create-pmos 0.27.0 → 0.29.0

package/README.md

@@ -333,6 +333,32 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.28.0
+
+**`search everything…` now searches every file in the folder, and any file it finds opens in a tab.**
+Run `npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **The box searched three lists, and the folder was not one of them.** It matched initiative slugs,
+  paths *declared on* an initiative record, and session names — so a file PMOS had never been told
+  about could not be found by typing its exact name. Worse, the miss read *"nothing matches — a
+  successful read of nothing"*, which is the phrase for *we looked and there was nothing there*,
+  printed after a search that never opened the folder.
+- **Type any part of a name or a path.** Every file under the workspace root now matches, at any
+  depth, whether or not any record mentions it — `README.md`, a script, a CSV you dropped in
+  yesterday. `node_modules/`, `dist/`, `.git/` and the other junk directories are skipped, exactly as
+  the folder lens already skips them, so search and the file tree agree about what is in there.
+- **Type a phrase that is *inside* a file.** Text files are searched by content too, and the result
+  names the file **and the line**, so you can see the match before you open anything.
+- **Click a result and it opens in a document tab** — the same reader you already use, with `view` ·
+  `raw` · `edit` · `diff`. A file the reader cannot show (an image, a binary) is still listed, greyed,
+  and says so, instead of opening a tab onto a failure.
+- **It works in every mode.** The search box was rendered in all seven and did something in exactly
+  one — including doing nothing in the library lens, the one screen that lists files.
+- **It tells you what it did not look at.** The walk is bounded so a huge folder can never hang the
+  box, and any bound that actually bit is stated in the heading. `11 of 1424 searched` is a
+  different sentence from `BOUNDED — files beyond the walk limit were not looked at`, and you get
+  whichever one is true. Nothing leaves your machine, as ever.
+
 ## What's new in 0.26.0
 
 **Your sessions now know which initiative they belong to — whatever branch you are on — and each

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Scaffold the PMOS portable kit \u2014 run the PMOS product-management workflow (initiative \u2192 lane-fit spec \u2192 contract \u2192 build \u2192 three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@86ae610
-assembled: 2026-08-02
+kernel-source: pmos@4104fde
+assembled: 2026-08-04
 mode: vendor

package/payload/scripts/pmos-log.sh

@@ -45,10 +45,37 @@ case "$cmd" in
     append runs.jsonl "{\"run_id\":$(js "$1"),\"initiative_id\":$(js "$2"),\"human_corrections\":$corr,\"date\":\"$today\"$model_field}"
     ;;
   eval)
-    [ $# -ge 5 ] || fail "usage: eval <run_id> <initiative_id> <score 0..1> <PASS|PASS-WITH-FINDINGS|FAIL> <rubric_path> [evaluator_model]"
+    # SKIPPED is a verdict this writer must be able to record.
+    #
+    # The enum here was PASS|PASS-WITH-FINDINGS|FAIL, while AGENTS.md tells every adopter: "a gate
+    # that was skipped is recorded as skipped — never leave a missing eval to be read as a pass."
+    # An adopter following that instruction hit `fail` and had no way to comply except by hand-
+    # appending, which is the drift this writer exists to prevent. PMOS-self's own ledger carries 16
+    # SKIPPED rows; the kit could not have written one of them.
+    #
+    # A skip is NOT a soft pass: it takes no score (a skip has no score to give), it requires a
+    # stated reason — an unexplained skip is indistinguishable from a forgotten one — and it leaves
+    # the verification the run owes still owing.
+    if [ "${4:-}" = "SKIPPED" ] || [ "${3:-}" = "SKIPPED" ]; then
+      # tolerated both argument positions: `eval <run> <init> SKIPPED <reason>` is the natural form
+      # when there is no score to give, and refusing it on argument order would just push people
+      # back to hand-appending.
+      if [ "${3:-}" = "SKIPPED" ]; then skip_reason="${4:-}"; skip_rubric="${5:-}"; skip_model="${6:-}"
+      else skip_reason="${5:-}"; skip_rubric="${6:-}"; skip_model="${7:-}"; fi
+      nonempty run_id "$1"; nonempty initiative_id "$2"
+      [ -n "$skip_reason" ] || fail "SKIPPED needs a reason: eval <run_id> <initiative_id> SKIPPED <reason> [rubric_path] [evaluator_model]"
+      rubric_field=""
+      if [ -n "$skip_rubric" ]; then rubric_field=",\"rubric_path\":$(js "$skip_rubric")"; fi
+      emodel_field=""
+      if [ -n "$skip_model" ]; then emodel_field=",\"evaluator_model\":$(js "$skip_model")"; fi
+      append evals.jsonl "{\"run_id\":$(js "$1"),\"initiative_id\":$(js "$2"),\"score\":null,\"verdict\":\"SKIPPED\",\"skipped_reason\":$(js "$skip_reason")$rubric_field,\"date\":\"$today\"$emodel_field}"
+      exit 0
+    fi
+    [ $# -ge 5 ] || fail "usage: eval <run_id> <initiative_id> <score 0..1> <PASS|PASS-WITH-FINDINGS|FAIL> <rubric_path> [evaluator_model]
+       or: eval <run_id> <initiative_id> SKIPPED <reason> [rubric_path] [evaluator_model]"
     nonempty run_id "$1"; nonempty initiative_id "$2"
     printf '%s' "$3" | grep -qE '^(0?\.[0-9]+|0|1(\.0+)?)$' || fail "score must be 0..1 written as 0, 1, N.N or .N — got '$3'."
-    case "$4" in PASS|PASS-WITH-FINDINGS|FAIL) ;; *) fail "verdict must be PASS | PASS-WITH-FINDINGS | FAIL, got '$4'." ;; esac
+    case "$4" in PASS|PASS-WITH-FINDINGS|FAIL) ;; *) fail "verdict must be PASS | PASS-WITH-FINDINGS | FAIL | SKIPPED, got '$4'." ;; esac
     score="$3"; case "$score" in .*) score="0$score" ;; esac  # ".5" -> "0.5": bare .5 is not valid JSON
     [ -f "$KIT/$5" ] || [ -f "$5" ] || fail "rubric_path '$5' not found (relative to the kit or the repo)."
     # optional evaluator-model provenance (which model rendered the verdict). Calibration (κ) is a

package/payload/scripts/workflow-state.js

@@ -859,14 +859,48 @@ function computeWorkflow(id, opts) {
   // ── review ─ the Review Gate's verdict, where the lane has a rubric ──────────────────────────
   const evals = readJsonl(path.join(L.runsDir, 'evals.jsonl')).filter((e) => e && e.initiative_id === id);
   {
-    if (effLane === 'chore' || effLane === 'prototype') {
-      steps.push(step('review', 'review', 'na', effLane === 'prototype'
-        ? 'leg A is grilled as dialogue, never scored (D60)'
-        : 'chore lane carries no rubric (D56)'));
+    /* The rung reads the RUBRIC, not the lane.
+     *
+     * It keyed on `lane` alone, so a chore that deliberately carries a rubric could never surface
+     * its Review Gate — the ladder said "chore lane carries no rubric (D56)" while a SKIPPED verdict
+     * sat in evals.jsonl unread. That is how `guard-and-ledger-hardening`, a chore whose own record
+     * argues "blast radius overrides lane" and which carried a rubric on purpose, reached `accept`
+     * with the gate never run. The board could not show what the ledger already knew.
+     *
+     * A prototype is still never scored — D60 grills leg A as dialogue, and that is a property of
+     * the lane, not of whether someone attached a rubric. Every other lane defers to the artifact. */
+    const declaresRubric = !!String(fm.rubric_path || '').trim();
+    /* EVERY lane defers to the artifact — the first version said so in the comment and applied it
+     * only to `chore`, so a discovery or incident initiative with no rubric (legitimate under D56)
+     * showed a permanent `no Review-Gate verdict recorded`: a rung it could never satisfy. The lanes
+     * that carry no rubric by design are named once, here. */
+    const RUBRIC_OPTIONAL = ['chore', 'discovery', 'incident', 'content'];
+    if (effLane === 'prototype') {
+      steps.push(step('review', 'review', 'na', 'leg A is grilled as dialogue, never scored (D60)'));
+    } else if (RUBRIC_OPTIONAL.includes(effLane) && !declaresRubric && !evals.length) {
+      steps.push(step('review', 'review', 'na', `${effLane} lane carries no rubric (D56)`));
     } else if (evals.length) {
       const last = evals[evals.length - 1];
-      steps.push(step('review', 'review', 'done',
-        `${last.verdict}${last.score != null ? ` (${last.score})` : ''} — advisory until calibrated per evaluator model (D40)`));
+      const verdict = String(last.verdict || '').toUpperCase();
+      const label = `${last.verdict}${last.score != null ? ` (${last.score})` : ''} — advisory until calibrated per evaluator model (D40)`;
+      /* A SKIPPED gate is NOT a satisfied gate, and a FAIL is emphatically not one.
+       *
+       * This rung rendered both as a green ✓, which is the watermelon this repo names as its own
+       * failure mode: the board said the Review Gate was done over a row that says judging never
+       * happened. Thirteen initiatives currently render `✓ review` over a SKIPPED verdict, and the
+       * fix that made a chore's gate visible ADDED one. The module's own rule, repeated in three
+       * files — "a skip is an honest RECORD that verification did not happen; it is not
+       * verification" — now applies to the surface that reports it. */
+      if (verdict === 'SKIPPED') {
+        steps.push(step('review', 'review', 'pending', label,
+          'the gate was skipped, so it is still owed — commission an independent evaluator and record a real verdict',
+          { rule: 'R3' }));
+      } else if (verdict === 'FAIL') {
+        steps.push(step('review', 'review', 'blocked', label,
+          'the Review Gate FAILED — remediate the findings and record a new verdict', { rule: 'R3' }));
+      } else {
+        steps.push(step('review', 'review', 'done', label));
+      }
     } else {
       steps.push(step('review', 'review', 'pending', 'no Review-Gate verdict recorded',
         'score the build against the rubric (build-skills/evaluator.skill), then append to evals.jsonl',

package/payload/skills/evaluator.skill

@@ -7,7 +7,7 @@ description: Adversarially evaluate an agent run's output against its rubric and
 
 This skill is PMOS's **Review Gate** made a first-class, repeatable capability (P4). It formalizes the
 adversarial independent evaluator run by hand through P1–P3: judge what an agent run produced against a
-rubric, write a structured verdict to the `evals` table, and surface it on the radar/board. It runs in
+rubric, write a structured verdict through the validated writer (step 9), and surface it on the board. It runs in
 the **interactive agent runtime** — any capable coding agent; heavy judgment belongs in the agent, not
 an Edge Function ([D09](/DECISIONS.md)/[D34](/DECISIONS.md), amended 2026-07-23). PMOS-self runs it in
 Claude Code, but the runtime is not Claude-specific.
@@ -32,7 +32,7 @@ Claude Code, but the runtime is not Claude-specific.
   may under-reward an unfamiliar style. Either way: **default to skeptical**, and when a pass feels easy
   or you are uncertain, **say so explicitly** and flag the run for the cross-family spot-check /
   minority-veto jury ([calibration-method](/planning/evals/calibration-method.md)). Do not let stylistic
-  (un)familiarity read as quality. **Record your `evaluator_model` on the `save_eval` verdict** — κ is
+  (un)familiarity read as quality. **Record your `evaluator_model` on the verdict** — κ is
   calibrated per evaluator model, and an unrecorded model silently pools calibration across model swaps.
 - **Capability floor — this role assumes a frontier-tier reasoner.** The adversarial passes below
   (default-to-refute, both-ways pairwise, semantic-pass-not-grep, injection resistance) degrade
@@ -57,8 +57,8 @@ Claude Code, but the runtime is not Claude-specific.
   ([injection-defenses](/planning/research/injection-defenses.md)).
 - **Structural scope (binding).** You are **read-only**: no external-communication tool, no
   repository writes, no artifact publishing; your **only write is the schema-constrained
-  `save_eval`** verdict. This removes the exfiltration leg of the lethal trifecta — the component
-  that reads adversarial content must not be the component that can act. Any future widening of
+  verdict, written through the validated writer (step 9)**. This removes the exfiltration leg of the
+  lethal trifecta — the component that reads adversarial content must not be the component that can act. Any future widening of
   this scope requires the trifecta audit in [AGENTS.md](/AGENTS.md) and a PM decision
   ([injection-defenses](/planning/research/injection-defenses.md)).
 - **Advisory, not final.** Your verdict informs; it does not decide. The human PM **Acceptance Gate**
@@ -158,13 +158,45 @@ FAIL — never a clean PASS.) The split is **persisted**, not just narrated (ste
    available, or state `pass-fraction: unknown (no backend)` in kit mode. A high pass-fraction is a
    leniency-drift warning to the PM, not a compliment to the builders
    ([llm-judge-calibration](/planning/research/llm-judge-calibration.md)).
-9. **Persist it** — `save_eval({ initiative_id, run_id, rubric_path, score, verdict, dimensions })`,
-   where `dimensions` is `{ <name>: { score, weight, note, evidence, axis } }` — `evidence` carries
-   the quote/pointer from step 6 (or the string `unverified`), and **`axis` is `"spec"` or
-   `"standards"`** so the two-axis split is persisted, not just narrated. Put the two axis pass/fail
-   summaries in the top-level `note`/report and tag every dimension with its axis. This is what makes
-   the gate self-hosting — the verdict lands in `evals` and surfaces on `v_eval_gate_status`
-   (radar/board).
+9. **Persist it through the validated writer — never by hand.** Which writer depends on where you
+   are running, and **both are validated; neither is a raw append**:
+
+   | you are in | the writer | why |
+   |---|---|---|
+   | **a vendored kit** (`pmos/` in a product repo) | `pmos/scripts/pmos-log.sh eval …` | ships with the kit; writes the kit's `state/evals.jsonl` |
+   | **PMOS-self** (file mode, [D64](/DECISIONS.md)) | `node scripts/record-eval.js --file verdict.json` | writes `planning/runs/evals.jsonl` |
+   | a hosted tenant | the `save_eval` MCP tool | **deprecated for PMOS-self**; does not exist in file mode |
+
+   ```
+   # kit
+   pmos/scripts/pmos-log.sh eval <run_id> <initiative_id> <score> <PASS|PASS-WITH-FINDINGS|FAIL> <rubric_path> [evaluator_model]
+   pmos/scripts/pmos-log.sh eval <run_id> <initiative_id> SKIPPED "<reason>" [rubric_path] [evaluator_model]
+
+   # PMOS-self
+   node scripts/record-eval.js --file verdict.json     # or pipe the JSON on stdin
+   ```
+
+   Both **fail loud**: a rejected verdict exits non-zero with the specific reason and writes nothing,
+   so a malformed record can never light the gate green. `record-eval.js` additionally refuses any
+   sink but the eval ledger — resolved, not by name — which is what keeps a Review-Gate verdict out
+   of the PM's acceptance ledger.
+
+   If the writer your context calls for is not present, **say so in the verdict and stop** — do not
+   hand-append. A ledger written by hand is how a field ends up meaning three things.
+
+   The record carries `{ initiative_id, run_id, rubric_path, score, verdict, evaluator_model,
+   recorded_at, dimensions }`, where `dimensions` is `{ <name>: { score, weight, note, evidence,
+   axis } }` — `evidence` carries the quote/pointer from step 6 (or the string `unverified`), and
+   **`axis` is `"spec"` or `"standards"`** so the two-axis split is persisted, not just narrated. Put
+   the two axis pass/fail summaries in the top-level `note` and tag every dimension with its axis.
+
+   A `SKIPPED` verdict is **declared, not omitted** — it requires `skipped_reason` and carries
+   `score: null`. A skip is an honest record that judging did not happen; it does not close the
+   verification the run owes, and the queue checker (PMOS-self: `scripts/check-verify-queue.js`)
+   will keep reporting the debt.
+
+   This is what makes the gate self-hosting: the verdict lands in the eval ledger and surfaces on the
+   board.
 10. **Hand to the PM.** The Acceptance Gate is theirs, and the PM records the ground-truth `pm_label` to
    `acceptances` — paired against your verdict by `v_calibration` to compute the kappa that calibrates this
    gate ([D40](/DECISIONS.md), [calibration-method](/planning/evals/calibration-method.md)). If the PM
@@ -177,5 +209,6 @@ A short report: **most important finding first**, then the **two axis verdicts (
 one line; Standards: pass/fail — one line)** and the **overall VERDICT** (score vs threshold, under
 the combine rule) with the pass-fraction disclosure, the calibration exemplars used (step 3), the
 numbered defects, and the per-dimension scores **with their evidence quotes/pointers and `axis`
-tag** — followed by the `save_eval` call. Be concrete; cite specifics; if it is genuinely solid, say
+tag** — followed by the verdict record, written through **the writer for your context (step 9)**:
+`pmos/scripts/pmos-log.sh eval …` in a vendored kit, `node scripts/record-eval.js …` in PMOS-self. Be concrete; cite specifics; if it is genuinely solid, say
 so — but only after a real refutation attempt.

package/payload/skills/pmos-router.skill

@@ -19,7 +19,7 @@ lanes and gates that already exist; where it and an authority disagree, the auth
 router is the bug (fix it via the weekly harness scan).
 
 > **Format note:** three-level progressive disclosure ([SKILL-FORMAT](/skills/core/SKILL-FORMAT.md)).
-> Sources of truth: the AGENTS.md lane list, `.github/scripts/initiative-gate.sh`, D56/D58/D60.
+> Sources of truth: the AGENTS.md lane list, the initiative gate (PMOS-self: `.github/scripts/initiative-gate.sh`; a vendored kit: `pmos/scripts/gate-initiative.sh`), D56/D58/D60.
 
 ## Step 0 — three checks before any route
 

package/payload/skills-native/evaluator/SKILL.md

@@ -8,7 +8,7 @@ license: MIT
 
 This skill is PMOS's **Review Gate** made a first-class, repeatable capability (P4). It formalizes the
 adversarial independent evaluator run by hand through P1–P3: judge what an agent run produced against a
-rubric, write a structured verdict to the `evals` table, and surface it on the radar/board. It runs in
+rubric, write a structured verdict through the validated writer (step 9), and surface it on the board. It runs in
 the **interactive agent runtime** — any capable coding agent; heavy judgment belongs in the agent, not
 an Edge Function ([D09](/DECISIONS.md)/[D34](/DECISIONS.md), amended 2026-07-23). PMOS-self runs it in
 Claude Code, but the runtime is not Claude-specific.
@@ -33,7 +33,7 @@ Claude Code, but the runtime is not Claude-specific.
   may under-reward an unfamiliar style. Either way: **default to skeptical**, and when a pass feels easy
   or you are uncertain, **say so explicitly** and flag the run for the cross-family spot-check /
   minority-veto jury ([calibration-method](/planning/evals/calibration-method.md)). Do not let stylistic
-  (un)familiarity read as quality. **Record your `evaluator_model` on the `save_eval` verdict** — κ is
+  (un)familiarity read as quality. **Record your `evaluator_model` on the verdict** — κ is
   calibrated per evaluator model, and an unrecorded model silently pools calibration across model swaps.
 - **Capability floor — this role assumes a frontier-tier reasoner.** The adversarial passes below
   (default-to-refute, both-ways pairwise, semantic-pass-not-grep, injection resistance) degrade
@@ -58,8 +58,8 @@ Claude Code, but the runtime is not Claude-specific.
   ([injection-defenses](/planning/research/injection-defenses.md)).
 - **Structural scope (binding).** You are **read-only**: no external-communication tool, no
   repository writes, no artifact publishing; your **only write is the schema-constrained
-  `save_eval`** verdict. This removes the exfiltration leg of the lethal trifecta — the component
-  that reads adversarial content must not be the component that can act. Any future widening of
+  verdict, written through the validated writer (step 9)**. This removes the exfiltration leg of the
+  lethal trifecta — the component that reads adversarial content must not be the component that can act. Any future widening of
   this scope requires the trifecta audit in [AGENTS.md](/AGENTS.md) and a PM decision
   ([injection-defenses](/planning/research/injection-defenses.md)).
 - **Advisory, not final.** Your verdict informs; it does not decide. The human PM **Acceptance Gate**
@@ -159,13 +159,45 @@ FAIL — never a clean PASS.) The split is **persisted**, not just narrated (ste
    available, or state `pass-fraction: unknown (no backend)` in kit mode. A high pass-fraction is a
    leniency-drift warning to the PM, not a compliment to the builders
    ([llm-judge-calibration](/planning/research/llm-judge-calibration.md)).
-9. **Persist it** — `save_eval({ initiative_id, run_id, rubric_path, score, verdict, dimensions })`,
-   where `dimensions` is `{ <name>: { score, weight, note, evidence, axis } }` — `evidence` carries
-   the quote/pointer from step 6 (or the string `unverified`), and **`axis` is `"spec"` or
-   `"standards"`** so the two-axis split is persisted, not just narrated. Put the two axis pass/fail
-   summaries in the top-level `note`/report and tag every dimension with its axis. This is what makes
-   the gate self-hosting — the verdict lands in `evals` and surfaces on `v_eval_gate_status`
-   (radar/board).
+9. **Persist it through the validated writer — never by hand.** Which writer depends on where you
+   are running, and **both are validated; neither is a raw append**:
+
+   | you are in | the writer | why |
+   |---|---|---|
+   | **a vendored kit** (`pmos/` in a product repo) | `pmos/scripts/pmos-log.sh eval …` | ships with the kit; writes the kit's `state/evals.jsonl` |
+   | **PMOS-self** (file mode, [D64](/DECISIONS.md)) | `node scripts/record-eval.js --file verdict.json` | writes `planning/runs/evals.jsonl` |
+   | a hosted tenant | the `save_eval` MCP tool | **deprecated for PMOS-self**; does not exist in file mode |
+
+   ```
+   # kit
+   pmos/scripts/pmos-log.sh eval <run_id> <initiative_id> <score> <PASS|PASS-WITH-FINDINGS|FAIL> <rubric_path> [evaluator_model]
+   pmos/scripts/pmos-log.sh eval <run_id> <initiative_id> SKIPPED "<reason>" [rubric_path] [evaluator_model]
+
+   # PMOS-self
+   node scripts/record-eval.js --file verdict.json     # or pipe the JSON on stdin
+   ```
+
+   Both **fail loud**: a rejected verdict exits non-zero with the specific reason and writes nothing,
+   so a malformed record can never light the gate green. `record-eval.js` additionally refuses any
+   sink but the eval ledger — resolved, not by name — which is what keeps a Review-Gate verdict out
+   of the PM's acceptance ledger.
+
+   If the writer your context calls for is not present, **say so in the verdict and stop** — do not
+   hand-append. A ledger written by hand is how a field ends up meaning three things.
+
+   The record carries `{ initiative_id, run_id, rubric_path, score, verdict, evaluator_model,
+   recorded_at, dimensions }`, where `dimensions` is `{ <name>: { score, weight, note, evidence,
+   axis } }` — `evidence` carries the quote/pointer from step 6 (or the string `unverified`), and
+   **`axis` is `"spec"` or `"standards"`** so the two-axis split is persisted, not just narrated. Put
+   the two axis pass/fail summaries in the top-level `note` and tag every dimension with its axis.
+
+   A `SKIPPED` verdict is **declared, not omitted** — it requires `skipped_reason` and carries
+   `score: null`. A skip is an honest record that judging did not happen; it does not close the
+   verification the run owes, and the queue checker (PMOS-self: `scripts/check-verify-queue.js`)
+   will keep reporting the debt.
+
+   This is what makes the gate self-hosting: the verdict lands in the eval ledger and surfaces on the
+   board.
 10. **Hand to the PM.** The Acceptance Gate is theirs, and the PM records the ground-truth `pm_label` to
    `acceptances` — paired against your verdict by `v_calibration` to compute the kappa that calibrates this
    gate ([D40](/DECISIONS.md), [calibration-method](/planning/evals/calibration-method.md)). If the PM
@@ -178,5 +210,6 @@ A short report: **most important finding first**, then the **two axis verdicts (
 one line; Standards: pass/fail — one line)** and the **overall VERDICT** (score vs threshold, under
 the combine rule) with the pass-fraction disclosure, the calibration exemplars used (step 3), the
 numbered defects, and the per-dimension scores **with their evidence quotes/pointers and `axis`
-tag** — followed by the `save_eval` call. Be concrete; cite specifics; if it is genuinely solid, say
+tag** — followed by the verdict record, written through **the writer for your context (step 9)**:
+`pmos/scripts/pmos-log.sh eval …` in a vendored kit, `node scripts/record-eval.js …` in PMOS-self. Be concrete; cite specifics; if it is genuinely solid, say
 so — but only after a real refutation attempt.

package/payload/skills-native/pmos-router/SKILL.md

@@ -21,7 +21,7 @@ lanes and gates that already exist; where it and an authority disagree, the auth
 router is the bug (fix it via the weekly harness scan).
 
 > **Format note:** three-level progressive disclosure ([SKILL-FORMAT](/skills/core/SKILL-FORMAT.md)).
-> Sources of truth: the AGENTS.md lane list, `.github/scripts/initiative-gate.sh`, D56/D58/D60.
+> Sources of truth: the AGENTS.md lane list, the initiative gate (PMOS-self: `.github/scripts/initiative-gate.sh`; a vendored kit: `pmos/scripts/gate-initiative.sh`), D56/D58/D60.
 
 ## Step 0 — three checks before any route
 

package/workspace/README.md

@@ -156,6 +156,28 @@ tokens, JWTs, `Authorization:` values, api keys): scrollback holds whatever the
 so D08's never-log-headers discipline applies to what this hands back. Matching runs against
 the *scrubbed* text, so the endpoint cannot be used to grep a secret out.
 
+## `search everything…` searches the folder (the file lens)
+The search box shipped matching three derived lists — initiative slugs, paths **declared on** an
+initiative record, and session names — so a file PMOS had never been told about could not be found
+by typing its exact name, and the miss printed *"nothing matches — a successful read of nothing"*
+after a search that had never opened the folder.
+
+`GET /api/search/files?q=…&ws=…&limit=…` is the folder corpus: every file under the workspace root,
+matched by **path** and by **content**, with the matching line and its number. Clicking a hit opens
+it in the ordinary document tab. It is a **different corpus** from `/api/search` above — that one is
+scrollback, this one is disk — and they are deliberately separate endpoints, because their hits
+share no field and one payload would have to lie about what it looked at.
+
+Three guarantees. The walk uses the **folder lens's own rules** (`node_modules`, `dist`, `.git` and
+the rest skipped, dotted names excluded), so search and the file tree can never disagree about what
+is in the folder. There is **no path parameter** — the query is a needle, not a location — and the
+walk starts at the root and never follows a symlink out of it, so nothing becomes reachable that
+`/api/doc` would refuse; `openable` on each hit reports whether the reader can actually show it.
+And it is **bounded, out loud**: `truncated` means files were never looked at, `content_truncated`
+means every file was named but not every body was read, `scanned`/`content_scanned` give the counts.
+Two caps, two flags — merged into one, the serious flag would light on any repository with a lock
+file in it, which is the same as retiring it.
+
 ## Branches: a new one doesn't move the others
 
 Starting a session, the branch control is **optional** — the default is "stay on current" and it