create-pmos 0.30.1 → 0.31.0

package/README.md

@@ -333,6 +333,24 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.31.0
+
+**Recording an acceptance can now carry the one field the calibration metric was missing — and the
+Review Gate's own writers stopped writing where they were told not to.**
+Run `npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **The Acceptance gate carries `pm_label`.** Accepting work answers "is this going in?" (D12).
+  Whether the *evaluator* was right about it (D40) is a different question, and there was nowhere to
+  put the answer — so every acceptance recorded through the workspace was unlabeled, and Cohen's κ
+  had nothing to compute against. `POST /api/gate` now accepts `pm_label: pass | fail` when you state
+  it, refuses anything else rather than silently dropping it, and still never *derives* one from the
+  fact that you accepted. A label nobody typed is not a label.
+- **`accepted: true` with `pm_label: fail` is deliberately legal.** You can accept work whose gate
+  correctly failed — that is not a contradiction, and forbidding it would erase a whole cell of the
+  matrix the metric needs.
+- **The response tells you whether the label landed**, so a surface can show the gap instead of you
+  having to know it exists.
+
 ## What's new in 0.30.1
 
 **Open a markdown file in the workspace and you get the document, not its source. And scrolling

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.30.1",
+  "version": "0.31.0",
   "description": "Scaffold the PMOS portable kit \u2014 run the PMOS product-management workflow (initiative \u2192 lane-fit spec \u2192 contract \u2192 build \u2192 three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/AGENTS.md

@@ -10,8 +10,12 @@ timestamp: 2026-07-22
 > if-else rules engines, and not vague mandates that assume shared context.
 
 You are working in a product repo that vendors the **PMOS portable kit** (D54). PMOS here is a
-**control plane** for how work is specced, evaluated, and accepted — it generates no application
-code by itself; you build the product, PMOS disciplines the loop.
+**control plane** for how work is specced, evaluated, and accepted: you build the product, PMOS
+disciplines the loop.
+
+(PMOS itself is a control plane **and a factory** since D65 — but the factory half is not in this
+kit. What you have vendored is the governing half. If a future kit ships execution, it will arrive
+propose-only: opening pull requests, never holding push or merge rights.)
 
 ## The containment rule (non-negotiable)
 

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@f5b480a
+kernel-source: pmos@fd42042
 assembled: 2026-08-05
 mode: vendor

package/payload/okf/core/concepts/control-plane.md

@@ -8,10 +8,16 @@ timestamp: 2026-06-28
 
 # The Control Plane
 
-**Situating context:** "PMOS is a control plane, not a code generator" is the load-bearing identity
-claim of the whole product, and it is easy to forget mid-build. This concept fixes what that claim
-means so design decisions stay on the right side of the line. It informs every artifact: if a thing
-generates production app code, it is not PMOS's job.
+**Situating context:** "PMOS is a control plane, not a code generator" was the load-bearing identity
+claim of the whole product. **As of D65 (PM-ratified 2026-08-04) the second half of that sentence is
+retired:** PMOS is a control plane *and a factory*. This concept still fixes what "control plane"
+means — the distinction is more useful now, not less, because there are two graphs and you must know
+which one you are in.
+
+The line the old phrasing drew is still drawn, in a different place. It is no longer "PMOS does not
+emit app code"; it is **"the executing half may not write the governing half's records, and may not
+push or merge."** If a thing anchors, accepts, disposes or approves a contract, it belongs to the
+control graph. If it opens a pull request against a product, it belongs to the factory.
 
 ## Control plane vs. data plane
 

package/payload/scripts/workflow-state.js

@@ -333,6 +333,7 @@ function firstAppearance(root, range, rel) {
 function buildCommits(root, range, lane, opts) {
   if (!range.ok) return { unknown: true };
   const id = opts && opts.id;
+  const recordIdx = opts && opts.recordIdx;
   const whole = !!range.wholeHistory;
 
   // Over the trunk, the id must be attributable before any commit counts. The index is built once
@@ -373,6 +374,19 @@ function buildCommits(root, range, lane, opts) {
     // answerable at all. `--name-only` lists no files for a true merge commit, so a branch-attributed
     // initiative is counted from its merge subject below rather than from this per-file loop.
     if (whole && id && !commitNamesId(range, i, id)) continue;
+    /* Inside a PR RANGE the id filter above does not apply, because a pull request was assumed to
+     * carry one initiative and everything in it to be that initiative's build. A branch carrying
+     * several breaks that: PR #287 held five, and the FIRST commit on it — a D01 propagation touching
+     * supabase/functions/mcp/index.ts — was attributed to `sink-discipline-backport`, whose record did
+     * not yet exist. The gate reported ORDER VIOLATION, spec-after-build, for an initiative whose spec
+     * demonstrably preceded its build by three commits.
+     *
+     * A commit made BEFORE an initiative's record first appeared cannot be that initiative's
+     * implementation — the initiative did not exist to be built. That is the whole rule, and it is
+     * narrow on purpose: an implementation commit landing AFTER the record but BEFORE the PRD still
+     * fails, which is the case D13 actually exists to catch. This removes a false violation without
+     * removing a true one. */
+    if (!whole && recordIdx != null && recordIdx !== undefined && recordIdx >= 0 && i < recordIdx) continue;
     count++;
     if (first === null) { first = i; sample = hit; }
   }
@@ -574,6 +588,9 @@ function computeWorkflow(id, opts) {
   const prdIdx = prd ? firstAppearance(root, range, prd) : null;
   const build = buildCommits(root, range, effLane, {
     id,
+    // Where this initiative's own record first appears in the range — the earliest commit that could
+    // possibly be its build. See the note in buildCommits' attribution loop.
+    recordIdx: firstAppearance(root, range, recRel),
     deliveryIndex: opts && opts.deliveryIndex,
     declaredDelivery: fm.delivered_by,
   });
@@ -945,6 +962,50 @@ function computeWorkflow(id, opts) {
     }
   }
 
+  /* ── outcome ─ D57: did the bet pay off? A SECOND verdict, at a second time ───────────────────
+   *
+   * This rung did not exist, and its absence is why the loop never ran: `outcome_metric` is optional
+   * in D57, nothing ever asked for it, and 0 of ~170 records declared one. An optional field with no
+   * prompt and no surface is a field that does not exist.
+   *
+   * `na` is a first-class, non-failing state on purpose. Most work is not a bet, and a rung that
+   * renders red for every initiative without a metric becomes noise and gets ignored — which is how
+   * you end up with a board nobody reads. */
+  {
+    const metric = String(fm.outcome_metric || '').trim();
+    const horizon = String(fm.outcome_horizon || '').trim();
+    const checks = readJsonl(path.join(L.runsDir, 'outcome_checks.jsonl'))
+      .filter((c) => c && c.initiative_id === id && ['validated', 'refuted', 'inconclusive'].includes(c.disposition));
+    const latest = checks.length ? checks[checks.length - 1] : null;
+    const today = new Date().toISOString().slice(0, 10);
+
+    if (!metric) {
+      steps.push(step('outcome', 'outcome', 'na', 'no outcome declared — most work is not a bet (D57)'));
+    } else if (!horizon) {
+      /* A metric with no horizon can never come due, so it reads as diligence for ever while
+       * committing to nothing. That is worse than declaring nothing at all. */
+      steps.push(step('outcome', 'outcome', 'blocked',
+        `outcome_metric declared with NO outcome_horizon — a bet that can never come due`,
+        'add outcome_horizon: YYYY-MM-DD to the initiative record, or remove the metric', { rule: 'D57' }));
+    } else if (latest) {
+      /* A refuted bet is a COMPLETED check and an UNSUCCESSFUL bet. The rung says both — rendering
+       * it as a plain green tick is the same watermelon the review rung was fixed for. */
+      const done = latest.disposition === 'refuted' ? 'blocked' : 'done';
+      steps.push(step('outcome', 'outcome', done,
+        `${latest.disposition}${latest.evidence ? ` — ${String(latest.evidence).slice(0, 60)}` : ''}`,
+        latest.disposition === 'refuted'
+          ? 'the check is complete and the bet did not pay off — that is a result, not a failure to record'
+          : undefined));
+    } else if (horizon <= today) {
+      steps.push(step('outcome', 'outcome', 'blocked',
+        `outcome check DUE — horizon ${horizon} has passed and no disposition is recorded`,
+        'dispose it: node scripts/record-outcome.js (validated | refuted | inconclusive, evidence required)',
+        { rule: 'D57' }));
+    } else {
+      steps.push(step('outcome', 'outcome', 'pending', `outcome pending — horizon ${horizon}`));
+    }
+  }
+
   // ── stage, derived from what the steps found ─────────────────────────────────────────────────
   const by = Object.fromEntries(steps.map((s) => [s.key, s]));
   let stage = 'intake';

package/workspace/lib/engine/workflow-state.js

@@ -333,6 +333,7 @@ function firstAppearance(root, range, rel) {
 function buildCommits(root, range, lane, opts) {
   if (!range.ok) return { unknown: true };
   const id = opts && opts.id;
+  const recordIdx = opts && opts.recordIdx;
   const whole = !!range.wholeHistory;
 
   // Over the trunk, the id must be attributable before any commit counts. The index is built once
@@ -373,6 +374,19 @@ function buildCommits(root, range, lane, opts) {
     // answerable at all. `--name-only` lists no files for a true merge commit, so a branch-attributed
     // initiative is counted from its merge subject below rather than from this per-file loop.
     if (whole && id && !commitNamesId(range, i, id)) continue;
+    /* Inside a PR RANGE the id filter above does not apply, because a pull request was assumed to
+     * carry one initiative and everything in it to be that initiative's build. A branch carrying
+     * several breaks that: PR #287 held five, and the FIRST commit on it — a D01 propagation touching
+     * supabase/functions/mcp/index.ts — was attributed to `sink-discipline-backport`, whose record did
+     * not yet exist. The gate reported ORDER VIOLATION, spec-after-build, for an initiative whose spec
+     * demonstrably preceded its build by three commits.
+     *
+     * A commit made BEFORE an initiative's record first appeared cannot be that initiative's
+     * implementation — the initiative did not exist to be built. That is the whole rule, and it is
+     * narrow on purpose: an implementation commit landing AFTER the record but BEFORE the PRD still
+     * fails, which is the case D13 actually exists to catch. This removes a false violation without
+     * removing a true one. */
+    if (!whole && recordIdx != null && recordIdx !== undefined && recordIdx >= 0 && i < recordIdx) continue;
     count++;
     if (first === null) { first = i; sample = hit; }
   }
@@ -574,6 +588,9 @@ function computeWorkflow(id, opts) {
   const prdIdx = prd ? firstAppearance(root, range, prd) : null;
   const build = buildCommits(root, range, effLane, {
     id,
+    // Where this initiative's own record first appears in the range — the earliest commit that could
+    // possibly be its build. See the note in buildCommits' attribution loop.
+    recordIdx: firstAppearance(root, range, recRel),
     deliveryIndex: opts && opts.deliveryIndex,
     declaredDelivery: fm.delivered_by,
   });
@@ -945,6 +962,50 @@ function computeWorkflow(id, opts) {
     }
   }
 
+  /* ── outcome ─ D57: did the bet pay off? A SECOND verdict, at a second time ───────────────────
+   *
+   * This rung did not exist, and its absence is why the loop never ran: `outcome_metric` is optional
+   * in D57, nothing ever asked for it, and 0 of ~170 records declared one. An optional field with no
+   * prompt and no surface is a field that does not exist.
+   *
+   * `na` is a first-class, non-failing state on purpose. Most work is not a bet, and a rung that
+   * renders red for every initiative without a metric becomes noise and gets ignored — which is how
+   * you end up with a board nobody reads. */
+  {
+    const metric = String(fm.outcome_metric || '').trim();
+    const horizon = String(fm.outcome_horizon || '').trim();
+    const checks = readJsonl(path.join(L.runsDir, 'outcome_checks.jsonl'))
+      .filter((c) => c && c.initiative_id === id && ['validated', 'refuted', 'inconclusive'].includes(c.disposition));
+    const latest = checks.length ? checks[checks.length - 1] : null;
+    const today = new Date().toISOString().slice(0, 10);
+
+    if (!metric) {
+      steps.push(step('outcome', 'outcome', 'na', 'no outcome declared — most work is not a bet (D57)'));
+    } else if (!horizon) {
+      /* A metric with no horizon can never come due, so it reads as diligence for ever while
+       * committing to nothing. That is worse than declaring nothing at all. */
+      steps.push(step('outcome', 'outcome', 'blocked',
+        `outcome_metric declared with NO outcome_horizon — a bet that can never come due`,
+        'add outcome_horizon: YYYY-MM-DD to the initiative record, or remove the metric', { rule: 'D57' }));
+    } else if (latest) {
+      /* A refuted bet is a COMPLETED check and an UNSUCCESSFUL bet. The rung says both — rendering
+       * it as a plain green tick is the same watermelon the review rung was fixed for. */
+      const done = latest.disposition === 'refuted' ? 'blocked' : 'done';
+      steps.push(step('outcome', 'outcome', done,
+        `${latest.disposition}${latest.evidence ? ` — ${String(latest.evidence).slice(0, 60)}` : ''}`,
+        latest.disposition === 'refuted'
+          ? 'the check is complete and the bet did not pay off — that is a result, not a failure to record'
+          : undefined));
+    } else if (horizon <= today) {
+      steps.push(step('outcome', 'outcome', 'blocked',
+        `outcome check DUE — horizon ${horizon} has passed and no disposition is recorded`,
+        'dispose it: node scripts/record-outcome.js (validated | refuted | inconclusive, evidence required)',
+        { rule: 'D57' }));
+    } else {
+      steps.push(step('outcome', 'outcome', 'pending', `outcome pending — horizon ${horizon}`));
+    }
+  }
+
   // ── stage, derived from what the steps found ─────────────────────────────────────────────────
   const by = Object.fromEntries(steps.map((s) => [s.key, s]));
   let stage = 'intake';

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.30.1",
+  "version": "0.31.0",
   "private": true,
   "description": "PMOS Terminal Workspace \u2014 local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/server.js

@@ -4644,10 +4644,23 @@ async function handleRequest(req, res) {
       action: body.action, run_id: body.run_id, initiative_id: body.initiative_id,
       // `accepted` is the kit's field (D54) — what metrics.py counts for the north star and
       // throughput. Only the explicit Acceptance action sets it; `approve` is a Review-gate
-      // disposition and leaves it unset. `pm_label` is deliberately NOT derived here: κ labels
-      // are the PM's own word (D40 — never manufacture calibration data from a UI click).
+      // disposition and leaves it unset. `pm_label` is still never DERIVED here: κ labels are the
+      // PM's own word (D40 — never manufacture calibration data from a UI click).
+      //
+      // But refusing to derive it is not the same as refusing to CARRY it, and the two were
+      // conflated. This endpoint is the PM's real click path under D62/D64, so every acceptance it
+      // wrote was unlabeled — 38 of 42 distinct runs in the live ledger — and κ stayed degenerate
+      // because tn and fp had nowhere to come from. `record-acceptance.js` requires the label and
+      // nothing routes the PM to it. So the label is accepted from the client when the PM states
+      // it, validated against the same closed set, and simply absent when they do not.
       accepted: body.action === 'accept' ? true : body.action === 'return' ? false : undefined,
+      ...(body.pm_label === 'pass' || body.pm_label === 'fail' ? { pm_label: body.pm_label } : {}),
       note: body.note || '', workspace: w ? w.name : null, root: w ? w.root : null, pm: true };
+    // A malformed label is refused rather than dropped. Silently discarding it would put the row in
+    // the unlabeled pile while the PM believed they had labelled it — the same shape as inferring.
+    if (body.pm_label !== undefined && body.pm_label !== 'pass' && body.pm_label !== 'fail') {
+      return json(res, { ok: false, error: "pm_label must be 'pass' or 'fail' — it answers whether the EVALUATOR was right (D40), separately from whether the work goes in (D12)" }, 400);
+    }
     // Record into the workspace's OWN state, creating the kit layout for a PMOS-shaped repo.
     // If it can't be resolved, still record — but in the server's state/, and say so in the
     // response so the client can be honest about where the decision landed.
@@ -4677,7 +4690,14 @@ async function handleRequest(req, res) {
         fs.writeFileSync(nf, JSON.stringify(needs.filter((n) => n.run_id !== body.run_id)));
       }
     } catch (e) { warnWriteFail('needs.json (clearing the accepted need)', e); }
-    return json(res, { ok: true, recorded: rec, sink, fallback });
+    /* `pm_label_recorded` is reported so the surface can show the gap rather than the PM having to
+     * know it exists. An acceptance with no label is legal and always will be — the PM's attention
+     * is the scarce thing — but it is the reason κ is degenerate, and a gap nobody is shown is a gap
+     * nobody closes. Reported, never enforced. */
+    return json(res, {
+      ok: true, recorded: rec, sink, fallback,
+      pm_label_recorded: rec.pm_label === 'pass' || rec.pm_label === 'fail',
+    });
   }
   if (p === '/api/doc/save' && req.method === 'POST') {
     // The editor's save (workspace-doc-editor R3/R4). The ONLY write path on this surface, and it is