create-pmos 0.39.0 → 0.40.0

package/workspace/server.js

@@ -65,6 +65,8 @@ const { createSinkGuard } = require('./lib/sink.js');
 const tsSettings = require('./lib/typesafe-settings.js');
 const tsClient = require('./lib/typesafe.js');
 const validateLib = require('./lib/validate.js');
+const claimsLib = require('./lib/claims.js');
+const repoWatch = require('./lib/repo-watch.js');
 tsSettings.adoptEnv(process.env);   // D79 — take the env key into memory and delete it, before anything is spawned
 const scheduleLogic = require('./lib/schedule-logic');
 const { safeFirstInput } = require('./lib/prompt-input');
@@ -74,6 +76,8 @@ const { deriveNextSteps } = require('./lib/next-steps');
 const nextStepActions = require('./lib/next-step-actions');
 const sessionBudget = require('./lib/session-budget');
 const judgmentLib = require('./lib/judgment');
+const proactiveLib = require('./lib/proactive');
+const briefLib = require('./lib/brief');
 const harness = require('./lib/harness-parse');
 const transcript = require('./lib/transcript-read');
 const skillStore = require('./lib/skill-store');
@@ -1177,19 +1181,37 @@ function searchFamily(w, query, limit, only) {
 }
 
 // Serve a TEXTUAL document — markdown (incl. .skill), plain-text/config source, or HTML source —
-// per-workspace-guarded. Images are NOT served here (they stream through /api/asset); anything
-// non-textual returns null so the reader shows it inert. A NUL byte ⇒ binary masquerading as text
-// ⇒ refused. Returns { kind, text } or null. The traversal + cross-workspace guard is unchanged
-// (insideRoot); what widened is the file KIND, never the reachable path set.
-function readTextDoc(root, rel) {
+// per-workspace-guarded. Images, PDF and workbooks are NOT served here (they stream through /api/asset).
+// file-viewer-any-text: a file whose extension is on no list is TRIED as text rather than refused for
+// being unlisted — unless its type is binary by nature, it is over MAX_READ_BYTES, it holds a NUL byte, or
+// it is not valid UTF-8. The traversal + cross-workspace guard is unchanged (insideRoot); what widened is
+// the file KIND, never the reachable path set. A refusal carries its reason (readTextDocWhy).
+const MAX_READ_BYTES = 2 * 1024 * 1024;
+function readTextDocWhy(root, rel) {
   const full = path.resolve(root, rel || '');
-  if (!insideRoot(root, full)) return null;                     // per-workspace guard (traversal + cross-ws)
-  const kind = preview.previewKind(path.basename(full));
-  if (kind !== 'markdown' && kind !== 'text' && kind !== 'html') return null;
+  if (!insideRoot(root, full)) return { ok: false, reason: 'not inside this workspace' };   // per-workspace guard (traversal + cross-ws)
+  const name = path.basename(full);
+  const kind = preview.previewKind(name);
+  if (kind === 'image' || kind === 'pdf' || kind === 'sheet') return { ok: false, reason: 'this kind of file is opened another way, not as text' };
+  const known = kind === 'markdown' || kind === 'text' || kind === 'html';
+  if (!known && preview.isKnownBinary(name)) return { ok: false, reason: 'this is a binary file (.' + preview.extOf(name) + ') and cannot be shown as text' };
+  let buf;
+  try {
+    const st = fs.statSync(full);
+    if (!st.isFile()) return { ok: false, reason: 'this is not a file' };
+    if (!known && st.size > MAX_READ_BYTES) return { ok: false, reason: 'the file is larger than 2 MB' };
+    buf = fs.readFileSync(full);
+  } catch { return { ok: false, reason: 'the file could not be read' }; }
+  if (buf.indexOf(0) !== -1) return { ok: false, reason: 'the file is binary (it holds a NUL byte)' };   // binary masquerading as text
   let text;
-  try { text = fs.readFileSync(full, 'utf8'); } catch { return null; }
-  if (text.indexOf(String.fromCharCode(0)) !== -1) return null;   // NUL byte => binary masquerading as text
-  return { kind, text };
+  try { text = new TextDecoder('utf-8', { fatal: true }).decode(buf); }
+  catch { if (!known) return { ok: false, reason: 'the file is not valid UTF-8 text' }; text = buf.toString('utf8'); }
+  return { ok: true, kind: known ? kind : 'text', text };
+}
+// Returns { kind, text } or null — the contract every earlier caller relies on.
+function readTextDoc(root, rel) {
+  const r = readTextDocWhy(root, rel);
+  return r.ok ? { kind: r.kind, text: r.text } : null;
 }
 
 // ── The initiative lens: the library grouped the way the PM thinks. ───────────────────
@@ -2049,6 +2071,7 @@ function taskById(id, root) { return loadTasks(root).find((t) => t.id === id ||
 // D71 — the recommended schedules, one set per purpose. Times are host-local, like every schedule.
 const SEED_SETS = {
   requirements: [{ name: 'Daily requirement gathering', skill: 'gather-requirements', cadence: 'daily', time: '07:30' }],
+  brief: [{ name: 'Morning brief', skill: 'morning-brief', cadence: 'daily', time: '06:45' }],
   memory: [{ name: 'Weekly memory grooming', skill: 'memory-groom', cadence: 'weekly', day: 'Mon', time: '08:00' }],
   skills: [{ name: 'Weekly skill discovery', skill: 'skill-discover', cadence: 'weekly', day: 'Wed', time: '09:00' }],
   reports: [
@@ -2165,7 +2188,7 @@ function checkDueSchedules() {
   return fired;
 }
 // the tick — the persistent server checks on an interval; unref'd so it never blocks exit
-try { const _tick = setInterval(checkDueSchedules, 60000); if (_tick.unref) _tick.unref(); } catch {}
+try { const _tick = setInterval(() => { checkDueSchedules(); proactiveTick(); }, 60000); if (_tick.unref) _tick.unref(); } catch {}
 
 // ── Sessions: real PTYs, owned by the server, with disk-backed scrollback + metadata. ──
 /** @type {Map<string, {id,ws,name,agent,cwd,state,note,created,pty,buf,cols,rows,clients:Set}>} */
@@ -3334,6 +3357,88 @@ function prepareNextStep(body) {
     judgment: { on: judgmentOn, outside_service: judgmentOn, needs_key: judgmentOn, note: judgmentOn ? 'The question text leaves this machine for the Typesafe service. It needs TYPESAFE_API_KEY in the session.' : 'No outside service is used.' } };
 }
 
+// ── Proactive engine, slice D1 (initiative proactive-engine) ─────────────────────────────────────────────────────
+// A scan reads ledgers and git for five conditions and appends each new one to signals.jsonl; Today is computed from what
+// is true now. No model call, no network call, no write into any repository, no session started (lib/proactive.js is
+// pure). Records live in the runtime state directory, never in a repository.
+const PRO_SIGNALS = () => path.join(STATE, 'signals.jsonl');
+const PRO_FEEDBACK = () => path.join(STATE, 'proactive-feedback.jsonl');
+const PRO_SETTINGS = () => path.join(STATE, 'proactive-settings.json');
+let proLastScan = 0;
+const PRO_SCAN_EVERY_MS = 10 * 60 * 1000;
+function proSettings() {
+  try { const n = proactiveLib.normalizeSettings(JSON.parse(fs.readFileSync(PRO_SETTINGS(), 'utf8'))); if (n.ok) return n.settings; } catch { /* defaults */ }
+  return proactiveLib.normalizeSettings({}).settings;
+}
+function proactiveCtx(now, settings) {
+  const repos = [];
+  const allSchedules = readSchedules();
+  // The same read the portfolio list uses: every initiative of every registered repository, from the cached boards.
+  const pf = portfolio();
+  for (const r of repoLeads()) {
+    const entry = { name: r.name, ws: r.ws, initiatives: [], needs: [], returned: [], schedules: [] };
+    repos.push(entry);
+    try {
+      const w = getWs(r.ws);
+      const pr = pf.repos.find((x) => x.ws === r.ws);
+      if (pr && pr.error) { entry.error = pr.error; continue; }
+      if (pr && pr.pending) { entry.error = 'the board is still being read — try again in a few seconds'; continue; }
+      const life = readLifecycle(w); const acc = readAcceptances(w);
+      const lastRun = new Map(); const hasRuns = new Set();
+      for (const x of readLedger(w, 'agent-runs.jsonl')) {
+        const id = x && x.initiative_id; if (!id) continue;
+        hasRuns.add(id);
+        const t = Date.parse(x.recorded_at || x.created_at);
+        if (Number.isFinite(t)) lastRun.set(id, Math.max(lastRun.get(id) || 0, t));
+      }
+      for (const b of pf.rows.filter((x) => x.ws === r.ws)) {
+        if (!b || !b.id) continue;
+        const lc = life.get(b.id); const stopped = !!(lc && lc.state !== 'active');
+        entry.initiatives.push({ id: b.id, title: b.title || b.id, active: !b.accepted && !stopped, lastRun: lastRun.has(b.id) ? lastRun.get(b.id) : null, hasRuns: hasRuns.has(b.id) });
+      }
+      entry.needs = (readNeeds(w) || []).filter((n) => n).map((n) => ({ initiative_id: n.initiative_id || null, question: n.question || '', run_id: n.run_id || null }));
+      for (const [id, a] of acc) if (a && a.action === 'return') entry.returned.push({ initiative_id: id, note: 'returned at the Acceptance Gate', at: a.at });
+      entry.schedules = allSchedules.filter((x) => r.ids.has(x.ws)).map((x) => ({ id: x.id, name: x.name || x.label || x.skill || x.id, lastStatus: x.lastStatus || null, lastRun: x.lastRun || null }));
+    } catch (e) { entry.error = 'the repository could not be read — ' + String((e && e.message) || 'error').slice(0, 120); }
+  }
+  const reviews = new Set(nsRead(NS_REVIEWS()).filter((x) => x && x.session_id).map((x) => x.session_id));
+  const nextStepRuns = nsRead(NS_RUNS()).filter((x) => x && x.session_id).map((x) => {
+    const s = sessions.get(x.session_id);
+    return { session_id: x.session_id, initiative_id: x.initiative_id, ws: x.ws, key: x.key, ended: !s || s.state === 'exited', reviewed: reviews.has(x.session_id), at: x.at };
+  });
+  return { now, settings, repos, nextStepRuns };
+}
+function proactiveToday(now) {
+  const settings = proSettings();
+  const ctx = proactiveCtx(now, settings);
+  const d = proactiveLib.detect(ctx);
+  const dismissed = proactiveLib.dismissedIds(nsRead(PRO_FEEDBACK()), now);
+  const live = d.candidates.filter((c) => !dismissed.has(c.id));
+  return { settings, unreadable: d.unreadable, dismissed: d.candidates.length - live.length, candidates: settings.enabled ? proactiveLib.rank(live, now) : [], off: !settings.enabled };
+}
+function proactiveScan({ manual }) {
+  const now = Date.now();
+  const settings = proSettings();
+  if (!manual && !settings.enabled) return { ok: true, skipped: 'the engine is off', appended: 0 };
+  if (!manual && proactiveLib.inQuietHours(now, settings.quiet)) return { ok: true, skipped: 'quiet hours', appended: 0 };
+  const ctx = proactiveCtx(now, settings);
+  const d = proactiveLib.detect(ctx);
+  const recent = nsRead(PRO_SIGNALS()).slice(-2000);
+  const fresh = proactiveLib.newSignals(d.candidates, recent, now);
+  let wrote = 0;
+  for (const c of fresh) {
+    const w = nsAppend(PRO_SIGNALS(), { at: new Date(now).toISOString(), key: c.key, id: c.id, kind: c.kind, initiative_id: c.initiative_id, ws: c.ws, why: c.why, evidence: c.evidence, confidence: c.confidence, manual: !!manual }, 'proactive signal');
+    if (w.ok) wrote++;
+  }
+  return { ok: true, skipped: null, appended: wrote, found: d.candidates.length, unreadable: d.unreadable };
+}
+function proactiveTick() {
+  const now = Date.now();
+  if (now - proLastScan < PRO_SCAN_EVERY_MS) return;
+  proLastScan = now;
+  try { proactiveScan({ manual: false }); } catch (e) { warnWriteFail('proactive scan', e); }
+}
+
 // ── Worktree housekeeping: the app that creates the folders shows and clears them ──────────────
 // Isolation buys "your other sessions keep running" at the price of a directory per branch. That
 // price is only fair if the PM can see the folders and reclaim them without leaving the workspace
@@ -4352,6 +4457,40 @@ function serveFile(res, file, type, noCache) {
     res.end(buf);
   });
 }
+// claims-ledger — the claims ledger and its local checks. Local only: no key, no network. The ledger is file-mode
+// state beside the repository's other ledgers; the caches (stamps, per-document index) live in the per-user runtime
+// directory, outside every repository.
+const claimsRunning = new Set();
+function claimsKey(w) { return require('crypto').createHash('sha1').update(w.root).digest('hex').slice(0, 12); }
+function claimsPaths(w) {
+  const cacheDir = path.join(STATE, 'claims', claimsKey(w));
+  let dir = null;
+  if (isDir(path.join(w.root, 'planning', 'initiatives'))) dir = path.join(w.root, 'planning', 'runs');
+  else if (isDir(path.join(w.root, 'pmos', 'state'))) dir = path.join(w.root, 'pmos', 'state');
+  else dir = cacheDir;
+  return { cacheDir, ledgerFile: path.join(dir, 'claims.jsonl'), ledgerDir: dir };
+}
+async function runClaims(w, { sweep = false } = {}) {
+  if (claimsRunning.has(w.root)) return { ok: false, busy: true, error: 'a check is already running for this repository' };
+  claimsRunning.add(w.root);
+  try {
+    const { cacheDir, ledgerFile, ledgerDir } = claimsPaths(w);
+    try { fs.mkdirSync(ledgerDir, { recursive: true }); fs.mkdirSync(cacheDir, { recursive: true }); } catch { /* the writers report it */ }
+    return await claimsLib.check({ root: w.root, cacheDir, ledgerFile, sweep });
+  } finally { claimsRunning.delete(w.root); }
+}
+const claimsLast = new Map();      // root → { at, run, error }
+const claimsWatcher = repoWatch.createWatcher({
+  repos: () => Array.from(workspaces.values()).map((w) => ({ id: w.id, root: w.root })),
+  enabled: (root) => tsSettings.getRepo(STATE, root).watch === true,
+  listFiles: claimsLib.listScope,
+  check: async ({ root, sweep }) => { const w = Array.from(workspaces.values()).find((x) => x.root === root); return w ? runClaims(w, { sweep }) : { ok: false }; },
+  // Timing only (a test shortens them); nothing here names a host or a path.
+  pollMs: Math.max(250, Number(process.env.PMOS_CLAIMS_POLL_MS) || 10000),
+  stableMs: Math.max(250, Number(process.env.PMOS_CLAIMS_STABLE_MS) || 8000),
+  onResult: ({ root, ok, result, error, sweep }) => { claimsLast.set(root, { at: new Date().toISOString(), ok, sweep, run: result && result.run ? result.run : null, error: error || (result && result.error) || null }); },
+});
+if (!REQUIRED_AS_LIBRARY) claimsWatcher.start();
 // D79 — why a validation may not start, or null. The same words on the plan and the run, so the browser
 // never has to guess. No key means no request; no consent means this repository is never sent.
 const validating = new Set();
@@ -5308,8 +5447,9 @@ async function handleRequest(req, res) {
       res.writeHead(200, { 'Content-Type': at.kind === 'markdown' ? 'text/markdown; charset=utf-8' : 'text/plain; charset=utf-8', 'X-Doc-Kind': at.kind });
       return res.end(at.text);
     }
-    const doc = w ? readTextDoc(w.root, url.searchParams.get('path') || '') : null;
-    if (doc == null) { res.writeHead(404); return res.end('not a readable text document in this workspace'); }
+    const got = w ? readTextDocWhy(w.root, url.searchParams.get('path') || '') : { ok: false, reason: 'no such workspace' };
+    if (!got.ok) { res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' }); return res.end(got.reason); }
+    const doc = got;
     // HTML is served as text/plain — the client renders it sandboxed on demand, never as live markup.
     const ctype = doc.kind === 'markdown' ? 'text/markdown; charset=utf-8' : 'text/plain; charset=utf-8';
     res.writeHead(200, { 'Content-Type': ctype, 'X-Doc-Kind': doc.kind }); return res.end(doc.text);
@@ -5930,6 +6070,38 @@ async function handleRequest(req, res) {
       return json(res, { ok: true, budget: nsBudget() });
     }
   }
+  // ── claims-ledger — the local checks, on a press or on a watch the PM switched on ────────────────────────────
+  if (p === '/api/claims' && req.method === 'GET') {
+    const w = getWs(url.searchParams.get('ws'));
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const { cacheDir, ledgerFile } = claimsPaths(w);
+    const last = claimsLast.get(w.root) || null;
+    return json(res, { ok: true, ws: w.id, name: w.name, ...claimsLib.readView({ cacheDir, ledgerFile }),
+      watching: tsSettings.getRepo(STATE, w.root).watch === true, checking: claimsRunning.has(w.root), last_run: last,
+      // the record's path, only when it is inside the repository AND something has been written to it
+      ledger: (path.relative(w.root, ledgerFile).startsWith('..') || !fs.existsSync(ledgerFile)) ? null : path.relative(w.root, ledgerFile).split(path.sep).join('/') });
+  }
+  if (p === '/api/claims/check' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const out = await runClaims(w, { sweep: body.sweep === true });
+    if (out.ok) claimsLast.set(w.root, { at: new Date().toISOString(), ok: true, sweep: body.sweep === true, run: out.run, error: null });
+    return json(res, { ws: w.id, name: w.name, ...out }, out.ok ? 200 : (out.busy ? 409 : 500));
+  }
+  if (p === '/api/claims/watch' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    if (typeof body.watch !== 'boolean') return json(res, { ok: false, error: 'watch must be true or false' }, 400);
+    const out = tsSettings.setRepo(STATE, w.root, { watch: body.watch });
+    if (!out.ok) return json(res, { ok: false, error: out.error }, 500);
+    return json(res, { ok: true, ws: w.id, watching: tsSettings.getRepo(STATE, w.root).watch === true });
+  }
   // ── D79 — repository validation through TypeSafe ──────────────────────────────────────────────────
   // The ONLY routes that lead to an outbound request, and only through lib/typesafe.js. The key is never
   // in a response: `status` says present or absent. Nothing here edits a repository file.
@@ -5994,6 +6166,59 @@ async function handleRequest(req, res) {
     if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
     return json(res, { ok: true, ws: w.id, name: w.name, ...validateLib.readFindings(validationFindingsFile(w)) });
   }
+  /* ── proactive engine (D1): Today is computed, feedback is recorded, nothing is sent, started or changed ── */
+  if (p === '/api/proactive/today' && req.method === 'GET') {
+    const now = Date.now();
+    const t = proactiveToday(now);
+    return json(res, { ok: true, as_of: new Date(now).toISOString(), ...t, quiet: proactiveLib.inQuietHours(now, t.settings.quiet), empty: !t.off && t.candidates.length === 0 && t.unreadable.length === 0,
+      note: 'Derived from the ledgers and git on this computer, only while the workspace server runs. It does not read your mail or calendar.' });
+  }
+  if (p === '/api/proactive/scan' && req.method === 'POST') {
+    const r = proactiveScan({ manual: true });
+    return json(res, r);
+  }
+  if (p === '/api/proactive/feedback' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const v = proactiveLib.validateFeedback(body);
+    if (!v.ok) return json(res, { ok: false, error: v.error }, 400);
+    const rec = { at: nowISO(), id: 'pf-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 5), pm: 'wawan', ...v.record };
+    const w = nsAppend(PRO_FEEDBACK(), rec, 'proactive feedback');
+    if (!w.ok) return json(res, { ok: false, error: w.error }, 500);
+    return json(res, { ok: true, recorded: rec });
+  }
+  if (p === '/api/proactive/brief') {
+    // The brief is submitted by a scheduled skill in an agent session and only CHECKED and stored here. One file per day;
+    // a second submission for the same day replaces the first. Nothing is sent, started or changed.
+    const dir = path.join(STATE, 'briefs');
+    if (req.method === 'POST') {
+      let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+      const v = briefLib.validateBrief(body, { now: Date.now(), settings: proSettings() });
+      if (!v.ok) return json(res, { ok: false, error: v.error }, 400);
+      try { fs.mkdirSync(dir, { recursive: true }); fs.writeFileSync(path.join(dir, v.brief.date + '.json'), JSON.stringify(v.brief) + '\n'); }
+      catch (e) { warnWriteFail('briefs', e); return json(res, { ok: false, error: 'could not save — nothing changed' }, 500); }
+      return json(res, { ok: true, brief: v.brief });
+    }
+    if (req.method === 'GET') {
+      const now = Date.now(); const st = proSettings();
+      let latest = null;
+      try { const f = fs.readdirSync(dir).filter((n) => /^\d{4}-\d{2}-\d{2}\.json$/.test(n)).sort().pop(); if (f) latest = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')); } catch { /* none yet */ }
+      const sched = readSchedules().filter((x) => x.skill === 'morning-brief').map((x) => ({ id: x.id, ws: x.ws, time: x.time, enabled: x.enabled !== false, lastRun: x.lastRun, lastStatus: x.lastStatus }));
+      return json(res, { ok: true, greeting: briefLib.greeting(now, st.name), today: briefLib.localDate(now), brief: latest, stale: !!latest && latest.date !== briefLib.localDate(now), scheduled: sched,
+        note: 'A session reads your calendar and other sources and submits the brief. This server only checks and stores it.' });
+    }
+  }
+  if (p === '/api/proactive/settings') {
+    if (req.method === 'GET') return json(res, { ok: true, settings: proSettings() });
+    if (req.method === 'POST') {
+      let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+      const cur = proSettings();
+      const n = proactiveLib.normalizeSettings({ ...cur, ...body, triggers: { ...cur.triggers, ...(body.triggers || {}) }, briefSources: { ...cur.briefSources, ...(body.briefSources || {}) } });
+      if (!n.ok) return json(res, { ok: false, error: n.error }, 400);
+      try { fs.mkdirSync(STATE, { recursive: true }); fs.writeFileSync(PRO_SETTINGS(), JSON.stringify(n.settings) + '\n'); }
+      catch (e) { warnWriteFail('proactive-settings.json', e); return json(res, { ok: false, error: 'could not save — nothing changed' }, 500); }
+      return json(res, { ok: true, settings: n.settings });
+    }
+  }
   if (p === '/api/lifecycle' && req.method === 'POST') {
     // D70 — close, hold, cancel or reopen an initiative. Only reached by an explicit PM press. It
     // appends ONE line to lifecycle.jsonl and never writes an acceptance.

package/workspace/skills/morning-brief.skill

@@ -0,0 +1,43 @@
+---
+name: morning-brief
+label: "Morning brief"
+description: "Prepare today's brief: the calendar, the priorities and what is worth asking. Read-only on every source; it submits the brief to the workspace and sends nothing."
+run: agent
+agent: claude
+output:
+  - Calendar
+  - Priorities
+  - Worth asking
+  - Sources reached and not reached
+---
+
+/morning-brief — prepare today's brief for the PM.
+
+Rules that always hold:
+1. READ-ONLY on every source. Never send, reply, forward, post, comment, create, edit, accept, decline, transition, label, archive or delete anything in mail, chat, Jira, Confluence, calendar, Wispr Flow or any other source.
+2. SETTINGS DECIDE THE SOURCES. Run `pmos proactive settings`. Read a source only if its line under "brief sources" says on. A source that is off is reported as "off". Mail is off unless the PM turned it on.
+3. LIGHT ON CONTENT. Titles, times, names and ids only. Never copy a message body, an attachment, a token or a credential. Skip anything marked private, personal, confidential or HR. At most one short evidence line per item.
+4. NOTHING INVENTED. A source you cannot reach in this session is reported as "not-reached". If nothing is waiting, submit a brief with no items. An honest short brief is correct.
+5. THE ONLY WRITE is `pmos proactive brief submit`. Do not edit repository files and do not commit.
+6. TYPED SCORING only if `pmos proactive settings` says "scoring on" under the brief line. Then use the Typesafe skill for confidence scores on titles and metadata only; the text you send leaves this machine. Otherwise score yourself. Set "judgment": {"used": true|false} to say which.
+
+Procedure:
+1. Run `pmos proactive settings` and `pmos proactive today`. The second lists what the workspace derived from the ledgers. Each of its items may become a priority with source "derived".
+2. Read today's events from the calendar and today's and tomorrow's meeting notes from Wispr Flow, if those sources are on and reachable. Read Jira issues assigned to the PM or due soon, and Confluence pages changed since yesterday, if on and reachable. Read mail only if on: subjects and senders of threads waiting on the PM, no bodies.
+3. For each thing the PM should act on today, write one item: a short title, why it is for today, its source, the initiative id if one applies, who acts (pm or agent), effort (minutes, an-hour, half-day, day), your confidence from 0 to 1 that it belongs on today's list, and one short evidence line. Give a low confidence when you are guessing. The workspace shows an item under 0.5 as "worth asking", not as a priority.
+4. Write the brief as a JSON file in the scratch folder of this session, in this shape, and nothing else:
+   ```
+   {"date": "YYYY-MM-DD", "sources": {"calendar": "read", "wispr": "not-reached", "mail": "off", "jira": "read", "confluence": "read"},
+    "calendar": [{"start": "<ISO date and time>", "end": "<ISO>", "title": "…", "with": "…"}],
+    "items": [{"title": "…", "why_now": "…", "source": "calendar|wispr|mail|jira|confluence|derived", "initiative_id": "<id or omit>", "owner": "pm|agent", "effort": "minutes|an-hour|half-day|day", "confidence": 0.0, "evidence": "…"}],
+    "judgment": {"used": false}}
+   ```
+   Only report calendar events if calendar is "read". Only give an item a source that is "read" (or "derived").
+5. Run `pmos proactive brief submit --file <that file>`. If it is refused, read the reason, fix the file and submit once more. Do not work around a refusal.
+6. Finish by saying in two lines how many priorities and worth-asking items you submitted and which sources were not reached.
+
+Output contract — produce EXACTLY these sections in your final message:
+- Calendar
+- Priorities
+- Worth asking
+- Sources reached and not reached