create-pmos 0.53.0 → 0.53.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.53.0",
+  "version": "0.53.1",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@aa14199
+kernel-source: pmos@bfd9b34
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T01:59:33Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T01:59:33Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T01:59:33Z"}
 status: stable
 ---
 

package/workspace/README.md

@@ -33,6 +33,8 @@ pmos status          # is it running? which sessions?
 pmos stop            # shut it down (scrollback is preserved; sessions respawn next time)
 pmos doctor          # diagnose the environment (node-pty arch, PTY spawn test, ports)
 ```
+**Without a terminal.** `pmos launcher on` (once, from the repository you want) writes a PMOS app — `~/Applications/PMOS.app` on macOS, an app-menu entry on Linux — and a login item that starts the server at login without opening a browser. Both run `pmos up <repo>` with the PATH your terminal had at setup. `pmos launcher status` checks it, `pmos launcher off` removes it. Guide: [`guide/launcher.md`](guide/launcher.md).
+
 **The port is found, not assumed.** A running server records the port it serves, so `pmos` in a second repo joins the workspace you already have open — whatever port it ended up on, and however it was started. If another program holds the default port (7433), `pmos` starts on the next free one and says so; `PMOS_WS_PORT=7500 pmos` pins it by hand. `pmos stop` shuts down every workspace server it finds, which is how you collapse two back into one.
 
 <details><summary>Without the global install (running from the repo)</summary>

package/workspace/REMOTE.md

@@ -1,32 +1,23 @@
 ---
 type: Reference
 title: "Workspace remote access over a private tailnet (Tailscale)"
-timestamp: 2026-07-26
+timestamp: 2026-10-06
 ---
 
 # Reaching the workspace from your phone — over a private tailnet, never the public internet
 
-The workspace server owns **real terminal sessions (PTYs)** running your `claude` on **your own
-subscription**. By default it binds `127.0.0.1` only, so it is reachable solely from the machine it
-runs on. This runbook enables reaching **the same local server** from another of your own devices —
-a phone, a laptop — over a **private Tailscale tailnet**. It never exposes a public endpoint.
+The workspace server owns **real terminal sessions (PTYs)** running your `claude` on **your own subscription**. By default it binds `127.0.0.1` only, so it is reachable solely from the machine it runs on. This runbook enables reaching **the same local server** from another of your own devices — a phone, a laptop — over a **private Tailscale tailnet**. It never exposes a public endpoint.
 
 ## Why a tailnet, and why no public endpoint (D62)
 
-A [Tailscale](https://tailscale.com) tailnet is a private [WireGuard](https://www.wireguard.com/)
-mesh between **your own devices**. Every device is authenticated and encrypted end-to-end; addresses
-live in the CGNAT range `100.64.0.0/10` and are routable **only** between devices on your tailnet —
-never from the public internet.
+A [Tailscale](https://tailscale.com) tailnet is a private [WireGuard](https://www.wireguard.com/) mesh between **your own devices**. Every device is authenticated and encrypted end-to-end; addresses live in the CGNAT range `100.64.0.0/10` and are routable **only** between devices on your tailnet — never from the public internet.
 
 PMOS's locked decision **D62** rejects, permanently:
 
 - **any public endpoint** for the workspace server, and
 - **any hosted PTY bridge** (proxying the terminal through a hosted, browser-reachable surface).
 
-A public server that owns a PTY running your Claude subscription is severe exposure. The tailnet path
-sidesteps that entirely: the phone attaches to the *same local server* across your own private
-network. Accordingly, this feature will **only ever** bind loopback plus your machine's own tailnet
-address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it **refuses to start**.
+A public server that owns a PTY running your Claude subscription is severe exposure. The tailnet path sidesteps that entirely: the phone attaches to the *same local server* across your own private network. Accordingly, this feature will **only ever** bind loopback plus your machine's own tailnet address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it **refuses to start**.
 
 ## Setup
 
@@ -52,16 +43,15 @@ address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it
      loopback requests are token-free; every tailnet request must present the token.
    ```
 
-   **Copy the token now** — it is shown only once and never logged again.
+   Under those lines it prints the phone URL as a **QR code**, and the same URL as text (`http://100.x.y.z:7433/?token=<token>`). The token is shown only at startup and never logged again. A token you supply with `PMOS_TOKEN` is never printed, so that mode prints no QR code.
 
-3. **Open it from your phone.** In the phone's browser (on the same tailnet), open:
+3. **Open it from your phone.** Point the phone camera at the QR code and open the link. Or type the URL into the phone's browser. The server sets a sign-in cookie (7 days) and redirects to `http://100.x.y.z:7433/`, so the token does not stay in the address bar or the history.
 
-   ```
-   http://100.x.y.z:7433/?token=<token>
-   ```
+   If the phone has no valid cookie, it shows a **sign-in page**. Paste the token there. The field is a password field, so the phone's password manager can save it. This is also what you see after the cookie expires, or after a restart that generated a new token.
+
+   The client attaches to the **same live sessions** the desktop sees. Requests from the machine itself (`127.0.0.1`) never need the token.
 
-   The client attaches to the **same live sessions** the desktop sees; the token authorizes both the
-   page and its WebSocket. Requests from the machine itself (`127.0.0.1`) never need the token.
+4. **Optional: put it on the home screen.** In Safari, tap Share › Add to Home Screen. In Chrome on Android, tap ⋮ › Add to Home screen. The PMOS icon then opens the workspace full screen, without the browser bar. On iOS the home-screen app has its own cookies, so it asks for the token once. On Android, Chrome opens a home-screen app full screen only from an HTTPS origin. Over the plain `http://100.x.y.z` address it adds a shortcut that opens in a normal browser tab. There is no offline mode: the workspace shows live state, and it needs the server to be running.
 
 ## Configuration
 
@@ -76,56 +66,27 @@ address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it
 
 ## Security model (what is guaranteed)
 
-- **Never public.** The only addresses the server will ever bind are loopback and a
-  `100.64.0.0/10` tailnet address. `0.0.0.0`, `::`, LAN, and public IPs are refused — the server
-  exits with a clear error rather than binding them. There is no code path to a public bind.
-- **Token beyond loopback.** With remote mode on, every non-loopback HTTP request and WebSocket
-  upgrade must present the bearer token, or it is rejected (`401` / socket closed). Loopback requests
-  stay token-free for local development. The comparison is constant-time.
-- **Origin/Host allowlist (D64).** Both the HTTP guard and the WebSocket-upgrade handshake reject any
-  request whose `Origin` is foreign (not same-origin with the `Host` it arrived on) or whose `Host`
-  hostname is not loopback/localhost or your tailnet address. This closes the cross-origin-localhost /
-  DNS-rebinding vector: without it, **any website open in your browser** could open a WebSocket to
-  `ws://127.0.0.1:<port>` and spawn a shell + type into it, because loopback peers are token-exempt.
-  A same-origin page served by the workspace passes; a cross-site page is rejected `403`. Native
-  clients / `curl` (which send no `Origin`) still pass this check and are then gated by the token.
-- **No header/token logging (D08).** The request-guard path logs nothing about the request. The
-  token is printed at most once at startup (only when generated); a token you supply is never echoed.
-- **Rate-limited control channel (D64).** The WS messages that spawn shells (`new`/`respawn`) and
-  feed a PTY (`input`) are per-connection rate-limited, bounding abuse if the socket is ever reached.
-- **Independent layers.** The tailnet (WireGuard device auth), the bearer token, and the origin/host
-  allowlist all gate access — a device must be *on your tailnet*, *hold the token*, **and** present a
-  same-origin request from an allowed host.
+- **Never public.** The only addresses the server will ever bind are loopback and a `100.64.0.0/10` tailnet address. `0.0.0.0`, `::`, LAN, and public IPs are refused — the server exits with a clear error rather than binding them. There is no code path to a public bind.
+- **Token beyond loopback.** With remote mode on, every non-loopback HTTP request and WebSocket upgrade must present the bearer token, or it is rejected (`401` / socket closed). A browser page load gets the sign-in page with that `401`. The one exception is `POST /auth`, the sign-in form's target: it only compares the posted token and, on a match, sets the session cookie. It still sits behind the Origin/Host allowlist. Loopback requests stay token-free for local development. The comparison is constant-time.
+- **Origin/Host allowlist (D64).** Both the HTTP guard and the WebSocket-upgrade handshake reject any request whose `Origin` is foreign (not same-origin with the `Host` it arrived on) or whose `Host` hostname is not loopback/localhost or your tailnet address. This closes the cross-origin-localhost / DNS-rebinding vector: without it, **any website open in your browser** could open a WebSocket to `ws://127.0.0.1:<port>` and spawn a shell + type into it, because loopback peers are token-exempt. A same-origin page served by the workspace passes; a cross-site page is rejected `403`. Native clients / `curl` (which send no `Origin`) still pass this check and are then gated by the token.
+- **No header/token logging (D08).** The request-guard path logs nothing about the request. The token is printed at most once at startup (only when generated); a token you supply is never echoed.
+- **Rate-limited control channel (D64).** The WS messages that spawn shells (`new`/`respawn`) and feed a PTY (`input`) are per-connection rate-limited, bounding abuse if the socket is ever reached.
+- **Independent layers.** The tailnet (WireGuard device auth), the bearer token, and the origin/host allowlist all gate access — a device must be *on your tailnet*, *hold the token*, **and** present a same-origin request from an allowed host.
 
 ## Exposing to the internet — the required hardening (D64)
 
-The workspace is **tailnet-first**. The tailnet path above is the supported way to reach it from
-another of your own devices and needs no internet exposure. If you nonetheless expose an instance to
-the internet, D64 permits it **only after all three of the following are in place — never before, and
-never as a raw public bind**:
+The workspace is **tailnet-first**. The tailnet path above is the supported way to reach it from another of your own devices and needs no internet exposure. If you nonetheless expose an instance to the internet, D64 permits it **only after all three of the following are in place — never before, and never as a raw public bind**:
 
 1. **The bearer token for every non-loopback peer** (already enforced in remote mode).
 2. **The Origin/Host allowlist** (already enforced — see above).
-3. **TLS termination at the exposure boundary.** **The workspace server does not terminate TLS.** It
-   speaks plain HTTP/WS and must sit behind something that terminates TLS for it — Tailscale's own
-   HTTPS (`tailscale serve` / `tailscale funnel`) or a reverse proxy (Caddy, nginx, a tunnel) that
-   holds the certificate and forwards to the loopback/tailnet listener. Do **not** put the raw HTTP
-   port on a public interface — the server refuses non-loopback/non-tailnet binds precisely so this
-   stays a conscious proxy decision, not an accident.
+3. **TLS termination at the exposure boundary.** **The workspace server does not terminate TLS.** It speaks plain HTTP/WS and must sit behind something that terminates TLS for it — Tailscale's own HTTPS (`tailscale serve` / `tailscale funnel`) or a reverse proxy (Caddy, nginx, a tunnel) that holds the certificate and forwards to the loopback/tailnet listener. Do **not** put the raw HTTP port on a public interface — the server refuses non-loopback/non-tailnet binds precisely so this stays a conscious proxy decision, not an accident.
 
-When a reverse proxy forwards to the workspace, keep the forwarded `Host` set to the loopback/tailnet
-host the server actually binds, so the Origin/Host allowlist still recognises same-origin requests.
+When a reverse proxy forwards to the workspace, keep the forwarded `Host` set to the loopback/tailnet host the server actually binds, so the Origin/Host allowlist still recognises same-origin requests.
 
 ## Troubleshooting
 
-- **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"**
-  — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real
-  `tailscale ip -4` value.
-- **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run
-  `tailscale up`, or set `PMOS_TAILNET_IP`.
-- **"cannot bind 100.x.y.z:PORT — that address is not present on this machine"** — the pinned
-  `PMOS_TAILNET_IP` isn't actually assigned to this machine. Check `tailscale ip -4`.
-- **Phone gets 401** — the token is missing or wrong. Re-open with `?token=<token>` (or send
-  `Authorization: Bearer <token>`). Restarting the server without `PMOS_TOKEN` mints a new token.
-- **Phone can't connect at all** — confirm both devices show each other in the Tailscale app, and
-  that you used the `100.x.y.z` address, not a LAN IP.
+- **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.
+- **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run `tailscale up`, or set `PMOS_TAILNET_IP`.
+- **"cannot bind 100.x.y.z:PORT — that address is not present on this machine"** — the pinned `PMOS_TAILNET_IP` isn't actually assigned to this machine. Check `tailscale ip -4`.
+- **Phone shows the sign-in page** — the cookie is missing, expired, or from an older token. Paste the token, or scan the QR code again. Restarting the server without `PMOS_TOKEN` mints a new token, so every phone must sign in again. (API clients without a browser still get a JSON `401`.)
+- **Phone can't connect at all** — confirm both devices show each other in the Tailscale app, and that you used the `100.x.y.z` address, not a LAN IP.

package/workspace/bin/pmos.js

@@ -45,7 +45,9 @@ const pidFile = (port) => path.join(STATE, D.pidFileName(port));
 const logFile = (port) => path.join(STATE, `server-${port}.log`);
 const APP_VERSION = (() => { try { return require('../package.json').version || null; } catch { return null; } })();
 const urlOf = (port) => `http://127.0.0.1:${port}`;
-const NO_OPEN = process.env.PMOS_NO_OPEN === '1';      // tests set this
+// Tests set PMOS_NO_OPEN. `--no-open` is the login item's (`pmos launcher on`): a flag, not the env var, so the
+// server it starts does not hand PMOS_NO_OPEN to every session, where a `pmos` typed later would open nothing.
+const NO_OPEN = process.env.PMOS_NO_OPEN === '1' || process.argv.includes('--no-open');
 
 const say = (s) => console.log(s);
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -442,7 +444,7 @@ function doctor() {
     code = 0;
   } else if (cmd === 'up' || cmd === 'start' || cmd === 'open') {
     // `pmos open ../other-repo` — the path is the argument AFTER the verb
-    code = await up(process.argv[3] ? path.resolve(process.argv[3]) : process.cwd());
+    code = await up(process.argv[3] && !process.argv[3].startsWith('-') ? path.resolve(process.argv[3]) : process.cwd());
   } else if (arg && !arg.startsWith('-')) {
     code = await up(path.resolve(arg));                 // `pmos ../other-repo`
   } else {

package/workspace/guide/command-palette.md

@@ -67,7 +67,7 @@ The palette reads the lists of all three scopes when it opens. When a list canno
 
 The palette opens as a sheet from the bottom edge. Each row is at least 48 pixels high, and the rows are reached by touch.
 
-There is no separate capture box. The scratchpad remains in one place only: the **compose line** at the bottom of a terminal tab. Type a message there and press **Send**. The text is typed into the session and the line clears. The line keeps your text for each session until you send it, so a message you did not finish is still there when you come back.
+On a phone, the scratchpad is the **compose line** at the bottom of a terminal tab. (On a desktop, open it with **▲ scratchpad** under the dock's tabs.) Type a message there and press **Send**. The text is typed into the session and the line clears. The line keeps your text for each session until you send it, so a message you did not finish is still there when you come back.
 
 ## Related
 

package/workspace/guide/index.md

@@ -1,7 +1,7 @@
 ---
 type: Guide
 title: "Guide: start here"
-timestamp: 2026-10-05
+timestamp: 2026-10-06
 ---
 
 # Guide: start here
@@ -33,6 +33,7 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 
 ## Where to read next
 
+- [Start the workspace without a terminal](launcher.md): the PMOS app, the login item and `pmos launcher`.
 - [Layout](layout.md): the frame, the keys and the rule for where a list or a detail opens.
 - [Statuses](statuses.md): what each status means, where it comes from, and what you can change.
 - [Initiatives and next steps](initiatives-and-next-steps.md): the detail, the next steps, and the artifacts.

package/workspace/guide/launcher.md

@@ -0,0 +1,51 @@
+---
+type: Guide
+title: "Start the workspace without a terminal"
+timestamp: 2026-10-06
+---
+
+# Start the workspace without a terminal
+
+`pmos launcher` makes a PMOS app and a login item. After you set it up once, you do not need a terminal to start the workspace.
+
+## Set it up once
+
+Open a terminal in the repository that the app must open. Type:
+
+```sh
+pmos launcher on
+```
+
+To set up a different repository, give its path: `pmos launcher on ~/code/my-product`.
+
+This command writes two things:
+
+| Thing | macOS | Linux |
+|---|---|---|
+| The PMOS app | `~/Applications/PMOS.app`. Open it from Spotlight or Launchpad, or drag it to the Dock. | An app menu entry, `~/.local/share/applications/pmos.desktop`. |
+| The login item | `~/Library/LaunchAgents/com.pmos.workspace.plist` | `~/.config/autostart/pmos-workspace.desktop` |
+
+To make only the app, without the login item, type `pmos launcher on --no-login`.
+
+## What each one does
+
+- **The app** opens the workspace in your browser. When no server runs, it starts one first. It does the same thing as `pmos` in a terminal.
+- **The login item** starts the workspace server when you log in. It does not open a browser window. Open the app when you want the window.
+
+Both run `pmos up` on the repository you chose. They use the PATH that your terminal had when you typed `pmos launcher on`. That is how they find `claude`, `git` and `tmux`.
+
+What each start printed is in `launcher.log`, in the workspace state folder (`~/Library/Application Support/pmos` on macOS, `~/.local/state/pmos` on Linux).
+
+## Check it
+
+Type `pmos launcher status`. It shows the repository, the node program and the `pmos` program that the app uses, and whether the login item is installed. A path marked "not found" stops the app. If you move or upgrade node, type `pmos launcher on` again.
+
+## Remove it
+
+Type `pmos launcher off`. It removes the app and the login item. It removes only files that `pmos launcher on` wrote. A file with the same name that you wrote yourself stays.
+
+## Limits
+
+- The login item never starts remote (tailnet) mode, and it writes no token. To open the workspace from your phone, start remote mode yourself as `workspace/REMOTE.md` tells you.
+- Native Windows is not supported. The workspace needs WSL on Windows. Type `pmos launcher on` inside WSL.
+- The login item runs once, at login. If the server stops, open the app to start it again.

package/workspace/guide/layout.md

@@ -41,6 +41,9 @@ The dock holds your terminals, documents, conversations, skills and web pages. I
 - The dock never opens by itself. A tab that opens while the dock is a rail waits in the dock until you open it.
 - **＋ Session** in the dock starts a new session. Its menu also has **Session with options** and one item for each skill of the repository. A skill opens in its own tab in the dock.
 - The Web button in the dock opens a web page in a tab.
+- To make the dock wider or narrower, drag its left edge. With the edge focused, the left and right arrow keys change the width in steps. Double-click the edge to go back to the default width. The width is kept in this browser.
+- **Focus** in the dock gives the dock the whole window. The place and the detail are hidden, and the dock stays full width on every place. Press **Exit focus**, or ⌘⇧J (Ctrl-Shift-J), to show the place again. Folding the dock also ends Focus.
+- **▲ scratchpad** in the bar under the tabs opens the scratchpad. The pad keeps one note for each terminal session, and one for the repository when no terminal is in front. **Send to terminal** types the note into the session in front.
 
 Folding the dock, or going to another place, does not touch your terminals.
 
@@ -63,6 +66,7 @@ The workspace is neutral. A primary button is the text colour on the page colour
 | g t, g i, g b, g r | Show Today, Initiatives, Board or Reports. |
 | ⌘K (Ctrl-K) | Open or close the command palette. |
 | ⌘J (Ctrl-J) | Open or fold the dock. |
+| ⌘⇧J (Ctrl-Shift-J) | Focus: give the dock the whole window, or show the place again. |
 | j, k | Move down or up the rows of the place. |
 | Enter | Open the row that has the focus. |
 | Space | Tick the row. Space never opens a row. On another button of the row, for example ⋯, Space presses that button. |

package/workspace/guide/proactive-engine.md

@@ -1,20 +1,35 @@
 ---
 type: Guide
 title: "Guide: Today and the proactive engine"
-description: "What the Today item shows, how the morning brief is made, and how the workspace works out what is waiting for you."
-timestamp: 2026-10-04
+description: "What the Today item shows, how your goals for the day are prepared, how the morning brief is made, and how the workspace works out what is waiting for you."
+timestamp: 2026-10-06
 ---
 
 # Guide: Today and the proactive engine
 
 The today item shows what is waiting for you now. The workspace works it out by itself from the records of your repositories. You do not ask for it.
 
+## Goals for today
+
+At the top of Today you can list what you want done today. A goal is one line of text, and it can name an initiative.
+
+- Open **Goals for today** and type a goal. Press Enter to add it. A day has at most 7 goals, each at most 140 characters.
+- Press **Done**, **Drop**, **Reopen** or **Remove** on a goal. A goal is open, done or dropped.
+- Press **Prepare my day**. The workspace makes the daily 06:45 morning-brief schedule if this repository has none, and runs it now. The session reads your goals, your calendar, and the mentions of you in Slack, Jira and Confluence. It ties each meeting, mention and step that moves a goal to that goal.
+- Each goal shows its steps: yours first, then the agent's. A step comes from the brief, or from a Today card on the goal's initiative. A goal with no step says so. The session does not invent a step.
+- A step is under a goal only when the brief names the goal, or when the step and the goal name the same initiative. The workspace never matches words.
+- An agent step that names an initiative has **Prepare**. It shows the step, the branch and the prompt, the same as background preparation. **Queue it** approves that exact prompt. Background preparation must be on in the settings. Otherwise the queue says so and nothing is queued.
+- What fits no goal is listed under **Also on your plate**, and items the session is less than 0.5 sure about under **Worth asking**.
+- Today also says how much free time you have until 18:00, the event coming up, and which sources were not read.
+- If the brief is for another day, it is not used. Only the Today cards are shown under the goals.
+- The goals are stored in the workspace state folder on this computer, one file for each day (`goals/<date>.json`). They are not committed.
+
 ## The morning brief
 
 The top of Today is the morning brief: a greeting, the day's calendar, the priorities and a list of things worth asking about. The brief is not computed by the workspace. A skill called morning-brief runs in an agent session. The session reads the sources, and then submits one brief with `pmos proactive brief submit`. The workspace server only checks the brief and stores it. It makes no model call and reaches no calendar or mailbox.
 
 - Press **schedule the morning brief** in Today to make a daily schedule at 06:45. The schedule is an ordinary scheduled task, so it runs only while the workspace server runs. A sleeping computer gets no brief. A schedule that is made after its time of day for the first time runs within a minute, so pressing the button at 10:00 starts one brief session straight away.
-- Each source is a setting: calendar, wispr, mail, jira and confluence. Mail is off by default and the skill reads only subjects and senders, never bodies. A source that is off cannot be reported as read.
+- Each source is a setting: calendar, wispr, mail, slack, jira and confluence. Mail is off by default and the skill reads only subjects and senders, never bodies. Slack is on by default. In Slack, Jira and Confluence the skill reads the mentions of you: where, who, and a one-line summary. It never copies a message. A source that is off cannot be reported as read.
 - The brief names the day it is for. If that is not today, Today says it is out of date.
 - An item the session is less than 0.5 sure about is shown under worth asking, not as a priority. The workspace sets that bucket from the confidence. The session cannot choose it.
 - The order is fixed: higher confidence first, then your items before the agent's, then by title.
@@ -85,7 +100,7 @@ A verdict never changes a status, a lifecycle record or an acceptance. It is rec
 |---|---|
 | engine on | Off stops automatic scans. The scan now button still works. |
 | watch: needs, returned, review, schedule, stalled | Turn one trigger off. |
-| brief sources | One switch for each of calendar, wispr, mail, jira and confluence. |
+| brief sources | One switch for each of calendar, wispr, mail, slack, jira and confluence. |
 | background prepare | Off by default. On lets the workspace start a session for a plan you approved. |
 | typed scoring | Off by default. On lets the skill send titles and metadata to the Typesafe service. |
 | name | Used in the greeting. |
@@ -102,6 +117,7 @@ Text that you type in a setting (the name, the stalled days, the quiet hours) or
 - `pmos proactive today` lists the items.
 - `pmos proactive scan` scans now.
 - `pmos proactive settings` shows the settings. Add `--enabled`, `--trigger NAME=on|off`, `--stalled-days`, `--quiet HH:MM-HH:MM|none`, `--pause-learning`, `--background-prepare on|off`, `--brief-source NAME=on|off`, `--brief-scoring on|off` or `--name` to change one.
+- `pmos proactive goals` lists today's goals with their steps. `pmos proactive goals add TEXT [--initiative ID]` adds one. `done N`, `drop N`, `reopen N` and `remove N` change the Nth goal. `pmos proactive goals plan` does the same as **Prepare my day**.
 - `pmos proactive brief` shows today's brief. `pmos proactive brief submit --file PATH` submits one. `pmos proactive brief schedule` makes the 06:45 schedule for the current repository.
 - `pmos proactive prepare` shows the queue. `pmos proactive prepare plan --initiative ID` shows a plan and its hash. `pmos proactive prepare queue --initiative ID --item ITEM --sha HASH` approves it. `pmos proactive prepare cancel ID` cancels an entry. `pmos proactive prepare run` looks at the queue now.
 - `pmos proactive learn` shows the rollup, the weights, the narrowed triggers and the lessons. `pmos proactive learn run` takes the weekly review now. `pmos proactive learn lessons` lists the approved lessons. `pmos proactive learn approve ID`, `reject ID` and `retire ID` decide a lesson. `pmos proactive learn restore TRIGGER` brings back a narrowed trigger. `pmos proactive learn reset` makes it ignore earlier feedback.
@@ -110,7 +126,7 @@ Text that you type in a setting (the name, the stalled days, the quiet hours) or
 ## Limits
 
 - It runs only while the workspace server runs. It does not catch up for time the server was off. A sleeping computer gets no scan.
-- The items from the records come from this computer. The workspace itself does not read your mail or your calendar. Only the morning-brief session does, and only the sources you switched on.
+- The items from the records come from this computer. The workspace itself does not read your mail, your calendar, Slack, Jira or Confluence. Only the morning-brief session does, and only the sources you switched on.
 - It does not start a session, push, send, post, accept or merge. It only shows items and records your feedback, and learns from it as described above. The one exception is background preparation, which starts a session only for a plan you approved, as described above.
 - An unreadable repository is listed as not read. An empty list is not proof that nothing waits there.
 - The records stay in the workspace state folder on this computer. They are not committed.

package/workspace/lib/board-fold.js

@@ -68,8 +68,8 @@ function workInitiatives(root) {
   for (const id of eng.listInitiatives(root)) {
     let pl;
     try { pl = planTree.profileAndLane(root, id); } catch { continue; }
-    const def = pl.defs && pl.defs[pl.lane];
-    if (!def || def.group !== 'work') continue;
+    if (pl.group !== 'work') continue;
+    const def = (pl.defs && pl.defs[pl.lane]) || {};
     let title = id;
     if (pl.record) {
       try { title = String((eng.parseLeadingFrontmatter(fs.readFileSync(pl.record, 'utf8')) || {}).title || '').trim() || id; } catch { title = id; }

package/workspace/lib/breakdown-export.js

@@ -18,7 +18,6 @@
 const fs = require('fs');
 const planItems = require('./plan-items.js');
 const planTree = require('./plan-tree.js');
-const rows = require('./initiative-rows.js');
 const consoleState = require('./console-state');
 
 const STATE_LABEL = { todo: 'Todo', doing: 'Doing', review: 'Review', done: 'Done' };
@@ -51,11 +50,7 @@ function exportBreakdown(root, id) {
   if (!loaded.ok) return refuse(500, loaded.error);
   let fm = {};
   try { fm = loaded.engine.parseLeadingFrontmatter(fs.readFileSync(file, 'utf8')) || {}; } catch { fm = {}; }
-  const { lane } = planTree.profileAndLane(root, id);
-  let groups;
-  try { groups = rows.workGroupOf(root); } catch { groups = {}; }
-  const declared = String(fm.lane || '').trim();
-  if (groups[Object.prototype.hasOwnProperty.call(groups, declared) ? declared : lane] !== 'work') {
+  if (planTree.profileAndLane(root, id).group !== 'work') {
     return refuse(404, `${id} is not on a work lane; a document is a file and has no breakdown to export`);
   }
   const fold = planItems.readFold(root, { now: 0 });

package/workspace/lib/brief.js

@@ -10,12 +10,16 @@
  *   greeting(now, name)                   → the one line Today opens with
  *   localDate(now)                        → YYYY-MM-DD on this machine's clock
  *
+ * Goals (initiative `today-goals`, PRD G3): an item or an event may name one of the day's goals with `goal`. With
+ * `ctx.goalIds` given, a goal that is not in that day's record is refused. An item may say it is a `mention` of the PM
+ * (Slack, Jira, Confluence, mail): a boolean, nothing more.
+ *
  * The bucket is derived: an item under WORTH_ASKING confidence is "worth asking", whatever the session said. The order is
  * fixed and stated: higher confidence first, then PM-owned before agent-owned, then by title.
  */
 const crypto = require('crypto');
 
-const SOURCES = ['calendar', 'wispr', 'mail', 'jira', 'confluence'];
+const SOURCES = ['calendar', 'wispr', 'mail', 'slack', 'jira', 'confluence'];
 const ITEM_SOURCES = [...SOURCES, 'derived'];
 const SOURCE_STATES = ['read', 'not-reached', 'off'];
 const OWNERS = ['pm', 'agent'];
@@ -24,6 +28,7 @@ const WORTH_ASKING = 0.5;
 const MAX_ITEMS = 12;
 const MAX_EVENTS = 20;
 const INI_RE = /^[a-z0-9][a-z0-9._-]*$/i;
+const GOAL_RE = /^g-[0-9a-f]{8}$/;
 const clip = (s, n) => String(s == null ? '' : s).replace(/\s+/g, ' ').trim().slice(0, n);
 
 const pad = (n) => String(n).padStart(2, '0');
@@ -40,6 +45,13 @@ const tooLong = (v, n) => typeof v === 'string' && v.trim().length > n;
 function validateBrief(raw, ctx = {}) {
   const now = ctx.now || Date.now();
   const settings = ctx.settings || {};
+  const goalIds = Array.isArray(ctx.goalIds) ? new Set(ctx.goalIds) : null;
+  const badGoal = (g, at) => {
+    if (g === undefined || g === null) return null;
+    if (typeof g !== 'string' || !GOAL_RE.test(g)) return `${at}: goal is not a goal id`;
+    if (goalIds && !goalIds.has(g)) return `${at}: goal ${g} is not one of the goals for that day`;
+    return null;
+  };
   const on = (src) => !settings.briefSources || settings.briefSources[src] !== false;
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, error: 'a brief is a JSON object' };
   const date = raw.date === undefined ? localDate(now) : raw.date;
@@ -68,7 +80,9 @@ function validateBrief(raw, ctx = {}) {
     if (typeof e.start !== 'string' || Number.isNaN(Date.parse(e.start))) return { ok: false, error: `calendar event ${i + 1}: start must be a date and time` };
     if (e.end !== undefined && (typeof e.end !== 'string' || Number.isNaN(Date.parse(e.end)))) return { ok: false, error: `calendar event ${i + 1}: end must be a date and time` };
     if (e.with !== undefined && tooLong(e.with, 120)) return { ok: false, error: `calendar event ${i + 1}: "with" is over 120 characters` };
-    calendar.push({ start: e.start, end: e.end || null, title: clip(e.title, 120), with: e.with ? clip(e.with, 120) : null });
+    const gErr = badGoal(e.goal, `calendar event ${i + 1}`);
+    if (gErr) return { ok: false, error: gErr };
+    calendar.push({ start: e.start, end: e.end || null, title: clip(e.title, 120), with: e.with ? clip(e.with, 120) : null, ...(e.goal ? { goal: e.goal } : {}) });
   }
   calendar.sort((a, b) => Date.parse(a.start) - Date.parse(b.start));
 
@@ -90,11 +104,15 @@ function validateBrief(raw, ctx = {}) {
     if (!EFFORTS.includes(x.effort)) return { ok: false, error: `${at}: effort must be one of ${EFFORTS.join(', ')}` };
     if (typeof x.confidence !== 'number' || !Number.isFinite(x.confidence) || x.confidence < 0 || x.confidence > 1) return { ok: false, error: `${at}: confidence must be a number from 0 to 1` };
     if (x.initiative_id !== undefined && x.initiative_id !== null && (typeof x.initiative_id !== 'string' || !INI_RE.test(x.initiative_id))) return { ok: false, error: `${at}: initiative_id is not an initiative id` };
+    const gErr = badGoal(x.goal, at);
+    if (gErr) return { ok: false, error: gErr };
+    if (x.mention !== undefined && typeof x.mention !== 'boolean') return { ok: false, error: `${at}: mention must be true or false` };
     const title = clip(x.title, 140);
     items.push({
       id: crypto.createHash('sha1').update(`${date}|${x.source}|${title}`).digest('hex').slice(0, 12),
       title, why_now: clip(x.why_now, 240), evidence: clip(x.evidence, 240), source: x.source, initiative_id: x.initiative_id || null,
       owner: x.owner, effort: x.effort, confidence: x.confidence, worth_asking: x.confidence < WORTH_ASKING,
+      ...(x.goal ? { goal: x.goal } : {}), ...(x.mention ? { mention: true } : {}),
     });
   }
   items.sort((a, b) => b.confidence - a.confidence || (a.owner === b.owner ? 0 : a.owner === 'pm' ? -1 : 1) || a.title.localeCompare(b.title));