create-pmos 0.38.4 → 0.38.6

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.38.4",
+  "version": "0.38.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.38.4",
+  "version": "0.38.6",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",
@@ -15,7 +15,7 @@
     "test:parity": "node design-parity.js --states",
     "test:all": "npm test && npm run test:panels && npm run test:ui && npm run test:parity && npm run test:offline",
     "doctor": "node doctor.js",
-    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js && node pm-r1-test.js && node pm-r2-test.js && node pm-r3-test.js && node pm-r4-test.js && node pm-r5-test.js && node pm-r6-test.js && node pm-r7-test.js && node pm-r8-test.js && node pm-r9-test.js && node pm-r10-test.js && node pm-r11-test.js && node pm-r12-test.js && node pm-r13-test.js && node pm-r14-test.js && node pm-r15-test.js && node pm-r16-test.js",
+    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js && node pm-r1-test.js && node pm-r2-test.js && node pm-r3-test.js && node pm-r4-test.js && node pm-r5-test.js && node pm-r6-test.js && node pm-r7-test.js && node pm-r8-test.js && node pm-r9-test.js && node pm-r10-test.js && node pm-r11-test.js && node pm-r12-test.js && node pm-r13-test.js && node pm-r14-test.js && node pm-r15-test.js && node pm-r16-test.js && node pm-r17-test.js",
     "test:offline": "node offline-tarball.test.js"
   },
   "engines": {

package/workspace/public/pm/data.js

@@ -110,43 +110,55 @@ const RUNGS = {
   feature: {
     intake: ['route', 'anchor', 'prototype', 'understand', 'priors'],
     spec: ['spec'], contract: ['contract'], build: ['build', 'quality'],
-    eval: ['review', 'explain'], accepted: ['accept'],
+    eval: ['review', 'explain'], accepted: ['accept', 'outcome'],
   },
   discovery: {
     intake: ['route', 'anchor', 'prototype', 'understand', 'priors', 'spec', 'contract'],
-    explore: ['build', 'quality'], synthesize: ['review'], decide: ['explain', 'accept'],
+    explore: ['build', 'quality'], synthesize: ['review'], decide: ['explain', 'accept', 'outcome'],
   },
   chore: {
     intake: ['route', 'anchor', 'prototype', 'understand', 'priors', 'spec', 'contract'],
-    fix: ['build', 'quality'], verify: ['review', 'explain', 'accept'],
+    fix: ['build', 'quality'], verify: ['review', 'explain', 'accept', 'outcome'],
   },
   incident: {
     intake: ['route', 'anchor', 'prototype', 'understand', 'priors'],
-    contain: ['build', 'quality'], record: ['spec', 'contract', 'review'], verify: ['explain', 'accept'],
+    contain: ['build', 'quality'], record: ['spec', 'contract', 'review'], verify: ['explain', 'accept', 'outcome'],
   },
   content: {
     intake: ['route', 'anchor', 'prototype', 'understand', 'priors'],
-    draft: ['spec', 'contract', 'build', 'quality'], review: ['review'], publish: ['explain', 'accept'],
+    draft: ['spec', 'contract', 'build', 'quality'], review: ['review'], publish: ['explain', 'accept', 'outcome'],
   },
   prototype: {
     intake: ['route', 'anchor', 'prototype', 'understand', 'priors', 'spec', 'contract'],
-    specimens: ['build', 'quality'], grill: ['review', 'explain'], dispose: ['accept'],
+    specimens: ['build', 'quality'], grill: ['review', 'explain'], dispose: ['accept', 'outcome'],
   },
 };
 
-/* D68 — the pm-artifacts profile's ladder: every PM lane walks brief → draft → review → approved
- * (→ handed off). Keyed `pm:<lane>` because `discovery` and `chore` exist in BOTH profiles with
- * different ladders; the profile comes from the engine's own ladder row, never guessed. */
-const PM_LANES_CLIENT = ['strategy', 'prd', 'project-plan', 'discovery', 'decision-record', 'report', 'chore'];
-const PM_NO_HANDOFF_CLIENT = ['decision-record', 'report', 'chore'];
-for (const l of PM_LANES_CLIENT) {
-  const withHandoff = !PM_NO_HANDOFF_CLIENT.includes(l);
+/* D68/D77 — the pm-artifacts profile's ladder: every document lane walks brief → draft → review →
+ * approved (→ handed off). Keyed `pm:<lane>` because `discovery` and `chore` exist in BOTH profiles
+ * with different ladders; the profile comes from the engine's own ladder row, never guessed.
+ *
+ * The lane NAMES and whether a lane hands off are not written here. They come from the server's
+ * lane definitions (scripts/lane-defs.js, D77) through `setLaneDefs`, so a lane added to the
+ * definitions has phases with no edit in this file. Before the first payload arrives, and for a
+ * lane the server did not name, the phases are `pm:prd`'s — the profile's strictest. */
+let laneDefsFromServer = null;
+function buildPmLane(l, withHandoff) {
   PHASES['pm:' + l] = ['intake', 'brief', 'draft', 'review', 'approved'].concat(withHandoff ? ['handed off'] : []);
   RUNGS['pm:' + l] = Object.assign({ intake: ['route', 'anchor'], brief: ['brief'], draft: ['draft'], review: ['review'], approved: ['approved'] },
     withHandoff ? { 'handed off': ['handoff'] } : {});
 }
+buildPmLane('prd', true);
+/** Register the lane definitions the server sent with an initiative payload. */
+function setLaneDefs(defs) {
+  if (!defs || typeof defs !== 'object') return;
+  laneDefsFromServer = defs;
+  for (const [l, d] of Object.entries(defs)) {
+    if (Array.isArray(d.rungs)) buildPmLane(l, d.rungs.includes('handoff'));
+  }
+}
 const laneOf = (lane, profile) => (profile === 'pm-artifacts'
-  ? 'pm:' + (PM_LANES_CLIENT.includes(lane) ? lane : 'prd')
+  ? 'pm:' + (PHASES['pm:' + lane] ? lane : 'prd')
   : (PHASES[lane] ? lane : 'feature'));
 
 /**
@@ -166,7 +178,8 @@ function phaseRungStatus(rungs) {
   if (rungs.every((r) => !r.evidence)) return 'pending';
   if (rungs.some((r) => r.status === 'blocked')) return 'blocked';
   if (rungs.some((r) => r.status === 'current')) return 'current';
-  const decided = rungs.filter((r) => r.status !== 'na' && r.status !== 'unknown');
+  // An outcome still waiting on its horizon is time, not unfinished work: it does not hold the phase open.
+  const decided = rungs.filter((r) => r.status !== 'na' && r.status !== 'unknown' && !(r.key === 'outcome' && r.status === 'pending'));
   if (decided.length && decided.every((r) => r.status === 'done')) return 'done';
   return 'pending';
 }
@@ -200,8 +213,21 @@ function derivedTasks(phase, rungs, ctx) {
     ? ['resolve the ' + phase + ' blocker', 'produce the ' + phase + ' output', 'record the result']
     : ['read the inputs for ' + phase, 'produce the ' + phase + ' output', 'record the result'];
   const evidence = rungs.filter((r) => r.evidence).map((r) => r.key + ': ' + r.evidence).join(' · ') || null;
-  const inputs = [ctx.record, ctx.prd, ctx.rubric].filter(Boolean).join(' · ') || null;
+  const inputs = [ctx.record, ctx.brief, ctx.doc, ctx.prd, ctx.rubric].filter(Boolean)
+    .filter((v, i, a) => a.indexOf(v) === i).join(' · ') || null;
+  // D77 — what each rung read and the sentence that decides it, from the engine's own basis.
+  const basis = rungs.map((r) => ({ key: r.key, b: r.basis || null })).filter((x) => x.b);
+  const sentences = basis.map((x) => x.b.rule).filter((v, i, a) => v && a.indexOf(v) === i);
+  const readLine = basis.filter((x) => x.b.file)
+    .map((x) => x.b.file + (x.b.first_seen ? ' (first seen ' + x.b.first_seen + ')' : '')).filter((v, i, a) => a.indexOf(v) === i);
   const rules = rungs.map((r) => r.rule).filter(Boolean);
+  // The produced artifact: a file a rung of this phase read, never guessed. A document or record is
+  // preferred over a ledger for the second task; the third task shows the ledger the result lands in.
+  const files = basis.filter((x) => x.b.file && x.b.source === 'file').map((x) => x.b.file);
+  const ledgers = basis.filter((x) => x.b.file && x.b.source === 'ledger').map((x) => x.b.file);
+  const produced = files[files.length - 1] || pathIn(lead.evidence) || pathIn(lead.next) || null;
+  const recorded = ledgers[ledgers.length - 1] || null;
+  const def = ctx.laneDef || null;
   return titles.map((title, i) => ({
     title,
     status: (TASK_STATUS[s] || TASK_STATUS.pending)[i],
@@ -210,13 +236,14 @@ function derivedTasks(phase, rungs, ctx) {
     // engine's sentence, the other is a list of paths the record declares.
     instruction: (i === 0 && inputs ? 'Read ' + inputs : null) || lead.next || lead.evidence || null,
     input: inputs,
-    expect: evidence,
-    evalNote: rules.length
-      ? 'workflow rule ' + rules.join(', ') + ' decides this phase'
-      : 'the workflow engine derives this phase from ' + rungs.map((r) => r.key).join(', '),
-    // The produced artifact, when the engine named a path in its own evidence. Never guessed:
-    // an artifact the engine did not name is "no artifact yet", which the task pane says in words.
-    output: i === 1 ? (pathIn(lead.evidence) || pathIn(lead.next) || null) : null,
+    // What the lane says finishing means, then what the engine found. Both are data, not prose written here.
+    expect: [def ? def.done : null, evidence ? 'Found: ' + evidence : null].filter(Boolean).join(' — ') || null,
+    evalNote: sentences.length
+      ? sentences.join(' ') + (readLine.length ? ' Decided from: ' + readLine.join(', ') + '.' : '')
+      : rules.length
+        ? 'workflow rule ' + rules.join(', ') + ' decides this phase'
+        : 'the workflow engine derives this phase from ' + rungs.map((r) => r.key).join(', '),
+    output: i === 1 ? produced : (i === 2 ? recorded : null),
   }));
 }
 
@@ -385,11 +412,16 @@ function recordFrom(payload) {
     return { readError: error, l2: ['read failed', error.slice(0, 60), C.des] };
   }
   const fm = payload.frontmatter || {};
+  if (payload.lanes && payload.lanes.defs) setLaneDefs(payload.lanes.defs);
   const row = (payload.ladder && payload.ladder.ok && payload.ladder.row) || null;
   const scope = (payload.ladder && payload.ladder.scope) || null;
   const lane = fm.lane || (row && row.lane) || null;
   const steps = row ? phaseSteps(lane, row.steps, row.profile) : [];
-  const ctx = { record: payload.record, prd: fm.prd_path || null, rubric: fm.rubric_path || null };
+  const laneDef = (payload.lanes && payload.lanes.defs && lane && payload.lanes.defs[lane]) || null;
+  const ctx = {
+    record: payload.record, prd: fm.prd_path || null, rubric: fm.rubric_path || null,
+    brief: fm.brief_path || null, doc: fm.doc_path || null, laneDef,
+  };
   // Authored tasks win over derivation, per phase (PRD, "Tasks"). Their absence is not a defect.
   const authored = payload.tasks || {};
   const tasks = {};
@@ -406,6 +438,8 @@ function recordFrom(payload) {
     // the lane this record declares, and the lanes this repository allows — what the header's lane picker offers
     lane: lane || null,
     lanes: payload.lanes && Array.isArray(payload.lanes.lanes) ? payload.lanes.lanes : null,
+    laneDefs: (payload.lanes && payload.lanes.defs) || null,
+    laneDef,
     stage: row ? row.stage : null,
     flow: fm.flow || null,
     pills: pillsFor({ lane, anchor: payload.anchor, flow: fm.flow || null }),
@@ -577,6 +611,7 @@ function foldWorkspaces(rows) {
         // here and never re-derived: a second opinion about what a repository IS would be a second
         // thing to keep true, and this one is the one that did the read.
         kind: w.kind === 'github' ? 'github' : 'local', remote: w.remote || null,
+        laneSets: w.lane_sets || null,
       });
     }
     const p = byRepo.get(key);
@@ -1059,6 +1094,14 @@ export async function removeRepository(name) {
 export function repoInitials(name) { const p = products.get(name); return (p && p.initials) || null; }
 
 /** panel-repos.js — the repository's profile (D68): 'pm-artifacts' (documents) or 'product-code'. */
+/** The workflow audit for one repository (D77): the sweep, read-only. Resolves to the report or `{ok:false,error}`. */
+export async function loadAudit(name) {
+  const p = products.get(name);
+  if (!p) return { ok: false, error: 'that repository is not registered' };
+  return getJson('/api/audit', { ws: p.ws });
+}
+/** The lane names a profile offers, as the server's engine reports them; null when it did not say. */
+export function repoLanes(name, profile) { const p = products.get(name); return (p && p.laneSets && p.laneSets[profile]) || null; }
 export function repoProfile(name) { const p = products.get(name); return (p && p.profile) || 'product-code'; }
 
 /** panel-repos.js — write or remove `.pmos-profile`. Refusals come back as { ok:false, error }. */

package/workspace/public/pm/panel-detail.js

@@ -295,7 +295,8 @@ let laneNote = null;
 function lanePicker(slug, rec) {
   if (FIXTURE || !rec || !rec.lane || !Array.isArray(rec.lanes) || !rec.lanes.length) return null;
   const opts = rec.lanes.includes(rec.lane) ? rec.lanes : [rec.lane, ...rec.lanes];
-  return el('div', { 'data-r15': 'lane-bar', style: 'display:flex;gap:6px;align-items:center;flex-wrap:wrap;margin-top:8px;font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground)' },
+  const cur = rec.laneDefs && rec.laneDefs[rec.lane];
+  const bar = el('div', { 'data-r15': 'lane-bar', style: 'display:flex;gap:6px;align-items:center;flex-wrap:wrap;margin-top:8px;font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground)' },
     el('span', null, 'workflow'),
     el('select', { 'data-r15': 'lane-pick', title: 'change this initiative’s workflow (lane); the ladder re-derives from it',
       style: 'font-family:var(--mono);font-size:10.5px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground);padding:2px 4px;min-height:24px',
@@ -310,8 +311,17 @@ function lanePicker(slug, rec) {
         laneNote = out && out.ok ? 'lane is now ' + next : 'not changed — ' + ((out && out.error) || 'the server did not answer');
         setState({});
       } },
-    opts.map((l) => el('option', { value: l, selected: l === rec.lane ? 'selected' : null }, l))),
+    opts.map((l) => {
+      const d = rec.laneDefs && rec.laneDefs[l];
+      return el('option', { value: l, title: d ? d.when : null, selected: l === rec.lane ? 'selected' : null }, d && d.label ? d.label + ' (' + l + ')' : l);
+    })),
     laneNote ? el('span', { 'data-r15': 'lane-note', style: 'color:var(--muted-foreground)' }, iv(laneNote)) : null);
+  if (!cur) return bar;
+  // D77 — what this lane is: the definition the engine runs on, read from the same module.
+  const row = (k, v) => el('div', null, el('span', { style: 'text-transform:uppercase;letter-spacing:.1em;font-size:9.5px;margin-right:6px' }, k), iv(v));
+  return el('div', null, bar,
+    el('div', { 'data-r17': 'lane-def', style: 'margin-top:6px;font-size:11.5px;line-height:1.5;color:var(--muted-foreground)' },
+      row('when', cur.when), row('input', cur.requires || cur.input), row('output', cur.output), row('done', cur.done)));
 }
 
 function headerBlock(name, tag, pills, crumb, lane) {

package/workspace/public/pm/panel-repos.js

@@ -276,14 +276,41 @@ async function renameRepo(name) {
 
 /* The repository's profile (D68). `pm-artifacts` offers document lanes and no build rungs; `product-code` is the
  * default. The confirm states the consequence before anything is written. */
-const DOC_LANES = 'strategy, prd, project-plan, discovery, decision-record, report, chore';
-const CODE_LANES = 'feature, discovery, chore, incident, content, prototype';
+const lanesText = (name, profile) => {
+  const l = dataMod && dataMod.repoLanes ? dataMod.repoLanes(name, profile) : null;
+  return l ? l.join(', ') : '(the workspace did not report them)';
+};
+/* The workflow audit (D77). Runs the sweep on the repository and shows what it found. It writes nothing. */
+async function runAudit(name) {
+  if (!dataMod || !dataMod.loadAudit) return;
+  setState({ repoAudit: { name, busy: true } });
+  const out = await dataMod.loadAudit(name);
+  setState({ repoAudit: { name, report: out && out.ok !== false ? out : null, error: out && out.ok === false ? out.error : null } });
+}
+function auditBlock(name) {
+  const a = state.repoAudit;
+  if (!a || a.name !== name) return null;
+  const box = (kids) => el('div', { 'data-r17': 'audit-report', style: 'padding:6px 14px 10px 39px;font-size:11px;line-height:1.5;color:var(--muted-foreground)' }, kids);
+  if (a.busy) return box(ip('checking…'));
+  if (a.error || !a.report) return box(ip('the audit could not run — ' + (a.error || 'no answer')));
+  const r = a.report;
+  const head = r.counts.defects + ' defect' + (r.counts.defects === 1 ? '' : 's') + ' · ' + r.counts.owed + ' owed · ' + r.counts.repairable + ' repairable';
+  const line = (f) => el('div', { style: 'margin-top:4px', 'data-r17': 'finding', 'data-class': f.class },
+    el('span', { style: 'font-family:var(--mono);color:var(--foreground)' }, ip(f.class)), ip(' · ' + (f.id || 'repository') + ' — ' + f.what),
+    f.repair ? el('div', null, ip('repair: set ' + f.repair.key + ' to ' + f.repair.to + ' — ' + f.command)) : (f.hand ? el('div', null, ip(f.hand)) : null));
+  return box([
+    el('div', { style: 'color:var(--foreground)', 'data-r17': 'audit-counts' }, ip(head)),
+    r.defects.slice(0, 8).map(line),
+    r.counts.defects > 8 ? el('div', { style: 'margin-top:4px' }, ip('+ ' + (r.counts.defects - 8) + ' more — node scripts/workflow-sweep.js')) : null,
+    r.counts.owed ? el('div', { style: 'margin-top:6px' }, ip('owed (open loops, not corruption): ' + Object.entries(r.owed_by_class).map(([k, v]) => k + ' ×' + v).join(', '))) : null,
+  ]);
+}
 async function switchProfile(name) {
   if (!dataMod || !dataMod.repoProfile) return;
   const toDocs = dataMod.repoProfile(name) !== 'pm-artifacts';
   const msg = toDocs
-    ? 'Switch “' + name + '” to document work?\n\nLanes offered: ' + DOC_LANES + '.\nThe ladder becomes route, anchor, brief, draft, review, approved, handed off — no contract, build, eval or explainer.'
-    : 'Switch “' + name + '” to code work?\n\nLanes offered: ' + CODE_LANES + '.\nThe ladder returns to spec, contract, build, eval, explainer, acceptance.';
+    ? 'Switch “' + name + '” to document work?\n\nLanes offered: ' + lanesText(name, 'pm-artifacts') + '.\nThe ladder becomes route, anchor, brief, draft, review, approved, handed off — no contract, build, eval or explainer.'
+    : 'Switch “' + name + '” to code work?\n\nLanes offered: ' + lanesText(name, 'product-code') + '.\nThe ladder returns to spec, contract, build, eval, explainer, acceptance.';
   const tail = '\n\nAn initiative whose lane is not in the new set is treated as the strictest lane (' + (toDocs ? 'a governed prd' : 'feature') + '). No initiative record is edited.\n\nThis ' + (toDocs ? 'writes' : 'removes') + ' the file .pmos-profile in the repository. It is a change for you to commit.';
   const ok = typeof window === 'undefined' || !window.confirm ? true : window.confirm(msg + tail);
   if (!ok) return;
@@ -323,9 +350,12 @@ function repoEntry(tuple, product) {
     { const sb = syncButton(name); if (sb) tools.push(sb); }
     { const docs = dataMod.repoProfile && dataMod.repoProfile(name) === 'pm-artifacts';
       tools.push(el('button', { onClick: () => switchProfile(name), style: chipStyle, hover: 'color:var(--foreground)',
-        title: docs ? 'document work (pm-artifacts): lanes are strategy, prd, project-plan … with no build rungs. Press to switch to code work.'
+        title: docs ? 'document work (pm-artifacts): lanes are kinds of PM work and documents, with no build rungs. Press to switch to code work.'
           : 'code work (product-code): lanes are feature, discovery, chore … with the full build ladder. Press to switch to document work.',
         'data-r16': 'profile', 'data-profile': docs ? 'pm-artifacts' : 'product-code' }, ip(docs ? 'docs' : 'code'))); }
+    tools.push(el('button', { onClick: () => runAudit(name), style: chipStyle, hover: 'color:var(--foreground)',
+      title: 'check this repository’s workflow records against its files and its profile (read-only — nothing is written)',
+      'data-r17': 'audit' }, ip('audit')));
     tools.push(el('button', { onClick: () => renameRepo(name), style: actStyle, hover: 'color:var(--foreground)', title: 'rename this repository', 'data-r1': 'rename' }, '✎'));
     tools.push(el('button', { onClick: () => removeRepo(name), style: actStyle, hover: 'color:var(--destructive)', title: 'remove this repository from PMOS (no folder is deleted)', 'data-r1': 'remove' }, '✕'));
   }
@@ -335,6 +365,7 @@ function repoEntry(tuple, product) {
   { const bf = branchForm(name); if (bf) kids.push(bf); }
   if (open && trees.length) kids.push(treesBlock(name, trees, product === name));
   { const tn = treeNoteFor(name); if (tn) kids.push(tn); }
+  { const ab = auditBlock(name); if (ab) kids.push(ab); }
   const n = state.repoNotice;
   if (n && n.name === name) {
     kids.push(el('div', {

package/workspace/public/pm/tab-task.js

@@ -49,7 +49,10 @@ export function mountTask(host, tab) {
       iv(tab.output),
     )
     : el('div', { style: 'font-size:13px;color:var(--muted-foreground);font-style:italic' },
-      'no artifact yet — produced when the agent runs this task');
+      // Only a step that is not done is "not produced yet". A done step with no file says what decided it.
+      tab.status === 'done'
+        ? 'this step read no file of its own — the rule and evidence above are its result'
+        : 'no artifact yet — produced when the agent runs this task');
 
   const body = el('div', {
     style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);color:var(--foreground);padding:22px 26px 60px;font-size:14px;line-height:1.65',

package/workspace/server.js

@@ -74,6 +74,7 @@ const fmParse = require('./lib/file-mode-parse');      // canonical file-mode pa
 const skillsReg = require('./lib/skills-registry');     // discovered and generated skills: quarantine, provenance, local approval (D76)
 const modelLib = require('./lib/models');               // tier routing — one code path, shared with the agents' CLI (D75)
 const memoryLib = require('./lib/memory');             // curated repository memory — one ledger code path, shared with the agents' CLI (D72)
+const audit = require('./lib/audit');                 // the workflow audit — the sweep the agents' CLI runs, read-only here (D77)
 const syncLib = require('./lib/sync');                 // press-only fetch / integrate / commit records / push (D70)
 const gitInfo = require('./lib/git-info');             // read-mostly branch awareness + select/create at session start
 const startPolicy = require('./lib/start-policy');     // ONE stated rule for where a session starts (repo-first R1/R3)
@@ -591,11 +592,23 @@ function profileOfRoot(root) {
     return line === 'pm-artifacts' ? 'pm-artifacts' : 'product-code';
   } catch { return 'product-code'; }
 }
+// D77 — the lane names of each profile, from the engine's own definitions. The client never carries a list.
+let laneSetsMemo = null;
+function laneSets() {
+  if (laneSetsMemo) return laneSetsMemo;
+  try {
+    const e = consoleState.loadEngine();
+    if (e && e.ok && typeof e.engine.laneNames === 'function') {
+      laneSetsMemo = { 'pm-artifacts': e.engine.laneNames('pm-artifacts'), 'product-code': e.engine.laneNames('product-code') };
+    }
+  } catch { /* the engine is not here; the client then says so rather than guessing */ }
+  return laneSetsMemo;
+}
 function wsList() {
   return [...workspaces.values()].map((w) => {
     const rid = repoIdentity(w.root);
     return {
-      id: w.id, name: w.name, label: w.label || null, initials: w.initials || null, profile: profileOfRoot(w.root), root: w.root, home: HOME_ENABLED && w.root === SELF_ROOT,
+      id: w.id, name: w.name, label: w.label || null, initials: w.initials || null, profile: profileOfRoot(w.root), lane_sets: laneSets(), root: w.root, home: HOME_ENABLED && w.root === SELF_ROOT,
       shape: wsShape(w.root), addedAt: w.addedAt,
       sessions: [...sessions.values()].filter((s) => s.ws === w.id).length,
       // the repository this working tree belongs to, and the branch it is on. `branch_code`
@@ -5178,6 +5191,14 @@ async function handleRequest(req, res) {
     try { if (typeof engine.engine.lanesFor === 'function') lanes = engine.engine.lanesFor(root); } catch { lanes = null; }
     return json(res, { ws: w ? w.id : null, ...out, lanes });
   }
+  if (p === '/api/audit' && req.method === 'GET') {
+    /* The workflow audit (D77): the sweep run on one repository, read-only. It reports state that contradicts
+     * the repository (a document no record points at, a lane the profile does not offer, a done step with
+     * nothing to open) and work honestly not done. It writes nothing; repairs are the CLI's, on the PM's word. */
+    const w = getWs(url.searchParams.get('ws'));
+    const root = w ? w.root : SELF_ROOT;
+    return json(res, audit.run(root));
+  }
   if (p === '/api/initiative/lane' && req.method === 'POST') {
     /* Change an existing initiative's lane — the PM's word. The ladder is DERIVED from `lane:` (workflow-state.js),
      * so this edits that one frontmatter line and nothing else; the next read re-derives the rungs. It never

package/workspace/skills/gather-requirements.skill

@@ -4,6 +4,10 @@ label: "Gather requirements"
 description: "Read what changed in the PM's mail, chat, Jira, Confluence, calendar and meeting notes since the last note, and file one dated note of requirements — each with its source, how sure it is, and which initiative it touches."
 run: agent
 agent: claude
+version: 1.1.0
+owner: wawan
+risk: low
+scope: read:connectors, read:state, write:state/requirements
 output:
   - New or changed requirements
   - Validations and contradictions
@@ -20,17 +24,22 @@ Rules that always hold:
 4. NOTHING INVENTED. If a source is not reachable in this session, say so under "Sources reached and not reached". If nothing changed, say that. An honest empty note is correct.
 5. UNCONFIRMED IS ALLOWED. Mark every item `confidence: unconfirmed` or `confirmed` (confirmed = a person with authority said it in a decision, an approved document or a closed ticket). A note is evidence, never a decision or an acceptance.
 
-Procedure:
+Procedure (each step ends with a check that shows it is done):
 1. Find the state directory: `pmos/state/` if it exists, otherwise `planning/`. The note goes in `<state>/requirements/YYYY-MM-DD.md` (today's date). If today's file already exists, do NOT overwrite it: append a section `## Later run HH:MM`.
+   Done when: the target path is named, and an existing file is still intact.
 2. Read the previous note in that folder to learn the cutoff. With no previous note, look back 3 days.
+   Done when: you can state the cutoff as a date and time.
 3. Read the initiatives in `<state>/initiatives/` (or `planning/initiatives/`) so you can say which one an item touches. Match by what the item is about, not by keyword.
+   Done when: you have the list of initiative ids that an item can name.
 4. For each source you can reach, read what changed since the cutoff: mail, chat, Jira, Confluence, calendar events with their notes, meeting notes.
+   Done when: each source kind is either read or marked not reached.
 5. For each requirement found, write one item:
    - the requirement, in your words
    - pointer: kind · id or link · date · author
    - confidence: unconfirmed | confirmed
    - relation: validates | clarifies | extends | contradicts | none
    - initiative: its id, or `unmatched`
+   Done when: every item has all five fields and a pointer.
 6. Start the file with this frontmatter (OKF v0.2, D73). Every key is on ONE line — never indent a key under another, because the readers stop at the first indented line. Then the four sections above, in this order:
    ```
    ---
@@ -43,8 +52,11 @@ Procedure:
    ---
    ```
    `sources` lists every item the note is derived from (the same pointers you give per item). Do not add a `timestamp` and do not add `verified`: only the PM confirms a note.
+   Done when: the file starts with this frontmatter and holds the four sections in order.
 7. Under "Sources reached and not reached", list every source kind you tried, with `reached` or `not reached — <why>`, and the number of private items skipped.
+   Done when: every source kind you tried has a line, and the private count is stated.
 8. Finish by saying in one line how many items you filed and where. Do not commit; the PM's Sync carries the file.
+   Done when: the count and the path are said once, and no commit was made.
 
 Output contract — produce EXACTLY these sections, the same shape every run:
 - New or changed requirements