create-pmos 0.27.0 → 0.29.0

package/workspace/lib/drive-guard.js

@@ -1,5 +1,6 @@
 'use strict';
-/* drive-guard — the driver's ONLY write path (pmos-autonomous-drive-build, R9).
+/* drive-guard — the driver's ONLY write path (pmos-autonomous-drive-build, R9;
+ * hardened from a denylist to an allowlist by `guard-and-ledger-hardening`, 2026-08-04).
  *
  * THE PROBLEM THIS EXISTS FOR, stated plainly because it is easy to under-rate:
  * nothing in PMOS checks an identity. `/api/gate` sets `pm: true` unconditionally
@@ -20,10 +21,44 @@
  * that throws, and the tests ATTEMPT each forbidden write and assert the throw. A rule the driver
  * is trusted to follow is exactly what leg A showed cannot be trusted.
  *
- * SCOPE, honestly. This binds the DRIVER, not the repo: a human, another agent, or a careless
- * `fs.writeFileSync` elsewhere is unaffected. It is a seatbelt on one vehicle, not a law of
+ * ── WHY THIS IS NOW AN ALLOWLIST ────────────────────────────────────────────────────────────────
+ * The first version was a denylist, and its suite DID attempt each forbidden write and assert the
+ * throw — six attempts, six assertions, exactly as the paragraph above claims. It still shipped
+ * SEVEN bypasses, each measured by an independent pass
+ * (planning/explainers/work-item-entity-surface-explainer.md) by running it against this module:
+ *
+ *   1. `PM_approved` nested 11 deep      — recursion capped at `depth > 8`
+ *   2. `PM_approved: "true"` or `: 1`    — strict `v === true`
+ *   3. the payload JSON.stringify'd      — the `"` defeated /PM_approved\s*[:=]\s*true/
+ *   4. `status: 'PROMOTE'` / `'KILL'`    — the regex required -D / -ED
+ *   5. `payload.frontmatter.status`      — the structured status check was top-level only
+ *   6. `assertWritable({})`              — FAILED OPEN: no file, no payload, no text → returned true
+ *   7. `parent_kr`, an evals verdict,
+ *      `DECISIONS.md`                    — never named at all
+ *
+ * Plus a FALSE POSITIVE the other way: a legitimate initiative record was refused because its
+ * `status:` prose contained the word "promoted".
+ *
+ * The suite probed THE LIST. Nothing probed THE SHAPE OF THE LIST — and a denylist's shape is
+ * "everything somebody thought of". So:
+ *
+ *   - sinks are ALLOWLISTED, closing (7) as a class rather than as three strings;
+ *   - the content guard reads the SERIALIZED request, closing (1), (2) and (3) together — depth,
+ *     type-looseness and stringification all vanish when you look at the text the write would
+ *     actually produce;
+ *   - an unreadable request THROWS, closing (6), the worst of the seven;
+ *   - the disposition match is widened (4), recurses (5), and is anchored to the status value's
+ *     LEADING TOKEN, so a real disposition is refused and prose that merely says "promoted" is not.
+ *
+ * SCOPE, honestly, and unchanged: this binds the DRIVER, not the repo. A human, another agent, or a
+ * careless `fs.writeFileSync` elsewhere is unaffected. It is a seatbelt on one vehicle, not a law of
  * physics — and that limit is the argument for making O5's boolean falsifiable at the engine, which
  * is a separate initiative this one does not pretend to have done.
+ *
+ * AND THE LIMIT WORTH SAYING OUT LOUD: **nothing imports this module** — only workspace/test.js.
+ * The live acceptance writer at `POST /api/gate` appends directly and never calls it. This hardening
+ * makes the boundary correct; it does not make it load-bearing. Its whole value is that when
+ * something does adopt it, it will not adopt seven bypasses with it.
  */
 
 const path = require('path');
@@ -36,53 +71,406 @@ class ForbiddenWrite extends Error {
   }
 }
 
-/** Ledgers that record a human decision. The driver may never append to these. */
-const FORBIDDEN_FILES = Object.freeze(['acceptances.jsonl']);
+/**
+ * The sinks the driver's own free-zone policy sanctions (pmos-autonomous-drive, round 2): research,
+ * routing, the surface explainer, a disposable prototype, and DRAFT specs. Anything not here is
+ * refused — including every ledger, decision log and record nobody thought to enumerate.
+ *
+ * Directory prefixes rather than basenames, because these artifact classes name their files per
+ * initiative. `planning/evals/` admits a draft rubric and NOT `evals.jsonl`, which lives in
+ * `planning/runs/` and is refused with a reason below.
+ */
+const ALLOWED_DIR_PREFIXES = Object.freeze([
+  'planning/prd/',
+  'planning/evals/',
+  'planning/explainers/',
+  'planning/research/',
+  'planning/briefs/',
+  'prototype/',
+]);
+
+/**
+ * Machine ledgers the driver legitimately appends to: its own run record, the verification it owes,
+ * the work-items it declares, and the friction it hits.
+ *
+ * These are BASENAMES rather than a `planning/runs/` prefix, deliberately. Allowing the directory
+ * would admit `acceptances.jsonl`, `evals.jsonl` and `outcome_checks.jsonl` by default, and would
+ * admit the FOURTH ledger somebody adds next year without anyone deciding to — which is exactly the
+ * class-failure this rewrite exists to close. A new ledger is refused until it is named here.
+ *
+ * `agent-runs.jsonl` is on this list even though it carries `pre_run_contract`: the driver logging
+ * its own run is the free zone working as designed, and a fabricated `PM_approved` INSIDE that write
+ * is caught by the content guard below, not by refusing the file.
+ */
+/**
+ * RESOLVE BEFORE ALLOWING — each ledger paired with the ONE directory it may live in.
+ *
+ * This was a bare basename list matched with `path.basename` in any directory, and an independent
+ * evaluator walked through it on 2026-08-04 with `/etc/agent-runs.jsonl`,
+ * `/home/user/.ssh/discoveries.md` and `workspace/lib/discoveries.md` — all permitted, because the
+ * name was the whole identity. Worse, the two halves of the allowlist disagreed: the PREFIX half
+ * correctly refused absolute paths while the basename half waved them through, so which rule
+ * happened to match decided whether `/etc/…` was inside the repo.
+ *
+ * A ledger is now its path, not its name.
+ */
+const ALLOWED_FILES = Object.freeze([
+  'planning/runs/agent-runs.jsonl',
+  'planning/runs/verify-queue.jsonl',
+  'planning/runs/work-items.jsonl',
+  'discoveries.md',
+]);
+
+/** Kept for the refusal message only — never for deciding permission. */
+const ALLOWED_BASENAMES = Object.freeze(ALLOWED_FILES.map((f) => path.posix.basename(f)));
+
+/** Named explicitly so the refusal says WHY, rather than "not on the allowlist". Each of these
+ *  would otherwise be caught by the allowlist anyway — the value here is the message. */
+const HUMAN_DECISION_SINKS = Object.freeze({
+  // The module argues that a DIRECTORY prefix "would admit the FOURTH ledger somebody adds next year
+  // without anyone deciding to — exactly the class-failure this rewrite exists to close" — and then
+  // allows `planning/evals/` as a prefix, which admits the PM's own override log and any future
+  // planning/evals/*.jsonl. The argument is right; it just was not applied to its own second
+  // directory. These two are the PM's calibration record, not the driver's scratch space.
+  'eval-calibration.md': 'the PM\'s log of every override of an evaluator verdict is the PM\'s (D40)',
+  'calibration-status.md': 'the declared calibration state is the PM\'s to assert, not the driver\'s',
+  'acceptances.jsonl': 'the Acceptance Gate is the PM\'s and non-delegable (D12)',
+  'evals.jsonl': 'a Review-Gate verdict on the driver\'s own work is self-grading — the driver may not record one (D40)',
+  'outcome_checks.jsonl': 'whether the bet paid off is the PM\'s judgement (D57)',
+  'DECISIONS.md': 'an architectural decision is the PM\'s (D45)',
+  'pm-decisions.md': 'the PM\'s decision journal is the PM\'s',
+});
 
-/** Disposition tokens (D60). Case-insensitive; a status carrying one is a PM act. */
-const DISPOSITION_RE = /\b(PROMOTED|ITERATE[D]?|KILLED)\b/i;
+/** Disposition tokens (D60), widened to the bare verbs bypass 4 slipped through, and anchored so a
+ *  status VALUE that begins with one is a disposition while prose mentioning one is not. */
+/* Explicit groups, not a trailing `?` on the last letter. The first attempt at this widening wrote
+ * `KILLED?`, which is "KILLE" plus an optional "D" and therefore does NOT match the bare `KILL` —
+ * reintroducing bypass 4 while appearing to fix it. Caught only because every bypass is attempted
+ * individually, which is the whole argument for the suite below. */
+const DISPOSITION_RE = /^\s*"?\s*(PROMOTE(D)?|ITERATE(D)?|KILL(ED)?)\b/i;
 
-/** True when `value` contains a truthy PM_approved anywhere in its object graph. */
-function carriesApproval(value, depth = 0) {
-  if (depth > 8 || value === null || typeof value !== 'object') return false;
+/**
+ * The leading-token rule above is correct and insufficient, and the measurement says so.
+ *
+ * Anchoring to the value's first token bought the false positive back (`derived from the promoted
+ * prototype` is permitted, rightly) and paid for it in false NEGATIVES nobody counted. Swept over
+ * every disposition-bearing `status:` line in this repo's own planning/initiatives/ on 2026-08-04:
+ * **26 of 30 were permitted**, including four real recorded PM dispositions —
+ *
+ *     status: "CLOSED — disposed PROMOTE by PM wawan 2026-07-28…"
+ *     status: "CLOSED — PROMOTED 2026-07-28…"
+ *     status: "…PM disposition 2026-07-29: ITERATE A…"
+ *     status: "**PM disposition 2026-07-30: ITERATE C**"
+ *
+ * — because each leads with CLOSED, or with the word "PM". A guard validated against six test
+ * strings and never against the corpus it protects. So the leading-token rule stays, and these
+ * value-INTERNAL forms join it: a disposition announced as a disposition, wherever it sits in the
+ * line. Prose that merely mentions a verb still passes, because these require the announcing noun.
+ */
+const DISPOSITION_INTERNAL_RE = new RegExp(
+  '(?:' +
+    'dispositions?\\s*[:=]\\s*|' +          // "disposition: PROMOTE", "PM disposition: ITERATE A"
+    'dispos(?:ed|ition)\\s+(?:to\\s+)?|' +  // "disposed PROMOTE", "disposed to KILL"
+    'disposition\\s+\\S{0,24}?\\s*[:=]\\s*' + // "PM disposition 2026-07-30: ITERATE C"
+  ')' +
+  '\\W{0,4}(PROMOTE(?:D)?|ITERATE(?:D)?|KILL(?:ED)?)\\b',
+  'i');
+
+/**
+ * The third rule, rewritten after independent verification refuted its first form.
+ *
+ * The first attempt keyed on CASE: dispositions are written `PROMOTED`, prose writes "the promoted
+ * prototype". Swept over the corpus it looked perfect — 7 all-caps lines, all 7 genuine, zero false
+ * positives. An independent verifier then pointed out the obvious: **a driver forging a disposition
+ * defeats a case-sensitive guard by not pressing shift.**
+ *
+ *     status: CLOSED — promoted 2026-07-28 by PM wawan     prev=refused  →  mine=PERMITTED
+ *
+ * That is `workspace-doc-editing.md`'s real recorded disposition in lower case, and it was a strict
+ * regression against the module I was fixing — the same veto I wrote the rubric to catch, in the fix
+ * for the round that failed it. It also carried the SAME `KILLED?` typo this file documents itself
+ * catching twenty lines up ("KILLE" plus an optional D never matches a bare `KILL`).
+ *
+ * So case is not the signal. The signal is GRAMMAR: a disposition is the verb used as a verb, and
+ * the false positive this round must preserve is the verb used as an ADJECTIVE or in a PASSIVE
+ * clause — "derived from *the promoted* prototype", "M3 *was killed* off upstream". Both are marked
+ * by a small closed set of words immediately before the verb. Everything else is a disposition,
+ * whatever its case.
+ *
+ * Default refuse, carve out narrowly, and enumerate the carve-out — rather than default permit and
+ * enumerate the catches, which is the denylist shape this whole round exists to remove.
+ */
+const DISPOSITION_VERB = '(?:PROMOTE[SD]?|ITERATE[SD]?|KILL(?:ED|S)?)';
+
+/** Immediately-preceding words that make the verb a modifier or a passive, not an act. */
+const PROSE_LEAD = new Set([
+  'the', 'a', 'an', 'this', 'that', 'these', 'those', 'its', 'their', 'our', 'his', 'her',
+  'was', 'were', 'been', 'being', 'is', 'are', 'be', 'get', 'gets', 'got', 'gotten',
+  'not', 'never', 'unless', 'if', 'when', 'would', 'could', 'should', 'may', 'might',
+]);
+
+/**
+ * True when a status VALUE announces a PM disposition. Case-insensitive by construction; the
+ * carve-out, not the catch, is what is enumerated.
+ */
+function isDisposition(value) {
+  const v = String(value);
+  if (DISPOSITION_RE.test(v) || DISPOSITION_INTERNAL_RE.test(v)) return true;
+  const re = new RegExp(`(^|[^A-Za-z])(${DISPOSITION_VERB})\\b`, 'gi');
+  let m;
+  while ((m = re.exec(v)) !== null) {
+    const before = v.slice(0, m.index + m[1].length);
+    const prior = (before.match(/([A-Za-z']+)[^A-Za-z']*$/) || [])[1];
+    if (prior && PROSE_LEAD.has(prior.toLowerCase())) continue;   // adjectival or passive — prose
+    return true;
+  }
+  return false;
+}
+
+/**
+ * NORMALIZE BEFORE MATCHING — and the reason this rule is written as a rule.
+ *
+ * The predecessor tested `/PM_approved\s*[:=]\s*true/i`: unbounded whitespace. Its replacement — the
+ * "hardening" — tested `/PM_approved\W{0,4}(true|1|yes)/i`, which widened the VALUE side and, without
+ * anyone noticing, capped the SEPARATOR side at four non-word characters. An independent evaluator
+ * measured both modules side by side on 2026-08-04:
+ *
+ *     PM_approved  :  true       old=refused    new=PERMITTED
+ *     PM_approved:      true     old=refused    new=PERMITTED
+ *
+ * A hardening round that shipped a strict regression, on the one predicate whose whole job is to stop
+ * a driver forging the PM's approval. `{"pre_run_contract"  :  {"PM_approved"   :   true}}` written
+ * as text to the allowlisted agent-runs.jsonl JSON.parses to `PM_approved === true`, which
+ * scripts/workflow-state.js accepts as O5 satisfaction.
+ *
+ * The lesson is not "use a bigger budget". Any budget is a denylist of the gaps you thought of, and
+ * the next one is defeated by a form nobody enumerated (the double-stringified payload defeated four
+ * with five escape characters). So: collapse the input to a canonical form FIRST — drop the
+ * characters an encoding can multiply, squeeze whitespace — and only then match, with unbounded
+ * separators. There is no budget to overrun because there is nothing left to pad with.
+ */
+/** Returned when normalization will not settle — the call site treats it as refusal, never as text. */
+const NON_CONVERGENT = '\u0000NON_CONVERGENT\u0000';
+
+function normalizeForMatch(s) {
+  let out = String(s);
+  /* DECODE, do not delete. The first attempt at this stripped backslashes outright — and a literal
+   * tab, which JSON.stringify writes as the two characters `\t`, became the letter `t`:
+   *
+   *     PM_approved<TAB>:<TAB>true   →   "PM_approved\t:\ttrue"   →   PM_approvedt:ttrue
+   *
+   * …which matches nothing, so a tab-separated approval walked straight through the "fix". Caught by
+   * this round's own N-R1 assertion, which is the argument for attempting each form individually.
+   * Escape sequences are DATA and must be decoded to what they denote, never erased.
+   *
+   * Applied repeatedly so that multiply-stringified payloads (the ninth bypass) unwrap layer by
+   * layer rather than one level deep. Bounded, because a fixed point is not guaranteed on hostile
+   * input and an unbounded loop here is a denial of service. */
+  /* ONE left-to-right pass per round, not four independent global replaces.
+   *
+   * The four-replace form was itself defective, and an independent verifier found it: because
+   * `JSON.stringify` DOUBLES backslashes, the `\\u....` replace consumed the second backslash and
+   * left the first dangling in front of the decoded letter, which the `\\[tnrfvb0]` replace then
+   * ATE as a control char — turning `PM_approved` into `PM_app o ed` and permitting the write. The
+   * same `\t` → `t` corruption as the first attempt, one rule to the right, because the rules could
+   * see each other's output mid-pass. A single scanner consumes each escape exactly once.
+   *
+   * Loops to a FIXED POINT rather than a fixed count. The earlier `i < 4` was a budget — and this
+   * file argues at length that a budget is a denylist of the gaps you thought of; five layers of
+   * stringification walked past it. The cap here is a non-termination guard, not a budget, and
+   * hitting it means the input is still changing after 16 rounds, which is not something a
+   * legitimate write does: it fails CLOSED at the call site. */
+  const decodeOnce = (s) => {
+    let r = '';
+    for (let i = 0; i < s.length; i++) {
+      if (s[i] !== '\\') { r += s[i]; continue; }
+      const n = s[i + 1];
+      if (n === undefined) { r += ' '; break; }
+      if (n === 'u' && /^[0-9a-fA-F]{4}$/.test(s.slice(i + 2, i + 6))) {
+        r += String.fromCharCode(parseInt(s.slice(i + 2, i + 6), 16)); i += 5;
+      } else if (n === 'x' && /^[0-9a-fA-F]{2}$/.test(s.slice(i + 2, i + 4))) {
+        r += String.fromCharCode(parseInt(s.slice(i + 2, i + 4), 16)); i += 3;
+      } else if ('tnrfvb0'.includes(n)) { r += ' '; i += 1; }
+      else { r += n; i += 1; }
+    }
+    return r;
+  };
+  let converged = false;
+  for (let i = 0; i < 16; i++) {
+    const before = out;
+    out = decodeOnce(out);
+    if (out === before) { converged = true; break; }
+  }
+  if (!converged) return NON_CONVERGENT;
+  return out
+    .replace(/["'`]/g, '')     // quoting is packaging, not content
+    .replace(/\s+/g, ' ');     // any run of whitespace is one space
+}
+
+/** Unbounded separators, by construction. Applied only to normalized text. */
+const APPROVAL_RE = /PM_approved\s*[:=]\s*(true|1|yes)\b/i;
+
+/** Truthy-tolerant: an approval the PM never gave is what is being refused; its JSON type is not the
+ *  point. Closes bypass 2. */
+const TRUTHY = new Set([true, 1, 'true', 'TRUE', 'True', 'yes', 'YES', '1']);
+
+const isObj = (v) => !!v && typeof v === 'object';
+
+/** True when `value` carries a truthy PM_approved anywhere. No depth cap (bypass 1); cycle-safe. */
+function carriesApproval(value, seen) {
+  const s = seen || new Set();
+  if (!isObj(value) || s.has(value)) return false;
+  s.add(value);
   for (const [k, v] of Object.entries(value)) {
-    if (k === 'PM_approved' && v === true) return true;
-    if (k === 'pre_run_contract' && v && typeof v === 'object' && v.PM_approved === true) return true;
-    if (carriesApproval(v, depth + 1)) return true;
+    if (k === 'PM_approved' && TRUTHY.has(v)) return true;
+    if (carriesApproval(v, s)) return true;
   }
   return false;
 }
 
+/**
+ * True when a `status`/`disposition` key ANYWHERE carries a disposition (bypass 5).
+ *
+ * Three type-loose gaps closed here, each measured on 2026-08-04: the key test was case-SENSITIVE
+ * (`Status` walked past), the value test required `typeof v === 'string'` (so `status: ['PROMOTED']`
+ * walked past), and a Buffer serialized to a byte array invisible to every scan.
+ */
+function carriesDisposition(value, seen) {
+  const s = seen || new Set();
+  if (!isObj(value) || s.has(value)) return false;
+  s.add(value);
+  for (const [k, v] of Object.entries(value)) {
+    const isStatusKey = k.toLowerCase() === 'status' || k.toLowerCase() === 'disposition';
+    if (isStatusKey) {
+      // A status value may be a string, a Buffer, or a list of candidate values. All are inspected.
+      const candidates = Array.isArray(v) ? v : [v];
+      for (const c of candidates) {
+        if (typeof c === 'string' && isDisposition(c)) return true;
+        if (Buffer.isBuffer(c) && isDisposition(c.toString('utf8'))) return true;
+      }
+    }
+    if (Buffer.isBuffer(v)) continue;   // a Buffer's numeric indices are not an object graph
+    if (carriesDisposition(v, s)) return true;
+  }
+  return false;
+}
+
+/**
+ * Repo-relative, canonical, or nothing.
+ *
+ * `path.posix.normalize` collapses `.` and `..` properly instead of the old substring test, which
+ * both over-refused (a legitimate `draft..v2.md`) and under-thought the problem. The backslash
+ * rewrite is gone: on POSIX a backslash is an ordinary filename character, and rewriting it let the
+ * single root-level file `planning\prd\x.md` pose as a file inside `planning/prd/`.
+ */
+function onAllowlist(file) {
+  const raw = String(file);
+  if (path.posix.isAbsolute(raw) || path.win32.isAbsolute(raw)) return false;  // never outside the repo
+  const norm = path.posix.normalize(raw.replace(/^\.\//, ''));
+  if (norm === '.' || norm.startsWith('../')) return false;                    // escaped the repo root
+  if (norm.split('/').includes('..')) return false;
+  if (ALLOWED_FILES.includes(norm)) return true;
+  /* The prefix half admits DRAFT ARTIFACTS, never ledgers. Without this the module's own
+   * fourth-ledger argument fails against its own second directory: `planning/evals/anything.jsonl`
+   * was permitted, so the next append-only ledger anyone puts there is admitted by default —
+   * "exactly the class-failure this rewrite exists to close", as the comment above says. */
+  if (/\.jsonl$/i.test(norm)) return false;
+  return ALLOWED_DIR_PREFIXES.some((p) => norm.startsWith(p));
+}
+
 /**
  * The chokepoint. Every driver write goes through here or does not happen.
  * @param {{file:string, payload?:any, text?:string}} req
  * @throws {ForbiddenWrite}
  */
 function assertWritable(req) {
-  const file = (req && req.file) || '';
-  const base = path.basename(file);
+  // (6) FAIL CLOSED. The predecessor returned `true` here, which is the worst of the seven: a
+  // request this function cannot understand is precisely the one it must not wave through.
+  if (!isObj(req) || Array.isArray(req)) {
+    throw new ForbiddenWrite('an unreadable request', 'a write request must be an object — refused (fail-closed)');
+  }
+  if (typeof req.file !== 'string' || !req.file.trim()) {
+    throw new ForbiddenWrite('a request with no target', 'a write request must name its `file` — refused (fail-closed)');
+  }
 
-  if (FORBIDDEN_FILES.includes(base)) {
-    throw new ForbiddenWrite('an acceptance', 'the Acceptance Gate is the PM\'s and non-delegable (D12)');
+  /* A Buffer or TypedArray supplied AS the payload is bytes the writer will put on disk verbatim,
+   * and JSON.stringify renders it `{"type":"Buffer","data":[80,77,…]}` — invisible to the text scan
+   * and to the object walk alike. Both were handled NESTED and neither at the top level, which an
+   * independent verifier walked straight through with
+   * `payload: Buffer.from(JSON.stringify({pre_run_contract:{PM_approved:true}}))`. Decode to text
+   * and adjudicate it as text. */
+  if (Buffer.isBuffer(req.payload) || ArrayBuffer.isView(req.payload)) {
+    const asText = Buffer.from(
+      ArrayBuffer.isView(req.payload) && !Buffer.isBuffer(req.payload)
+        ? Buffer.from(req.payload.buffer, req.payload.byteOffset, req.payload.byteLength)
+        : req.payload).toString('utf8');
+    return assertWritable({ file: req.file, text: `${req.text || ''}\n${asText}` });
   }
-  if (req && req.payload !== undefined && carriesApproval(req.payload)) {
-    throw new ForbiddenWrite('pre_run_contract.PM_approved',
-      'the contract is the PM\'s to approve before any build (D16, AGENTS.md §4)');
+
+  const why = HUMAN_DECISION_SINKS[path.basename(req.file)];
+  if (why) throw new ForbiddenWrite(path.basename(req.file), why);
+
+  // (7) closed as a CLASS: anything not sanctioned is refused, named or not.
+  if (!onAllowlist(req.file)) {
+    throw new ForbiddenWrite(req.file,
+      `not on the driver's allowlist — it may write ${ALLOWED_DIR_PREFIXES.join(', ')} or ${ALLOWED_BASENAMES.join(', ')}`);
   }
-  if (req && typeof req.text === 'string' && /PM_approved\s*[:=]\s*true/i.test(req.text)) {
+
+  // (1)(2)(3) closed together by one look at the text the write would actually produce. A
+  // stringified payload, a "true", and an 11-deep nesting are all plainly visible here.
+  let serialized;
+  try {
+    serialized = JSON.stringify({ p: req.payload === undefined ? null : req.payload, t: req.text || '' });
+  } catch {
+    throw new ForbiddenWrite('an unserialisable payload',
+      'a payload that cannot be inspected cannot be permitted — refused (fail-closed)');
+  }
+  const normalized = normalizeForMatch(serialized);
+  if (normalized === NON_CONVERGENT) {
+    throw new ForbiddenWrite('an input that will not normalize',
+      'a payload whose escaping does not settle cannot be inspected — refused (fail-closed)');
+  }
+  if (APPROVAL_RE.test(normalized) || carriesApproval(req.payload)) {
     throw new ForbiddenWrite('pre_run_contract.PM_approved',
-      'the contract is the PM\'s to approve before any build (D16) — caught in raw text');
+      'the contract is the PM\'s to approve before any build (D16, AGENTS.md §4)');
   }
 
-  // A disposition is a PM act (D60) wherever it lands: the record's `status:` is where it is
-  // conventionally written, so both the structured and the raw-text shapes are refused.
-  const status = req && req.payload && typeof req.payload === 'object' ? req.payload.status : null;
-  if (typeof status === 'string' && DISPOSITION_RE.test(status)) {
+  // (4)(5) and the false positive: matched on a status VALUE's leading token, structured or raw, so
+  // `status: "PROMOTED by PM wawan"` is refused and `status: "derived from the promoted prototype"`
+  // is not. Prose that mentions a disposition is not a disposition.
+  if (carriesDisposition(req.payload)) {
     throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
   }
-  if (req && typeof req.text === 'string' && /^status:.*$/im.test(req.text)
-      && DISPOSITION_RE.test(req.text.match(/^status:.*$/im)[0])) {
-    throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
+  if (typeof req.text === 'string') {
+    // Split on /\r?\n/, not '\n'. The old split left a trailing '\r' on every CRLF line, and the
+    // matcher's `$` anchor (without the `m` flag) then matched nothing at all — a CRLF document
+    // sailed through the raw-text check entirely.
+    for (const line of req.text.split(/\r?\n/)) {
+      /* Markdown prefixes are how a status line is ACTUALLY written in the driver's own sinks —
+       * `- status:`, `**status:**`, `> status:`, `| status |` — and the old anchor allowed only
+       * leading whitespace, so every one of them walked past the check. */
+      const m = /^[\s>*\-+#|]*\**\s*(?:status|disposition)\**\s*[:|]\s*(.*?)\s*\|?\s*$/i.exec(line);
+      if (m && isDisposition(m[1])) {
+        throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
+      }
+      // The raw and structured paths must agree. A JSONL line supplied as `text` was permitted while
+      // the identical object supplied as `payload` was refused — the same content, two verdicts,
+      // decided by which field it arrived in.
+      const t = line.trim();
+      if (t.startsWith('{') || t.startsWith('[')) {
+        let parsed;
+        try { parsed = JSON.parse(t); } catch { parsed = undefined; }
+        if (parsed !== undefined) {
+          if (carriesDisposition(parsed)) {
+            throw new ForbiddenWrite('a disposition', 'promote/iterate/kill is the PM\'s (D60 step 7)');
+          }
+          if (carriesApproval(parsed)) {
+            throw new ForbiddenWrite('pre_run_contract.PM_approved',
+              'the contract is the PM\'s to approve before any build (D16, AGENTS.md §4)');
+          }
+        }
+      }
+    }
   }
   return true;
 }
@@ -95,4 +483,7 @@ function guardedWriter(write) {
   };
 }
 
-module.exports = { assertWritable, guardedWriter, carriesApproval, ForbiddenWrite, FORBIDDEN_FILES };
+module.exports = {
+  assertWritable, guardedWriter, carriesApproval, carriesDisposition, ForbiddenWrite,
+  ALLOWED_DIR_PREFIXES, ALLOWED_BASENAMES, HUMAN_DECISION_SINKS, DISPOSITION_RE,
+};

package/workspace/lib/engine/workflow-state.js

@@ -859,14 +859,48 @@ function computeWorkflow(id, opts) {
   // ── review ─ the Review Gate's verdict, where the lane has a rubric ──────────────────────────
   const evals = readJsonl(path.join(L.runsDir, 'evals.jsonl')).filter((e) => e && e.initiative_id === id);
   {
-    if (effLane === 'chore' || effLane === 'prototype') {
-      steps.push(step('review', 'review', 'na', effLane === 'prototype'
-        ? 'leg A is grilled as dialogue, never scored (D60)'
-        : 'chore lane carries no rubric (D56)'));
+    /* The rung reads the RUBRIC, not the lane.
+     *
+     * It keyed on `lane` alone, so a chore that deliberately carries a rubric could never surface
+     * its Review Gate — the ladder said "chore lane carries no rubric (D56)" while a SKIPPED verdict
+     * sat in evals.jsonl unread. That is how `guard-and-ledger-hardening`, a chore whose own record
+     * argues "blast radius overrides lane" and which carried a rubric on purpose, reached `accept`
+     * with the gate never run. The board could not show what the ledger already knew.
+     *
+     * A prototype is still never scored — D60 grills leg A as dialogue, and that is a property of
+     * the lane, not of whether someone attached a rubric. Every other lane defers to the artifact. */
+    const declaresRubric = !!String(fm.rubric_path || '').trim();
+    /* EVERY lane defers to the artifact — the first version said so in the comment and applied it
+     * only to `chore`, so a discovery or incident initiative with no rubric (legitimate under D56)
+     * showed a permanent `no Review-Gate verdict recorded`: a rung it could never satisfy. The lanes
+     * that carry no rubric by design are named once, here. */
+    const RUBRIC_OPTIONAL = ['chore', 'discovery', 'incident', 'content'];
+    if (effLane === 'prototype') {
+      steps.push(step('review', 'review', 'na', 'leg A is grilled as dialogue, never scored (D60)'));
+    } else if (RUBRIC_OPTIONAL.includes(effLane) && !declaresRubric && !evals.length) {
+      steps.push(step('review', 'review', 'na', `${effLane} lane carries no rubric (D56)`));
     } else if (evals.length) {
       const last = evals[evals.length - 1];
-      steps.push(step('review', 'review', 'done',
-        `${last.verdict}${last.score != null ? ` (${last.score})` : ''} — advisory until calibrated per evaluator model (D40)`));
+      const verdict = String(last.verdict || '').toUpperCase();
+      const label = `${last.verdict}${last.score != null ? ` (${last.score})` : ''} — advisory until calibrated per evaluator model (D40)`;
+      /* A SKIPPED gate is NOT a satisfied gate, and a FAIL is emphatically not one.
+       *
+       * This rung rendered both as a green ✓, which is the watermelon this repo names as its own
+       * failure mode: the board said the Review Gate was done over a row that says judging never
+       * happened. Thirteen initiatives currently render `✓ review` over a SKIPPED verdict, and the
+       * fix that made a chore's gate visible ADDED one. The module's own rule, repeated in three
+       * files — "a skip is an honest RECORD that verification did not happen; it is not
+       * verification" — now applies to the surface that reports it. */
+      if (verdict === 'SKIPPED') {
+        steps.push(step('review', 'review', 'pending', label,
+          'the gate was skipped, so it is still owed — commission an independent evaluator and record a real verdict',
+          { rule: 'R3' }));
+      } else if (verdict === 'FAIL') {
+        steps.push(step('review', 'review', 'blocked', label,
+          'the Review Gate FAILED — remediate the findings and record a new verdict', { rule: 'R3' }));
+      } else {
+        steps.push(step('review', 'review', 'done', label));
+      }
     } else {
       steps.push(step('review', 'review', 'pending', 'no Review-Gate verdict recorded',
         'score the build against the rubric (build-skills/evaluator.skill), then append to evals.jsonl',

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.26.0",
+      "version": "0.28.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/data.js

@@ -1093,6 +1093,23 @@ export async function readDoc(path) {
   return res.text();
 }
 
+/**
+ * panel-initiatives.js — `searchFiles(q, limit)`. Every file under THIS workspace's root whose path
+ * or contents match, from the one endpoint that walks the folder. Bounded on the server, and the
+ * bound comes back in the payload (`truncated`, `scanned`) rather than being silently applied — a
+ * capped list rendered as a complete one is the defect the search box already had.
+ *
+ * FIXTURE mode resolves to an empty, untruncated result WITHOUT fetching: rule 1 of this file is
+ * that a fixture render is provably not a real read wearing a costume, and `no-network.test.js`
+ * checks that claim at source level.
+ */
+export async function searchFiles(query, limit) {
+  const q = String(query == null ? '' : query).trim();
+  if (FIXTURE || !q) return { ok: true, q, hits: [], truncated: false, scanned: 0 };
+  const p = products.get(currentProductName());
+  return getJson('/api/search/files', { ws: state.wsId || (p ? p.ws : ''), q, limit });
+}
+
 /**
  * tab-doc.js — `saveDoc({ws, path, base, text})`. Refuse-on-stale: the server compares `base`
  * against the file on disk and REFUSES rather than overwriting a file that changed underneath.