base, { kind: 'health', budget: id, form: 'health:<id>' });
+    if (!budgets) return Object.assign(out, { status: 'unknown', reason: 'health budget registry not supplied to the resolver' });
+    if (!budgets.ok) return Object.assign(out, { status: 'unknown', reason: `health-budget registry unreadable at ${budgets.path}` });
+    // Same case handling as the classifier (R-3): recognised case-insensitively, looked up the same way.
+    const declared = new RegExp('health:' + id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\b', 'i').test(budgets.text);
+    return declared
+      ? Object.assign(out, { status: 'resolved', reason: `declared in ${budgets.path}` })
+      : Object.assign(out, { status: 'unresolvable', reason: `health:${id} is not a declared budget in ${budgets.path}` });
+  }
+
+  const s = stripCommentary(original);
+  if (!s) {
+    return Object.assign(base, { kind: 'okr', status: 'unresolvable', reason: 'no anchor left after commentary was stripped' });
+  }
+
+  let period = null, objTok = null, krTok = null, form = null;
+  let m;
+  if ((m = RE_COLON_KR.exec(s))) { period = m[1].toLowerCase(); objTok = m[2]; krTok = m[3]; form = 'q3-2026:<objective>:<kr>'; }
+  else if ((m = RE_COLON_OBJ.exec(s))) { period = m[1].toLowerCase(); objTok = m[2]; form = 'q3-2026:<objective>'; }
+  else if ((m = RE_ARROW.exec(s))) { period = m[1].toLowerCase(); objTok = m[2]; krTok = m[3] || null; form = 'legacy arrow'; }
+  else if ((m = RE_BARE.exec(s))) { objTok = m[1]; krTok = m[2] || null; form = 'legacy bare'; }
+  else {
+    return Object.assign(base, { kind: 'okr', status: 'unresolvable', form: 'unrecognised', reason: `'${s}' matches no accepted anchor form` });
+  }
+
+  const out = Object.assign({}, base, {
+    kind: 'okr', form, period,
+    objective: objectiveId(objTok),
+    kr: krTok ? krId(krTok) : null,
+  });
+
+  if (!index) return Object.assign(out, { status: 'unknown', reason: 'OKR index not supplied to the resolver' });
+  if (!index.ok) return Object.assign(out, { status: 'unknown', reason: index.error || 'OKR documents unreadable' });
+
+  const obj = index.objectives.find((o) => o.id === out.objective);
+  if (!obj) {
+    return Object.assign(out, { status: 'unresolvable', reason: `objective '${out.objective}' is not declared in ${index.files.join(', ')}` });
+  }
+  if (!out.kr) {
+    // Assumption A2: objective-only anchoring is a legitimate resolvable kind, not debt.
+    return Object.assign(out, { status: 'resolved', objective_name: obj.name || null, reason: `objective '${obj.id}' — no KR written (objective-level anchor)` });
+  }
+  const kr = obj.krs.find((k) => k.id === out.kr);
+  if (!kr) {
+    return Object.assign(out, { status: 'unresolvable', reason: `objective '${obj.id}' declares no KR '${out.kr}' (has: ${obj.krs.map((k) => k.id).join(', ') || 'none'})` });
+  }
+  return Object.assign(out, { status: 'resolved', objective_name: obj.name || null, kr_name: kr.name || null, kr_line: kr.line || null,
+    reason: `${obj.id}/${kr.id} — ${kr.name}`.slice(0, 160) });
+}
+
+/**
+ * The one normative written form (R-1, as amended 2026-07-28 by PM decision).
+ * Returns null when the input does not resolve to something writable — callers must not invent one.
+ */
+function canonical(resolved, fallbackPeriod) {
+  if (!resolved) return null;
+  if (resolved.kind === 'health') return resolved.budget ? `health:${resolved.budget}` : null;
+  if (resolved.kind === 'domain') return resolved.domain ? `domain:${resolved.domain}` : null;
+  if (resolved.kind !== 'okr' || !resolved.objective) return null;
+  const period = resolved.period || fallbackPeriod || null;
+  if (!period) return null;
+  return resolved.kr ? `${period}:${resolved.objective}:${resolved.kr}` : `${period}:${resolved.objective}`;
+}
+
+module.exports = {
+  unquote,
+  parseOkrIndex, readBudgets, readDomains, withDomains, resolveAnchor, canonical,
+  objectiveId, krId, stripCommentary, listOkrFiles,
+  ACCEPTED_FORMS,
+  // exported for the tests that assert the widening happened together (R-4)
+  RE_OBJ_HEADING, RE_KR_BULLET,
+};