create-pmos 0.52.0 → 0.53.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@a6425d1
-assembled: 2026-10-05
+kernel-source: pmos@aa14199
+assembled: 2026-10-06
 mode: vendor

package/payload/mods/pmos-cockpit/README.md

@@ -32,6 +32,14 @@ A grant is one line in `grants.jsonl`. You mint it by typing `/pmos-grant merge:
 
 `/pmos-accept <run_id> pass|fail <note>` records your Acceptance through the same writer, with `pm_label` set. When your own message reads as an approval, a band offers Pass, Fail and Not now for the newest run of the branch's initiative that has no acceptance. Your press writes the row; the note quotes your message. Nothing is written from inferred text.
 
+**PM-only acts (pm-os-absorb Run 2, D86 point 2).** The guards deny a model call that does one of the PM's acts in the workspace: Move to Now, adopt a proposal, Issue, acceptance, lifecycle, the anchor change, Keep and Release. A call is denied when it:
+
+- sends a write (a body, or a method other than GET) to a PM-only workspace route on a loopback address and a workspace port: `/api/gate`, `/api/lifecycle`, `/api/plan-items`, `/api/placements`, `/api/doc/save`, `/api/align/apply`, `/api/ingest/confirm`, `/api/session/initiative`, `/api/report/issue` or `/api/board/release`. The workspace ports are 7433 to 7445, the port in `PMOS_ROUTE_URL` and a `PMOS_WS_PORT` pin. The check reads each spelling of a loopback address (`127.1`, `0`, `[::1]`, …), removes `/./` and `/x/../` from the path, and reads a URL that the command keeps in a variable. A call to a product's own server on another port is allowed;
+- runs a PM-only `pmos` verb (`pmos initiative now`, `adopt`, `anchor` or `lifecycle`; `pmos report issue`; `pmos board release`), also through `node $PMOS_BIN`, `env`, `script` or a launcher;
+- loads the writer of a D86 ledger (`workspace/lib/plan-items.js`, `placements.js`, `measurements.js`, `issues.js`) from inline code (`-e`, `--eval=`, `-r`, `--require=`, `--import=`, a here-document, a here-string, or a program sent through a pipe), or writes and runs such a script in one command, or writes one outside the repository that calls the writer's PM path. The module path must name `workspace/lib/`. In PMOS's own repository, `lib/<name>` and `./<name>` also count. A product's own `src/github/issues.js` is not a writer, and a kit install loads it freely.
+
+The four D86 ledgers are listed as ledgers, so a hand write to one is denied and the message names the `pmos` verb that writes it. Two grant scopes join `merge` and `publish`: `release:<initiative>:<batch-id>` (one factory batch) and `lifecycle-bulk:<state>:<id>,<id>,…` (one state for at most 20 initiatives). Both are single use and live 120 minutes unless you give a shorter time.
+
 ## Model routing (prompt-model-routing, Run 3)
 
 - **Every prompt is routed before it runs.** When the PMOS workspace started this terminal, it put its own loopback address in `PMOS_ROUTE_URL`. The mod asks that address for the route of each prompt you type and each prompt handed to a sub-agent. The workspace asks Jev only when its three gates are open: a saved key, consent for the repository, and the "route prompts with Jev" switch (D84). All three are on the workspace's validation page. The key stays in the workspace and never reaches this terminal.
@@ -81,6 +89,11 @@ A shell can do what a matcher does not name. The guards are defence in depth. Th
 - a script written first and run second (`bash /tmp/x.sh`);
 - a path built from pieces no pattern can join (`'runs' + '.js' + 'onl'`);
 - a patch that touches a ledger (`git apply`);
+- a script written by one call inside the repository and run by a later call, or a writer's path built from pieces: the line it writes is flagged by CI (`scripts/check-pm-lines.js`) when it arrives in an agent-authored commit, which is detection after the fact;
+- a call to a PM-only route on an address that is not loopback, or on a port that this session does not know as a workspace port;
+- a program that `node` reads from a file on stdin (`node < /tmp/x.js`), as for any script run from a file;
+- in a kit install, a writer loaded by a path that does not name `workspace/lib/` (`cd` into the workspace first);
+- `pmos initiative up`, `top`, `down` and `check-by`. These are PM-only only for an initiative in Now, and the matcher cannot see the horizon. For a Now initiative, the verb asks the PM to type a confirmation at a terminal, so an agent's call fails there;
 - a Bash write through a link that points at a ledger (Edit and Write are resolved to where the link leads; Bash is not);
 - `cd npm-pkg && npm publish`: the mod reads the package name from the session root, so a publish from another folder finds no matching grant and is denied. Run it yourself, or run it from the folder.
 

package/payload/mods/pmos-cockpit/hooks/lib/commands.mjs

@@ -68,7 +68,8 @@ export function planAcceptance({ layout, root, run, label, note, pm, atIso }) {
     return { ok: true, argv: [...w.argv, 'accept', run.run_id, run.initiative_id, label, note], env: w.env };
   }
   if (layout.kind === 'self') {
-    const row = { run_id: run.run_id, initiative_id: run.initiative_id, accepted: label === 'pass', pm_label: label, pm, at: atIso, note };
+    // via 'cli': the PM typed /pmos-accept (a PM-only line carries via, R25(4); scripts/check-pm-lines.js reads it).
+    const row = { run_id: run.run_id, initiative_id: run.initiative_id, accepted: label === 'pass', pm_label: label, pm, at: atIso, note, via: 'cli' };
     return { ok: true, argv: ['node', `${r}/scripts/record-acceptance.js`, JSON.stringify(row)], env: {} };
   }
   return { ok: false, text: 'There is no PMOS state here, so there is nowhere to record an acceptance.' };

package/payload/mods/pmos-cockpit/hooks/lib/grants.mjs

@@ -11,38 +11,68 @@
 // on a branch that names none. It is optional. A value that is not a plain slug makes the whole grant
 // ignored: a grant that says something the code cannot read is not trusted for anything.
 //
-// This release has two scopes and no standing grant. `merge` covers one PR number (or one branch name
-// for a push), `publish` covers one artifact. A scope the code does not know, including `docs-sync`
-// and every `outward:` scope, is refused when minted and ignored when read. A grant for one target
-// never covers another. A grant is live when it has not expired and has not been used.
+// This release has four scopes and no standing grant. `merge` covers one PR number (or one branch name
+// for a push), `publish` covers one artifact. Two more came with D86 point 2 (pm-os-absorb Run 2, map-spec
+// X5): `release` covers ONE factory batch of one initiative (`release:<initiative>:<batch-id>`, D65), and
+// `lifecycle-bulk` covers one lifecycle change of an explicit list of at most 20 initiatives
+// (`lifecycle-bulk:<state>:<id>,<id>,…`, the state one of active, closed, on-hold, cancelled; an id listed
+// twice is refused). Both are minted only by /pmos-grant or a person's press (workspace/lib/grant-mint.js).
+// A scope the code does not know, including `docs-sync` and every `outward:` scope, is refused when
+// minted and ignored when read. A grant for one target never covers another. A grant is live when it
+// has not expired and has not been used.
+//
+// ONE RULE IN THREE PLACES. scripts/record-grant.js and kit/scripts/pmos-log.sh hold the same scopes and
+// target patterns; scripts/tests/record-grant.test.js runs one table of cases through all three.
 //
 // Pure: it reads text and a clock value it is given.
 
-export const SCOPES = ['merge', 'publish'];
+export const SCOPES = ['merge', 'publish', 'release', 'lifecycle-bulk'];
 export const DEFAULT_TTL_MINUTES = 120;
 export const MAX_TTL_MINUTES = 24 * 60;
 // The same slug rule as the initiative resolver and both writers.
 export const INITIATIVE_ID = /^[a-z0-9][a-z0-9._-]{0,99}$/;
 
+// The lifecycle states a bulk grant may name: STOPPED_STATES of scripts/workflow-state.js, and `active`.
+export const LIFECYCLE_STATES = ['active', 'closed', 'on-hold', 'cancelled'];
+export const BULK_MAX_IDS = 20;
+const SLUG = '[a-z0-9][a-z0-9._-]{0,99}';
 const TARGET = {
   merge: /^(?:\d{1,9}|[A-Za-z0-9][A-Za-z0-9._\/-]{0,79})$/,
   publish: /^[A-Za-z0-9@][A-Za-z0-9@._\/-]{0,99}$/,
+  release: new RegExp(`^${SLUG}:[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`),
+  'lifecycle-bulk': new RegExp(`^(?:active|closed|on-hold|cancelled):${SLUG}(?:,${SLUG}){0,${BULK_MAX_IDS - 1}}$`),
+};
+const WHAT = {
+  merge: 'PR number or branch name',
+  publish: 'artifact name',
+  release: '<initiative>:<batch-id>',
+  'lifecycle-bulk': `<state>:<id>,<id>,… (one of ${LIFECYCLE_STATES.join(', ')}, then 1 to ${BULK_MAX_IDS} initiative ids)`,
 };
+const USE = 'Use merge:<PR number or branch>, publish:<artifact>, release:<initiative>:<batch-id> or lifecycle-bulk:<state>:<id>,<id>,….';
+
+/** Does `target` name exactly one thing a grant of `kind` may cover? The rule the two writers repeat. */
+export function targetOk(kind, target) {
+  const t = String(target);
+  if (!Object.prototype.hasOwnProperty.call(TARGET, kind) || t.includes('*') || t.includes('..') || !TARGET[kind].test(t)) return false;
+  if (kind !== 'lifecycle-bulk') return true;
+  const ids = t.slice(t.indexOf(':') + 1).split(',');
+  return new Set(ids).size === ids.length;
+}
 
 /** Parse "merge:361" into its parts, or say why not. */
 export function parseScope(text) {
   const raw = String(text ?? '').trim();
-  if (raw === '') return { ok: false, reason: 'a scope is required, for example merge:361 or publish:create-pmos' };
+  if (raw === '') return { ok: false, reason: 'a scope is required, for example merge:361, publish:create-pmos or release:alpha:b-01' };
   if (/^docs-sync(?::|$)/.test(raw) || /^outward(?::|$)/.test(raw)) {
     return { ok: false, reason: `"${raw}" is a standing scope. Standing grants are not allowed in this release (D81). Mint one single-use grant per action.` };
   }
   const at = raw.indexOf(':');
-  if (at === -1) return { ok: false, reason: `unknown scope "${raw}". Use merge:<PR number or branch> or publish:<artifact>.` };
+  if (at === -1) return { ok: false, reason: `unknown scope "${raw}". ${USE}` };
   const kind = raw.slice(0, at);
   const target = raw.slice(at + 1);
-  if (!SCOPES.includes(kind)) return { ok: false, reason: `unknown scope "${kind}". Use merge:<PR number or branch> or publish:<artifact>.` };
-  if (target === '' || target.includes('*') || target.includes('..') || !TARGET[kind].test(target)) {
-    return { ok: false, reason: `"${target}" is not a single ${kind === 'merge' ? 'PR number or branch name' : 'artifact name'}. A grant names one target; a wildcard is refused.` };
+  if (!SCOPES.includes(kind)) return { ok: false, reason: `unknown scope "${kind}". ${USE}` };
+  if (target === '' || !targetOk(kind, target)) {
+    return { ok: false, reason: `"${target}" is not a single ${WHAT[kind]}. A grant names one target; a wildcard is refused.` };
   }
   return { ok: true, kind, target };
 }
@@ -60,7 +90,7 @@ export function parseLedger(text) {
     if (r === null || typeof r !== 'object' || Array.isArray(r)) { ignored += 1; continue; }
     if (r.type === 'use' && typeof r.grant_id === 'string') { uses.set(r.grant_id, (uses.get(r.grant_id) ?? 0) + 1); continue; }
     if (r.type !== 'grant' || typeof r.id !== 'string' || !SCOPES.includes(r.scope) || typeof r.target !== 'string') { ignored += 1; continue; }
-    if (!TARGET[r.scope].test(r.target) || r.target.includes('*') || r.target.includes('..')) { ignored += 1; continue; }
+    if (!targetOk(r.scope, r.target)) { ignored += 1; continue; }
     const at = Date.parse(r.at);
     const exp = Date.parse(r.expires_at);
     if (Number.isNaN(at) || Number.isNaN(exp) || exp <= at || exp - at > MAX_TTL_MINUTES * 60_000 || r.uses !== 1) { ignored += 1; continue; }

package/payload/mods/pmos-cockpit/hooks/lib/guard.mjs

@@ -11,6 +11,10 @@
 //                 default branch, a forced push, npm publish           -> needs a live grant
 //   cloud         a cloud-mutating command from AGENTS.md              -> deny, the PM runs it
 //   outward       a write tool for Confluence, Jira, Slack, Gmail …    -> ask for each item
+//   pm-act        a PM-only act (pm-os-absorb R25(3), D86 point 2): an
+//                 HTTP write to a loopback PM-only route, a PM-only
+//                 `pmos` verb, or inline code that requires a D86
+//                 ledger's writer module                               -> deny, the PM presses it
 //
 // WHAT THIS IS NOT. A shell can do what no matcher names: a path built from pieces, a script written
 // first and run second, a tool this file has never seen. The mod is defence in depth. The writers
@@ -23,9 +27,17 @@
 // Pure: no I/O. The caller gives it the layout, the branch facts and, for settings.json, the text.
 
 // ── paths ───────────────────────────────────────────────────────────────────────────────────────
+// The four D86 ledgers (pm-os-absorb, PRD R24) and the one module that writes each. An agent reaches each
+// writer through a `pmos` verb, which records who wrote the line; the verb is named in a deny message.
+export const D86_LEDGERS = Object.freeze({
+  'plan-items.jsonl': { writer: 'workspace/lib/plan-items.js', verb: 'pmos item' },
+  'placements.jsonl': { writer: 'workspace/lib/placements.js', verb: 'pmos initiative' },
+  'measurements.jsonl': { writer: 'workspace/lib/measurements.js', verb: 'pmos measure' },
+  'issues.jsonl': { writer: 'workspace/lib/issues.js', verb: 'pmos report' },
+});
 export const LEDGER_NAMES = new Set([
   'runs.jsonl', 'evals.jsonl', 'acceptances.jsonl', 'outcome_checks.jsonl', 'grants.jsonl',
-  'agent-runs.jsonl', 'lifecycle.jsonl', 'verify-queue.jsonl',
+  'agent-runs.jsonl', 'lifecycle.jsonl', 'verify-queue.jsonl', ...Object.keys(D86_LEDGERS),
 ]);
 const ACCEPT_GRANTS = new Set(['acceptances.jsonl', 'grants.jsonl']);
 
@@ -51,7 +63,8 @@ export function classifyPath(path, ctx) {
   const state = ctx.layout?.stateRoot ?? null;
   const inState = state !== null && under(abs, state);
   if (name.endsWith('.jsonl') && (inState || LEDGER_NAMES.has(name))) {
-    return { kind: ACCEPT_GRANTS.has(name) ? 'accept-grants' : 'ledger', path: abs };
+    const d86 = D86_LEDGERS[name];
+    return { kind: ACCEPT_GRANTS.has(name) ? 'accept-grants' : 'ledger', path: abs, ...(d86 ? { writer: d86.verb } : {}) };
   }
   if (abs === `${root}/.claude/pmos-cockpit.json`) return { kind: 'governing', path: abs, what: '.claude/pmos-cockpit.json' };
   if (ctx.layout?.kind === 'kit' && under(abs, `${root}/pmos/mods`)) return { kind: 'governing', path: abs, what: 'the installed mod (pmos/mods)' };
@@ -115,7 +128,8 @@ function readSubstitutions(cmd) {
 
 /**
  * Split a command into segments of words. A word is { t: text, dyn: has an unresolved $ or glob,
- * op: a redirect operator }. A segment also carries the bodies of its here-documents.
+ * op: a redirect operator }. A segment also carries the bodies of its here-documents, and pipedIn when a
+ * single `|` feeds it.
  */
 export function parseShell(cmd) {
   const segs = [];
@@ -163,7 +177,12 @@ export function parseShell(cmd) {
       seg.words.push({ t: '&>', dyn: false, op: true }); continue;
     }
     if (c === ';' || c === '|' || c === '&' || c === '(' || c === ')' || ((c === '{' || c === '}') && standalone(i))) {
-      flushSeg(); i += 1; if ((c === '&' || c === '|') && cmd[i] === c) i += 1; continue;
+      // A single `|` (or `|&`) feeds the next segment: it is marked pipedIn, so an interpreter that reads its
+      // program from the pipe is judged on the text that feeds it.
+      const pipe = c === '|' && cmd[i + 1] !== '|';
+      flushSeg(); i += 1; if ((c === '&' || c === '|') && cmd[i] === c) i += 1;
+      if (pipe) { if (cmd[i] === '&') i += 1; seg.pipedIn = true; }
+      continue;
     }
     if (c === '>' || c === '<') {
       if (cur !== null && /^\d+$/.test(cur.t)) cur = null; else flushWord();
@@ -300,6 +319,157 @@ function ghFindings(args, findings, raw) {
 
 const CLOUD = /^(db\s+(push|reset)|functions\s+deploy|projects\s+create|secrets\s+set|branches\s+create|link)\b/;
 
+// ── PM-only acts (pm-os-absorb R25(3), D86 point 2) ──────────────────────────────────────────────
+// The workspace routes that write a PM-only act. The server refuses a call with no nonce or no Origin (R25(2));
+// this refuses the model's call before it is made, so a nonce read from the page is not used either.
+export const PM_ROUTES = Object.freeze(['gate', 'lifecycle', 'plan-items', 'placements', 'doc/save', 'align/apply', 'ingest/confirm',
+  'session/initiative', 'report/issue', 'board/release']);
+// The `pmos` subverbs that do a PM-only act. The verb asks the PM to type a confirmation at a terminal; an agent's
+// Bash tool has none, and `script` makes one (bypass b), so the model's call is refused here as well.
+export const PM_VERBS = Object.freeze({ initiative: ['now', 'adopt', 'anchor', 'lifecycle'], report: ['issue'], board: ['release'] });
+const reEsc = (t) => t.replace(/[.*+?^${}()|[\]\\/-]/g, '\\$&');
+// The workspace's ports (workspace/lib/server-discovery.js): DEFAULT_PORT 7433 and the FALLBACK_SPAN of 12 the launcher
+// rolls forward over. A port pinned with PMOS_WS_PORT is added from the session's environment (wsPortsOf; register.tsx
+// puts it in ctx.wsPorts). A product's own server on another port is not the workspace, so a call to it passes.
+export const WS_PORTS = Object.freeze(Array.from({ length: 13 }, (_, k) => 7433 + k));
+/** The workspace ports for one session: WS_PORTS, the port of PMOS_ROUTE_URL and a pinned PMOS_WS_PORT. */
+export function wsPortsOf(env = {}) {
+  const ports = new Set(WS_PORTS);
+  const add = (v) => { const n = Number(v); if (Number.isInteger(n) && n > 0 && n < 65536) ports.add(n); };
+  if (typeof env.PMOS_WS_PORT === 'string' && /^\d{1,5}$/.test(env.PMOS_WS_PORT.trim())) add(env.PMOS_WS_PORT.trim());
+  const m = typeof env.PMOS_ROUTE_URL === 'string' ? /^https?:\/\/[^/:]+:(\d{1,5})\//.exec(env.PMOS_ROUTE_URL) : null;
+  if (m) add(m[1]);
+  return [...ports];
+}
+// A loopback host in every spelling a client resolves (127.1, 127.0.1, 0, 0x7f000001, 2130706433, [::1], …), or a
+// host in a variable, then an optional port, then a PM-only route. Text is normalized first (normalizeUrlText).
+const LOOP_HOST = '(?:localhost|127(?:\\.\\d{1,3}){0,3}|0x7f[0-9a-fx.]*|0177(?:\\.\\d{1,4}){0,3}|2130706433|0(?:\\.0){0,3}'
+  + '|\\[(?:::1|0:0:0:0:0:0:0:1|::ffff:127(?:\\.\\d{1,3}){3}|::ffff:7f00:1)\\])';
+const VAR = '\\$\\{?([A-Za-z_][A-Za-z0-9_]*)\\}?';
+const PM_ROUTE_URL = new RegExp(`(?<![\\w.-])(${LOOP_HOST}|${VAR})(?::(\\d{1,5}|${VAR}))?/api/(${PM_ROUTES.map(reEsc).join('|')})(?![\\w/-])`, 'gi');
+const HTTP_CLIENTS = new Set(['curl', 'wget', 'http', 'https', 'xh', 'xhs', 'httpie']);
+
+/** Expand the variables a command assigns ($U, ${U}), then collapse the dot segments a client collapses (/./, /x/../). */
+function normalizeUrlText(text, vars) {
+  let t = String(text);
+  for (let k = 0; k < 3 && vars && vars.size && /\$/.test(t); k += 1) {
+    t = t.replace(new RegExp(VAR, 'g'), (m, name) => (vars.has(name) ? vars.get(name) : m));
+  }
+  let prev;
+  do { prev = t; t = t.replace(/\/\.(?=\/)/g, '').replace(/\/(?!\.\.\/)[^/\s'"?#]+\/\.\.(?=\/)/g, '').replace(/([^:/\s])\/{2,}/g, '$1/'); } while (t !== prev);
+  return t;
+}
+
+/**
+ * The PM-only route a text sends to, or null. The port must be one of the workspace's (ctx.wsPorts, else WS_PORTS). A
+ * port or a host in a variable the command does not assign cannot be read: it counts in PMOS-self, and in a kit
+ * install only when the variable's name starts with PMOS.
+ */
+function pmRouteIn(text, ctx) {
+  const ports = ctx?.wsPorts ?? WS_PORTS;
+  const self = ctx?.layout?.kind === 'self';
+  const t = normalizeUrlText(text, ctx?.vars);
+  for (const m of t.matchAll(PM_ROUTE_URL)) {
+    const hostVar = m[2];
+    const portVar = m[4];
+    const port = m[3] !== undefined && portVar === undefined ? Number(m[3]) : null;
+    const varOk = (name) => self || /^PMOS/.test(name);
+    if (portVar !== undefined) { if (varOk(portVar)) return m[5]; continue; }
+    if (port !== null) { if (ports.includes(port)) return m[5]; continue; }
+    if (hostVar !== undefined && varOk(hostVar)) return m[5];
+  }
+  return null;
+}
+
+// Inline code that loads a D86 writer module: require(…), import(…), import … from …, node -r/--require/--import. The
+// module path must name the writer where it lives, workspace/lib/<name> (D86_LEDGERS). In PMOS-self, where those are
+// the only modules of those names, lib/<name> and ./<name> count as well. A product's own src/github/issues.js is not
+// a writer, so a kit install loads it freely.
+const D86_NAME = /(?:^|\/)(plan-items|placements|measurements|issues)(?:\.[cm]?js)?$/;
+const REQUIRE_SPEC = /(?:\b(?:require|import)\s*\(?\s*|\bfrom\s+)['"`]([^'"`]+)['"`]/g;
+const LOOSE_REQUIRE = /(?:\b(?:require|import)\s*\(?\s*|\bfrom\s+)['"`][^'"`]*\bworkspace\/lib\/(?:plan-items|placements|measurements|issues)(?:\.[cm]?js)?['"`]/;
+/** The D86 module a module path names (plan-items, placements, measurements or issues), or null. */
+function d86Module(spec, ctx) {
+  const m = D86_NAME.exec(String(spec).trim());
+  if (!m) return null;
+  if (/(?:^|\/)workspace\/lib\/[^/]+$/.test(spec)) return m[1];
+  if (ctx?.layout?.kind === 'self' && (/(?:^|\/)lib\/[^/]+$/.test(spec) || /^\.\/[^/]+$/.test(spec))) return m[1];
+  return null;
+}
+/** The D86 module that inline code requires or imports, or null. */
+function requiredModule(text, ctx) {
+  for (const m of String(text).matchAll(REQUIRE_SPEC)) { const w = d86Module(m[1], ctx); if (w) return w; }
+  return null;
+}
+// The node options that carry inline code, and the ones that load a module. `--opt=value` is split first.
+const INLINE_FLAGS = new Set(['-e', '-p', '--eval', '--print', '-c', '-pe', '-ne']);
+const LOAD_FLAGS = new Set(['-r', '--require', '--import', '--loader', '--experimental-loader']);
+const splitEq = (args) => args.flatMap((a) => { const m = /^(--[A-Za-z][\w-]*)=([\s\S]*)$/.exec(a); return m ? [m[1], m[2]] : [a]; });
+const PM_WRITE_CALL = /\bappendFromUi\s*\(/;
+const D86_USE = 'Write through the pmos verb that owns the ledger (pmos item, pmos initiative, pmos measure, pmos report): it records who wrote the line, and a PM-only line needs the PM\'s own press';
+const writerOfModule = (m) => Object.values(D86_LEDGERS).find((d) => d.writer.endsWith(`/${m}.js`));
+
+/** Does this HTTP-client call send a body or a writing method? A plain GET is a read and passes. */
+function httpWrites(verb, args) {
+  const text = args.join(' ');
+  if (verb === 'curl') {
+    if (args.some((a) => /^(-d|--data(-\w+)?|--json|-F|--form(-string)?|-T|--upload-file)$/.test(a) || (/^-[A-Za-z]*[dFT]/.test(a) && !a.startsWith('--')))) return true;
+    const x = args.findIndex((a) => a === '-X' || a === '--request');
+    const m = x !== -1 ? args[x + 1] : (args.find((a) => /^-X\w+$/.test(a)) ?? '').slice(2);
+    return !!m && !/^(GET|HEAD|OPTIONS)$/i.test(m);
+  }
+  if (verb === 'wget') return /--(post-data|post-file|method|body-data|body-file)\b/.test(text);
+  return args.some((a) => /^(POST|PUT|PATCH|DELETE)$/i.test(a) || /^[^-][^=:\s]*:?=/.test(a));
+}
+
+/**
+ * The PM-only findings of one segment (R25(3)). `words` are the segment's words without their wrappers. ctx.vars holds
+ * the variables the command assigns, ctx.wsPorts the workspace's ports. `--opt=value` is read as `--opt value`.
+ */
+function pmActFindings(seg, words, verb, rawArgs, findings, raw, ctx) {
+  const args = splitEq(rawArgs).map((a) => normalizeUrlText(a, ctx.vars));
+  const texts = [];
+  if (INTERPRETERS.has(verb)) {
+    for (let k = 0; k < args.length; k += 1) {
+      if ((INLINE_FLAGS.has(args[k]) || args[k] === '<<<') && args[k + 1] !== undefined) texts.push(args[k + 1]);
+    }
+    texts.push(...seg.heredocs);
+    // A program fed through a pipe (`echo "…" | node`, `… | node -`): the text that feeds it is its code.
+    if (typeof seg.stdinText === 'string') texts.push(seg.stdinText);
+  }
+  // 1 · an HTTP write to a loopback PM-only route, by a client or by inline code
+  if (HTTP_CLIENTS.has(verb)) {
+    const route = args.map((a) => pmRouteIn(a, ctx)).find(Boolean);
+    if (route && httpWrites(verb, args)) findings.push({ kind: 'pm-act', why: `${verb} sends a write to the PM-only route /api/${route}`, act: 'route', raw });
+  }
+  for (const t of texts) {
+    const route = pmRouteIn(t, ctx);
+    if (route && /\b(POST|PUT|PATCH|DELETE)\b|\bmethod\b|\bbody\b|\bdata\s*=/i.test(t)) {
+      findings.push({ kind: 'pm-act', why: `inline ${verb} code sends a write to the PM-only route /api/${route}`, act: 'route', raw });
+      break;
+    }
+  }
+  // 2 · a PM-only `pmos` verb: pmos …, node $PMOS_BIN …, node …/bin/pmos.js …, inside env, script, xargs or a launcher
+  if (!READ_VERBS.has(verb) && verb !== 'git') {
+    const ws = words.filter((w) => !w.op).map((w) => w.t);
+    for (let k = 0; k < ws.length; k += 1) {
+      const b = base(ws[k]);
+      if (!(b === 'pmos' || b === 'pmos.js' || /^\$\{?PMOS_BIN\}?$/.test(ws[k]))) continue;
+      const rest = ws.slice(k + 1).filter((a) => !a.startsWith('-'));
+      if ((PM_VERBS[rest[0]] ?? []).includes(rest[1])) {
+        findings.push({ kind: 'pm-act', why: `pmos ${rest[0]} ${rest[1]} is a PM-only act`, act: 'verb', verb: `pmos ${rest[0]} ${rest[1]}`, raw });
+        break;
+      }
+    }
+  }
+  // 3 · inline code that requires a D86 writer module (bypass e): node -e "require('…/placements.js')…"
+  if (INTERPRETERS.has(verb)) {
+    const mod = texts.map((t) => requiredModule(t, ctx)).find(Boolean)
+      ?? args.map((a, k) => (LOAD_FLAGS.has(args[k - 1]) ? d86Module(a, ctx) : null)).find(Boolean);
+    if (mod) findings.push({ kind: 'pm-act', why: `inline ${verb} code loads ${writerOfModule(mod)?.writer ?? mod}, a D86 ledger writer`, act: 'require', use: D86_USE, raw });
+  }
+}
+
 function segmentFindings(seg, ctx, findings, depth) {
   const raw = seg.words.map((w) => w.t).join(' ');
   const words = stripWrappers(seg.words);
@@ -316,6 +486,11 @@ function segmentFindings(seg, ctx, findings, depth) {
       for (const h of seg.heredocs) analyzeInto(h, ctx, findings, depth + 1);
     }
     if (verb === 'eval') analyzeInto(args.join(' '), ctx, findings, depth + 1);
+    // `script -c "…" /dev/null` (util-linux) runs its command under a new terminal: bypass (b) of R25
+    if (verb === 'script') {
+      const ci = args.findIndex((a) => /^-[A-Za-z]*c[A-Za-z]*$/.test(a) || a === '--command');
+      if (ci !== -1 && args[ci + 1] !== undefined) analyzeInto(args[ci + 1], ctx, findings, depth + 1);
+    }
     if (verb === 'source' || verb === '.') { /* a file: not read here */ }
   }
 
@@ -335,6 +510,9 @@ function segmentFindings(seg, ctx, findings, depth) {
   }
   if (verb === 'supabase' && CLOUD.test(nonFlags(words.slice(1)).join(' '))) findings.push({ kind: 'cloud', action: `supabase ${nonFlags(words.slice(1)).slice(0, 2).join(' ')}`, raw });
 
+  // ── PM-only acts ───────────────────────────────────────────────────────────────────────
+  pmActFindings(seg, words, verb, args, findings, raw, ctx);
+
   // ── the ledgers ────────────────────────────────────────────────────────────────────────
   const scriptName = [words[0], ...words.slice(1, 3)].map((w) => (w ? base(w.t) : '')).find((n) => WRITERS.has(n) || READ_SCRIPTS.has(n)) ?? '';
   if (scriptName === 'record-acceptance.js') findings.push({ kind: 'accept-grants', why: 'record-acceptance.js writes the acceptance ledger', raw });
@@ -394,7 +572,8 @@ function segmentFindings(seg, ctx, findings, depth) {
     else if (WRITERS.has(scriptName) || READ_SCRIPTS.has(scriptName)) readOnly = READ_SCRIPTS.has(scriptName);
     if (!readOnly || redirectsToLedger) {
       const acc = mentions.some((m) => ACCEPT_GRANTS.has(m.name));
-      findings.push({ kind: acc ? 'accept-grants' : 'ledger', why: `${verb || 'a redirect'} writes ${mentions[0].path}`, raw });
+      const d86 = mentions.map((m) => D86_LEDGERS[m.name]).find(Boolean);
+      findings.push({ kind: acc ? 'accept-grants' : 'ledger', why: `${verb || 'a redirect'} writes ${mentions[0].path}`, ...(d86 ? { writer: d86.verb } : {}), raw });
     }
   }
 
@@ -441,11 +620,41 @@ function taintedNames(segs, ctx) {
   return names;
 }
 
+// The variables a command assigns (`U=…; curl $U`, `export U=…`), so a URL or a module path kept in a variable is read
+// as its value. The assignments that start a segment count; the last one wins. Nested commands inherit the outer set.
+const DECLARE = new Set(['export', 'local', 'declare', 'readonly', 'typeset']);
+function assignedVars(segs, outer) {
+  const vars = new Map(outer ?? []);
+  for (const seg of segs) {
+    for (const w of seg.words) {
+      if (w.op) break;
+      if (DECLARE.has(w.t) || (w.t.startsWith('-') && !w.t.includes('='))) continue;
+      const m = /^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/.exec(w.t);
+      if (!m) break;
+      vars.set(m[1], normalizeUrlText(m[2], vars));
+    }
+  }
+  return vars;
+}
+
 function analyzeInto(cmd, ctx, findings, depth) {
-  for (const sub of readSubstitutions(cmd)) if (depth < 4) analyzeInto(sub, ctx, findings, depth + 1);
   const segs = parseShell(cmd);
+  const vars = assignedVars(segs, ctx.vars);
+  for (const sub of readSubstitutions(cmd)) if (depth < 4) analyzeInto(sub, { ...ctx, vars }, findings, depth + 1);
   const tainted = taintedNames(segs, ctx);
-  for (const seg of segs) segmentFindings(seg, { ...ctx, tainted }, findings, depth);
+  segs.forEach((seg, k) => {
+    if (seg.pipedIn && k > 0) seg.stdinText = [segs[k - 1].words.map((w) => w.t).join(' '), ...segs[k - 1].heredocs].join('\n');
+  });
+  for (const seg of segs) segmentFindings(seg, { ...ctx, tainted, vars }, findings, depth);
+  // A script written and run in one command (bypass e): a here-document that loads a D86 writer, written to a
+  // file by any verb, while another segment runs node. A script written by one call and run by a later one is
+  // seen only when it is written outside the repository (findingsFor); CI flags the line it writes either way.
+  const writtenRequire = segs.find((g) => g.heredocs.some((h) => requiredModule(h, ctx)));
+  const runsNode = segs.some((g) => { const w = stripWrappers(g.words); return w.length > 0 && ['node', 'nodejs', 'deno', 'bun'].includes(base0(w[0])); });
+  if (writtenRequire && runsNode && !findings.some((f) => f.kind === 'pm-act' && f.act === 'require')) {
+    const mod = writtenRequire.heredocs.map((h) => requiredModule(h, ctx)).find(Boolean);
+    findings.push({ kind: 'pm-act', why: `a script written and run in one command loads ${writerOfModule(mod)?.writer ?? mod}, a D86 ledger writer`, act: 'require', use: D86_USE, raw: cmd });
+  }
 }
 
 /**
@@ -505,6 +714,14 @@ export function findingsFor(e, ctx, settingsText = null) {
       if (c.kind === 'settings') { if (touchesPluginEntries(e, settingsText)) out.push({ kind: 'governing', what: c.what, path: c.path }); continue; }
       out.push({ ...c });
     }
+    // A script written outside the repository that loads a D86 writer and calls its PM path (bypass e, written
+    // first and run later). Inside the repository the writers' own callers and tests live, so it passes there,
+    // and CI flags a PM line that such a script writes when it arrives in an agent-authored commit.
+    const root = String(ctx.root).replace(/\/+$/, '');
+    const outside = pathsOf(e).some((p) => !under(resolvePath(p, root), root));
+    const body = [e.content, e.new_string, e.new_source, ...(Array.isArray(e.edits) ? e.edits.map((x) => x?.new_string) : [])].filter((t) => typeof t === 'string').join('\n');
+    const mod = requiredModule(body, ctx);
+    if (outside && mod && PM_WRITE_CALL.test(body)) out.push({ kind: 'pm-act', why: `a script outside the repository loads ${writerOfModule(mod)?.writer ?? mod} and calls its PM path`, act: 'require', use: D86_USE });
   }
   const other = classifyTool(e, ctx);
   if (other) out.push(other);
@@ -526,7 +743,9 @@ export function denyMessage(f, ctx) {
   const head = 'Blocked by pmos-cockpit:';
   switch (f.kind) {
     case 'ledger':
-      return `${head} a hand-written change to a ledger (${f.why ?? f.path ?? 'a *.jsonl file in the state root'}). Write ledger rows with ${writerHint(ctx)}, which validates the row. Reading a ledger is not blocked.`;
+      return `${head} a hand-written change to a ledger (${f.why ?? f.path ?? 'a *.jsonl file in the state root'}). Write ledger rows with ${f.writer ?? writerHint(ctx)}, which validates the row. Reading a ledger is not blocked.`;
+    case 'pm-act':
+      return `${head} ${f.why ?? 'a PM-only act'}. Only the PM does it (R25, D86 point 2). ${f.use ? `${f.use}.` : f.verb ? `Ask the PM to run ${f.verb} at their own terminal, or to press it in the workspace.` : 'Ask the PM to press it in the workspace.'}`;
     case 'accept-grants':
       return `${head} acceptances and grants are the PM's (D12: Acceptance is non-delegable). ${f.why ? `${f.why}. ` : ''}The PM records one by typing /pmos-accept <run_id> pass|fail <note> or /pmos-grant <scope>, or by pressing the button. Ask the PM to do it.`;
     case 'governing':
@@ -556,6 +775,7 @@ export function looseDeny(e) {
     const c = e.command;
     if (/\bgh\b[^\n;|&]*\b(pr\s+merge|api)\b|\bnpm\b[^\n;|&]*\bpublish\b|\b(pnpm|yarn)\b[^\n;|&]*\bpublish\b|\bgit\b[^\n;|&]*\bpush\b|\bsupabase\b[^\n;|&]*\b(db push|functions deploy|projects create|secrets set)\b/.test(c)) return say('a merge, push or publish');
     if (/\.jsonl\b|record-acceptance|record-grant|pmos-log\.sh\s+(accept|grant)|pmos\/mods|pmos-cockpit\.json|settings\.json/.test(c)) return say('a write that names a ledger or governing file');
+    if (pmRouteIn(c, null) || LOOSE_REQUIRE.test(c) || /\b(initiative\s+(now|adopt|anchor|lifecycle)|report\s+issue|board\s+release)\b/.test(c)) return say('a PM-only act');
     return null;
   }
   if (isFileWriteTool(tool)) {

package/payload/mods/pmos-cockpit/hooks/register.tsx

@@ -4,7 +4,7 @@ import type { Register } from 'claude-code'
 import type { CockpitStatus, SkillsReport } from '../types'
 import { checkGrant } from './lib/grants.mjs'
 import { parseAccept, pressNote, planAcceptance, planGrant, writerOf } from './lib/commands.mjs'
-import { PATH_KEYS, classifyTool, denyMerge, denyMessage, findingsFor, isFileWriteTool, looseDeny, readsAsApproval } from './lib/guard.mjs'
+import { PATH_KEYS, classifyTool, denyMerge, denyMessage, findingsFor, isFileWriteTool, looseDeny, readsAsApproval, wsPortsOf } from './lib/guard.mjs'
 import { recordPath, resolveInitiative } from './lib/initiative.mjs'
 import { detectLayout } from './lib/layout.mjs'
 import { parseProfile } from './lib/profile.mjs'
@@ -54,6 +54,14 @@ async function sh($: any, argv: string[], init?: any): Promise<{ exitCode: numbe
   try { return await $.process.run(argv, init) } catch (e: any) { return { exitCode: 1, stdout: '', stderr: String(e?.message ?? e) } }
 }
 
+// The workspace's ports for the PM-only route check: the defaults, plus the port of PMOS_ROUTE_URL and a pinned
+// PMOS_WS_PORT from this session's environment. A product's own server on another port is not the workspace.
+async function wsPorts($: any): Promise<number[]> {
+  const env: Record<string, string | undefined> = {}
+  for (const k of ['PMOS_ROUTE_URL', 'PMOS_WS_PORT']) { try { env[k] = await $.env.get(k) } catch { env[k] = undefined } }
+  return wsPortsOf(env)
+}
+
 async function rootAndLayout($: any) {
   const root: string = await $.session.root()
   const layout = await detectLayout({ exists: (p: string) => $.fs.exists(p) }, root)
@@ -156,7 +164,7 @@ async function judge($: any, e: any): Promise<string | null> {
   const { root, layout } = await rootAndLayout($)
   const needsBranch = (tool === 'Bash' && /\bpush\b/.test(String(e.command ?? ''))) || tool.startsWith('mcp__github')
   let facts = needsBranch ? await gitFacts($, root) : { branch: null, defaultBranch: null, commitsAhead: null }
-  const ctx = { root, layout, branch: facts.branch, defaultBranch: facts.defaultBranch }
+  const ctx = { root, layout, branch: facts.branch, defaultBranch: facts.defaultBranch, wsPorts: await wsPorts($) }
   const settingsPath = `${root}/.claude/settings.json`
   const settingsText = isFileWriteTool(tool) ? await readText($, settingsPath) : null
   const findings = findingsFor(e, ctx, settingsText)
@@ -175,7 +183,7 @@ async function judge($: any, e: any): Promise<string | null> {
   }
   if (findings.length === 0) return null
 
-  for (const kind of ['accept-grants', 'ledger', 'governing', 'cloud']) {
+  for (const kind of ['accept-grants', 'pm-act', 'ledger', 'governing', 'cloud']) {
     const f = findings.find((x) => x.kind === kind)
     if (f) return denyMessage(f, ctx)
   }

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-05T21:40:45Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-05T21:40:45Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
 status: stable
 ---