create-pmos 0.29.0 → 0.29.1

package/README.md

@@ -333,6 +333,51 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.29.1
+
+**0.29.0 could not reach an existing install. This is that release, delivered.**
+Run `npx create-pmos@latest workspace`.
+
+- **If you are on 0.28.0, 0.29.0 never upgraded you.** The launcher decides whether to reinstall by
+  comparing the bundled workspace-app version against the installed one, and 0.29.0 shipped with the
+  app version left at `0.28.0` — so the comparison came out equal and the upgrade was silently
+  skipped. Everything listed below was in the 0.29.0 tarball and unreachable from an existing
+  install. 0.29.1 bumps both versions together, which is what actually delivers it.
+- **The check that catches this already existed and did not run.** An assertion pins the two versions
+  in lockstep; CI only ran it when `workspace/**` changed, and a release PR touches
+  `npm-pkg/package.json`. The path filter now includes it, so the guard runs on the diff that breaks
+  it. This is the second time a version bump has shipped without reaching adopters (0.9.1 was the
+  first), and the first time the repo could have known.
+
+**What 0.29.0 carried, now actually delivered:**
+
+- **A skipped Review Gate no longer shows as a green tick.** `workflow-state.js` rendered a
+  `SKIPPED` verdict — a row that says *judging did not happen* — with the same ✓ it uses for a real
+  pass, and a `FAIL` likewise. A skip is now `pending` and a fail is `blocked`. If your board looked
+  greener than your ledger, this is why.
+- **A chore that carries a rubric now shows its Review Gate.** The rung decided from the
+  initiative's **lane**, so any lane that *may* skip a rubric could never surface a verdict it
+  actually had — the ladder printed *"chore lane carries no rubric"* while a verdict sat unread. It
+  reads the rubric now, in every lane. This is how a real initiative reached `accept` with its gate
+  never run.
+- **`evaluator.skill`'s final step is runnable.** It told you to persist the verdict through
+  `save_eval` — a hosted-backend tool that **does not exist in file mode**, which is the mode the kit
+  runs in. The last instruction of the Review Gate could not be followed. It now names the writer for
+  your context: `pmos/scripts/pmos-log.sh eval …`.
+- **`pmos-log.sh` can record a skipped gate.** Its verdict enum was `PASS|PASS-WITH-FINDINGS|FAIL`,
+  while `AGENTS.md` tells you *"a gate that was skipped is recorded as skipped — never leave a missing
+  eval to be read as a pass."* Following that instruction hit an error, and the only compliant option
+  was to edit the ledger by hand. Now: `pmos-log.sh eval <run> <initiative> SKIPPED "<reason>"`,
+  which requires the reason and records `score: null`.
+- **The kit build now refuses to ship a skill that names a tool you do not have.** That class had
+  already shipped twice in the same sentence of the same skill. The check runs at build time and
+  fails the build; its one bound (per-reference, not per-line) is documented in `build-kit.sh`.
+
+*Not in this release, stated so you do not go looking:* the same upstream round hardened two modules
+that the kit does not run — `drive-guard.js` ships inside the workspace bundle but nothing requires
+it, and `record-eval.js` is not in the payload at all. Those fixes are real, and they are not
+something your kit was relying on.
+
 ## What's new in 0.28.0
 
 **`search everything…` now searches every file in the folder, and any file it finds opens in a tab.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "Scaffold the PMOS portable kit \u2014 run the PMOS product-management workflow (initiative \u2192 lane-fit spec \u2192 contract \u2192 build \u2192 three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@4104fde
+kernel-source: pmos@b59909d
 assembled: 2026-08-04
 mode: vendor

package/workspace/lib/drive-guard.js

@@ -202,11 +202,28 @@ const DISPOSITION_INTERNAL_RE = new RegExp(
  */
 const DISPOSITION_VERB = '(?:PROMOTE[SD]?|ITERATE[SD]?|KILL(?:ED|S)?)';
 
-/** Immediately-preceding words that make the verb a modifier or a passive, not an act. */
+/**
+ * DETERMINERS ONLY, and the narrowing is measured rather than argued.
+ *
+ * The first version of this set carried 40 words — determiners, auxiliaries and modals — on the
+ * reasoning that a passive clause ("was killed off upstream") is prose too. A third independent pass
+ * showed what that bought an attacker:
+ *
+ *     status: got PROMOTED by PM wawan on 2026-07-28      prev=refused → PERMITTED
+ *     status: not KILLED — shipped 2026-07-28             prev=refused → PERMITTED
+ *
+ * Neither is prose. Both are forged dispositions wearing an auxiliary. Swept against this
+ * repository's own records, the ONLY genuine prose that needs an exemption at all is
+ * determiner-led — "derived from *the promoted* prototype" — which is exactly the false positive the
+ * previous round was contracted to fix. The auxiliaries were paying for a case the corpus does not
+ * contain, in forgeable forms.
+ *
+ * A status line that reads "if a specimen is promoted" is now REFUSED. That is over-refusal, it is
+ * the safe direction, and it is the trade this guard exists to make: the cost is a driver rephrasing
+ * one status line; the cost of the other direction is a forged PM disposition.
+ */
 const PROSE_LEAD = new Set([
   'the', 'a', 'an', 'this', 'that', 'these', 'those', 'its', 'their', 'our', 'his', 'her',
-  'was', 'were', 'been', 'being', 'is', 'are', 'be', 'get', 'gets', 'got', 'gotten',
-  'not', 'never', 'unless', 'if', 'when', 'would', 'could', 'should', 'may', 'might',
 ]);
 
 /**
@@ -220,8 +237,20 @@ function isDisposition(value) {
   let m;
   while ((m = re.exec(v)) !== null) {
     const before = v.slice(0, m.index + m[1].length);
-    const prior = (before.match(/([A-Za-z']+)[^A-Za-z']*$/) || [])[1];
-    if (prior && PROSE_LEAD.has(prior.toLowerCase())) continue;   // adjectival or passive — prose
+    /* ADJACENT, separated by whitespace and nothing else.
+     *
+     * This was `[^A-Za-z']*$` — "the last run of letters, skipping ANY non-letters" — so a colon, a
+     * comma, a quote or an em dash between the determiner and the verb kept the carve-out firing
+     * while destroying the grammar that justifies it. A third independent pass walked through it:
+     *
+     *     status: CLOSED — verdict is "PROMOTED" (PM wawan)     prev=refused → PERMITTED
+     *     status: CLOSED. Leg A is: PROMOTED 2026-07-28         prev=refused → PERMITTED
+     *
+     * "is" is not modifying "PROMOTED" across a colon and a quote mark; it is a different clause.
+     * An exemption that ignores what sits between its two words is not a grammatical rule, it is a
+     * proximity coincidence. */
+    const prior = (before.match(/([A-Za-z']+)[ \t]*$/) || [])[1];
+    if (prior && PROSE_LEAD.has(prior.toLowerCase())) continue;   // adjectival — prose
     return true;
   }
   return false;
@@ -343,10 +372,26 @@ function carriesDisposition(value, seen) {
     const isStatusKey = k.toLowerCase() === 'status' || k.toLowerCase() === 'disposition';
     if (isStatusKey) {
       // A status value may be a string, a Buffer, or a list of candidate values. All are inspected.
+      /* Judge what will be WRITTEN, not what the value's JS type happens to be.
+       *
+       * `typeof c === 'string'` let two shapes through that both serialize to a real disposition:
+       *
+       *     { status: { toJSON() { return 'PROMOTED'; } } }   →  {"status":"PROMOTED"}
+       *     { status: new String('PROMOTED') }                →  {"status":"PROMOTED"}
+       *
+       * The bytes that land on disk are a forged PM disposition; only the in-memory type differed.
+       * A third independent pass found both, and noted the asymmetry that gives it away: the same
+       * trick aimed at PM_approved was already caught, because THAT check reads the serialized form.
+       * This one now does too. */
       const candidates = Array.isArray(v) ? v : [v];
       for (const c of candidates) {
         if (typeof c === 'string' && isDisposition(c)) return true;
         if (Buffer.isBuffer(c) && isDisposition(c.toString('utf8'))) return true;
+        if (c !== null && typeof c === 'object' && !Buffer.isBuffer(c)) {
+          let ser;
+          try { ser = JSON.stringify(c); } catch { return true; }   // uninspectable → refuse
+          if (typeof ser === 'string' && isDisposition(ser)) return true;
+        }
       }
     }
     if (Buffer.isBuffer(v)) continue;   // a Buffer's numeric indices are not an object graph
@@ -484,6 +529,6 @@ function guardedWriter(write) {
 }
 
 module.exports = {
-  assertWritable, guardedWriter, carriesApproval, carriesDisposition, ForbiddenWrite,
+  assertWritable, guardedWriter, carriesApproval, carriesDisposition, isDisposition, PROSE_LEAD, ForbiddenWrite,
   ALLOWED_DIR_PREFIXES, ALLOWED_BASENAMES, HUMAN_DECISION_SINKS, DISPOSITION_RE,
 };

package/workspace/package.json

@@ -1,8 +1,8 @@
 {
   "name": "pmos-workspace",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "private": true,
-  "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
+  "description": "PMOS Terminal Workspace \u2014 local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",
   "bin": {
     "pmos": "bin/pmos.js"
@@ -29,7 +29,7 @@
     "playwright-core": "^1.61.1",
     "ws": "^8.18.0"
   },
-  "//devDependencies": "design-parity's pixel axis only. Kept OUT of dependencies deliberately: `create-pmos workspace` installs this package with `npm install -g`, which takes dependencies and not devDependencies, so an adopter installing a local PM tool does not also install a screenshot differ. design-parity.js requires both optionally and degrades to text+style+geometry when they are absent, so the parity check still runs — it just stops measuring pixels, and says so.",
+  "//devDependencies": "design-parity's pixel axis only. Kept OUT of dependencies deliberately: `create-pmos workspace` installs this package with `npm install -g`, which takes dependencies and not devDependencies, so an adopter installing a local PM tool does not also install a screenshot differ. design-parity.js requires both optionally and degrades to text+style+geometry when they are absent, so the parity check still runs \u2014 it just stops measuring pixels, and says so.",
   "devDependencies": {
     "pixelmatch": "^7.1.0",
     "pngjs": "^7.0.0"

package/workspace/server.js

@@ -866,6 +866,25 @@ function searchIndex(root) {
   return entry;
 }
 
+/**
+ * Is the FIRST chunk of this file free of NUL bytes? The bounded form of the reader's own refusal.
+ *
+ * `readTextDoc` scans the whole file, which is right for serving it and wrong for labelling 200
+ * search hits. This reads a fixed head — enough to catch the binary-masquerading-as-text case the
+ * reader refuses on, at a cost that does not scale with file size. A file whose head is clean and
+ * whose tail hides a NUL will still be labelled openable and still fail to open; that is a strictly
+ * smaller lie than labelling every large text file unopenable, and it is stated rather than hidden.
+ */
+function headIsText(full) {
+  let fd = null;
+  try {
+    fd = fs.openSync(full, 'r');
+    const buf = Buffer.alloc(64 * 1024);
+    const n = fs.readSync(fd, buf, 0, buf.length, 0);
+    return buf.subarray(0, n).indexOf(0) === -1;
+  } catch { return false; } finally { if (fd !== null) { try { fs.closeSync(fd); } catch { /* ignore */ } } }
+}
+
 /** One matched line, trimmed and centred on the needle, so a minified file cannot flood the row. */
 function searchSnippet(line, at) {
   const s = String(line || '').replace(/\t/g, '  ');
@@ -918,7 +937,13 @@ function searchWorkspace(root, query, limit) {
        * the honest answer is "we did not look", and the safe rendering of that is a hit the PM
        * cannot click into an unknown. */
       const st = fs.statSync(path.join(root, rel));
-      if (!st.isFile() || st.size > SEARCH_CONTENT_BYTES) return false;
+      if (!st.isFile()) return false;
+      /* Past the byte budget we do not READ the file — but "we did not look" is not "the reader
+       * refuses it". Returning false there swapped one false label for its opposite: a legitimate
+       * 316 KB markdown doc reported openable:false while /api/doc served it 200 with 324,017 bytes.
+       * An independent pass measured it. The NUL test only needs the HEAD of the file, so bound the
+       * read instead of abandoning the question. */
+      if (st.size > SEARCH_CONTENT_BYTES) return headIsText(path.join(root, rel));
       return readTextDoc(root, rel) !== null;
     } catch { return false; }
   };