create-pmos 0.178.0 → 0.180.0

package/workspace/guide/reports-dashboards.md

@@ -1,8 +1,8 @@
 ---
 type: Guide
 title: "Reports: dashboards of reports"
-description: "How the console Reports page shows dashboards at portfolio, board and initiative scope, how to edit one, how to share one as a draft, how to put one on a schedule, and where the report drafts went."
-timestamp: 2026-10-11
+description: "How the console Reports page shows dashboards at portfolio, board and initiative scope, how to edit one, how to send one as a report, and what the Charts tab holds."
+timestamp: 2026-10-12
 ---
 
 # Reports: dashboards of reports
@@ -11,9 +11,13 @@ A report answers one question. A dashboard is a set of reports for one scope. Op
 
 ## The three tabs
 
-- **Dashboards.** The reports of one scope, drawn from the repository's records.
-- **Library.** Every report the workspace can draw, with the question it answers and where it is used.
-- **Drafts.** The dashboard drafts you made with Share, what the Briefing used to show below Needs you, and the report families. See "Drafts" below.
+Each tab has one job. A line under the tabs repeats it: **Live** goes to Dashboards, **Sent** goes to Reports, **Building blocks** goes to Charts.
+
+- **Dashboards.** The charts of one scope, drawn from the repository's records. A dashboard is live: it changes when your work changes. The tab shows how many dashboards there are.
+- **Reports.** The documents you send, with their set-ups. See [Set up a report by asking](reports-set-up.md). The tab shows how many drafts wait for you.
+- **Charts.** Every chart the workspace can draw, with the question it answers, the dashboards that use it and the reports that use it. The tab shows how many charts there are.
+
+The old tab names still work. A link to Library opens Charts. A link to Drafts opens Reports.
 
 The headline deck of the Reports page is above the tabs. It shows only report signals: claims that block sending, ticket keys in a leadership report, a digest that is due, and people who hold an old date. It never repeats the Briefing's cards. When there is no report signal, the deck says that nothing needs you. The scope buttons are on the same row as the tabs.
 
@@ -50,32 +54,17 @@ The Calendar page no longer carries these. They moved here.
 
 The workspace keeps your layout for each scope in its runtime state. It does not write to the repository. **Reset to default** returns a scope to its first layout.
 
-## Share a dashboard
-
-Press **Share**. A sheet shows the dashboard as a report: a headline, one section per report, what needs your call, and the sources. Choose **Leadership** for one sentence per report. Choose **Team** to add the numbers behind each sentence.
-
-**Make a draft now** puts one draft in the outbox. Nothing is sent. With no channel connected, the outbox says so.
-
-## Put a dashboard on a schedule
-
-A schedule makes a ready draft of a dashboard and tells you on the bell. Nothing is sent. No sender channel is connected yet, so you send the draft yourself.
-
-1. Press **Share**.
-2. Choose the audience: **Leadership** or **Team**.
-3. Choose **Weekly, Mondays 08:00** or **Monthly, 1st at 08:00**. The sheet shows the next draft.
-4. Press **Save schedule**.
+## Send a dashboard as a report
 
-The dashboard head then says "Scheduled: ..., draft only". To stop a schedule, choose **Not scheduled** and press **Save schedule**. A dashboard has one schedule. The times are the time on this computer.
+A dashboard is live. A report is a document that you send on a day. To send a dashboard as a report, press **Send this as a report…** in the head of the dashboard.
 
-On each run, the workspace reads the dashboard as it is then, with your layout, and puts one draft in the outbox. The draft text is the same as the text **Make a draft now** makes. The bell shows "a scheduled draft is ready" for 7 days, or until you discard the draft. Press the notice to open **Drafts**.
+1. A sheet shows the proposed report: its name, what it is built from, the output, the schedule and the audience.
+2. Change the name. Choose the output: **PDF** or **Google Slides**. Choose the schedule: **Weekly**, **Every 2 weeks** or **Monthly**. Choose the audience: **Leadership** or **Team**.
+3. Press **Set up**.
 
-If the workspace is not running at the time, the run happens once when it starts again. It does not make one draft for each run it missed. If a run cannot read the dashboard, **Scheduled** shows why, and the next run tries again.
+PMOS shows the first draft date. Each cycle is a snapshot document of the dashboard as it was on that day. The document is in Reports, under Documents, and the set-up is under Set up. The dashboard stays live.
 
-## Drafts
+PMOS drafts only. It sends nothing. It writes to Google only when you press **Create the copy** in the document.
 
-Open the **Drafts** tab. It has these parts, in order.
+The Share sheet and the schedule control of a dashboard are gone. Each schedule is now the schedule of a report. See and change it in Reports, under Set up.
 
-- **Drafts.** One row for each dashboard draft. A row says **Made by schedule** or **Made by you**. Press **Preview** to read the text. Press **Discard** to remove it from the list. **Undo** in the message brings it back. The log keeps the line.
-- **Scheduled.** One row for each schedule: the dashboard, how often, the audience and the next draft.
-- **Handled for you**, **What I could stop** and **Data you can lean on.** The Briefing used to show these. They come from the same briefing data. A card with no data does not show.
-- **Reports to send.** The four report families, the claims check and the outbox. They work as before.

package/workspace/guide/reports-page.md

@@ -2,7 +2,7 @@
 type: Guide
 title: "Reports: draft, read and issue"
 description: "How to draft a report, add your notes, issue it, and print or copy it. How the report schedules and the Today cards for reports work."
-timestamp: 2026-10-05
+timestamp: 2026-10-12
 ---
 
 # Reports: draft, read and issue
@@ -15,11 +15,16 @@ The workspace keeps each report in a file of the repository, for example `planni
 
 Open the Reports tab with the shortcut `g r`, from the command palette, or from the Today card of a report. Reports shows the repository that is open.
 
-The page has three parts:
+The Reports page has three tabs: Dashboards, Reports and Charts. See [Reports: dashboards of reports](reports-dashboards.md) and [Set up a report by asking](reports-set-up.md).
 
-- **Report schedules.** The schedules that draft a report.
-- **Reports.** The reports of the repository, newest first.
-- **The selected report.** Its text and the actions you can do on it.
+The Reports tab is for the documents that you issue. It has four parts:
+
+- **Ask PMOS.** Describe a report. PMOS drafts it.
+- **Found in your work.** The reports PMOS found that you already issue.
+- **Set up.** One row for each report with a schedule.
+- **Documents.** One row for each cycle of each report. A draft or an issued document opens in the [document sheet](document-sheet.md).
+
+The parts that this guide describes below, such as Draft now, Edit notes and the report schedules, are the controls of the cadence report. The Reports tab does not show them. The `pmos report` commands in "In a terminal" do the same acts.
 
 ## Draft a report
 

package/workspace/guide/reports-set-up.md

@@ -0,0 +1,56 @@
+---
+type: Guide
+title: "Set up a report by asking, and the report finder"
+description: "How to ask PMOS to draft a report you send, how the report finder finds reports you already send, how to set one up, and how a cycle becomes a document you issue."
+timestamp: 2026-10-12
+---
+
+# Set up a report by asking, and the report finder
+
+Many PMs send the same report again and again, for example an update for a standing meeting. PMOS can draft that report on its day. You read it, change it and issue it. PMOS drafts only. It never sends a report.
+
+Open the **Reports** tab of the console. It has four parts: Ask PMOS, Found in your work, Set up and Documents.
+
+## Ask PMOS
+
+1. Write what the report is in the Ask box. For example: "My TSC update every month, due a week before TSC".
+2. Press **Set up**. PMOS reads your earlier copies and learns the sections. This takes a minute. You can leave the page. **Cancel** stops it.
+3. PMOS shows its proposal: what it found, the proposed report, what it learned from, and the fixes it will apply.
+4. Press **Set up** to accept the proposal. Press **Change** to say what to change, for example "Draft it on Tuesday instead". PMOS revises the proposal. Press **Cancel** to drop it.
+
+A proposal shows the name, the purpose, the audience, the output, the schedule, the sources and the sections in order. Change the output with the buttons: Google Slides, Google Doc, Google Sheets, Confluence or PDF. PMOS shows the report in the same format in the sheet.
+
+If PMOS finds no earlier copy, the proposal says so and works from your words only.
+
+## Found in your work
+
+PMOS looks for reports that you send already. It reads your calendar, Slack, Drive and the subjects of mail you sent. It never reads a message body. Each finding says why PMOS thinks it is a report, shows the evidence, and says **Likely** or **Not sure**.
+
+For each finding you can:
+
+- Press **Set up** to accept the proposal as it is.
+- Press **Change first** to open the proposal and change it.
+- Press **Not a report**. The finding goes away at once, and PMOS says it will not suggest it again. Press **Undo** in the next five seconds to bring it back. After five seconds the choice is saved.
+
+The most likely finding also shows on the Briefing as **Report found**. Press **See what PMOS found** to open it on the Reports tab. Turn the finder off, or change its sources, in [Settings](settings.md), under Connectors.
+
+## Set up and Documents
+
+**Set up** has one row for each report: its source, output, schedule, next draft and last issue. Each row has these buttons:
+
+- **Open** opens the current draft.
+- **All cycles** lists every cycle of the report.
+- **Pause** stops the drafts. **Resume** starts them again.
+
+**Documents** has one row for each cycle: Draft or Issued, the output, the copy state and who made it. Filter by state or by source. Press **Open** to read a document in the [document sheet](document-sheet.md).
+
+## What PMOS does and does not do
+
+- PMOS drafts on the day of the schedule. It sends nothing.
+- PMOS writes to Google or to Confluence only when you press **Create the copy** or **Update the copy**.
+- A download happens only when you press a download item.
+- You issue a report. An issued report is frozen.
+
+## Send a dashboard as a report
+
+To make a report from a dashboard, use **Send this as a report…** on the dashboard. See [Reports: dashboards of reports](reports-dashboards.md).

package/workspace/guide/reports.md

@@ -2,7 +2,7 @@
 type: Guide
 title: "Reports: draft and issue a cadence report"
 description: "How pmos report drafts a cadence report with every number, how the notes are kept when you draft again, and how you issue and freeze a report."
-timestamp: 2026-10-05
+timestamp: 2026-10-12
 ---
 
 # Reports: draft and issue a cadence report
@@ -64,6 +64,14 @@ pmos report issue biweekly 2026-10-16
 
 `pmos report list [<cadence>]` shows each draft and each issued report, newest first, with who issued it.
 
+`pmos report propose` is for an agent run. It files one report proposal or finding. It refuses a pattern that you dismissed with Not a report.
+
+`pmos report definitions` lists the report definitions. It only reads.
+
+`pmos report setups` lists the recurring reports that are set up.
+
+`pmos report finder` shows the report finder setting, or changes it.
+
 Every command accepts `--root <dir>` to name the repository. `draft` and `list` also accept `--json`.
 
 ## The window
@@ -73,3 +81,7 @@ The window starts at the time of the last issued report of the same cadence, so
 ## The report lane
 
 An initiative in the report lane completes its last step when you issue its report. The workflow engine reads the issued line for the initiative's `doc_path` in `issues.jsonl`.
+
+## Reports of your own
+
+The cadence report is the report that PMOS defines. For a report that you send already, such as an update for a standing meeting, use the Reports tab of the console. Describe the report, or let the report finder find it. See [Set up a report by asking](reports-set-up.md).

package/workspace/guide/settings.md

@@ -27,10 +27,10 @@ Settings is not a tab. While it is open, no tab is selected. Press a tab to go b
 | About you | Your name, your role, what you do and your job description. The Welcome page asks for the same four on first run. |
 | Workspaces | Your workspaces: rename, remove, add one by its folder. Which workspace opens on start, and what the Briefing covers. |
 | Boards and workflows | The workflow templates for new boards and the default template. The rules that move a card. To change the workflow of one board, open that board in Initiatives. |
-| Connectors | How your Claude session reaches Google Calendar, Jira, Wispr Flow and a sender. The import window, the refresh time, how private events show, and attendee names. |
+| Connectors | How your Claude session reaches Google Calendar, Jira, Wispr Flow and a sender. The import window, the refresh time, how private events show, and attendee names. The report finder is the last block. |
 | Recording | The live transcript: what to listen to, the Whisper model, the language, the echo removal, the final pass after Stop, the words to recognize, and how long kept audio stays. A card at the top says what recording uses now. |
 | Day and time | The time zone, the first day of the week, your working hours, the free time before a meeting with prep, the buffer between meetings, and the time-of-day tint and daylight strip. |
-| Sharing | How a dashboard is shared: off, a link, or sent by the sender. The audiences of the workspace. |
+| Sharing | How a report is shared: off, a link, or sent by the sender. The audiences of the workspace. Schedules are not here. Each report has its own schedule, in Reports, under Set up. |
 | Access and devices | Use from a phone or another computer: the host, the tunnel and the people who may open it. |
 | Claude sessions | What a new session starts with: the CLI, the model, the Claude profile and the launch flags. The session limits. Validate consent for this workspace. |
 | Privacy and data | A list of what leaves this computer and when. Whether a TypeSafe key is saved, the local model that answers when there is no key (Off, Winnow or Laya), and the data folder. |
@@ -74,3 +74,12 @@ The other settings are kept in the PMOS state directory, in `settings.json` for
 - A setting changes what the page stores. Some features read their setting in a later release. Until then, the feature uses its default.
 - Settings changes templates and defaults for boards. It does not change an existing board.
 - Nothing on this page sends a message or shares a dashboard by itself.
+
+## The report finder
+
+The report finder is the last block of **Connectors**. It looks for reports that you send already, and shows what it found on the Reports tab and on the Briefing.
+
+- **Look for reports you send.** Choose **Weekly** or **Off**. Weekly looks every Monday. Off stops it.
+- **Sources.** The finder reads Calendar, Slack and Drive. It reads the subjects and the recipient counts of mail you sent, only when you turn **Sent mail subjects** on. It never reads a message body. Sent mail subjects are off until you turn them on.
+
+See [Set up a report by asking](reports-set-up.md).

package/workspace/lib/doc-sync.js

@@ -11,7 +11,9 @@
  *   readingsByLink(rows)                   → Map "<path>|<kind>" → readings, oldest first (refused lines skipped)
  *   runsOf(rows)                           → { runs, open, last, syncs }   checks, and the syncs the PM pressed
  *   signal(link, readings, repo)           → { signal, words, basis, checked_at, … }
- *   remoteIdOf(kind, target)               → the Google Doc id or Confluence page id in a pasted link
+ *   remoteIdOf(kind, target)               → the Google file id or Confluence page id in a pasted link
+ *   kindOfTarget(target)                   → 'google' | 'google-slides' | 'google-sheets' | 'confluence' | null, from a pasted address
+ *   copyKindOf(output)                     → the copy kind a report output makes (pdf: null)
  *
  * ── How a signal is decided ────────────────────────────────────────────────────────────────────────────────────
  * A READING is what a check session saw for one link: whether the copy exists, its version and modified time, and
@@ -36,8 +38,10 @@
  * writes nothing: a session holding the PM's connectors does the write and records it through `pmos docs`.
  */
 
-const KINDS = Object.freeze(['google', 'confluence']);
-const KIND_LABEL = Object.freeze({ google: 'Google Docs', confluence: 'Confluence' });
+// `google` is a Google Doc (the first kind, so its name stays); Slides and Sheets joined it with report-workspace.
+const KINDS = Object.freeze(['google', 'google-slides', 'google-sheets', 'confluence']);
+const KIND_LABEL = Object.freeze({ google: 'Google Docs', 'google-slides': 'Google Slides', 'google-sheets': 'Google Sheets', confluence: 'Confluence' });
+const GOOGLE_KINDS = Object.freeze(['google', 'google-slides', 'google-sheets']);
 const EVENTS = Object.freeze(['run', 'reading']);
 const SIGNALS = Object.freeze(['same', 'ahead', 'behind', 'diverged', 'unchecked', 'unreadable', 'missing-remote', 'missing-repo']);
 // What needs the PM's eye: everything but `same`. `unchecked` is included — a copy nobody read is not known to match.
@@ -56,11 +60,29 @@ function okPath(p) {
   return !(p.startsWith('/') || p.includes('\\') || p.split('/').some((s) => s === '..' || s === '.' || s === ''));
 }
 
+/**
+ * The copy kind a pasted address names, or null: Google Slides (docs.google.com/presentation), Google Sheets
+ * (docs.google.com/spreadsheets), a Google Doc (any other Google address) or Confluence. The server decides; a page may guess too.
+ */
+function kindOfTarget(target) {
+  const t = String(target || '').trim();
+  if (!t) return null;
+  if (remoteIdOf('confluence', t) && /atlassian|confluence|\/wiki\/|pageId=/i.test(t)) return 'confluence';
+  if (!remoteIdOf('google', t) || !/google|docs\.|drive\./i.test(t)) return null;
+  if (/\/presentation\//i.test(t)) return 'google-slides';
+  if (/\/spreadsheets\//i.test(t)) return 'google-sheets';
+  return 'google';
+}
+
+/** The copy kind a report's output makes: a Google Doc, Slides or Sheets, a Confluence page; a PDF has no live copy (null). */
+const COPY_KIND_OF_OUTPUT = Object.freeze({ 'google-doc': 'google', 'google-slides': 'google-slides', 'google-sheets': 'google-sheets', confluence: 'confluence', pdf: null });
+const copyKindOf = (output) => (Object.prototype.hasOwnProperty.call(COPY_KIND_OF_OUTPUT, output) ? COPY_KIND_OF_OUTPUT[output] : null);
+
 /** The id inside a pasted link, so the same copy pasted in two shapes is one copy. */
 function remoteIdOf(kind, target) {
   const t = String(target || '').trim();
   if (!t) return null;
-  if (kind === 'google') {
+  if (GOOGLE_KINDS.includes(kind)) {
     const m = /\/d\/([A-Za-z0-9_-]{10,})/.exec(t) || /[?&]id=([A-Za-z0-9_-]{10,})/.exec(t);
     if (m) return m[1];
     return /^[A-Za-z0-9_-]{10,}$/.test(t) ? t : null;
@@ -220,6 +242,6 @@ function signal(link, readings, repo) {
 }
 
 module.exports = {
-  KINDS, KIND_LABEL, EVENTS, SIGNALS, ATTENTION, RUN_ID, USES,
-  checkRow, readingsByLink, runsOf, signal, remoteIdOf, okPath, keyOf,
+  KINDS, KIND_LABEL, GOOGLE_KINDS, EVENTS, SIGNALS, ATTENTION, RUN_ID, USES,
+  checkRow, readingsByLink, runsOf, signal, remoteIdOf, kindOfTarget, copyKindOf, okPath, keyOf,
 };

package/workspace/lib/docs-cli.js

@@ -4,12 +4,12 @@
  *
  *   pmos docs [list] [--attention] [--json]               each linked document and its signal per copy
  *   pmos docs link <file> <google-or-confluence-link>     link a repository file to a copy
- *   pmos docs unlink <file> google|confluence             remove that link (the copy is not touched)
+ *   pmos docs unlink <file> google|google-slides|google-sheets|confluence             remove that link (the copy is not touched)
  *   pmos docs check-start [--json]                        open a check: what to read, with each file's hash
  *   pmos docs record <check> --file <readings.json>       record what the session read
  *   pmos docs check-finish <check> [--summary "…"]        close the check
  *   pmos docs find [words]                                the repository's markdown files that match, with or without a copy
- *   pmos docs sync-start <file> google|confluence --use pmos|copy [--json]   open a sync of one copy (the sync session)
+ *   pmos docs sync-start <file> google|google-slides|google-sheets|confluence --use pmos|copy [--json]   open a sync of one copy (the sync session)
  *   pmos docs sync-finish <sync> --version <v> [--modified-at <t>] [--url <u>]   close it: both sides now the same
  *   pmos docs sync-fail <sync> --reason "…"               close it: nothing was written, and why
  *
@@ -33,12 +33,12 @@ const USAGE = [
   'usage: pmos docs [list|link|unlink|find|check-start|record|check-finish|sync-start|sync-finish|sync-fail] — is each linked document the same as its Google Docs and Confluence copy',
   '  pmos docs [list] [--attention] [--json]            each linked document and its signal: same, ahead, behind, edited in both',
   '  pmos docs link <file> <link>                       link a repository file to a Google Doc or a Confluence page',
-  '  pmos docs unlink <file> google|confluence          remove that link; the copy is not touched',
+  '  pmos docs unlink <file> google|google-slides|google-sheets|confluence          remove that link; the copy is not touched',
   '  pmos docs check-start [--json]                     (check session) open a check and list what to read',
   '  pmos docs record <check> --file <readings.json>    (check session) record what was read',
   '  pmos docs check-finish <check> [--summary "…"]     (check session) close the check',
   '  pmos docs find [words]                             the repository\'s markdown files that match',
-  '  pmos docs sync-start <file> google|confluence --use pmos|copy   (sync session) open a sync of one copy',
+  '  pmos docs sync-start <file> google|google-slides|google-sheets|confluence --use pmos|copy   (sync session) open a sync of one copy',
   '  pmos docs sync-finish <sync> --version <v> [--modified-at <t>] [--url <u>]   (sync session) both sides are now the same',
   '  pmos docs sync-fail <sync> --reason "…"            (sync session) nothing was written, and why',
   'Nothing here writes a document. Press Check now, or Use … version on one copy, in Docs.',
@@ -66,11 +66,7 @@ function whoOf(flags, env) {
   if (flags.by) return 'profile:' + String(flags.by).slice(0, 60);
   return null;
 }
-const kindOf = (target) => {
-  if (D.remoteIdOf('confluence', target) && /atlassian|confluence|\/wiki\/|pageId=/i.test(target)) return 'confluence';
-  if (D.remoteIdOf('google', target) && /google|docs\.|drive\./i.test(target)) return 'google';
-  return null;
-};
+const kindOf = (target) => D.kindOfTarget(target);
 const ago = (iso, now) => {
   if (!iso) return 'never';
   const m = Math.round((now - Date.parse(iso)) / 60000);
@@ -125,7 +121,7 @@ async function run(argv, { say = console.log, cwd = process.cwd(), env = process
 
   if (sub === 'unlink') {
     const [file, kind] = [pos[1], pos[2]];
-    if (!file || !D.KINDS.includes(kind)) return fail('usage: pmos docs unlink <file> google|confluence', 2);
+    if (!file || !D.KINDS.includes(kind)) return fail('usage: pmos docs unlink <file> google|google-slides|google-sheets|confluence', 2);
     const r = rel(file);
     if (!r) return fail(`${file} is not inside this repository`);
     const w = store.removeLink(root, { path: r, kind });
@@ -186,7 +182,7 @@ async function run(argv, { say = console.log, cwd = process.cwd(), env = process
   }
   if (sub === 'sync-start') {
     const [file, kind] = [pos[1], pos[2]];
-    if (!file || !D.KINDS.includes(kind) || !D.USES.includes(flags.use)) return fail('usage: pmos docs sync-start <file> google|confluence --use pmos|copy', 2);
+    if (!file || !D.KINDS.includes(kind) || !D.USES.includes(flags.use)) return fail('usage: pmos docs sync-start <file> google|google-slides|google-sheets|confluence --use pmos|copy', 2);
     if (!by) return fail('a sync must name who writes: run it in a workspace session, or add --by <profile>');
     const r = rel(file);
     if (!r) return fail(`${file} is not inside this repository`);

package/workspace/lib/four-panel.js

@@ -68,7 +68,7 @@ const INITIATIVE_LINKS = 'initiative-links.jsonl';
 const ARTIFACT_SYNC = 'artifact-sync.jsonl';
 
 /** The destinations the surface can declare. A kind outside this set is refused, not stored. */
-const LINK_KINDS = ['confluence', 'jira', 'google'];
+const LINK_KINDS = ['confluence', 'jira', 'google', 'google-slides', 'google-sheets'];
 
 /**
  * The closed vocabulary a link row may use about itself. Three states, and the word `connected` is

package/workspace/lib/headless.js

@@ -3,7 +3,7 @@
  * (initiative workspace-headless-jobs; PM decision 2026-10-11: keep Jev, no direct Claude API, background
  * jobs that need no human run headless).
  *
- *   kindFor({ agent, origin, skill, env })        → 'notes' | 'skill' | 'ask' | 'drive' | 'scan-web' | 'scan-repo' | null   (null: open a pane, as before)
+ *   kindFor({ agent, origin, skill, env })        → 'notes' | 'skill' | 'ask' | 'drive' | 'scan-web' | 'scan-repo' | 'report-setup' | 'report-find' | null   (null: open a pane, as before)
  *   argsFor(kind, { modelArgs, addDirs })          → the argv after `claude`
  *   parseResult(stdout)                            → { ok, text, isError, turns, durationMs, costUsd, denied[] }
  *   logLines(result, exitCode)                     → the lines the read-only log pane shows at the end
@@ -25,6 +25,14 @@
  * `pmos scan file`, and nothing else: it reads untrusted pages, so it holds no private data (no Read, Glob or Grep, no repository
  * path in its prompt, no --add-dir). `scan-repo` reads the repository and the findings the web run filed, so it has no web tool and
  * nothing that sends. Neither kind ever runs in a pane.
+ *
+ * The `report-setup` and `report-find` kinds are the report workspace (initiative report-workspace). `report-setup` (origin `report-setup:<ask>`)
+ * turns the PM's request in the Ask box into ONE proposal: it reads the repository, the report definitions and (where the PM's own settings allow
+ * it) the PM's earlier copies through read-only connectors, and its only write is `pmos report propose`. `report-find` (origin `report-find:<run>`)
+ * is the weekly look for reports the PM already sends. It reads calendar, Slack, mail SUBJECTS and file names, which is untrusted text, so it holds
+ * no Write, no Edit, no web fetch and no tool that sends or posts, and its only write is `pmos report propose`. A connector tool is named in neither
+ * list: a connector read runs only where the PM's own Claude Code settings already allow it, and a connector write is denied and reported. A proposal
+ * is data; only the PM's press on the Reports page sets a report up. Neither kind ever runs in a pane.
  */
 
 // The skills whose every start runs headless: they read, file a result for PMOS, and send nothing out.
@@ -43,6 +51,9 @@ const DRIVE_ORIGINS = Object.freeze(['drive:']);
 // the repository and fetches nothing. Neither has both untrusted input and a way out (PRD: trust boundary).
 const SCAN_WEB_ORIGINS = Object.freeze(['scan-web:']);
 const SCAN_REPO_ORIGINS = Object.freeze(['scan-repo:', 'scan-suggest:']);
+// report-workspace: the Ask box run (origin `report-setup:<ask>`) and the weekly finder run (origin `report-find:<run>`).
+const REPORT_SETUP_ORIGINS = Object.freeze(['report-setup:']);
+const REPORT_FIND_ORIGINS = Object.freeze(['report-find:']);
 
 // What each kind may use. Read-only search is always allowed. The notes passes write their JSON (and rename the .tmp
 // file) in their notes folder, which --add-dir opens to them; the skills also run `pmos` verbs and repository scripts.
@@ -56,6 +67,12 @@ const TOOLS = Object.freeze({
   // The repository run: read and search the repository, `pmos scan` (its PM-only verbs refuse an agent session), the initiative list and git log.
   // No WebSearch, no WebFetch, no curl, no git push: it reads the web run's findings, which are untrusted text, so it has nothing that sends or fetches.
   'scan-repo': Object.freeze(['Read', 'Glob', 'Grep', 'Bash(pmos scan *)', 'Bash(pmos initiative list *)', 'Bash(git log *)']),
+  // The Ask box run: read and search, the one verb that files a proposal, the read-only list of definitions and git log. No Write, no Edit, no web,
+  // nothing that sends. The PM's earlier copies are read through a connector only where the PM's own settings allow it (as for `drive`).
+  'report-setup': Object.freeze(['Read', 'Glob', 'Grep', 'Bash(pmos report propose *)', 'Bash(pmos report definitions *)', 'Bash(git log *)']),
+  // The finder run: read and search, and the one verb that files a finding. Calendar, Slack, mail subjects and Drive are read through the PM's own
+  // connectors where the PM's settings allow it. No web fetch, no git, no Write or Edit, nothing that sends or posts.
+  'report-find': Object.freeze(['Read', 'Glob', 'Grep', 'Bash(pmos report propose *)']),
   skill: Object.freeze(['Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash(pmos *)', 'Bash(node *)',
     'Bash(git log *)', 'Bash(git status *)', 'Bash(git diff *)', 'Bash(ls *)', 'Bash(date *)']),
 });
@@ -74,6 +91,8 @@ function kindFor({ agent, origin, skill, env } = {}) {
   if (DRIVE_ORIGINS.some((p) => o.startsWith(p))) return 'drive';
   if (SCAN_WEB_ORIGINS.some((p) => o.startsWith(p))) return 'scan-web';
   if (SCAN_REPO_ORIGINS.some((p) => o.startsWith(p))) return 'scan-repo';
+  if (REPORT_SETUP_ORIGINS.some((p) => o.startsWith(p))) return 'report-setup';
+  if (REPORT_FIND_ORIGINS.some((p) => o.startsWith(p))) return 'report-find';
   if (skill && HEADLESS_SKILLS.includes(String(skill))) return 'skill';
   return null;
 }
@@ -125,4 +144,4 @@ function logLines(r, exitCode) {
   return out;
 }
 
-module.exports = { HEADLESS_SKILLS, HEADLESS_ORIGINS, ASK_ORIGINS, DRIVE_ORIGINS, SCAN_WEB_ORIGINS, SCAN_REPO_ORIGINS, TOOLS, DEFAULT_TIMEOUT_MS, kindFor, argsFor, timeoutMs, parseResult, logLines, switchedOff };
+module.exports = { HEADLESS_SKILLS, HEADLESS_ORIGINS, ASK_ORIGINS, DRIVE_ORIGINS, SCAN_WEB_ORIGINS, SCAN_REPO_ORIGINS, REPORT_SETUP_ORIGINS, REPORT_FIND_ORIGINS, TOOLS, DEFAULT_TIMEOUT_MS, kindFor, argsFor, timeoutMs, parseResult, logLines, switchedOff };