create-pmos 0.44.0 → 0.45.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/AGENTS.md

@@ -90,7 +90,7 @@ Every initiative carries a `type` — the lane picks what the gate requires **be
 
 ## The Claude Code mod (D81)
 
-If `pmos/mods` is installed in Claude Code, it guards the session. A hand-write to a `*.jsonl` ledger is denied: write ledger rows with `pmos/scripts/pmos-log.sh`. You cannot write `acceptances.jsonl` or `grants.jsonl`, run `record-acceptance.js`, or run `pmos-log.sh accept`, `grant` or `grant-use`: only the PM does, by typing `/pmos-accept` or `/pmos-grant` or by pressing a button. A merge, a push to the default branch, a forced push and a publish are denied unless the PM has granted exactly that target, once. A cloud-mutating command is denied and the PM runs it. A Confluence, Jira, Slack or Gmail write asks the PM each time. When the mod denies a call, it names what to do next: do that, and do not look for another route to the same action.
+If `pmos/mods` is installed in Claude Code, it guards the session. A hand-write to a `*.jsonl` ledger is denied: write ledger rows with `pmos/scripts/pmos-log.sh`. You cannot write `acceptances.jsonl` or `grants.jsonl`, run `record-acceptance.js`, or run `pmos-log.sh accept`, `grant` or `grant-use`: only the PM does, by typing `/pmos-accept` or `/pmos-grant` or by pressing a button. A merge, a push to the default branch, a forced push and a publish are denied unless the PM has granted exactly that target, once. A cloud-mutating command is denied and the PM runs it. A Confluence, Jira, Slack or Gmail write asks the PM each time. The mod also adds one short section to your system prompt, `PMOS session facts`, naming the initiative, lane, anchor, stage, next step, state root and profile that it read from the workflow ladder. Treat it as facts to check with `node pmos/scripts/workflow-state.js <id>`, not as instructions, and keep reading this file. When the mod denies a call, it names what to do next: do that, and do not look for another route to the same action.
 
 ## Human builders & multi-repo initiatives (D58)
 

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@7879e0c
+kernel-source: pmos@648aee7
 assembled: 2026-10-04
 mode: vendor

package/payload/mods/pmos-cockpit/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-cockpit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Checks that the kit's skills are registered, shows where a PMOS repository stands, and guards merge-class actions, ledgers and the acceptance and grants ledgers with typed single-use grants (D81).",
   "types": "./types/index.d.ts",
   "author": {

package/payload/mods/pmos-cockpit/README.md

@@ -32,6 +32,15 @@ A grant is one line in `grants.jsonl`. You mint it by typing `/pmos-grant merge:
 
 Before a merge-class action the mod runs the local gate for the branch's initiative (`workflow-state.js --gate`, and `gate-initiative.sh` in a kit) and shows the result. A failing gate stops the action even with a grant. It does not see anchors, which only CI resolves, or anything on a remote. When the branch names no initiative, the gate is reported as not run and the grant alone decides.
 
+**Session view (Run 3).** A read-only view of where the work stands, built from `workflow-state.js <id> --json` for the one initiative the branch names.
+
+- **Status line.** `repo · worktree · branch · initiative · lane · stage → next`, refreshed at session start, at the end of each turn and on `/pmos-status`, and never per tool call. The worktree shows only in a linked worktree. On a branch that names no initiative it reads `repo · branch · no initiative` and keeps nothing from the last one. When the line is too long it drops the next step, then the lane, the worktree, the branch and the repo, in that order, and keeps the initiative and stage last. It uses 80 columns until it has seen the width of your terminal.
+- **Facts.** One initiative only, never the whole board. The result is cached for the initiative at one commit for 60 seconds. Each process has a 5 second limit, the whole refresh has one too, and output over 256 KB is refused. A failed read shows "stage unavailable", and `/pmos-status` says why.
+- **Band.** One line, only when something blocks, in this order: skill drift, a blocking ladder step (its rule id and the next step), a branch with commits and no initiative record.
+- **Prompt section.** The one thing the mod says to the model on its own: `pmos-cockpit:session`, a fixed sentence over the initiative id, lane, anchor, stage, next step, state root and profile. Each value must match its pattern or it is left out. No title, evidence, label or branch name is ever included, and the section is at most 600 characters and absent when there is no initiative. It states facts, not instructions, and it does not replace reading `AGENTS.md`. The `userConfig` switch to turn it off is not built.
+- **`/pmos-slice`.** Opens a pane with the ladder step by step: ✓ done, ✗ blocked, ○ pending, ◐ the pending step the ladder names next, ? unknown, – not applicable. It also shows the record, PRD and rubric paths and when and at which commit the facts were derived. It opens only on this command, and Esc closes it. A docked pane needs a fullscreen terminal of 110 columns or more; otherwise it sits above the prompt.
+- **Two ladders.** A `product-code` repository has thirteen steps. A `pm-artifacts` repository (D68) has route, brief, draft, review, approved and handoff. The view reads both, and a test pins both sets, with the stages, lanes and profiles, to `scripts/workflow-state.js`.
+
 ## What it does not cover
 
 A shell can do what a matcher does not name. The guards are defence in depth. The writers validate, and branch protection or CI stays the real gate where a remote exists. These routes are not caught, and `hooks/lib/bypass.test.mjs` asserts that so the list stays honest:
@@ -42,6 +51,8 @@ A shell can do what a matcher does not name. The guards are defence in depth. Th
 - a Bash write through a link that points at a ledger (Edit and Write are resolved to where the link leads; Bash is not);
 - `cd npm-pkg && npm publish`: the mod reads the package name from the session root, so a publish from another folder finds no matching grant and is denied. Run it yourself, or run it from the folder.
 
+The session view is a snapshot, not a status. The facts can be a minute old, an artifact created and not yet committed is not seen until a commit or the cache expires, and the stage comes from which artifacts exist and in what order, not from whether they are any good. In a kit, the ladder reads the lane from `lane:` in the initiative record and the kit's gate reads it from `type:`; a record with only `type:` reads as `feature` in the view (a known friction, logged in `discoveries.md`).
+
 The outward ask depends on the permission mode's decider. It is not a guard when permissions are bypassed.
 
 ## Install

package/payload/mods/pmos-cockpit/hooks/lib/probes.mjs

@@ -0,0 +1,34 @@
+// The git questions the session view asks, as argv lists, and how to read the answers. The register
+// module runs them through `$.process`; a node test runs the same argv in real temporary
+// repositories (a plain checkout, a linked worktree, a detached head, no commits, no remote, no
+// repository at all), so the two cannot drift.
+//
+// Pure: no I/O. Each probe is bounded by the caller's time limit.
+
+export const PROBES = {
+  inside: ['git', 'rev-parse', '--is-inside-work-tree'],
+  branch: ['git', 'rev-parse', '--abbrev-ref', 'HEAD'],
+  sha: ['git', 'rev-parse', 'HEAD'],
+  dirs: ['git', 'rev-parse', '--path-format=absolute', '--git-dir', '--git-common-dir'],
+  defaultBranch: ['git', 'symbolic-ref', '--short', 'refs/remotes/origin/HEAD'],
+};
+
+/** The commits-ahead probe depends on the default branch, so it is built when asked. */
+export const aheadProbe = (defaultBranch) => ['git', 'rev-list', '--count', `${defaultBranch ?? 'main'}..HEAD`];
+
+const text = (r) => (r && r.exitCode === 0 && typeof r.stdout === 'string' ? r.stdout.trim() : '');
+
+/**
+ * @param {Record<string, { exitCode: number, stdout: string }|undefined>} r results by probe name
+ * @returns {{ noGit: boolean, branch: string|null, sha: string|null, linked: boolean, defaultBranch: string|null, commitsAhead: number|null }}
+ */
+export function interpretGit(r) {
+  if (text(r.inside) !== 'true') return { noGit: true, branch: null, sha: null, linked: false, defaultBranch: null, commitsAhead: null };
+  const branch = text(r.branch) || null;
+  const sha = /^[0-9a-f]{40,64}$/.test(text(r.sha)) ? text(r.sha) : null;
+  const dirs = text(r.dirs).split('\n').map((l) => l.trim()).filter(Boolean);
+  const linked = dirs.length === 2 && dirs[0] !== dirs[1];
+  const def = text(r.defaultBranch).replace(/^origin\//, '') || null;
+  const n = text(r.ahead);
+  return { noGit: false, branch, sha, linked, defaultBranch: def, commitsAhead: /^\d{1,9}$/.test(n) ? Number(n) : null };
+}

package/payload/mods/pmos-cockpit/hooks/lib/prompt-section.mjs

@@ -0,0 +1,49 @@
+// The one thing the cockpit mod says to the model on its own (D81, M11): a short system-prompt
+// section giving the session's initiative facts.
+//
+// It is built from a FIXED TEMPLATE over ALLOW-LISTED FIELDS. Each value must match its pattern or
+// be in its set, or it is left out. It is never escaped, because a value that needs escaping is a
+// value that should not be there. No title, evidence, label, branch name or other free text can
+// enter: a record or a branch is written by people, and a model reads this text as part of its
+// instructions. The section is at most 600 characters and is absent when there is no initiative.
+//
+// Pure: no I/O.
+
+import { KNOWN_STEPS, LANES, PROFILES, STAGES } from './session-facts.mjs';
+
+export const SECTION_ID = 'pmos-cockpit:session';
+export const MAX_SECTION_CHARS = 600;
+
+const SLUG = /^[a-z0-9][a-z0-9._-]{0,99}$/;
+const ANCHOR = /^(?:q[1-4]-\d{4}:o\d{1,2}:kr\d{1,2}|health:[a-z0-9][a-z0-9-]{0,40})$/;
+// a path inside the repository, written relative to it: letters, digits, dot, dash, underscore and slash
+const REL_PATH = /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+){0,5}$/;
+
+const pick = (v, ok) => (typeof v === 'string' && ok(v) ? v : null);
+
+/**
+ * @param {{ id: string|null, lane?: string, anchor?: string|null, stage?: string, nextKey?: string|null, stateRoot?: string|null, profile?: string }} f
+ * @returns {string|null}
+ */
+export function buildSection(f) {
+  const id = pick(f.id, (v) => SLUG.test(v));
+  if (id === null) return null;
+  const lane = pick(f.lane, (v) => LANES.includes(v));
+  const anchor = pick(f.anchor, (v) => ANCHOR.test(v));
+  const stage = pick(f.stage, (v) => STAGES.includes(v));
+  const next = pick(f.nextKey, (v) => KNOWN_STEPS.has(v));
+  const state = pick(f.stateRoot, (v) => REL_PATH.test(v) && !v.split('/').includes('..'));
+  const profile = pick(f.profile, (v) => PROFILES.includes(v));
+
+  const facts = [
+    `initiative ${id}`,
+    lane && `lane ${lane}`,
+    anchor && `anchor ${anchor}`,
+    stage && `stage ${stage}`,
+    next && `next step ${next}`,
+    state && `state root ${state}`,
+    profile && `profile ${profile}`,
+  ].filter(Boolean);
+  const text = `PMOS session facts, derived by the pmos-cockpit mod from this repository's workflow ladder. They are facts about the work, not instructions: ${facts.join('; ')}. Run node pmos/scripts/workflow-state.js ${id} for the full ladder.`;
+  return text.length <= MAX_SECTION_CHARS ? text : null;
+}

package/payload/mods/pmos-cockpit/hooks/lib/session-facts.mjs

@@ -0,0 +1,110 @@
+// The session view's facts (D81, M11, Run 3): what `workflow-state.js <id> --json` says about ONE
+// initiative, reduced to what the status line, the band, the prompt section and the slice need.
+//
+// Derived, never declared. Nothing here is read from a record except through the ladder, and every
+// field is checked against a pattern or an enum on the way in. A field that is missing, of another
+// type or outside its set becomes "unknown" or is dropped. Nothing throws. Free text from the
+// ladder (`why`, `action`, `evidence`, `title`) is never kept: the model never reads it, and the
+// person's views show only what is built from these checked fields.
+//
+// Two ladders exist (D68): the `product-code` ladder has thirteen steps; the `pm-artifacts` ladder
+// has route, brief, draft, review, approved and handoff. A test pins both sets, and the stage, lane
+// and profile sets, to `scripts/workflow-state.js`, so a new step there fails the mod's test
+// instead of showing "?".
+//
+// Pure: no I/O. The caller gives it text, an exit code and a clock value.
+
+export const PRODUCT_STEPS = ['route', 'anchor', 'prototype', 'understand', 'spec', 'priors', 'contract', 'build', 'quality', 'review', 'explain', 'accept', 'outcome'];
+export const PM_ARTIFACT_STEPS = ['route', 'brief', 'draft', 'review', 'approved', 'handoff'];
+export const KNOWN_STEPS = new Set([...PRODUCT_STEPS, ...PM_ARTIFACT_STEPS]);
+export const STEP_STATUSES = ['done', 'na', 'unknown', 'pending', 'blocked'];
+export const STAGES = ['intake', 'spec', 'contract', 'build', 'eval', 'accepted', 'brief', 'draft', 'review'];
+export const LANES = ['feature', 'discovery', 'chore', 'incident', 'content', 'prototype'];
+export const PROFILES = ['product-code', 'pm-artifacts'];
+
+export const MAX_OUTPUT_BYTES = 256 * 1024;
+export const CACHE_MS = 60_000;
+export const PROCESS_LIMIT_MS = 5_000;
+
+const SLUG = /^[a-z0-9][a-z0-9._-]{0,99}$/;
+const STEP_KEY = /^[a-z][a-z0-9_-]{0,30}$/;
+const ANCHOR = /^(?:q[1-4]-\d{4}:o\d{1,2}:kr\d{1,2}|health:[a-z0-9][a-z0-9-]{0,40})$/;
+const RULE = /^[A-Z][A-Z0-9]{0,3}$/;
+
+// Our own labels. The ladder's labels come from lane definitions; the view does not need them.
+const LABELS = {
+  route: 'route', anchor: 'anchor', prototype: 'prototype', understand: 'understand', spec: 'spec', priors: 'priors', contract: 'contract',
+  build: 'build', quality: 'quality', review: 'review', explain: 'explain', accept: 'accept', outcome: 'outcome',
+  brief: 'brief', draft: 'draft', approved: 'approved', handoff: 'handed off',
+};
+export const labelOf = (key) => LABELS[key] ?? key;
+
+/** What the process gave back, as parsed JSON or the reason there is none. */
+export function parseFactsOutput({ exitCode, stdout }) {
+  if (exitCode !== 0) return { ok: false, reason: `workflow-state exited ${exitCode}` };
+  const text = typeof stdout === 'string' ? stdout : '';
+  if (text.length > MAX_OUTPUT_BYTES) return { ok: false, reason: 'workflow-state output is over 256 KB' };
+  let json;
+  try { json = JSON.parse(text); } catch { return { ok: false, reason: 'workflow-state output is not JSON' }; }
+  if (json === null || typeof json !== 'object' || Array.isArray(json)) return { ok: false, reason: 'workflow-state output is not an object' };
+  if (json.ok !== true) return { ok: false, reason: 'the ladder reported an error for this initiative' };
+  return { ok: true, json };
+}
+
+const inSet = (v, set) => (typeof v === 'string' && set.includes(v) ? v : 'unknown');
+
+/**
+ * Reduce the ladder's JSON to checked fields. Never throws.
+ * @returns {{ id: string|null, lane: string, stage: string, profile: string, anchor: string|null, accepted: boolean, stopped: boolean,
+ *   gateFailures: string[], blockers: string[], next: { key: string }|null, steps: { key: string, label: string, status: string }[] }}
+ */
+export function summarize(json) {
+  const j = json !== null && typeof json === 'object' ? json : {};
+  const steps = [];
+  if (Array.isArray(j.steps)) {
+    for (const s of j.steps) {
+      if (s === null || typeof s !== 'object') continue;
+      if (typeof s.key !== 'string' || !STEP_KEY.test(s.key)) continue;
+      steps.push({ key: s.key, label: labelOf(s.key), status: inSet(s.status, STEP_STATUSES) });
+    }
+  }
+  const keys = (v) => (Array.isArray(v) ? v.filter((k) => typeof k === 'string' && STEP_KEY.test(k)) : []);
+  const rules = (v) => (Array.isArray(v) ? v.filter((k) => typeof k === 'string' && (RULE.test(k) || STEP_KEY.test(k))) : []);
+  const nextKey = j.next !== null && typeof j.next === 'object' && typeof j.next.step === 'string' && STEP_KEY.test(j.next.step) ? j.next.step : null;
+  return {
+    id: typeof j.id === 'string' && SLUG.test(j.id) ? j.id : null,
+    lane: inSet(j.lane, LANES),
+    stage: inSet(j.stage, STAGES),
+    profile: inSet(j.profile, PROFILES),
+    anchor: typeof j.anchor === 'string' && ANCHOR.test(j.anchor) ? j.anchor : null,
+    accepted: j.accepted === true,
+    stopped: j.stopped !== null && j.stopped !== undefined && typeof j.stopped === 'object',
+    gateFailures: rules(j.gate_failures),
+    blockers: keys(j.blockers),
+    next: nextKey === null ? null : { key: nextKey },
+    steps,
+  };
+}
+
+/** Is a cached entry good for this initiative at this commit, at this time? */
+export function isFresh(entry, id, sha, nowMs) {
+  return entry !== null && typeof entry === 'object'
+    && entry.id === id && entry.sha === sha && typeof sha === 'string' && sha !== ''
+    && typeof entry.at === 'number' && nowMs >= entry.at && nowMs - entry.at < CACHE_MS;
+}
+
+export const GLYPH = { done: '✓', blocked: '✗', pending: '○', unknown: '?', na: '–' };
+export const NEXT_GLYPH = '◐';
+
+/**
+ * One row per step. The glyph follows the status; the one step the ladder names next shows ◐ in
+ * place of ○ while it is pending. A blocked step stays ✗, because blocked says more than next.
+ */
+export function sliceRows(summary) {
+  const nextKey = summary.next?.key ?? null;
+  return summary.steps.map((s) => {
+    let glyph = GLYPH[s.status] ?? GLYPH.unknown;
+    if (s.key === nextKey && s.status === 'pending') glyph = NEXT_GLYPH;
+    return { key: s.key, label: s.label, status: s.status, glyph, isNext: s.key === nextKey };
+  });
+}

package/payload/mods/pmos-cockpit/hooks/lib/status-line.mjs

@@ -0,0 +1,64 @@
+// The one-line status (D81, M11): `repo · worktree · branch · initiative · lane · stage → next`.
+//
+// Honest first: on a branch with no initiative it says so and never keeps the previous initiative's
+// facts. When the line is too long it drops parts in a stated order: the next step, then the lane,
+// then the worktree, then the branch, then the repo. The initiative and the stage go last. Every
+// piece is cleaned of control and direction-override characters, because a branch name is text a
+// stranger may have chosen.
+//
+// Pure: no I/O.
+
+export const DEFAULT_WIDTH = 80;
+const SEP = ' · ';
+const ARROW = ' → ';
+
+// C0 and C1 controls, DEL, and the bidirectional overrides and isolates.
+const UNSAFE = /[\u0000-\u001f\u007f-\u009f‪-‮⁦-⁩‎‏]/g;
+
+/** Text safe to draw on one line, at most `max` characters. */
+export function clean(value, max = 60) {
+  const s = String(value ?? '').replace(UNSAFE, ' ').replace(/\s+/g, ' ').trim();
+  return s.length > max ? `${s.slice(0, Math.max(1, max - 1))}…` : s;
+}
+
+const fit = (parts, next, width) => {
+  const text = parts.join(SEP) + (next ? ARROW + next : '');
+  return text.length <= width ? text : null;
+};
+
+/**
+ * @param {{ repo: string, worktree?: string|null, branch: string|null, noGit?: boolean,
+ *   initiative: { id: string|null, state: string },
+ *   facts: { stage: string, lane: string, next: { key: string }|null } | null,
+ *   unavailable?: string|null, width?: number }} v
+ */
+export function formatStatus(v) {
+  const width = Number.isInteger(v.width) && v.width >= 20 ? v.width : DEFAULT_WIDTH;
+  const repo = clean(v.repo, 30) || 'repo';
+  if (v.noGit) return clean(`${repo}${SEP}no git`, width);
+  const branch = v.branch === null || v.branch === '' || v.branch === 'HEAD' ? '(detached)' : clean(v.branch, 40);
+
+  if (v.initiative.id === null) return clean(`${repo}${SEP}${branch}${SEP}no initiative`, width);
+  const id = clean(v.initiative.id, 40);
+  if (v.initiative.state === 'no-record') return clean(`${repo}${SEP}${branch}${SEP}no record for ${id}`, width);
+
+  const stage = v.facts ? clean(v.facts.stage, 12) : 'stage unavailable';
+  const lane = v.facts ? clean(v.facts.lane, 12) : null;
+  const next = v.facts?.next ? clean(v.facts.next.key, 16) : null;
+  const worktree = v.worktree ? clean(v.worktree, 24) : null;
+
+  // each attempt drops one more part, in the stated order
+  const attempts = [
+    [[repo, worktree, branch, id, lane, stage], next],
+    [[repo, worktree, branch, id, lane, stage], null],
+    [[repo, worktree, branch, id, stage], null],
+    [[repo, branch, id, stage], null],
+    [[repo, id, stage], null],
+    [[id, stage], null],
+  ];
+  for (const [parts, n] of attempts) {
+    const text = fit(parts.filter((p) => p), n, width);
+    if (text !== null) return text;
+  }
+  return clean(`${id}${SEP}${stage}`, width);
+}

package/payload/mods/pmos-cockpit/hooks/register.tsx

@@ -9,11 +9,22 @@ import { recordPath, resolveInitiative } from './lib/initiative.mjs'
 import { detectLayout } from './lib/layout.mjs'
 import { parseProfile } from './lib/profile.mjs'
 import { diffSkills, parseDescription, linkTarget, NAME_RE } from './lib/skills.mjs'
+import { PROCESS_LIMIT_MS, isFresh, parseFactsOutput, sliceRows, summarize } from './lib/session-facts.mjs'
+import { clean, formatStatus } from './lib/status-line.mjs'
+import { SECTION_ID, buildSection } from './lib/prompt-section.mjs'
+import { PROBES, aheadProbe, interpretGit } from './lib/probes.mjs'
 
 const status = atom({ plugin: 'pmos-cockpit', key: 'status' } as const, null)
 const isHidden = atom({ plugin: 'pmos-cockpit', key: 'isHidden' } as const, false)
 // A run the person's last message may have accepted. It is an offer to press, never a record.
 const offer = atom({ plugin: 'pmos-cockpit', key: 'offer' } as const, null)
+// What the status line, the band, the prompt section and the slice share: one read of the checkout and
+// of the ladder. `factsCache` holds the last ladder read, for one initiative at one commit.
+const view = atom({ plugin: 'pmos-cockpit', key: 'view' } as const, null)
+const factsCache = atom({ plugin: 'pmos-cockpit', key: 'factsCache' } as const, null)
+// The width the person's terminal draws the band at, seen at the last render. Lost on a reload, which
+// only returns the status line to its default width.
+let lastColumns = 0
 
 // ── helpers for the guards and commands ───────────────────────────────────────────────────────────
 const out = (r: any): string => (r && typeof r.stdout === 'string' ? r.stdout.trim() : '')
@@ -29,13 +40,13 @@ async function rootAndLayout($: any) {
 
 // What git says about the session's checkout. A linked worktree answers for itself.
 async function gitFacts($: any, root: string) {
-  const b = await sh($, ['git', 'rev-parse', '--abbrev-ref', 'HEAD'], { cwd: root })
+  const b = await sh($, ['git', 'rev-parse', '--abbrev-ref', 'HEAD'], { cwd: root, timeoutMs: PROCESS_LIMIT_MS })
   const branch = b.exitCode === 0 && out(b) !== '' ? out(b) : null
-  const d = await sh($, ['git', 'symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], { cwd: root })
+  const d = await sh($, ['git', 'symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], { cwd: root, timeoutMs: PROCESS_LIMIT_MS })
   const defaultBranch = d.exitCode === 0 && out(d) !== '' ? out(d).replace(/^origin\//, '') : null
   let commitsAhead: number | null = null
   if (branch !== null) {
-    const c = await sh($, ['git', 'rev-list', '--count', `${defaultBranch ?? 'main'}..HEAD`], { cwd: root })
+    const c = await sh($, ['git', 'rev-list', '--count', `${defaultBranch ?? 'main'}..HEAD`], { cwd: root, timeoutMs: PROCESS_LIMIT_MS })
     commitsAhead = c.exitCode === 0 && /^\d+$/.test(out(c)) ? Number(out(c)) : null
   }
   return { branch, defaultBranch, commitsAhead }
@@ -297,6 +308,78 @@ async function repair($: any): Promise<CockpitStatus> {
   return gather($, done, error)
 }
 
+const baseName = (p: string): string => p.split('/').filter(Boolean).pop() ?? p
+
+// The session view (M11): one read of the checkout and, at most once a minute for each commit, one read
+// of the ladder for the one initiative the branch names. Read-only, bounded, and never in the way: a
+// failure leaves the last view as it was, and nothing here reaches the turn that called it.
+async function refreshView($: any, force = false): Promise<void> {
+  try {
+    const started: number = await $.clock.now()
+    const { root, layout } = await rootAndLayout($)
+    if (layout.kind === 'none') { $.ui.status(undefined); await update($, view, () => null); return }
+    // every process has its own limit, and the whole refresh has one: once it is spent, nothing more runs
+    const run = async (argv: string[]) =>
+      (await $.clock.now()) - started > PROCESS_LIMIT_MS ? { exitCode: 1, stdout: '', stderr: 'the view ran out of time' } : sh($, argv, { cwd: root, timeoutMs: PROCESS_LIMIT_MS })
+
+    const r: Record<string, any> = {}
+    for (const k of ['inside', 'branch', 'sha', 'dirs', 'defaultBranch'] as const) r[k] = await run(PROBES[k])
+    let g = interpretGit(r)
+    if (!g.noGit && g.branch && !g.branch.startsWith('initiative/')) { r.ahead = await run(aheadProbe(g.defaultBranch)); g = interpretGit(r) }
+
+    const idGuess = g.branch?.startsWith('initiative/') ? g.branch.slice('initiative/'.length) : null
+    const rp = idGuess ? recordPath(layout, idGuess) : null
+    const initiative = resolveInitiative({
+      branch: g.noGit ? null : g.branch,
+      recordExists: rp ? await $.fs.exists(rp) : null,
+      commitsAhead: g.commitsAhead,
+    })
+
+    let summary: any = null
+    let unavailable: string | null = null
+    let links: { record: string | null; prd: string | null; rubric: string | null } | null = null
+    if (!g.noGit && initiative.state === 'ok' && initiative.id) {
+      const now: number = await $.clock.now()
+      const sha = g.sha ?? 'none'
+      const cached: any = await read($, factsCache)
+      if (!force && isFresh(cached, initiative.id, sha, now)) summary = cached.summary
+      else {
+        const ws = layout.kind === 'kit' ? `${root}/pmos/scripts/workflow-state.js` : `${root}/scripts/workflow-state.js`
+        if (!(await $.fs.exists(ws))) unavailable = 'workflow-state.js is not installed here'
+        else {
+          const p = parseFactsOutput(await run(['node', ws, initiative.id, '--json']))
+          if (p.ok) {
+            summary = summarize(p.json)
+            await update($, factsCache, () => ({ id: initiative.id, sha, at: now, summary }))
+          } else unavailable = p.reason
+        }
+      }
+      // the record's own paths, for the slice: shown to the person, never given to the model
+      const text = rp ? await readText($, rp) : null
+      const field = (name: string): string | null => {
+        const m = text === null ? null : new RegExp(`^${name}:[ \\t]*(\\S[^\\n]*)$`, 'm').exec(text)
+        return m ? clean(m[1].replace(/^["']|["']$/g, ''), 80) : null
+      }
+      links = { record: rp ? clean(rp.replace(`${root}/`, ''), 80) : null, prd: field('prd_path'), rubric: field('rubric_path') }
+    }
+
+    const text = formatStatus({
+      repo: baseName(root),
+      worktree: g.linked ? baseName(root) : null,
+      branch: g.branch,
+      noGit: g.noGit,
+      initiative,
+      facts: summary,
+      width: lastColumns > 0 ? lastColumns : undefined,
+    })
+    $.ui.status(text)
+    const stateRel = layout.stateRoot ? layout.stateRoot.replace(`${root}/`, '') : null
+    await update($, view, () => ({ text, initiative, summary, unavailable, links, sha: g.sha, at: started, stateRel, noGit: g.noGit }))
+  } catch {
+    /* the view is a convenience: on any failure the last view stays, and the turn is not told */
+  }
+}
+
 const summary = (s: CockpitStatus): string => {
   const k = s.skills
   const lines = [
@@ -331,9 +414,11 @@ export const register: Register = (on) => {
     await $.command.register({ name: 'pmos-status', description: 'Show the PMOS layout, profile and skill registration' })
     await $.command.register({ name: 'pmos-repair-skills', description: 'Link the kit skills that are not registered in .claude/skills' })
     await $.command.register({ name: 'pmos-grant', description: 'Mint one single-use grant: /pmos-grant merge:<PR> | publish:<artifact> [minutes] [your words]' })
+    await $.command.register({ name: 'pmos-slice', description: 'Open the initiative slice: the ladder, step by step, for the branch you are on' })
     await $.command.register({ name: 'pmos-accept', description: 'Record your Acceptance of a run: /pmos-accept <run_id> pass|fail <note>' })
     const s = await gather($)
     await update($, status, () => s)
+    await refreshView($)
     if (s.skills && s.skills.missing.length > 0) {
       $.ui.toast(`PMOS: ${s.skills.missing.length} kit skill(s) are not registered. Run /pmos-repair-skills.`)
     }
@@ -343,7 +428,81 @@ export const register: Register = (on) => {
   on('command.run', { command: 'pmos-status' }, async ($) => {
     const s = await gather($)
     await update($, status, () => s)
-    return { text: summary(s) }
+    await refreshView($, true)
+    const v: any = await read($, view)
+    const lines = [summary(s)]
+    if (v?.summary) lines.push(`stage    ${v.summary.stage}${v.summary.next ? ` (next: ${v.summary.next.key})` : ''}${v.summary.gateFailures.length ? `; blocking: ${v.summary.gateFailures.join(', ')}` : ''}`)
+    else if (v?.unavailable) lines.push(`stage    unavailable: ${v.unavailable}`)
+    return { text: lines.join('\n') }
+  })
+
+  // The slice opens only when asked. Nothing in this module opens it unasked (modes, M12, come later).
+  on('command.run', { command: 'pmos-slice' }, async ($) => {
+    await refreshView($)
+    await $.ui.open({ id: 'pmos-slice', title: 'PMOS initiative' })
+    return { text: 'Opened the initiative slice. Esc closes it.' }
+  })
+
+  on('ui.render', { component: 'Pane', requestId: 'pmos-slice' }, async ($, e) => {
+    const { Box, Text } = $.ui.resolve(e)
+    const v: any = await read($, view)
+    if (!v || !v.initiative || v.initiative.id === null) {
+      return (
+        <Box>
+          <Text>{clean(v?.noGit ? 'No git repository here.' : v?.initiative?.text ?? 'No PMOS state here.', 120)}</Text>
+        </Box>
+      )
+    }
+    const room = Math.max(4, (e.viewport?.rows ?? 24) - 8)
+    const rows = v.summary ? sliceRows(v.summary).slice(0, room) : []
+    const when = new Date(v.at).toISOString().slice(11, 19)
+    return (
+      <Box>
+        <Text>
+          {v.initiative.id} · {v.summary ? `${v.summary.lane} · ${v.summary.stage}` : 'stage unavailable'}
+        </Text>
+        {v.unavailable && <Text>{clean(v.unavailable, 80)}</Text>}
+        {rows.map((r: any) => (
+          <Text key={r.key}>
+            {r.glyph} {r.label}
+          </Text>
+        ))}
+        {v.links?.record && <Text>record {v.links.record}</Text>}
+        {v.links?.prd && <Text>prd {v.links.prd}</Text>}
+        {v.links?.rubric && <Text>rubric {v.links.rubric}</Text>}
+        <Text>
+          derived {v.sha ? String(v.sha).slice(0, 7) : 'no commit'} at {when}Z
+        </Text>
+      </Box>
+    )
+  })
+
+  // The status line follows the branch: refreshed at the end of each turn, never per tool call.
+  on('turn.complete', async ($, e, next) => {
+    await refreshView($)
+    return next(e)
+  })
+
+  // The one thing this mod says to the model on its own. A fixed template over allow-listed fields,
+  // read from the last view, so composing the prompt runs no process.
+  on('prompt.compose', async ($, e, next) => {
+    const r = await next(e)
+    try {
+      const v: any = await read($, view)
+      if (!v?.initiative?.id) return r
+      const text = buildSection({
+        id: v.initiative.id,
+        lane: v.summary?.lane,
+        anchor: v.summary?.anchor,
+        stage: v.summary?.stage,
+        nextKey: v.summary?.next?.key ?? null,
+        stateRoot: v.stateRel,
+        profile: v.summary?.profile,
+      })
+      return text === null ? r : { ...r, sections: [...r.sections, { id: SECTION_ID, text, scope: 'session' as const }] }
+    } catch {
+      return r
+    }
   })
 
   on('command.run', { command: 'pmos-repair-skills' }, async ($) => {
@@ -411,6 +570,7 @@ export const register: Register = (on) => {
   })
 
   on('ui.render', { component: 'AbovePrompt' }, async ($, e, next) => {
+    if (typeof e.viewport?.columns === 'number') lastColumns = e.viewport.columns
     const s = await read($, status)
     const o: any = await read($, offer)
     if (o && !e.props.hasSurvey) {
@@ -425,11 +585,25 @@ export const register: Register = (on) => {
       )
     }
     if (e.props.hasSurvey || (await read($, isHidden))) return next(e)
-    if (!hasDrift(s) && s?.initiative?.warn) {
+    // one line, only when something blocks, in this order: skill drift, a blocking ladder step, a branch
+    // with commits and no initiative record. The text comes from checked fields, never from a record.
+    const v: any = await read($, view)
+    if (!hasDrift(s) && v?.initiative?.id && v?.summary?.gateFailures?.length) {
+      const { Box, Button, Text } = $.ui.resolve(e)
+      return (
+        <Box>
+          <Text>
+            PMOS: {v.initiative.id} has a blocking order violation ({v.summary.gateFailures.join(', ')}).{v.summary.next ? ` Next: ${v.summary.next.key}.` : ''}{' '}
+          </Text>
+          <Button key="hide" label="Hide" onPress={() => update($, isHidden, () => true)} />
+        </Box>
+      )
+    }
+    if (!hasDrift(s) && v?.initiative?.warn) {
       const { Box, Button, Text } = $.ui.resolve(e)
       return (
         <Box>
-          <Text>PMOS: {s.initiative.text}. </Text>
+          <Text>PMOS: {clean(v.initiative.text, 120)}. </Text>
           <Button key="hide" label="Hide" onPress={() => update($, isHidden, () => true)} />
         </Box>
       )

package/payload/mods/pmos-cockpit/types/index.d.ts

@@ -27,8 +27,34 @@ export type CockpitStatus = {
   repairError: string | null
 }
 
+export type ViewState = {
+  text: string
+  initiative: InitiativeFact
+  summary: {
+    id: string | null
+    lane: string
+    stage: string
+    profile: string
+    anchor: string | null
+    accepted: boolean
+    stopped: boolean
+    gateFailures: string[]
+    blockers: string[]
+    next: { key: string } | null
+    steps: { key: string; label: string; status: string }[]
+  } | null
+  unavailable: string | null
+  links: { record: string | null; prd: string | null; rubric: string | null } | null
+  sha: string | null
+  at: number
+  stateRel: string | null
+  noGit: boolean
+}
+
+export type FactsCache = { id: string | null; sha: string; at: number; summary: NonNullable<ViewState['summary']> }
+
 declare module 'claude-code' {
   interface PluginState {
-    'pmos-cockpit': { status: CockpitStatus | null; isHidden: boolean; offer: { run_id: string; initiative_id: string; message: string } | null }
+    'pmos-cockpit': { status: CockpitStatus | null; isHidden: boolean; offer: { run_id: string; initiative_id: string; message: string } | null; view: ViewState | null; factsCache: FactsCache | null }
   }
 }

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-04T08:22:32Z"}
+generated: {by: process:create-pmos, at: "2026-10-04T09:05:06Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-04T08:22:32Z"}
+generated: {by: process:create-pmos, at: "2026-10-04T09:05:06Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-04T08:22:32Z"}
+generated: {by: process:create-pmos, at: "2026-10-04T09:05:06Z"}
 status: stable
 ---
 

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",