create-pmos 0.169.0 → 0.170.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.169.0",
+  "version": "0.170.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@d87e438
+kernel-source: pmos@b5055b4
 assembled: 2026-10-12
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-12T14:51:11Z"}
+generated: {by: process:create-pmos, at: "2026-10-12T17:05:32Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-12T14:51:11Z"}
+generated: {by: process:create-pmos, at: "2026-10-12T17:05:32Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-12T14:51:11Z"}
+generated: {by: process:create-pmos, at: "2026-10-12T17:05:32Z"}
 status: stable
 ---
 

package/workspace/c3-scan-fixture.js

@@ -0,0 +1,78 @@
+'use strict';
+/* c3-scan-fixture.js — a real server, a scratch repository and a seeded scan ledger for the console3 Horizon scan suite (c3-scan-test.js).
+ * Not a suite: it asserts nothing. The server runs with PMOS_DRIVER=off, so no scan and no suggest run starts: every suggestion, scan and
+ * finding the page shows is a line this file wrote with lib/scan.js (the single writer) and the boards ledger.
+ *
+ *   const F = await start({ name })  -> { BASE, ws, board, team, ledger, boards, post, get, seedScan, stop, S }
+ *   at start: the board holds three suggestions from the agent (a product, a domain, an approach) and no scan has run
+ *   seedScan() writes one finished scan of today: 2 web findings and 1 repository finding, each already an open Triage ask
+ */
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const T = require('./test-run').configure({ name: 'c3-scan' });
+const { makeRepos, codeRepo, write, git } = require('./plan-test-repos');
+const S = require('./lib/scan.js');
+
+async function call(base, method, p, body, headers) {
+  const r = await fetch(base + p, { method, headers: headers || {}, body: body === undefined ? undefined : JSON.stringify(body) });
+  const raw = await r.text(); let j = null; try { j = JSON.parse(raw); } catch { /* not JSON */ }
+  return { status: r.status, body: j, raw };
+}
+
+async function start({ name = 'c3-scan' } = {}) {
+  const R = makeRepos(name);
+  const team = codeRepo(path.join(R.base, 'team'));
+  fs.mkdirSync(path.join(team, 'pmos', 'state'), { recursive: true });
+  write(team, 'pmos/state/.keep', '');
+  git(team, ['add', '-A']); git(team, ['commit', '-q', '-m', 'state']);
+  const ledger = path.join(team, 'pmos', 'state', 'scan.jsonl');
+  const boards = path.join(team, 'pmos', 'state', 'boards.jsonl');
+  const BASE = T.BASE;
+  const srv = spawn(process.execPath, [path.join(__dirname, 'server.js')], { cwd: __dirname, stdio: 'ignore',
+    env: T.env({ PMOS_WS_PORT: String(T.PORT), PMOS_SELF_ROOT: team, PMOS_NO_OPEN: '1', PMOS_DRIVER: 'off' }) });
+  await T.waitForServer(BASE);
+  const press = await T.pressHeaders(BASE);
+  const post = (p, body) => call(BASE, 'POST', p, body, press);
+  const get = (p) => call(BASE, 'GET', p);
+  const reg = await post('/api/workspaces', { root: team, focus: true });
+  const ws = reg.body.workspace.id;
+  const made = await post('/api/initiatives', { ws, title: 'Partner API onboarding', lane: 'feature', anchor: 'health:tech', id: 'scan-ui' });
+  if (made.status !== 200) throw new Error('could not create the initiative: ' + made.raw);
+  const now = Date.now();
+  const w = (line, at) => S.append(ledger, line, { now: at });
+  w({ ev: 'scan-start', board: ws, scan: 'scan-0000000001', mode: 'suggest', watch: [] }, now - 3600000 * 30);
+  w({ ev: 'watch-suggest', board: ws, id: 'w-00000001', kind: 'product', name: 'Rival Notes', why: 'A direct rival in partner onboarding', ini: 'scan-ui' }, now - 3600000 * 30);
+  w({ ev: 'watch-suggest', board: ws, id: 'w-00000002', kind: 'domain', name: 'Data privacy law', why: 'We store partner emails', ini: 'scan-ui' }, now - 3600000 * 30);
+  w({ ev: 'watch-suggest', board: ws, id: 'w-00000003', kind: 'approach', name: 'Eval-first delivery', why: 'How other teams write the test before the build', ini: 'scan-ui' }, now - 3600000 * 30);
+  w({ ev: 'scan-end', board: ws, scan: 'scan-0000000001', ok: true, pages: 0, found: 3, skipped: 0, runs: 1 }, now - 3600000 * 30 + 60000);
+
+  /** One finished scan of today, with its three findings as open Triage asks. */
+  function seedScan() {
+    const t0 = new Date(); t0.setHours(9, 0, 0, 0);
+    const t = Math.min(t0.getTime(), now - 120000);
+    const scan = 'scan-00000000a2';
+    w({ ev: 'watch-keep', board: ws, id: 'w-00000001', by: 'pm:wawan' }, t - 60000);
+    w({ ev: 'scan-start', board: ws, scan, mode: 'scan', watch: [{ id: 'w-00000001', kind: 'product', name: 'Rival Notes', why: '' }] }, t);
+    const F = [
+      { id: 'f-00000000a1', origin: 'web', title: 'Rival Notes ships PDF export for partners', why: 'A rival added PDF export for partner reports. Two of our partners asked for the same.', match: null,
+        sources: [{ label: 'Rival blog', ref: 'https://rivalnotes.example/blog/pdf-export' }, { label: 'Changelog', ref: 'https://rivalnotes.example/changelog' }] },
+      { id: 'f-00000000a2', origin: 'web', title: 'New consent rule for partner emails', why: 'A new privacy rule changes how consent for partner emails must be stored.', match: 'scan-ui',
+        sources: [{ label: 'Regulator notice', ref: 'https://regulator.example/privacy/consent-rule' }] },
+      { id: 'f-00000000a3', origin: 'repo', title: 'Retire the unused CSV importer', why: 'No file in the repository calls it and it has not changed in 9 months.', match: null,
+        sources: [{ label: 'File', ref: 'src/importer.js' }, { label: 'Jira', ref: 'IDPF-1204' }] },
+    ];
+    F.forEach((f, i) => {
+      w({ ev: 'finding', board: ws, scan, id: f.id, origin: f.origin, title: f.title, why: f.why, sources: f.sources, match: f.match, by: 'agent:sess-4.0a1b2c3d', run: 'srun-000000000' + (i < 2 ? 1 : 2) }, t + 1000 * (i + 1));
+      const line = { at: new Date(t + 5000 + i).toISOString(), by: 'agent:sess-4.0a1b2c3d', kind: 'ask', board: ws, ask: 'ask-' + f.id.slice(2), line: f.title, source: 'scan', draft: null,
+        found: { why: f.why, sources: f.sources, match: f.match, scan, run: 'srun-000000000' + (i < 2 ? 1 : 2) } };
+      fs.appendFileSync(boards, JSON.stringify(line) + '\n');
+    });
+    w({ ev: 'skip', board: ws, scan, origin: 'web', of: 'f-00000000a1' }, t + 8000);
+    w({ ev: 'scan-end', board: ws, scan, ok: true, pages: 12, found: 3, skipped: 1, runs: 2 }, t + 60000);
+    return { scan, findings: F.map((f) => f.id), asks: F.map((f) => 'ask-' + f.id.slice(2)) };
+  }
+  const stop = () => { try { srv.kill('SIGKILL'); } catch { /* gone */ } T.killTmux(); R.cleanup(); };
+  return { BASE, ws, board: ws, team, ledger, boards, post, get, seedScan, stop, T, S };
+}
+module.exports = { start };

package/workspace/c3-scan-test.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+'use strict';
+/* c3-scan-test.js — the Horizon scan on console3 (initiative horizon-scan; PRD section 6 and the mockup 40-scan).
+ * LIVE mode: a real server and a scratch repository whose scan ledger this suite seeds (c3-scan-fixture.js; PMOS_DRIVER=off, so no scan
+ * and no suggest run starts and every line the page shows is one the fixture wrote). A real Chromium drives /c3.html.
+ *
+ *   settings   Board settings has the Horizon scan block: How often (Daily, Weekly, Off), the schedule line, the banner, the watch list with
+ *              Keep, Edit and Remove on each suggestion, Undo after Remove, and Add; every press posts to /api/scan/* with no writer field
+ *   triage     the asks a scan found read "Found by agent", with the reason, source chips (a public page is a link), the match chip and
+ *              Accept, Ask for more and Decline
+ *   briefing   the Horizon scan card: the counts, one row per finding, "Nothing was sent", Open Triage and Scan settings both navigate
+ *   phone      at 400 wide none of the three has a horizontal scroll
+ * Set SCAN_SHOTS=<dir> to save screenshots of the three screens at 1280 and 400 wide. Every wait polls the page. No script error may be raised.
+ */
+const fs = require('fs');
+const path = require('path');
+const { findBrowser } = require('./lib/find-browser');
+const F = require('./c3-scan-fixture');
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const until = async (fn, ms = 20000, step = 120) => { const t0 = Date.now(); for (;;) { const v = await fn(); if (v) return v; if (Date.now() - t0 > ms) return v; await sleep(step); } };
+const results = [];
+const ok = (n, cond, extra = '') => { results.push({ n, cond: !!cond }); console.log(`${cond ? '✓' : '✗'} ${n}${!cond && extra !== '' ? ' — ' + String(extra).slice(0, 500) : ''}`); };
+let fx = null; let browser = null;
+const finish = async (code) => {
+  if (browser) await browser.close().catch(() => {});
+  if (fx) fx.stop();
+  const bad = results.filter((x) => !x.cond).length;
+  console.log(`\n${results.length - bad}/${results.length} c3-scan assertions passed`);
+  process.exit(code !== undefined ? code : (bad ? 1 : 0));
+};
+process.on('unhandledRejection', (e) => { console.error(e); finish(1); });
+
+(async () => {
+  const exe = findBrowser();
+  if (!exe) { console.log('· no Chrome/Chromium on this machine — c3-scan suite skipped'); process.exit(0); }
+  let chromium;
+  try { ({ chromium } = require('playwright-core')); } catch { console.log('· playwright-core not installed — c3-scan suite skipped'); process.exit(0); }
+  fx = await F.start({ name: 'c3-scan' });
+  const { BASE, ws, S, ledger } = fx;
+  const state = () => S.fold(S.readLines(ledger));
+  browser = await chromium.launch({ executablePath: exe });
+  const ctx = await browser.newContext({ viewport: { width: 1280, height: 900 } });
+  const page = await ctx.newPage();
+  const errors = []; page.on('pageerror', (e) => errors.push(String((e && e.message) || e)));
+  const posts = []; page.on('request', (r) => { if (r.method() === 'POST' && r.url().includes('/api/scan/')) posts.push({ path: new URL(r.url()).pathname, body: JSON.parse(r.postData() || '{}') }); });
+  const st = (f, a) => page.evaluate(f, a);
+  const sel = (s) => until(() => page.$(s));
+  const shots = process.env.SCAN_SHOTS || '';
+  if (shots) fs.mkdirSync(shots, { recursive: true });
+  const shot = async (name) => { if (shots) await page.screenshot({ path: path.join(shots, name + '.png'), fullPage: false }); };
+  const noScroll = () => st(() => document.documentElement.scrollWidth <= window.innerWidth + 1);
+  const openSettings = async () => {
+    await page.goto(BASE + `/c3.html?tab=init&init=board:${ws}:summary`, { waitUntil: 'load' });
+    await (await sel('[data-ini=board-settings]')).click();
+    await sel('[data-scan-set] [data-scan-item]');
+  };
+
+  /* ── settings ── */
+  await openSettings();
+  const items = () => st(() => [...document.querySelectorAll('[data-scan-item]')].map((n) => ({ id: n.dataset.scanItem, state: n.dataset.scanState, text: n.textContent })));
+  const blk = await st(() => document.querySelector('[data-scan-set]').textContent);
+  ok('T1 the block says HORIZON SCAN, How often, the schedule line and the watch list count', /HORIZON SCAN/.test(blk) && /HOW OFTEN/.test(blk) && /Every working day, 09:00/.test(blk) && /WATCH LIST \(3\)/.test(blk), blk.slice(0, 300));
+  ok('T2 Daily is pressed; Weekly and Off are not', await st(() => ['daily', 'weekly', 'off'].map((k) => document.querySelector(`[data-scan-freq=${k}]`).getAttribute('aria-pressed')).join() === 'true,false,false'));
+  ok('T3 the first-time banner says the agent suggests 3 things and to keep, edit or remove each', /The agent suggests 3 things to watch\. Keep, edit or remove each before the first scan\./.test(await st(() => (document.querySelector('[data-scan="banner"]') || {}).textContent || '')));
+  ok('T4 the last scan line says none yet and that nothing runs until an item is kept', /Last scan: none yet/.test(blk) && /No scan runs until you keep an item/.test(blk), blk);
+  const its = await items();
+  ok('T5 three suggestions, each with a kind tag, the initiative it came from, Keep, Edit and Remove', its.length === 3 && its.every((i) => i.state === 'suggested') && await st(() => [...document.querySelectorAll('[data-scan-item]')].every((n) => n.querySelector('[data-scan-act=keep]') && n.querySelector('[data-scan-act=edit]') && n.querySelector('[data-scan-act=remove]') && /from scan-ui/.test(n.textContent))), JSON.stringify(its));
+  await st(() => document.querySelector('[data-scan-set]').scrollIntoView({ block: 'start' }));
+  await shot('settings-1280');
+  ok('T6 the block uses the real buttons (no hand-made controls)', await st(() => [...document.querySelectorAll('[data-scan-set] button')].every((b) => /pmc-btn|(^| )btn( |$)/.test(b.className))));
+  await page.click('[data-scan-item="w-00000001"] [data-scan-act=keep]');
+  await until(() => state().boards.get(ws).items.get('w-00000001').state === 'kept');
+  await until(() => st(() => document.querySelector('[data-scan-item="w-00000001"]').dataset.scanState === 'kept'));
+  ok('T7 Keep posts op keep with the item and no writer field; the ledger holds the keep by the PM; the row reads Kept', posts.some((p) => p.path === '/api/scan/watch' && p.body.op === 'keep' && p.body.id === 'w-00000001' && !('by' in p.body))
+    && S.readLines(ledger).some((l) => l.ev === 'watch-keep' && l.id === 'w-00000001' && l.by === 'pm:wawan') && /Kept/.test((await items())[0].text));
+  await page.click('[data-scan-item="w-00000002"] [data-scan-act=edit]');
+  await sel('[data-scan-edit-in]');
+  await page.fill('[data-scan-edit-in]', 'Data privacy law (EU)');
+  await page.click('[data-scan-act=save]');
+  await until(() => state().boards.get(ws).items.get('w-00000002').name === 'Data privacy law (EU)');
+  ok('T8 Edit then Save posts op edit with the new name and the item becomes kept', posts.some((p) => p.body.op === 'edit' && p.body.name === 'Data privacy law (EU)') && state().boards.get(ws).items.get('w-00000002').state === 'kept');
+  await page.click('[data-scan-item="w-00000003"] [data-scan-act=edit]');
+  await sel('[data-scan-edit-in]');
+  await page.click('[data-scan-act=cancel]');
+  ok('T9 Cancel leaves the item as it was', state().boards.get(ws).items.get('w-00000003').name === 'Eval-first delivery' && state().boards.get(ws).items.get('w-00000003').state === 'suggested' && !(await page.$('[data-scan-edit-in]')));
+  await page.click('[data-scan-item="w-00000003"] [data-scan-act=remove]');
+  await until(() => !state().boards.get(ws).items.get('w-00000003') || state().boards.get(ws).items.get('w-00000003').state === 'removed');
+  await sel('[data-c3-toast-action]');
+  ok('T10 Remove posts op remove, the row leaves, and a toast offers Undo', posts.some((p) => p.body.op === 'remove' && p.body.id === 'w-00000003') && (await items()).length === 2 && /Removed Eval-first delivery/.test(await st(() => document.querySelector('[data-c3-toast]').textContent)));
+  await page.click('[data-c3-toast-action]');
+  await until(() => state().boards.get(ws).items.get('w-00000003').state === 'suggested');
+  await until(async () => (await items()).length === 3);
+  ok('T11 Undo posts keep with restore and the item is back as it was (suggested)', posts.some((p) => p.body.op === 'keep' && p.body.restore === true && p.body.id === 'w-00000003') && (await items()).length === 3);
+  await page.click('[data-scan-act=add]');
+  ok('T12 Add with nothing typed says so in plain words and posts nothing', /Write what to watch first/.test(await st(() => (document.querySelector('[data-scan="add-error"]') || {}).textContent || '')) && !posts.some((p) => p.body.op === 'add'));
+  await page.fill('[data-scan-add-in]', 'Partner SDK trends');
+  await page.selectOption('[data-scan-add-kind]', 'domain');
+  await page.click('[data-scan-act=add]');
+  await until(() => [...state().boards.get(ws).items.values()].some((i) => i.name === 'Partner SDK trends'));
+  await until(async () => (await items()).length === 4);
+  const added = [...state().boards.get(ws).items.values()].find((i) => i.name === 'Partner SDK trends');
+  ok('T13 Add posts op add with the name and kind; the item is kept and marked added by you', posts.some((p) => p.body.op === 'add' && p.body.kind === 'domain' && p.body.name === 'Partner SDK trends') && added.state === 'kept' && added.added === true && /added by you/.test((await items()).find((i) => i.id === added.id).text));
+  await page.click('[data-scan-freq=weekly]');
+  await until(() => S.cadenceOf(state(), ws) === 'weekly');
+  await until(() => st(() => document.querySelector('[data-scan-freq=weekly]').getAttribute('aria-pressed') === 'true'));
+  ok('T14 Weekly posts the cadence; the line says Every Monday, 09:00 and a toast says so', posts.some((p) => p.path === '/api/scan/cadence' && p.body.cadence === 'weekly' && p.body.board === ws) && /Every Monday, 09:00/.test(await st(() => document.querySelector('[data-scan="schedule"]').textContent)));
+  await page.click('[data-scan-freq=off]');
+  await until(() => S.cadenceOf(state(), ws) === 'off');
+  await until(() => st(() => /^Off\./.test(document.querySelector('[data-scan="schedule"]').textContent)));
+  ok('T15 Off says that no scan runs and shows no next scan', await st(() => /Off\. No scan runs on this board/.test(document.querySelector('[data-scan="schedule"]').textContent) && !document.querySelector('[data-scan="next"]')));
+  await page.click('[data-scan-freq=daily]');
+  await until(() => S.cadenceOf(state(), ws) === 'daily');
+  await until(() => st(() => document.querySelector('[data-scan-freq=daily]').getAttribute('aria-pressed') === 'true'));
+  ok('T16 Daily brings the schedule back, with a next scan', await st(() => /Every working day, 09:00/.test(document.querySelector('[data-scan="schedule"]').textContent) && !!document.querySelector('[data-scan="next"]')));
+  await page.setViewportSize({ width: 400, height: 900 });
+  await sleep(300);
+  await st(() => document.querySelector('[data-scan-set]').scrollIntoView({ block: 'start' }));
+  await shot('settings-400');
+  ok('T17 at 400 wide the settings have no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
+  await page.setViewportSize({ width: 1280, height: 900 });
+
+  /* ── triage ── */
+  const seed = fx.seedScan();
+  await page.goto(BASE + `/c3.html?tab=init&init=board:${ws}:triage`, { waitUntil: 'load' });
+  await sel(`[data-ibt-ask="${seed.asks[0]}"]`);
+  const row = (i) => st((id) => { const r = document.querySelector(`[data-ibt-ask="${id}"]`); return { text: r.textContent, agent: !!r.querySelector('[data-scan="found-by-agent"]'), links: [...r.querySelectorAll('a[data-scan-src=web]')].map((a) => ({ href: a.href, target: a.target, rel: a.rel })),
+    noMatch: !!r.querySelector('[data-scan="no-match"]'), accept: !!r.querySelector('[data-ibt-accept]'), more: !!r.querySelector('[data-ibt-more]'), decline: !!r.querySelector('[data-ibt-decline]'), srcs: r.querySelectorAll('[data-scan-src]').length }; }, seed.asks[i]);
+  const r0 = await row(0); const r1 = await row(1); const r2 = await row(2);
+  ok('R1 each scan ask reads "Found by agent" with the reason, the Horizon scan chip and the source count', [r0, r1, r2].every((r) => r.agent && /Horizon scan/.test(r.text)) && /A rival added PDF export for partner reports/.test(r0.text) && /2 sources/.test(r0.text), r0.text.slice(0, 400));
+  ok('R2 a public page source is a link that opens in a new tab with noopener; a repository path and a Jira key are chips', r0.links.length === 2 && r0.links.every((l) => l.target === '_blank' && /noopener/.test(l.rel)) && /rivalnotes\.example\/blog\/pdf-export/.test(r0.links[0].href) && r2.links.length === 0 && r2.srcs === 2 && /src\/importer\.js/.test(r2.text) && /IDPF-1204/.test(r2.text), JSON.stringify([r0.links, r2.srcs]));
+  ok('R3 the match chip names the initiative; an ask with no match says "no initiative yet"', /matches scan-ui/.test(r1.text) && !r1.noMatch && r0.noMatch && r2.noMatch);
+  ok('R4 each has Accept, Ask for more and Decline with the shared attributes', [r0, r1, r2].every((r) => r.accept && r.more && r.decline) && /Accept into/.test(r0.text) && /Ask for more/.test(r0.text) && /Decline/.test(r0.text));
+  ok('R5 the agent is named by page name with no token', !/0a1b2c3d/.test(await st(() => document.body.innerHTML)));
+  await shot('triage-1280');
+  await page.setViewportSize({ width: 400, height: 900 });
+  await sleep(300);
+  await st((id) => document.querySelector(`[data-ibt-ask="${id}"]`).scrollIntoView({ block: 'start' }), seed.asks[0]);
+  await shot('triage-400');
+  ok('R6 at 400 wide Triage has no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
+  await page.setViewportSize({ width: 1280, height: 900 });
+
+  /* ── briefing ── */
+  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
+  await sel('[data-c3pg="scan"] [data-scan-find]');
+  const card = await st(() => document.querySelector('[data-c3pg="scan"]').textContent);
+  ok('B1 the Horizon scan card counts the day: 3 asks found, 1 matches an initiative, 2 new, the board scanned', /Horizon scan/.test(card) && /3 asks found/.test(card) && /1 matches an initiative/.test(card) && /2 new/.test(card) && /1 board scanned/.test(card), card.slice(0, 400));
+  ok('B2 one row per finding, in the order they were found', await st(() => [...document.querySelectorAll('[data-scan-find]')].map((n) => n.dataset.scanFind).join()) === seed.findings.join());
+  ok('B3 the foot says nothing was sent, 12 public pages were read and 1 finding was skipped', /Nothing was sent\. The agent read 12 public pages\. It skipped 1 finding from earlier scans\./.test(card), card);
+  await shot('briefing-1280');
+  await page.click('[data-scan-find] [data-scan-go]');
+  await until(() => page.$('[data-ibt-ask]'));
+  ok('B4 "Open in Triage" on a finding opens that board\'s Triage', !!(await page.$(`[data-ibt-ask="${seed.asks[0]}"]`)) && /board:.*triage/.test(decodeURIComponent(page.url())), page.url());
+  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
+  await sel('[data-scan-settings]');
+  await page.click('[data-scan-settings]');
+  await until(() => page.$('[data-scan-set] [data-scan-item]'));
+  ok('B5 "Scan settings" opens the board with its settings open at the Horizon scan block', !!(await page.$('[data-scan-set] [data-scan-freq=daily]')));
+  ok('B6 the block now shows the last scan', /Last scan: today/.test(await st(() => document.querySelector('[data-scan="last"]').textContent)), await st(() => document.querySelector('[data-scan="last"]').textContent));
+  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
+  await sel('[data-c3pg="scan"] [data-scan-find]');
+  await page.setViewportSize({ width: 400, height: 900 });
+  await sleep(300);
+  await st(() => document.querySelector('[data-c3pg="scan"]').scrollIntoView({ block: 'start' }));
+  await shot('briefing-400');
+  ok('B7 at 400 wide the Briefing has no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
+
+  ok('Z1 the page raised no script error', errors.length === 0, errors.join(' | '));
+  await finish();
+})().catch((e) => { console.error(e); finish(1); });

package/workspace/guide/horizon-scan.md

@@ -0,0 +1,73 @@
+---
+type: Guide
+title: "The Horizon scan: the agent looks outside your initiatives"
+description: "What the Horizon scan does, how often it runs, the watch list you keep, where its findings land, what it can and cannot do, and the pmos scan commands."
+timestamp: 2026-10-12
+---
+
+# The Horizon scan: the agent looks outside your initiatives
+
+The Initiative Driver works on initiatives that already exist. The Horizon scan looks the other way. It looks for opportunities you have not asked for yet. It reads the public web for similar products, changes in your domain and approaches other teams use. It reads your repository for what keeps coming up and no initiative covers.
+
+Every finding is an ask in Triage. A scan never creates an initiative. You accept or decline each ask, as you do for any ask.
+
+## How often it runs
+
+Each board has its own setting: **Daily**, **Weekly** or **Off**. Daily is the default.
+
+- **Daily.** Every working day, Monday to Friday, at 09:00 local time.
+- **Weekly.** Every Monday at 09:00.
+- **Off.** No scan runs on that board.
+
+If the workspace was not running at 09:00, the scan starts at the first check that day inside your working hours. It never starts outside your working hours or inside your quiet hours. A board gets at most one scan a day. Only one scan runs at a time across the workspace. `PMOS_DRIVER=off` or `PMOS_SCAN=off` starts no scan at all.
+
+Open the board, press **Board settings**, and find **Horizon scan** below Agent. The block shows the last scan and the next one.
+
+## The watch list
+
+The web part of a scan searches for what is on the watch list of the board, and for nothing else. An item has a kind and a name:
+
+- **product.** A similar product or a reference product.
+- **domain.** A topic that changes often.
+- **approach.** A way of working that other teams use.
+
+A board that has no watch list gets one **suggest run**. The agent reads the initiatives of the board and files up to 8 suggestions. Each one names the initiative it came from. Suggestions appear in Board settings. For each one, press **Keep**, **Edit** or **Remove**. You can also add your own item.
+
+Only items you kept or added are scanned. A board with no kept item is not scanned.
+
+## What a scan does
+
+A scan is two short background runs, in this order.
+
+1. **The web run.** It gets the kept watch list and nothing else. It cannot read your repository, your initiatives or your notes. It searches the public web and reads public pages. It files up to 5 findings. Each one has a title, a one-line reason and the public page the agent read.
+2. **The repository run.** It reads your repository, your notes and the Jira themes in them. It has no way to reach the web. It files up to 3 findings of its own: recurring friction, an ask repeated in notes or meetings, a Jira theme with no initiative, or a stalled bet. It also marks which findings, from both runs, match an initiative that already exists.
+
+The agent skips a finding it already filed on this board. A finding repeats an earlier one when it has the same source page, or when its title has the same significant words. The scan counts the skips.
+
+## Where the findings land
+
+- **Triage.** Each new finding is an ask on its board. The row says **Found by agent**. It shows the reason, the sources and either "matches" an initiative or "no initiative yet". Accept, Ask for more and Decline work as for any ask. A declined scan ask counts as a correction.
+- **Briefing.** The **Horizon scan** card shows the scan of the day: when it ran, which boards, how many asks were found, how many match an initiative and how many are new. Each finding has **Open in Triage**. The card says how many public pages the agent read and how many findings it skipped.
+
+## What it can and cannot do
+
+- It can search and read public web pages, and read your repository.
+- It can file a finding. That is the only thing it writes.
+- It cannot send anything: no mail, no message, no comment, no ticket.
+- It cannot read a page behind a login.
+- It cannot create an initiative, accept an ask or change a record. Only you can.
+- The run that reads the web never sees your repository. The run that reads your repository never reaches the web.
+- It cannot be started from the page. It runs on its schedule.
+
+Findings are proposals. The agent can be wrong. Check the sources before you accept.
+
+## The commands
+
+The agent uses `pmos scan file` to file one finding, `pmos scan match` to mark a finding that matches an initiative, `pmos scan suggest` to file a watch list suggestion and `pmos scan list` to read the findings of one scan. `pmos scan status` shows the cadence, the watch list and the last scan of each board. The other commands are yours, at an interactive terminal:
+
+- `pmos scan cadence <daily|weekly|off> --board <id>` sets how often a board is scanned.
+- `pmos scan watch keep <item> --board <id>` keeps a suggestion. `pmos scan watch remove <item> --board <id>` removes an item.
+- `pmos scan watch edit <item> --board <id> --name "<new name>"` changes an item.
+- `pmos scan watch add --board <id> --kind product --name "<what to watch>"` adds an item.
+
+The ledger is `scan.jsonl` in the state folder of the repository (`pmos/state`, `state` or `.pmos`). Each action adds one line. Nothing is changed or removed.

package/workspace/guide/index.md

@@ -62,6 +62,7 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 - [Initiatives: the Roadmap, the List and the initiative sheet](initiatives-screen.md): how to read and order the initiatives of a repository, open the sheet, make a new initiative, and review the cycle.
 - [Initiatives and the Roadmap: Now, Next and Later](initiatives-roadmap.md): what day one shows, how an agent proposes a move, and `pmos initiative` and `pmos measure` from a terminal.
 - [The Initiative Driver: drafts the agent files for you](initiative-driver.md): when the driver runs, the unblock sweep, the limits, Keep, Send back and Drop, the board modes, and `pmos driver`.
+- [The Horizon scan: the agent looks outside your initiatives](horizon-scan.md): how often it runs, the watch list you keep, what a scan does, where findings land, what it cannot do, and `pmos scan`.
 - [PM-only acts: what only you can do](pm-only-acts.md): which acts are yours, how the workspace checks that a press comes from your page or your terminal, and what to do when one is refused.
 - [PM-only lines: how the workspace checks your acts](pm-only-lines.md): how each act is recorded, what the Today card "A PM-only line is not attested" means, and the grants for a bulk lifecycle change and a Release.
 - [Breakdown › Timeline](timeline.md): an initiative's items on a time axis, split by stage, with milestones, today, and the at-risk flag when an item starts before its predecessor ends.

package/workspace/guide/initiative-driver.md

@@ -85,3 +85,7 @@ The agent uses `pmos driver propose` to file a proposal and `pmos driver status`
 - `pmos driver mode <off|shadow|approve> [--board <id>]` sets the board mode. Without `--board` it sets every board.
 
 The ledger is `driver.jsonl` in the state folder of the repository (`pmos/state`, `state` or `.pmos`). Each action adds one line. Nothing is changed or removed.
+
+## Related
+
+The [Horizon scan](horizon-scan.md) is the part of the agent that looks outside the initiatives: it files new opportunities as asks in Triage.

package/workspace/lib/engine/boards.js

@@ -27,7 +27,7 @@
  *   workflow     { stages: [{ name, cat, hint }], renamed: { old: new }, moved: [{ id, from, to }], sprints? }
  *   move         { id, from, to, why, warnings }
  *   assign       { id, to }                               (`board` is the board it left, or null)
- *   ask          { ask, line, source, draft }
+ *   ask          { ask, line, source, draft, found? }     found: what a Horizon scan filed with the ask { why, sources: [{ label, ref }], match, scan } (source 'scan')
  *   ask-accept   { ask, initiative, stage }
  *   ask-decline  { ask, why }
  *   ask-more     { ask, note }                            the asker is prompted for more detail; the ask stays open
@@ -146,6 +146,12 @@ const TOOLS = Object.freeze({
 
 const STATUSES = Object.freeze(['on track', 'at risk', 'late', 'done']);
 const VIEWS = Object.freeze(['now', 'mine', 'risk', 'noowner', 'all']);
+/** What a Horizon scan filed with an ask (initiative horizon-scan), cut to its shape; null for any other ask. */
+function foundOf(f) {
+  if (!f || typeof f !== 'object' || Array.isArray(f)) return null;
+  const sources = Array.isArray(f.sources) ? f.sources.filter((x) => x && typeof x.ref === 'string').slice(0, 8).map((x) => ({ label: String(x.label || ''), ref: x.ref })) : [];
+  return { why: typeof f.why === 'string' ? f.why : '', sources, match: typeof f.match === 'string' && f.match ? f.match : null, scan: typeof f.scan === 'string' ? f.scan : null, run: typeof f.run === 'string' ? f.run : null };
+}
 const KINDS = new Set(['board', 'workflow', 'move', 'assign', 'ask', 'ask-accept', 'ask-decline', 'ask-more', 'ini-workflow', 'task', 'task-update', 'ini-epics']);
 const TASK_STATES = Object.freeze(['To do', 'In progress', 'In review', 'Done']);
 
@@ -206,7 +212,7 @@ function fold(events) {
     } else if (e.kind === 'assign' && typeof e.id === 'string' && typeof e.to === 'string') {
       assigns.set(e.id, e.to);
     } else if (e.kind === 'ask' && b && typeof e.ask === 'string' && !asks.has(e.ask)) {
-      asks.set(e.ask, { id: e.ask, board: b, line: String(e.line || ''), source: e.source || null, draft: e.draft || null, at: e.at || null, by: e.by || null, state: 'open', initiative: null, stage: null, why: null, closedAt: null });
+      asks.set(e.ask, { id: e.ask, board: b, line: String(e.line || ''), source: e.source || null, draft: e.draft || null, ...(foundOf(e.found) ? { found: foundOf(e.found) } : {}), at: e.at || null, by: e.by || null, state: 'open', initiative: null, stage: null, why: null, closedAt: null });
     } else if (e.kind === 'ask-accept' && typeof e.ask === 'string' && asks.has(e.ask)) {
       const a = asks.get(e.ask);
       if (a.state !== 'open') continue;

package/workspace/lib/headless.js

@@ -3,7 +3,7 @@
  * (initiative workspace-headless-jobs; PM decision 2026-10-11: keep Jev, no direct Claude API, background
  * jobs that need no human run headless).
  *
- *   kindFor({ agent, origin, skill, env })        → 'notes' | 'skill' | 'ask' | 'drive' | null   (null: open a pane, as before)
+ *   kindFor({ agent, origin, skill, env })        → 'notes' | 'skill' | 'ask' | 'drive' | 'scan-web' | 'scan-repo' | null   (null: open a pane, as before)
  *   argsFor(kind, { modelArgs, addDirs })          → the argv after `claude`
  *   parseResult(stdout)                            → { ok, text, isError, turns, durationMs, costUsd, denied[] }
  *   logLines(result, exitCode)                     → the lines the read-only log pane shows at the end
@@ -20,6 +20,11 @@
  * connector tool is named in its list, so a connector read runs only where the PM's own Claude Code settings already allow it,
  * and a connector write is denied and reported like any other tool outside the list. The PM-only `pmos driver` verbs refuse an
  * agent session by themselves. The driver never runs in a pane (server.js refuses to start it when PMOS_HEADLESS=off).
+ *
+ * The `scan-web` and `scan-repo` kinds are the Horizon scan (initiative horizon-scan). `scan-web` has WebSearch, WebFetch and
+ * `pmos scan file`, and nothing else: it reads untrusted pages, so it holds no private data (no Read, Glob or Grep, no repository
+ * path in its prompt, no --add-dir). `scan-repo` reads the repository and the findings the web run filed, so it has no web tool and
+ * nothing that sends. Neither kind ever runs in a pane.
  */
 
 // The skills whose every start runs headless: they read, file a result for PMOS, and send nothing out.
@@ -33,6 +38,11 @@ const HEADLESS_ORIGINS = Object.freeze(['notes-bullets:', 'notes-summary:']);
 const ASK_ORIGINS = Object.freeze(['doc-ask:', 'focus-companion:']);   // focus-companion: the Meeting focus page's quiet companion and its private questions (read-only, nothing sent)
 // initiative-driver: one short run for one initiative or one Work task. Its origin is `drive:<kind>:<id>`.
 const DRIVE_ORIGINS = Object.freeze(['drive:']);
+// horizon-scan: a scan is two runs. The web run (origin `scan-web:<board>:<scan>`) reads the public web for the kept watch list and sees nothing of
+// the repository. The repository run (origin `scan-repo:<board>:<scan>`, and `scan-suggest:<board>` for the one that suggests a watch list) reads
+// the repository and fetches nothing. Neither has both untrusted input and a way out (PRD: trust boundary).
+const SCAN_WEB_ORIGINS = Object.freeze(['scan-web:']);
+const SCAN_REPO_ORIGINS = Object.freeze(['scan-repo:', 'scan-suggest:']);
 
 // What each kind may use. Read-only search is always allowed. The notes passes write their JSON (and rename the .tmp
 // file) in their notes folder, which --add-dir opens to them; the skills also run `pmos` verbs and repository scripts.
@@ -41,6 +51,11 @@ const TOOLS = Object.freeze({
   ask: Object.freeze(['Read', 'Glob', 'Grep']),
   drive: Object.freeze(['Read', 'Glob', 'Grep', 'Bash(pmos driver *)', 'Bash(pmos initiative list *)', 'Bash(pmos initiative export *)',
     'Bash(git log *)', 'Bash(ls *)', 'Bash(date *)']),
+  // The web run: WebSearch, WebFetch and the one verb that files a finding. No Read, no Glob, no Grep, no repository path in its prompt or its add-dirs.
+  'scan-web': Object.freeze(['WebSearch', 'WebFetch', 'Bash(pmos scan file *)']),
+  // The repository run: read and search the repository, `pmos scan` (its PM-only verbs refuse an agent session), the initiative list and git log.
+  // No WebSearch, no WebFetch, no curl, no git push: it reads the web run's findings, which are untrusted text, so it has nothing that sends or fetches.
+  'scan-repo': Object.freeze(['Read', 'Glob', 'Grep', 'Bash(pmos scan *)', 'Bash(pmos initiative list *)', 'Bash(git log *)']),
   skill: Object.freeze(['Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash(pmos *)', 'Bash(node *)',
     'Bash(git log *)', 'Bash(git status *)', 'Bash(git diff *)', 'Bash(ls *)', 'Bash(date *)']),
 });
@@ -57,6 +72,8 @@ function kindFor({ agent, origin, skill, env } = {}) {
   if (HEADLESS_ORIGINS.some((p) => o.startsWith(p))) return 'notes';
   if (ASK_ORIGINS.some((p) => o.startsWith(p))) return 'ask';
   if (DRIVE_ORIGINS.some((p) => o.startsWith(p))) return 'drive';
+  if (SCAN_WEB_ORIGINS.some((p) => o.startsWith(p))) return 'scan-web';
+  if (SCAN_REPO_ORIGINS.some((p) => o.startsWith(p))) return 'scan-repo';
   if (skill && HEADLESS_SKILLS.includes(String(skill))) return 'skill';
   return null;
 }
@@ -65,7 +82,8 @@ function argsFor(kind, { modelArgs = [], addDirs = [] } = {}) {
   const tools = TOOLS[kind];
   if (!tools) throw new Error('unknown headless kind: ' + kind);
   const argv = ['-p', '--output-format', 'json', '--no-session-persistence', ...modelArgs, '--allowedTools', tools.join(',')];
-  for (const d of addDirs) if (d) argv.push('--add-dir', String(d));
+  // The web run gets no directory at all, whatever the caller passes: it must not be able to read the repository.
+  if (kind !== 'scan-web') for (const d of addDirs) if (d) argv.push('--add-dir', String(d));
   return argv;
 }
 
@@ -107,4 +125,4 @@ function logLines(r, exitCode) {
   return out;
 }
 
-module.exports = { HEADLESS_SKILLS, HEADLESS_ORIGINS, ASK_ORIGINS, DRIVE_ORIGINS, TOOLS, DEFAULT_TIMEOUT_MS, kindFor, argsFor, timeoutMs, parseResult, logLines, switchedOff };
+module.exports = { HEADLESS_SKILLS, HEADLESS_ORIGINS, ASK_ORIGINS, DRIVE_ORIGINS, SCAN_WEB_ORIGINS, SCAN_REPO_ORIGINS, TOOLS, DEFAULT_TIMEOUT_MS, kindFor, argsFor, timeoutMs, parseResult, logLines, switchedOff };

package/workspace/lib/pmos-verbs.js

@@ -59,6 +59,9 @@ const VERBS = Object.freeze({
   // Not a pm-os-absorb verb (run: null): initiative initiative-driver added it through the same table.
   driver: Object.freeze({ module: 'driver-cli.js', run: null, guide: 'initiative-driver.md',
     help: 'pmos driver propose|status|keep|return|drop|pause|resume|mode … — the Initiative Driver: drafts for you to keep, send back or drop (pmos driver help)' }),
+  // Not a pm-os-absorb verb (run: null): initiative horizon-scan added it through the same table.
+  scan: Object.freeze({ module: 'scan-cli.js', run: null, guide: 'horizon-scan.md',
+    help: 'pmos scan file|list|match|suggest|status|cadence|watch … — the Horizon scan: what the agent found outside the initiatives, and the watch list (pmos scan help)' }),
   launcher: Object.freeze({ module: 'launcher-cli.js', run: null, guide: 'launcher.md',
     help: 'pmos launcher on|off|status — a PMOS app and a login item, so the workspace starts without a terminal' }),
 });

package/workspace/lib/route-modules.js

@@ -69,6 +69,7 @@ const MODULES = Object.freeze([
   'routes-meeting-focus', // console3 Meeting focus: the meeting, its note's talk, the companion's notes (GET); topic corrections and Ask PMOS quietly (page press)
   'routes-stage-tools',   // stage-tools-records: the records the PM edits per stage, what PMOS holds per stage, the sprint burndown
   'routes-driver',        // initiative-driver: the Agent strip's data, Keep, Send back, Drop, Pause and the board mode (driver.jsonl)
+  'routes-scan',          // horizon-scan: a board's watch list, cadence and last scan, the day's scan for the Briefing, the PM's watch and cadence presses (scan.jsonl)
 ]);
 const PM_DIR = path.join(__dirname, '..', 'public', 'pm');
 const MODULE_NAME = /^[a-z0-9][a-z0-9-]*\.js$/;

package/workspace/lib/routes-boards.js

@@ -94,6 +94,33 @@ function append(file, actor, ev) {
   return line;
 }
 
+/** A Horizon scan ask that the PM declines counts as a correction (initiative horizon-scan, PRD section 5): one line in corrections.jsonl, as the driver writes. */
+function scanDeclineSignal(ctx, a) {
+  if (!ctx.runtimeDir) return;
+  try {
+    const f = path.join(ctx.runtimeDir, 'corrections.jsonl');
+    const reason = 'scan:decline';
+    fs.mkdirSync(path.dirname(f), { recursive: true });
+    fs.appendFileSync(f, JSON.stringify({ type: 'correction', kind: 'reject', reason, run: (a.found && (a.found.run || a.found.scan)) || null, counted: true, at: new Date().toISOString(),
+      record: { kind: 'correction', run: (a.found && (a.found.run || a.found.scan)) || null, reason, by: 'pm' } }) + '\n');
+  } catch { /* the declined ask in the boards ledger is still the record */ }
+}
+
+/** The Triage ask of one Horizon scan finding (initiative horizon-scan, PRD section 4). The same ledger line as POST /api/boards/asks/add, with
+ * source 'scan', `found` and the agent as `by`. The ask id comes from the finding id, so writing it twice makes one ask. A scan never creates an
+ * initiative: the PM accepts or declines. → { ok, ask, existing } | { ok: false, error } */
+function appendScanAsk(ctx, w, boardId, f, by) {
+  const file = ledgerFile(ctx, w);
+  if (!file) return { ok: false, error: NO_STATE };
+  const id = 'ask-' + String(f.id).replace(/^f-/, '');
+  if (B.fold(readLedger(ctx, w)).asks.has(id)) return { ok: true, existing: true, id };
+  let draft = null;
+  try { draft = intake.intakeDraft({ line: f.title, root: w.root }); } catch { draft = null; }
+  append(file, { by }, { kind: 'ask', board: boardId, ask: id, line: f.title, source: 'scan', draft,
+    found: { why: f.why, sources: f.sources, match: f.match || null, scan: f.scan, run: f.run || null } });
+  return { ok: true, existing: false, id };
+}
+
 // ── boards of a workspace ─────────────────────────────────────────────────────────────────────────
 const isSelf = (ctx, w) => !!(ctx.selfRoot && w && path.resolve(w.root) === path.resolve(ctx.selfRoot));
 
@@ -750,6 +777,8 @@ const WRITES = {
     if (!ONE_LINE(body.why, 500)) return fail(ctx, res, 400, 'a decline needs a reason (why) of 1 to 500 characters');
     if (!p.file) return fail(ctx, res, 409, NO_STATE);
     append(p.file, g.actor, { kind: 'ask-decline', board: p.board.id, ask: a.id, why: body.why.trim() });
+    // initiative horizon-scan: a declined scan finding is a correction signal, as a dropped driver proposal is.
+    if (a.source === 'scan') scanDeclineSignal(ctx, a);
     ctx.json(res, { ok: true });
   },
 };
@@ -846,4 +875,4 @@ function meetingBoards(ctx) {
   return { list, detail };
 }
 
-module.exports = { prefixes: ['/api/boards'], handle, move, boardIndex, frameFor, boardIdOf, meetingBoards, boardsOf, baseRows, boardRow, portfolio, SELF_REFUSAL, NO_STATE };
+module.exports = { prefixes: ['/api/boards'], handle, move, boardIndex, appendScanAsk, frameFor, boardIdOf, meetingBoards, boardsOf, baseRows, boardRow, portfolio, SELF_REFUSAL, NO_STATE };