create-pmos 0.53.0 → 0.53.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.53.0",
+  "version": "0.53.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@aa14199
+kernel-source: pmos@439620f
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T02:40:00Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T02:40:00Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T00:08:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T02:40:00Z"}
 status: stable
 ---
 

package/workspace/README.md

@@ -33,6 +33,8 @@ pmos status          # is it running? which sessions?
 pmos stop            # shut it down (scrollback is preserved; sessions respawn next time)
 pmos doctor          # diagnose the environment (node-pty arch, PTY spawn test, ports)
 ```
+**Without a terminal.** `pmos launcher on` (once, from the repository you want) writes a PMOS app — `~/Applications/PMOS.app` on macOS, an app-menu entry on Linux — and a login item that starts the server at login without opening a browser. Both run `pmos up <repo>` with the PATH your terminal had at setup. `pmos launcher status` checks it, `pmos launcher off` removes it. Guide: [`guide/launcher.md`](guide/launcher.md).
+
 **The port is found, not assumed.** A running server records the port it serves, so `pmos` in a second repo joins the workspace you already have open — whatever port it ended up on, and however it was started. If another program holds the default port (7433), `pmos` starts on the next free one and says so; `PMOS_WS_PORT=7500 pmos` pins it by hand. `pmos stop` shuts down every workspace server it finds, which is how you collapse two back into one.
 
 <details><summary>Without the global install (running from the repo)</summary>

package/workspace/REMOTE.md

@@ -1,32 +1,23 @@
 ---
 type: Reference
 title: "Workspace remote access over a private tailnet (Tailscale)"
-timestamp: 2026-07-26
+timestamp: 2026-10-06
 ---
 
 # Reaching the workspace from your phone — over a private tailnet, never the public internet
 
-The workspace server owns **real terminal sessions (PTYs)** running your `claude` on **your own
-subscription**. By default it binds `127.0.0.1` only, so it is reachable solely from the machine it
-runs on. This runbook enables reaching **the same local server** from another of your own devices —
-a phone, a laptop — over a **private Tailscale tailnet**. It never exposes a public endpoint.
+The workspace server owns **real terminal sessions (PTYs)** running your `claude` on **your own subscription**. By default it binds `127.0.0.1` only, so it is reachable solely from the machine it runs on. This runbook enables reaching **the same local server** from another of your own devices — a phone, a laptop — over a **private Tailscale tailnet**. The tailnet path never exposes a public endpoint. To use your own domain instead, see [Reaching the workspace at your own domain](#reaching-the-workspace-at-your-own-domain-cloudflare-tunnel--access): the server still binds loopback only, and Cloudflare forwards to it.
 
 ## Why a tailnet, and why no public endpoint (D62)
 
-A [Tailscale](https://tailscale.com) tailnet is a private [WireGuard](https://www.wireguard.com/)
-mesh between **your own devices**. Every device is authenticated and encrypted end-to-end; addresses
-live in the CGNAT range `100.64.0.0/10` and are routable **only** between devices on your tailnet —
-never from the public internet.
+A [Tailscale](https://tailscale.com) tailnet is a private [WireGuard](https://www.wireguard.com/) mesh between **your own devices**. Every device is authenticated and encrypted end-to-end; addresses live in the CGNAT range `100.64.0.0/10` and are routable **only** between devices on your tailnet — never from the public internet.
 
 PMOS's locked decision **D62** rejects, permanently:
 
 - **any public endpoint** for the workspace server, and
 - **any hosted PTY bridge** (proxying the terminal through a hosted, browser-reachable surface).
 
-A public server that owns a PTY running your Claude subscription is severe exposure. The tailnet path
-sidesteps that entirely: the phone attaches to the *same local server* across your own private
-network. Accordingly, this feature will **only ever** bind loopback plus your machine's own tailnet
-address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it **refuses to start**.
+A public server that owns a PTY running your Claude subscription is severe exposure. The tailnet path sidesteps that entirely: the phone attaches to the *same local server* across your own private network. Accordingly, this feature will **only ever** bind loopback plus your machine's own tailnet address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it **refuses to start**.
 
 ## Setup
 
@@ -52,16 +43,15 @@ address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it
      loopback requests are token-free; every tailnet request must present the token.
    ```
 
-   **Copy the token now** — it is shown only once and never logged again.
+   Under those lines it prints the phone URL as a **QR code**, and the same URL as text (`http://100.x.y.z:7433/?token=<token>`). The token is shown only at startup and never logged again. A token you supply with `PMOS_TOKEN` is never printed, so that mode prints no QR code.
 
-3. **Open it from your phone.** In the phone's browser (on the same tailnet), open:
+3. **Open it from your phone.** Point the phone camera at the QR code and open the link. Or type the URL into the phone's browser. The server sets a sign-in cookie (7 days) and redirects to `http://100.x.y.z:7433/`, so the token does not stay in the address bar or the history.
 
-   ```
-   http://100.x.y.z:7433/?token=<token>
-   ```
+   If the phone has no valid cookie, it shows a **sign-in page**. Paste the token there. The field is a password field, so the phone's password manager can save it. This is also what you see after the cookie expires, or after a restart that generated a new token.
+
+   The client attaches to the **same live sessions** the desktop sees. Requests from the machine itself (`127.0.0.1`) never need the token.
 
-   The client attaches to the **same live sessions** the desktop sees; the token authorizes both the
-   page and its WebSocket. Requests from the machine itself (`127.0.0.1`) never need the token.
+4. **Optional: put it on the home screen.** In Safari, tap Share › Add to Home Screen. In Chrome on Android, tap ⋮ › Add to Home screen. The PMOS icon then opens the workspace full screen, without the browser bar. On iOS the home-screen app has its own cookies, so it asks for the token once. On Android, Chrome opens a home-screen app full screen only from an HTTPS origin. Over the plain `http://100.x.y.z` address it adds a shortcut that opens in a normal browser tab. There is no offline mode: the workspace shows live state, and it needs the server to be running.
 
 ## Configuration
 
@@ -76,56 +66,108 @@ address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it
 
 ## Security model (what is guaranteed)
 
-- **Never public.** The only addresses the server will ever bind are loopback and a
-  `100.64.0.0/10` tailnet address. `0.0.0.0`, `::`, LAN, and public IPs are refused — the server
-  exits with a clear error rather than binding them. There is no code path to a public bind.
-- **Token beyond loopback.** With remote mode on, every non-loopback HTTP request and WebSocket
-  upgrade must present the bearer token, or it is rejected (`401` / socket closed). Loopback requests
-  stay token-free for local development. The comparison is constant-time.
-- **Origin/Host allowlist (D64).** Both the HTTP guard and the WebSocket-upgrade handshake reject any
-  request whose `Origin` is foreign (not same-origin with the `Host` it arrived on) or whose `Host`
-  hostname is not loopback/localhost or your tailnet address. This closes the cross-origin-localhost /
-  DNS-rebinding vector: without it, **any website open in your browser** could open a WebSocket to
-  `ws://127.0.0.1:<port>` and spawn a shell + type into it, because loopback peers are token-exempt.
-  A same-origin page served by the workspace passes; a cross-site page is rejected `403`. Native
-  clients / `curl` (which send no `Origin`) still pass this check and are then gated by the token.
-- **No header/token logging (D08).** The request-guard path logs nothing about the request. The
-  token is printed at most once at startup (only when generated); a token you supply is never echoed.
-- **Rate-limited control channel (D64).** The WS messages that spawn shells (`new`/`respawn`) and
-  feed a PTY (`input`) are per-connection rate-limited, bounding abuse if the socket is ever reached.
-- **Independent layers.** The tailnet (WireGuard device auth), the bearer token, and the origin/host
-  allowlist all gate access — a device must be *on your tailnet*, *hold the token*, **and** present a
-  same-origin request from an allowed host.
+- **Never public.** The only addresses the server will ever bind are loopback and a `100.64.0.0/10` tailnet address. `0.0.0.0`, `::`, LAN, and public IPs are refused — the server exits with a clear error rather than binding them. There is no code path to a public bind.
+- **Token beyond loopback.** With remote mode on, every non-loopback HTTP request and WebSocket upgrade must present the bearer token, or it is rejected (`401` / socket closed). A browser page load gets the sign-in page with that `401`. The one exception is `POST /auth`, the sign-in form's target: it only compares the posted token and, on a match, sets the session cookie. It still sits behind the Origin/Host allowlist. Loopback requests stay token-free for local development, unless they arrived through a proxy (see [Why a proxy on the same machine needs special handling](#why-a-proxy-on-the-same-machine-needs-special-handling)). The comparison is constant-time.
+- **Origin/Host allowlist (D64).** Both the HTTP guard and the WebSocket-upgrade handshake reject any request whose `Origin` is foreign (not same-origin with the `Host` it arrived on) or whose `Host` hostname is not loopback/localhost or your tailnet address. This closes the cross-origin-localhost / DNS-rebinding vector: without it, **any website open in your browser** could open a WebSocket to `ws://127.0.0.1:<port>` and spawn a shell + type into it, because loopback peers are token-exempt. A same-origin page served by the workspace passes; a cross-site page is rejected `403`. Native clients / `curl` (which send no `Origin`) still pass this check and are then gated by the token.
+- **No header/token logging (D08).** The request-guard path logs nothing about the request. The token is printed at most once at startup (only when generated); a token you supply is never echoed.
+- **Rate-limited control channel (D64).** The WS messages that spawn shells (`new`/`respawn`) and feed a PTY (`input`) are per-connection rate-limited, bounding abuse if the socket is ever reached.
+- **Independent layers.** The tailnet (WireGuard device auth), the bearer token, and the origin/host allowlist all gate access — a device must be *on your tailnet*, *hold the token*, **and** present a same-origin request from an allowed host.
 
 ## Exposing to the internet — the required hardening (D64)
 
-The workspace is **tailnet-first**. The tailnet path above is the supported way to reach it from
-another of your own devices and needs no internet exposure. If you nonetheless expose an instance to
-the internet, D64 permits it **only after all three of the following are in place — never before, and
-never as a raw public bind**:
+The workspace is **tailnet-first**. The tailnet path above is the supported way to reach it from another of your own devices and needs no internet exposure. If you nonetheless expose an instance to the internet, D64 permits it **only after all three of the following are in place — never before, and never as a raw public bind**:
+
+1. **The bearer token for every non-loopback or proxied request.** A request that arrives through a reverse proxy or tunnel is never token-exempt, even though the proxy connects from `127.0.0.1` (see below).
+2. **The Origin/Host allowlist** (already enforced — see above). `PMOS_PUBLIC_HOST` adds exactly one public hostname to it.
+3. **TLS termination at the exposure boundary.** **The workspace server does not terminate TLS.** It speaks plain HTTP/WS and must sit behind something that terminates TLS for it. Do **not** put the raw HTTP port on a public interface — the server refuses non-loopback/non-tailnet binds precisely so this stays a conscious proxy decision, not an accident.
+
+**Do not rewrite the forwarded `Host` header to a loopback address.** Earlier versions of this runbook advised it. Forward the public hostname unchanged and set `PMOS_PUBLIC_HOST` to it.
+
+### Why a proxy on the same machine needs special handling
+
+A tunnel or reverse proxy that runs on the workspace machine (cloudflared, Caddy, nginx) connects to the server from `127.0.0.1`. Loopback peers are token-exempt, so without a further check every internet request would look local. The server therefore treats a request as **proxied** when it carries any of these headers, and a proxied request must always present the token:
+
+`Forwarded`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Real-IP`, `Cf-Connecting-IP`, `Cf-Ray`, `Cf-Access-Jwt-Assertion`
+
+A request to the `PMOS_PUBLIC_HOST` hostname is proxied by definition, with or without these headers.
+
+## Reaching the workspace at your own domain (Cloudflare Tunnel + Access)
 
-1. **The bearer token for every non-loopback peer** (already enforced in remote mode).
-2. **The Origin/Host allowlist** (already enforced — see above).
-3. **TLS termination at the exposure boundary.** **The workspace server does not terminate TLS.** It
-   speaks plain HTTP/WS and must sit behind something that terminates TLS for it — Tailscale's own
-   HTTPS (`tailscale serve` / `tailscale funnel`) or a reverse proxy (Caddy, nginx, a tunnel) that
-   holds the certificate and forwards to the loopback/tailnet listener. Do **not** put the raw HTTP
-   port on a public interface — the server refuses non-loopback/non-tailnet binds precisely so this
-   stays a conscious proxy decision, not an accident.
+This runbook puts the workspace at `https://pm-os.app/` (use your own hostname). Cloudflare holds the certificate and terminates TLS. **Cloudflare Access** asks for your Google or email login before any request reaches the machine. The workspace then asks for its own token. The workspace keeps running on **your own always-on machine**; Cloudflare forwards bytes to it. It does not run on Cloudflare Workers or Containers: it holds real terminal sessions, a git checkout and your agent CLI's login, and needs a persistent disk.
 
-When a reverse proxy forwards to the workspace, keep the forwarded `Host` set to the loopback/tailnet
-host the server actually binds, so the Origin/Host allowlist still recognises same-origin requests.
+Two locks protect the workspace, and each one is enforced by the server:
+
+| Lock | Who checks it | What happens without it |
+|---|---|---|
+| Cloudflare Access login | Cloudflare's edge. The server refuses a request to the public host that has no `Cf-Access-Jwt-Assertion` header. | `403`, before the sign-in page. |
+| The workspace token | The server, constant-time. | `401` and the sign-in page. |
+
+The Access check in the server is a **presence check**: it confirms that Access is in front, and it fails closed when you forget the Access application. It does not verify the assertion's signature, because that needs Cloudflare's signing keys fetched over the network, and the workspace makes no outbound requests (D79). The origin listens on loopback only, so the tunnel is the only way to reach it with the public hostname.
+
+### Setup
+
+1. **Pick the machine.** Use a machine that stays on: your desktop, or a small Linux VPS. Install the workspace there as usual, and sign in to your agent CLI in a workspace terminal.
+
+2. **Move the domain's DNS to this tunnel.** In the Cloudflare dashboard, remove any existing record or Pages/Worker route for the hostname that you want to use. For `pm-os.app`, the retired PM-OS Pages project and Worker still own it.
+
+3. **Create the Access application first.** In Cloudflare Zero Trust, go to **Access › Applications › Add an application › Self-hosted**. Set the domain to `pm-os.app`. Add one policy: **Allow**, **Emails**, your own email address. Save. Do this before the tunnel, so the hostname is never reachable without a login.
+
+4. **Create the tunnel.** Install `cloudflared` on the machine, then:
+
+   ```sh
+   cloudflared tunnel login
+   cloudflared tunnel create pmos
+   cloudflared tunnel route dns pmos pm-os.app
+   ```
+
+   Write `~/.cloudflared/config.yml`:
+
+   ```yaml
+   tunnel: pmos
+   credentials-file: /home/<you>/.cloudflared/<tunnel-id>.json
+   ingress:
+     - hostname: pm-os.app
+       service: http://127.0.0.1:7433
+     - service: http_status:404
+   ```
+
+   Do not set `httpHostHeader`. The server must see the `Host: pm-os.app` that the browser sent.
+
+5. **Start the workspace in public-host mode**, from `workspace/`:
+
+   ```sh
+   PMOS_PUBLIC_HOST=pm-os.app PMOS_TOKEN='<a long random secret>' npm start
+   ```
+
+   Supply your own `PMOS_TOKEN` so that a restart does not sign out every device. Generate one with `openssl rand -base64 32`. Without `PMOS_TOKEN`, the server generates a token and prints it once.
+
+6. **Start the tunnel:** `cloudflared tunnel run pmos`. To keep it running after a reboot, install it as a service (`sudo cloudflared service install`).
+
+7. **Open `https://pm-os.app/`.** Cloudflare asks for your login. The workspace then shows its sign-in page. Paste the token. The workspace sets a `Secure` session cookie for 7 days.
+
+### Check that it is closed
+
+Run these from a machine that is **not** signed in to Access:
+
+- `curl -sI https://pm-os.app/` returns a redirect to `*.cloudflareaccess.com`, not a workspace page.
+- On the workspace machine, `curl -s -H 'Host: pm-os.app' http://127.0.0.1:7433/api/sessions` returns `403` (no Access assertion).
+- On the workspace machine, `curl -s -H 'X-Forwarded-For: 1.2.3.4' http://127.0.0.1:7433/api/sessions` returns `401` (proxied, no token).
+
+### Configuration
+
+| Variable | Effect |
+|---|---|
+| `PMOS_PUBLIC_HOST=<hostname>` | Opt in. Add this one bare hostname to the Host allowlist, and require the token and the Access header for requests to it. The server still binds loopback only (plus the tailnet when `PMOS_REMOTE=tailnet` is also set). A scheme, port, path, IP address or `localhost` is refused, and the server does not start. |
+| `PMOS_TOKEN=<t>` | The workspace token. Recommended in this mode. Never printed. |
 
 ## Troubleshooting
 
-- **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"**
-  — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real
-  `tailscale ip -4` value.
-- **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run
-  `tailscale up`, or set `PMOS_TAILNET_IP`.
-- **"cannot bind 100.x.y.z:PORT — that address is not present on this machine"** — the pinned
-  `PMOS_TAILNET_IP` isn't actually assigned to this machine. Check `tailscale ip -4`.
-- **Phone gets 401** — the token is missing or wrong. Re-open with `?token=<token>` (or send
-  `Authorization: Bearer <token>`). Restarting the server without `PMOS_TOKEN` mints a new token.
-- **Phone can't connect at all** — confirm both devices show each other in the Tailscale app, and
-  that you used the `100.x.y.z` address, not a LAN IP.
+- **`403` "the public host is only reachable through Cloudflare Access"** — the request reached the workspace without passing Access. Create the Access application for the hostname (Setup step 3).
+- **`403` "forbidden origin/host" on the public hostname** — `PMOS_PUBLIC_HOST` is not set, or it names another hostname, or the tunnel rewrites the `Host` header. Remove `httpHostHeader` from the tunnel's ingress rule.
+- **A local reverse proxy now gets `401`** — it adds a forwarding header, so its requests need the token. This is intended.
+
+- **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.
+- **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run `tailscale up`, or set `PMOS_TAILNET_IP`.
+- **"cannot bind 100.x.y.z:PORT — that address is not present on this machine"** — the pinned `PMOS_TAILNET_IP` isn't actually assigned to this machine. Check `tailscale ip -4`.
+- **Phone shows the sign-in page** — the cookie is missing, expired, or from an older token. Paste the token, or scan the QR code again. Restarting the server without `PMOS_TOKEN` mints a new token, so every phone must sign in again. (API clients without a browser still get a JSON `401`.)
+- **Phone can't connect at all** — confirm both devices show each other in the Tailscale app, and that you used the `100.x.y.z` address, not a LAN IP.

package/workspace/bin/pmos.js

@@ -45,7 +45,9 @@ const pidFile = (port) => path.join(STATE, D.pidFileName(port));
 const logFile = (port) => path.join(STATE, `server-${port}.log`);
 const APP_VERSION = (() => { try { return require('../package.json').version || null; } catch { return null; } })();
 const urlOf = (port) => `http://127.0.0.1:${port}`;
-const NO_OPEN = process.env.PMOS_NO_OPEN === '1';      // tests set this
+// Tests set PMOS_NO_OPEN. `--no-open` is the login item's (`pmos launcher on`): a flag, not the env var, so the
+// server it starts does not hand PMOS_NO_OPEN to every session, where a `pmos` typed later would open nothing.
+const NO_OPEN = process.env.PMOS_NO_OPEN === '1' || process.argv.includes('--no-open');
 
 const say = (s) => console.log(s);
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -442,7 +444,7 @@ function doctor() {
     code = 0;
   } else if (cmd === 'up' || cmd === 'start' || cmd === 'open') {
     // `pmos open ../other-repo` — the path is the argument AFTER the verb
-    code = await up(process.argv[3] ? path.resolve(process.argv[3]) : process.cwd());
+    code = await up(process.argv[3] && !process.argv[3].startsWith('-') ? path.resolve(process.argv[3]) : process.cwd());
   } else if (arg && !arg.startsWith('-')) {
     code = await up(path.resolve(arg));                 // `pmos ../other-repo`
   } else {

package/workspace/first-paint-audit.js

@@ -7,6 +7,7 @@
  * [draggable=true] inside the viewport on first paint.
  *
  *   EXPECT                      PRD Q5's budgets at 1280×800, counted outside the dock and the terminal
+ *   SPECIMEN_A                  specimen A's own counts (2026-10-05), the calibration the audit must reproduce
  *   audit(phone)                shoot.js's audit, verbatim; runs in the page (page.evaluate(audit, false))
  *   countIn([scope, exclude])   the same selector and visibility test, inside `scope` and outside `exclude`; in the page
  *   stableCount([scope, exclude, minus])   countIn once the screen is still (two animation frames apart); in the page,
@@ -16,7 +17,10 @@
  * Do not tune the selector or the visibility test for one surface: change them here, for all, or not at all.
  */
 
-const EXPECT = Object.freeze({ today: 17, initiatives: 24, board: 33, reports: 14 });
+// The budgets start at specimen A's counts. reports: 14 → 15 in Run 6 for Present, the one control the PM asked to keep
+// with the slides (2026-10-06). The calibration stays specimen A's own count: the specimen did not change.
+const SPECIMEN_A = Object.freeze({ today: 17, initiatives: 24, board: 33, reports: 14 });
+const EXPECT = Object.freeze({ ...SPECIMEN_A, reports: 15 });
 
 /* ── shoot.js audit(), copied verbatim (scratchpad/specimens2/shoot.js, 2026-10-05) ─────────────────────────────── */
 // runs in the page
@@ -142,4 +146,4 @@ function installCounter(page) {
   return page.addInitScript({ content: 'window.__countIn = ' + countIn.toString() + ';' });
 }
 
-module.exports = { EXPECT, audit, countIn, stableCount, installCounter };
+module.exports = { EXPECT, SPECIMEN_A, audit, countIn, stableCount, installCounter };

package/workspace/fixtures/initiatives-api/list.json

@@ -172,5 +172,18 @@
       "init": null,
       "why": "line 9: not JSON"
     }
+  ],
+  "unrecorded": [
+    {
+      "id": "fx-orphan",
+      "title": "An initiative with a PRD and no record",
+      "artifacts": [
+        {
+          "name": "fx-orphan-prd.md",
+          "path": "planning/prd/fx-orphan-prd.md",
+          "role": "PRD"
+        }
+      ]
+    }
   ]
 }

package/workspace/fixtures/initiatives-api/roadmap.json

@@ -204,5 +204,18 @@
       "init": null,
       "why": "line 9: not JSON"
     }
+  ],
+  "unrecorded": [
+    {
+      "id": "fx-orphan",
+      "title": "An initiative with a PRD and no record",
+      "artifacts": [
+        {
+          "name": "fx-orphan-prd.md",
+          "path": "planning/prd/fx-orphan-prd.md",
+          "role": "PRD"
+        }
+      ]
+    }
   ]
 }

package/workspace/fixtures/report-api/draft.json

@@ -173,5 +173,110 @@
       "path": "planning/reports/definitions/biweekly.md",
       "audience": "leadership"
     }
+  },
+  "slides": {
+    "v": 1,
+    "meta": {
+      "product": "northwind",
+      "cadence": "Biweekly",
+      "slot": "2026-10-16",
+      "today": "2026-10-16",
+      "last": {
+        "from": "2026-10-02",
+        "to": "2026-10-16"
+      },
+      "next": {
+        "from": "2026-10-16",
+        "to": "2026-10-30"
+      }
+    },
+    "roadmap": {
+      "months": [
+        "2026-09",
+        "2026-10",
+        "2026-11",
+        "2026-12",
+        "2027-01",
+        "2027-02"
+      ],
+      "today": "2026-10-16",
+      "groups": [
+        {
+          "name": "Now",
+          "rows": [
+            {
+              "id": "partner-sso",
+              "title": "Partner SSO",
+              "estimated": false,
+              "segments": [
+                {
+                  "stage": "build",
+                  "label": "Build",
+                  "start": "2026-10-01",
+                  "due": "2026-10-24"
+                }
+              ],
+              "milestones": [
+                {
+                  "title": "Pilot live",
+                  "due": "2026-10-24",
+                  "done": false
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    "list": [
+      {
+        "id": "partner-sso",
+        "title": "Partner SSO",
+        "status": "Build",
+        "pct": 58,
+        "next_milestone": {
+          "title": "Pilot live",
+          "due": "2026-10-24",
+          "overdue": false
+        },
+        "release": "2026-11-20"
+      }
+    ],
+    "initiatives": [
+      {
+        "id": "partner-sso",
+        "title": "Partner SSO",
+        "status": "Build",
+        "pct": 58,
+        "done": 7,
+        "total": 12,
+        "next_milestone": {
+          "title": "Pilot live",
+          "due": "2026-10-24",
+          "overdue": false
+        },
+        "release": "2026-11-20",
+        "last": [
+          {
+            "title": "SAML metadata",
+            "stage": "Build",
+            "owner": "Sheryl",
+            "milestone": false,
+            "done": true,
+            "date": null
+          }
+        ],
+        "next": [
+          {
+            "title": "Pilot live",
+            "stage": "Build",
+            "owner": null,
+            "milestone": true,
+            "done": false,
+            "date": "2026-10-24"
+          }
+        ]
+      }
+    ]
   }
 }

package/workspace/fixtures/reports-page/draft-biweekly-2026-10-16.md

@@ -73,6 +73,16 @@ Stage: Build · On track · 7 of 12 (+4)
 
 - Billing v2 (billing-v2), 8 Oct
 
+**Changelog** (your release notes for the changelog slide)
+
+<!-- pmos:note report.changelog -->
+Launch · Exports: Audit log CSV export
+
+Admins can download the audit log as a CSV file.
+
+- Added: CSV writer for the audit log
+<!-- /pmos:note -->
+
 ## Decided this cycle
 
 - Audit log export moved to Now, 3 Oct (planning/runs/placements.jsonl)
@@ -95,3 +105,5 @@ For leadership only.
 **Not reached**
 
 - tracker: not refreshed since 2 Oct
+
+<!-- pmos:slides v1 {"v":1,"meta":{"product":"northwind","cadence":"Biweekly","slot":"2026-10-16","today":"2026-10-16","last":{"from":"2026-10-02","to":"2026-10-16"},"next":{"from":"2026-10-16","to":"2026-10-30"}},"roadmap":{"months":["2026-09","2026-10","2026-11","2026-12","2027-01","2027-02"],"today":"2026-10-16","groups":[{"name":"Now","rows":[{"id":"audit-log","title":"Audit log export","estimated":false,"segments":[{"stage":"spec","label":"Spec","start":"2026-09-14","due":"2026-10-03"},{"stage":"build","label":"Build","start":"2026-10-04","due":"2026-10-28"},{"stage":"evaluate","label":"Evaluate","start":"2026-10-29","due":"2026-11-12"}],"milestones":[{"title":"Release","due":"2026-11-12","done":false}]},{"id":"partner-sso","title":"Partner SSO","estimated":false,"segments":[{"stage":"build","label":"Build","start":"2026-10-01","due":"2026-10-24"}],"milestones":[{"title":"Pilot live","due":"2026-10-24","done":false}]}]},{"name":"Next","rows":[{"id":"billing-v2","title":"Billing v2","estimated":true,"segments":[{"stage":"intake","label":"Intake","start":"2026-11-02","due":"2026-11-20"},{"stage":"spec","label":"Spec","start":"2026-11-23","due":"2026-12-18"}],"milestones":[]}]}]},"list":[{"id":"audit-log","title":"Audit log export","status":"Evaluate","pct":60,"next_milestone":{"title":"Retention rule","due":"2026-10-10","overdue":true},"release":"2026-11-12"},{"id":"partner-sso","title":"Partner SSO","status":"Build","pct":58,"next_milestone":{"title":"Pilot live","due":"2026-10-24","overdue":false},"release":null}],"initiatives":[{"id":"audit-log","title":"Audit log export","status":"Evaluate","pct":60,"done":3,"total":5,"next_milestone":{"title":"Retention rule","due":"2026-10-10","overdue":true},"release":"2026-11-12","last":[{"title":"CSV writer","stage":"Build","owner":"Sheryl","milestone":false,"done":true,"date":null},{"title":"Retention rule","stage":"Build","owner":"Ricky","milestone":true,"done":false,"date":"2026-10-10"}],"next":[{"title":"Retention rule","stage":"Build","owner":"Ricky","milestone":true,"done":false,"date":"2026-10-10"},{"title":"Export UI","stage":"Build","owner":"Lasantha","milestone":false,"done":false,"date":null}]},{"id":"partner-sso","title":"Partner SSO","status":"Build","pct":58,"done":7,"total":12,"next_milestone":{"title":"Pilot live","due":"2026-10-24","overdue":false},"release":null,"last":[],"next":[{"title":"Pilot live","stage":"Build","owner":null,"milestone":true,"done":false,"date":"2026-10-24"},{"title":"Pilot partners on SSO","stage":"Build","owner":"Agent","milestone":false,"done":false,"date":null}]}]} -->

package/workspace/guide/command-palette.md

@@ -67,7 +67,7 @@ The palette reads the lists of all three scopes when it opens. When a list canno
 
 The palette opens as a sheet from the bottom edge. Each row is at least 48 pixels high, and the rows are reached by touch.
 
-There is no separate capture box. The scratchpad remains in one place only: the **compose line** at the bottom of a terminal tab. Type a message there and press **Send**. The text is typed into the session and the line clears. The line keeps your text for each session until you send it, so a message you did not finish is still there when you come back.
+On a phone, the scratchpad is the **compose line** at the bottom of a terminal tab. (On a desktop, open it with **▲ scratchpad** under the dock's tabs.) Type a message there and press **Send**. The text is typed into the session and the line clears. The line keeps your text for each session until you send it, so a message you did not finish is still there when you come back.
 
 ## Related
 

package/workspace/guide/index.md

@@ -1,7 +1,7 @@
 ---
 type: Guide
 title: "Guide: start here"
-timestamp: 2026-10-05
+timestamp: 2026-10-06
 ---
 
 # Guide: start here
@@ -33,6 +33,7 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 
 ## Where to read next
 
+- [Start the workspace without a terminal](launcher.md): the PMOS app, the login item and `pmos launcher`.
 - [Layout](layout.md): the frame, the keys and the rule for where a list or a detail opens.
 - [Statuses](statuses.md): what each status means, where it comes from, and what you can change.
 - [Initiatives and next steps](initiatives-and-next-steps.md): the detail, the next steps, and the artifacts.
@@ -50,3 +51,4 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 - [Initiatives › Timeline](initiatives-timeline.md): when each initiative runs, one row per initiative, and how to reorder rows by their grip.
 - [Board](board.md): one Kanban for the items of every initiative, its filters, Release, and `pmos board`.
 - [Integrated work](integrated-work.md): how `pmos verify-work` turns a merged commit into Done, and what "Done · your call · not merged" means.
+- [Report slides](report-slides.md): how the Reports page shows a report as the PM-OS biweekly slides, Present and Print / PDF, and how your notes become the words on the slides.

package/workspace/guide/initiatives-roadmap.md

@@ -29,6 +29,7 @@ The first time you open the Roadmap, the file has no lines yet. The workspace th
 
 - An initiative with activity in the last 5 days reads **Now, unconfirmed**. Move it to confirm it, or move it to Next or Later.
 - An initiative with no activity for 45 days reads **dormant**, at the end of Later.
+- Documents with no initiative record (a PRD and rubric, or a prototype folder) are listed after dormant, under **with no record**. They are not placed.
 - Every other initiative is in Later, the most recent activity first.
 - An accepted or stopped initiative is never in Now. It goes to the end of Later.
 

package/workspace/guide/initiatives-screen.md

@@ -30,6 +30,7 @@ Only you can move an initiative into Now. The workspace writes the line as yours
 - **unconfirmed.** An initiative that reads Now only because it is active, with no line from you. Confirm it in the Cycle review.
 - **proposed.** An agent proposed a move. It changes nothing until you keep it in the Cycle review.
 - **Dormant.** An initiative with no activity for a long time. Press the dormant line under Later to show them.
+- **No record yet.** A PRD, rubric or prototype folder that no initiative record points at. Press the "with no record" line under Later to show them. In List they are the last group. Press one to open its PRD. Only a record can be placed, so these have no menu.
 
 ## The List
 

package/workspace/guide/launcher.md

@@ -0,0 +1,51 @@
+---
+type: Guide
+title: "Start the workspace without a terminal"
+timestamp: 2026-10-06
+---
+
+# Start the workspace without a terminal
+
+`pmos launcher` makes a PMOS app and a login item. After you set it up once, you do not need a terminal to start the workspace.
+
+## Set it up once
+
+Open a terminal in the repository that the app must open. Type:
+
+```sh
+pmos launcher on
+```
+
+To set up a different repository, give its path: `pmos launcher on ~/code/my-product`.
+
+This command writes two things:
+
+| Thing | macOS | Linux |
+|---|---|---|
+| The PMOS app | `~/Applications/PMOS.app`. Open it from Spotlight or Launchpad, or drag it to the Dock. | An app menu entry, `~/.local/share/applications/pmos.desktop`. |
+| The login item | `~/Library/LaunchAgents/com.pmos.workspace.plist` | `~/.config/autostart/pmos-workspace.desktop` |
+
+To make only the app, without the login item, type `pmos launcher on --no-login`.
+
+## What each one does
+
+- **The app** opens the workspace in your browser. When no server runs, it starts one first. It does the same thing as `pmos` in a terminal.
+- **The login item** starts the workspace server when you log in. It does not open a browser window. Open the app when you want the window.
+
+Both run `pmos up` on the repository you chose. They use the PATH that your terminal had when you typed `pmos launcher on`. That is how they find `claude`, `git` and `tmux`.
+
+What each start printed is in `launcher.log`, in the workspace state folder (`~/Library/Application Support/pmos` on macOS, `~/.local/state/pmos` on Linux).
+
+## Check it
+
+Type `pmos launcher status`. It shows the repository, the node program and the `pmos` program that the app uses, and whether the login item is installed. A path marked "not found" stops the app. If you move or upgrade node, type `pmos launcher on` again.
+
+## Remove it
+
+Type `pmos launcher off`. It removes the app and the login item. It removes only files that `pmos launcher on` wrote. A file with the same name that you wrote yourself stays.
+
+## Limits
+
+- The login item never starts remote (tailnet) mode, and it writes no token. To open the workspace from your phone, start remote mode yourself as `workspace/REMOTE.md` tells you.
+- Native Windows is not supported. The workspace needs WSL on Windows. Type `pmos launcher on` inside WSL.
+- The login item runs once, at login. If the server stops, open the app to start it again.