create-pmos 0.53.0 → 0.53.2

package/workspace/lib/remote-access.js

@@ -16,11 +16,19 @@
  *      Comparison is constant-time. The token is generated if not supplied and printed ONCE at
  *      startup — never logged thereafter, and request headers are never logged (D08).
  *
+ *   3. Public host (workspace-public-host) — PMOS_PUBLIC_HOST=<hostname> lets a TLS-terminating
+ *      tunnel on this machine (Cloudflare Tunnel + Cloudflare Access) forward that ONE hostname to the
+ *      loopback listener. It adds the hostname to the Host allowlist and mints a token; it never
+ *      changes what the server binds. A request that arrived through a proxy is never loopback-exempt
+ *      (see isProxied), and a request addressed to the public host must also carry Cloudflare
+ *      Access's assertion header, so a tunnel without an Access application in front fails closed.
+ *
  * Pure and side-effect-light so the guard logic is unit-testable without a live tailnet peer.
  */
 const crypto = require('crypto');
 const os = require('os');
 const { spawnSync } = require('child_process');
+const qr = require('./qr');
 
 const LOOPBACK = '127.0.0.1';
 
@@ -81,9 +89,28 @@ function remoteRequested(env) {
 // The one function that decides what the server may bind. Fail-closed: anything that is not
 // loopback or a tailnet address REFUSES (the server exits), so a public bind is unreachable by
 // construction. Returns {remote, binds, token, tailnetIp, generated} or {remote, refused:<msg>}.
+// A public hostname is a plain DNS name: no scheme, port, path or IP literal, and never localhost.
+// Anything else is a mistake to refuse, not a value to guess at.
+function parsePublicHost(raw) {
+  const h = String(raw == null ? '' : raw).trim().toLowerCase();
+  if (!h) return { host: null };
+  const valid = h.length <= 253 && /^(?=.*[a-z])[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(h);
+  if (!valid || h === 'localhost' || h.endsWith('.localhost') || parseIPv4(h)) {
+    return { refused: `refusing PMOS_PUBLIC_HOST="${h}": give a bare DNS hostname such as pm-os.app (no scheme, port, path or IP address).` };
+  }
+  return { host: h };
+}
+
 function resolveBinds({ env = process.env, detect = detectTailnetIp } = {}) {
+  const pub = parsePublicHost(env.PMOS_PUBLIC_HOST);
+  if (pub.refused) return { remote: false, refused: pub.refused };
+  const publicHost = pub.host;
   if (!remoteRequested(env)) {
-    return { remote: false, binds: [LOOPBACK], token: null, tailnetIp: null, generated: false };
+    if (!publicHost) return { remote: false, binds: [LOOPBACK], token: null, tailnetIp: null, generated: false, publicHost: null };
+    // Public-host mode alone: still loopback ONLY — the tunnel connects to it from this machine.
+    const supplied = (env.PMOS_TOKEN || '').trim();
+    const token = supplied || crypto.randomBytes(32).toString('base64url');
+    return { remote: false, binds: [LOOPBACK], token, tailnetIp: null, generated: !supplied, publicHost };
   }
   // An explicit bind address, when given, must itself be loopback or tailnet — never public.
   const requested = (env.PMOS_BIND_ADDR || '').trim();
@@ -102,7 +129,7 @@ function resolveBinds({ env = process.env, detect = detectTailnetIp } = {}) {
   }
   const supplied = (env.PMOS_TOKEN || '').trim();
   const token = supplied || crypto.randomBytes(32).toString('base64url');
-  return { remote: true, binds: [LOOPBACK, ip], token, tailnetIp: ip, generated: !supplied };
+  return { remote: true, binds: [LOOPBACK, ip], token, tailnetIp: ip, generated: !supplied, publicHost };
 }
 
 // ── Token extraction ──────────────────────────────────────────────────────────────────
@@ -183,20 +210,21 @@ function authorityOf(value) {
   if (scheme !== -1) h = h.slice(scheme + 3);
   return h.split('/')[0];   // host[:port]
 }
-function hostnameAllowed(authority, binds) {
+function hostnameAllowed(authority, binds, publicHost) {
   const h = hostnameOf(authority);
   if (!h) return false;
   if (h === 'localhost') return true;
   if (isLoopbackAddr(h)) return true;
   for (const b of (binds || [])) if (isTailnetIp(b) && unmap(h) === unmap(b)) return true;
+  if (publicHost && h === publicHost) return true;   // workspace-public-host: the one named hostname
   return false;
 }
 // The single decision, called from BOTH the HTTP guard and the WS-upgrade guard. Returns true when
 // the request is allowed to proceed (it may still be rejected by the token guard afterwards).
-function checkHostOrigin({ origin, host, binds }) {
+function checkHostOrigin({ origin, host, binds, publicHost }) {
   // 1. If a Host header is present, its hostname must be loopback/localhost/tailnet (anti-rebinding).
   if (host != null && host !== '') {
-    if (!hostnameAllowed(host, binds)) return false;
+    if (!hostnameAllowed(host, binds, publicHost)) return false;
   }
   // 2. If an Origin header is present, it must be same-origin with the Host it arrived on, and its
   //    hostname must itself be in the allowlist. "null"/opaque/garbage Origins are rejected.
@@ -205,11 +233,11 @@ function checkHostOrigin({ origin, host, binds }) {
     if (!oa) return false;
     const ha = authorityOf(host);
     if (ha && oa !== ha) return false;               // cross-origin → reject
-    if (!hostnameAllowed(oa, binds)) return false;   // Host absent but Origin foreign → reject
+    if (!hostnameAllowed(oa, binds, publicHost)) return false;   // Host absent but Origin foreign → reject
   }
   return true;
 }
-function isAllowedOrigin(origin, { host, binds } = {}) { return checkHostOrigin({ origin, host, binds }); }
+function isAllowedOrigin(origin, { host, binds, publicHost } = {}) { return checkHostOrigin({ origin, host, binds, publicHost }); }
 
 // Constant-time token comparison. Length is checked first (timingSafeEqual throws on a length
 // mismatch); a differing length is already a non-match, so this leaks nothing useful.
@@ -221,18 +249,77 @@ function tokenMatches(presented, expected) {
   try { return crypto.timingSafeEqual(a, b); } catch { return false; }
 }
 
+// ── Proxied requests (workspace-public-host) ────────────────────────────────────────────
+// A reverse proxy or tunnel on this machine (cloudflared, Caddy, nginx) connects from 127.0.0.1, so
+// the peer address alone would make every internet request look local and token-exempt. Each of
+// these headers is added by a proxy and never by a browser talking to the server directly, so a
+// request that carries one came from somewhere else and must present the token like any remote
+// peer. Only header NAMES are read here; no value is logged (D08).
+const PROXY_HEADERS = ['forwarded', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip',
+  'cf-connecting-ip', 'cf-ray', 'cf-access-jwt-assertion'];
+// Cloudflare Access adds this signed assertion to every request it lets through to the origin.
+const ACCESS_HEADER = 'cf-access-jwt-assertion';
+function hasHeader(headers, name) {
+  const v = (headers || {})[name];
+  return v != null && String(v) !== '';
+}
+function isProxied(headers = {}, publicHost = null) {
+  if (PROXY_HEADERS.some((n) => hasHeader(headers, n))) return true;
+  return !!publicHost && hostnameOf(headers.host) === publicHost;
+}
+// The edge check for the public host: a request addressed to it must have passed Cloudflare Access.
+// This is a PRESENCE check, not a signature check — verifying the JWT needs Cloudflare's signing keys
+// fetched over the network, which the no-network property forbids without a PM decision (D79). It
+// is still meaningful: the origin listens on loopback only, so the one way a request reaches it with
+// the public Host is through the tunnel, and a tunnel with no Access application in front sends no
+// assertion. That case fails closed (403) instead of leaving the token as the only lock.
+function edgeAllowed({ headers = {}, publicHost = null } = {}) {
+  if (!publicHost || hostnameOf(headers.host) !== publicHost) return true;
+  return hasHeader(headers, ACCESS_HEADER);
+}
+
 // The single authorization decision, PEER-based (what matters is where the request came FROM, not
-// which listener it hit). Loopback is always exempt; every non-loopback peer must present a valid
-// bearer token. Fail-closed: with no token configured, a non-loopback peer is rejected.
-function authorize({ remoteAddress, presentedToken, expectedToken }) {
-  if (isLoopbackAddr(remoteAddress)) return true;
+// which listener it hit). A loopback peer is exempt unless the request arrived through a proxy;
+// every other request must present a valid bearer token. Fail-closed: with no token configured, a
+// non-loopback or proxied request is rejected.
+function authorize({ remoteAddress, presentedToken, expectedToken, headers = {}, publicHost = null }) {
+  if (isLoopbackAddr(remoteAddress) && !isProxied(headers, publicHost)) return true;
   return tokenMatches(presentedToken, expectedToken);
 }
 
 // The startup banner lines. This is the ONE place a token may be printed, and ONLY a freshly
 // GENERATED token — a token supplied via PMOS_TOKEN is the PM's own secret and is never echoed.
 // Nothing here (or anywhere in this module) logs request headers (D08).
-function startupLines(bind, port) {
+//
+// workspace-phone-app: for a generated token the banner also prints the phone URL
+// (http://<tailnet>:<port>/?token=<t>) as a QR code, because typing 43 random characters on a phone
+// keyboard is the step that made the tailnet flow impractical. The QR is the same secret in another
+// form, so it follows the same rule: generated token only, startup only. `ansi` picks the
+// renderer (lib/qr.js toTerminal); the server passes stdout.isTTY && !NO_COLOR.
+function phoneUrl(bind, port) {
+  return `http://${bind.tailnetIp}:${port}/?token=${encodeURIComponent(bind.token)}`;
+}
+function publicLines(bind) {
+  const lines = [
+    `  public:  https://${bind.publicHost}/   (through Cloudflare Tunnel + Access only; the server still binds loopback)`,
+  ];
+  if (bind.generated && !bind.remote) {
+    lines.push(`  token (generated — shown ONCE, copy it now): ${bind.token}`);
+  } else if (!bind.generated) {
+    lines.push('  token: using PMOS_TOKEN from the environment (not shown)');
+  }
+  lines.push(`  sign in: open https://${bind.publicHost}/, pass Cloudflare Access, then paste the token.`);
+  lines.push('  proxied requests always need the token; requests to the public host also need Cloudflare Access.');
+  return lines;
+}
+function startupLines(bind, port, { ansi = false } = {}) {
+  if (bind && !bind.remote && bind.publicHost) {
+    return [
+      'pmos workspace server — PUBLIC-HOST mode',
+      `  local:   http://${LOOPBACK}:${port}`,
+      ...publicLines(bind),
+    ];
+  }
   if (!bind || !bind.remote) {
     return [`pmos workspace server — http://${LOOPBACK}:${port}  (loopback only, D62)`];
   }
@@ -244,16 +331,101 @@ function startupLines(bind, port) {
   if (bind.generated) {
     lines.push(`  token (generated — shown ONCE, copy it now): ${bind.token}`);
     lines.push('  attach with header  Authorization: Bearer <token>   or query  ?token=<token>');
+    lines.push('', '  phone: scan this with the camera of a phone on the same tailnet. It opens the workspace signed in.');
+    try {
+      for (const l of qr.toTerminal(qr.encode(phoneUrl(bind, port)), { ansi })) lines.push('  ' + l);
+    } catch { lines.push('  (the phone URL is too long for a QR code here; type it instead)'); }
+    lines.push(`  or open: ${phoneUrl(bind, port)}`, '');
   } else {
     lines.push('  token: using PMOS_TOKEN from the environment (not shown)');
+    lines.push(`  phone: open http://${bind.tailnetIp}:${port}/ and paste your PMOS_TOKEN into the sign-in field`);
   }
   lines.push('  loopback requests are token-free; every tailnet request must present the token.');
+  if (bind.publicHost) lines.push(...publicLines(bind));
   return lines;
 }
 
+// ── Sign-in for a phone (workspace-phone-app) ────────────────────────────────────────────
+// Three small pieces the HTTP guard uses so that a browser on a phone never meets a JSON 401 and
+// never keeps the token in its address bar. None of them changes WHO is let in: the decision is
+// still authorize() above, and the Origin/Host allowlist still runs first.
+
+// A top-level page load, as opposed to an API call, a script, or a WebSocket upgrade. Only these
+// get the HTML sign-in page or the token-stripping redirect; everything else keeps its JSON answer.
+function isPageNavigation({ method, accept } = {}) {
+  return (method === 'GET' || method === 'HEAD') && /\btext\/html\b/i.test(String(accept || ''));
+}
+
+// The URL with its `token` parameter removed, or null when it had none. A valid ?token= navigation
+// seeds the cookie and is then redirected here, so the secret leaves the address bar, the history,
+// and the start_url a phone records on Add to Home Screen.
+function stripTokenParam(url) {
+  let u;
+  try { u = new URL(url || '/', 'http://localhost'); } catch { return null; }
+  if (!u.searchParams.has('token')) return null;
+  u.searchParams.delete('token');
+  const q = u.searchParams.toString();
+  // A path that normalises to '//host/…' would be a scheme-relative Location, which a browser reads
+  // as another site. Collapse leading slashes so the redirect can only ever stay on this origin.
+  return u.pathname.replace(/^\/+/, '/') + (q ? '?' + q : '') + u.hash;
+}
+
+// The cookie a valid token seeds. HttpOnly (no script needs it) + SameSite=Strict + the Origin/Host
+// allowlist keep a foreign site from riding it. No Secure flag on the tailnet: it speaks plain HTTP
+// inside WireGuard. On the public host the browser is on HTTPS (TLS ends at the edge), so the cookie
+// is Secure there and is never sent over plain HTTP. 7 days, unchanged from workspace-mobile-remote-access.
+function sessionCookie(token, { secure = false } = {}) {
+  return `${COOKIE_NAME}=${encodeURIComponent(token)}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Strict; Path=/; Max-Age=604800`;
+}
+
+// The sign-in form posts application/x-www-form-urlencoded `token=<t>` to /auth.
+const AUTH_PATH = '/auth';
+function parseAuthForm(body) {
+  try { return (new URLSearchParams(String(body || '')).get('token') || '').trim() || null; } catch { return null; }
+}
+
+// The page an unauthorized phone sees. Self-contained (no script, no sub-resource, so it renders
+// without the cookie it is there to set) and phone-shaped. The password field lets the phone's
+// password manager remember the token. The colours are the dark theme's --background/--foreground.
+function signInPage({ failed = false } = {}) {
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<meta name="theme-color" content="#090b0c">
+<title>Sign in · PMOS workspace</title>
+<style>
+  :root { color-scheme: dark; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #090b0c; color: #f9fbfb;
+    font: 16px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; padding: 24px; box-sizing: border-box; }
+  main { width: 100%; max-width: 360px; }
+  h1 { font-size: 22px; margin: 0 0 8px; }
+  p { margin: 0 0 16px; color: #a3abae; }
+  label { display: block; font-size: 14px; margin-bottom: 6px; }
+  input, button { width: 100%; box-sizing: border-box; min-height: 48px; font: inherit; border-radius: 6px; }
+  input { padding: 0 12px; background: #15191b; color: inherit; border: 1px solid #3a4245; }
+  button { margin-top: 12px; border: 0; background: #f9fbfb; color: #090b0c; font-weight: 600; }
+  .err { color: #ff8a80; }
+  code { font-size: 13px; }
+</style></head>
+<body><main>
+  <h1>Sign in to the PMOS workspace</h1>
+  ${failed ? '<p class="err" role="alert">That token does not match. Check it and try again.</p>' : ''}
+  <p>Paste the token the workspace server printed when it started (<code>PMOS_REMOTE=tailnet npm start</code> or <code>PMOS_PUBLIC_HOST</code>), or scan its QR code again.</p>
+  <form method="post" action="${AUTH_PATH}">
+    <input type="text" name="username" value="pmos" autocomplete="username" hidden>
+    <label for="token">Token</label>
+    <input id="token" name="token" type="password" autocomplete="current-password" autocapitalize="off" spellcheck="false" required autofocus>
+    <button type="submit">Sign in</button>
+  </form>
+</main></body></html>
+`;
+}
+
 module.exports = {
   LOOPBACK, isLoopbackAddr, isTailnetIp, detectTailnetIp, remoteRequested,
   resolveBinds, extractHttpToken, extractWsToken, tokenMatches, authorize, startupLines,
   checkHostOrigin, isAllowedOrigin, hostnameAllowed,
+  parsePublicHost, PROXY_HEADERS, ACCESS_HEADER, isProxied, edgeAllowed,
   COOKIE_NAME, extractCookieToken, presentedToken,
+  phoneUrl, isPageNavigation, stripTokenParam, sessionCookie, AUTH_PATH, parseAuthForm, signInPage,
 };

package/workspace/lib/report-draft.js

@@ -62,6 +62,7 @@ const itemSpans = require('./item-spans.js');
 const actorLib = require('./actor.js');
 const reviewGate = require('./review-gate.js');
 const { readRules } = require('./plan-rules.js');
+const { slidesData } = require('./report-slides-data.js');
 
 const NOTE_OPEN = (id) => `<!-- pmos:note ${id} -->`;
 const NOTE_CLOSE = '<!-- /pmos:note -->';
@@ -85,6 +86,12 @@ function noteBlock(id, text) {
 /** The two notes that belong to the report, not to an initiative: the agent's headline and its asks to the audience. */
 const HEADLINE_NOTE = 'report.headline';
 const ASKS_NOTE = 'report.asks';
+/** The changelog slide's release notes (Run 6): the PM's own words; the agent never writes them (the PM's card, 2026-10-06). */
+const CHANGELOG_NOTE = 'report.changelog';
+/** The slide data block render() appends: one HTML comment on one line, so a markdown reader shows nothing of it and
+ * md-newlines --fix has no paragraph to join. */
+const SLIDES_OPEN = '<!-- pmos:slides v1';
+const SLIDES_CLOSE = '-->';
 /** The frame, in its frozen order (D78 as amended by D86 point 3). A definition's `sections` must name these. */
 const FRAME = Object.freeze(['headline', 'timeline', 'initiatives', 'new', 'decided', 'needs', 'sources']);
 const CADENCE_RE = /^[a-z][a-z0-9-]{0,39}$/;
@@ -143,7 +150,7 @@ function readJsonl(file) {
  */
 function readDefinition(root, cadence) {
   const rel = definitionPath(root, cadence);
-  const out = { path: rel, exists: false, cadence: null, audience: null, sections: FRAME.slice(), errors: [] };
+  const out = { path: rel, exists: false, cadence: null, audience: null, product: null, sections: FRAME.slice(), errors: [] };
   let text;
   try { text = fs.readFileSync(path.join(path.resolve(String(root)), rel), 'utf8'); } catch { return out; }
   out.exists = true;
@@ -164,6 +171,7 @@ function readDefinition(root, cadence) {
   out.cadence = isStr(map.cadence) ? map.cadence : null;
   if (out.cadence !== cadence) out.errors.push(`its cadence is ${JSON.stringify(out.cadence)}, not ${cadence}`);
   out.audience = isStr(map.audience) && map.audience.trim() ? map.audience.trim() : null;
+  out.product = isStr(map.product) && map.product.trim() ? map.product.trim() : null;
   if (!out.audience) out.errors.push('it names no audience, so Needs your call stays empty (X23)');
   if (Array.isArray(map.sections)) {
     const got = map.sections.map((s) => String(s).trim());
@@ -248,10 +256,9 @@ function draftOf(root, { cadence, slot, now, health } = {}) {
   const issuedHere = iss.issues.find((r) => r.cadence === cadence && r.slot === theSlot) || null;
 
   // The work-lane records (D86 point 4: the lanes scripts/lane-defs.js groups as work; never a hard-coded list).
-  const defs = E.lanesFor(abs).defs || {};
   const range = E.historyRange(abs);
   const workRows = E.listInitiatives(abs).map((id) => { try { return E.computeWorkflow(id, { root: abs, range }); } catch { return null; } })
-    .filter((r) => r && r.ok && has(defs, r.lane) && defs[r.lane].group === 'work');
+    .filter((r) => r && r.ok && planTree.profileAndLane(abs, r.id).group === 'work');
   // A block's note marker carries its id, and readNotes reads back only NOTE_ID_RE ids: a record named outside that
   // class would lose its note on the next Redraft, so it gets no block and Sources names it instead.
   const rows = workRows.filter((r) => NOTE_ID_RE.test(r.id));
@@ -442,11 +449,30 @@ function draftOf(root, { cadence, slot, now, health } = {}) {
     : [`${plural(moved, 'initiative', 'initiatives')} moved`, off ? `${off} ${off === 1 ? 'is' : 'are'} off track` : null,
       risk ? `${risk} ${risk === 1 ? 'is' : 'are'} at risk` : null].filter(Boolean).join('; ') + '.';
 
+  // The slides (Run 6, R22.7): the roadmap snapshot, the initiative list, a slide per block and the changelog, folded
+  // here with the rest of the draft so an issued report freezes them too.
+  const stageCache = new Map();
+  const stageLabel = (id, sid) => {
+    if (!stageCache.has(id)) stageCache.set(id, new Map(planTree.stagesFor(abs, id).map((x) => [x.id, x.label])));
+    const lab = stageCache.get(id).get(sid);
+    return lab || cap(String(sid || ''));
+  };
+  const integratedAll = new Set();
+  for (const r of rows) for (const w of ((factoryJoin.factoryOf(fj, r.id) || {}).items || [])) if (w && w.integrated && w.plan_item) integratedAll.add(w.plan_item);
+  const slides = slidesData({
+    product: def.product || path.basename(main), cadence, slot: theSlot, nowMs, window, cycleDays: cycle,
+    blocks, rows, itemsOf,
+    stageLabel, horizonOf: (id) => placements.horizonOf(plc, id),
+    rankOf: (id) => (has(plc.byInit, id) && Number.isFinite(plc.byInit[id].rank) ? plc.byInit[id].rank : Infinity),
+    isDone: (it) => it.state === 'done' || integratedAll.has(it.id),
+  });
+
   return {
     ok: true, cadence, slot: theSlot, window, path: rel,
     issued: issuedHere ? { at: issuedHere.at, by: actorLib.pageName(issuedHere.by), sha: issuedHere.sha, path: issuedHere.path } : null,
     headline, timeline, blocks, new_since_last: newSince, decided, needs_your_call: asks,
     sources: { reached, not_reached: notReached, definition: { path: def.exists ? def.path : null, audience: def.audience } },
+    slides,
   };
 }
 
@@ -500,7 +526,7 @@ function render(draft, { notes } = {}) {
   push('## New since last report', '');
   if (!draft.new_since_last.length) push('None.');
   for (const x of draft.new_since_last) push(`- ${x.title} (${x.id}), ${short(x.at)}`);
-  push('');
+  push('', '**Changelog** (your release notes for the changelog slide)', '', noteBlock(CHANGELOG_NOTE, noteOf(CHANGELOG_NOTE)), '');
 
   push('## Decided this cycle', '');
   if (!draft.decided.length) push('None.');
@@ -521,12 +547,14 @@ function render(draft, { notes } = {}) {
   push('');
 
   // Every note is kept, byte for byte: a note whose initiative left the window moves here instead of being lost.
-  const placed = new Set([HEADLINE_NOTE, ...(audience ? [ASKS_NOTE] : []), ...draft.blocks.map((b) => b.id)]);
+  const placed = new Set([HEADLINE_NOTE, CHANGELOG_NOTE, ...(audience ? [ASKS_NOTE] : []), ...draft.blocks.map((b) => b.id)]);
   const orphans = Object.keys(n).filter((k) => !placed.has(k)).sort(byText);
   if (orphans.length) {
     push('## Notes kept from an earlier draft', '', 'These initiatives are not in this window. Their notes are kept as they were written.', '');
     for (const k of orphans) push(noteBlock(k, n[k]), '');
   }
+  // The slides' data, frozen with the text. JSON escapes "<" and ">" so the block cannot close early or open a marker.
+  if (draft.slides) push(SLIDES_OPEN + ' ' + JSON.stringify(draft.slides).replace(/</g, '\\u003c').replace(/>/g, '\\u003e') + ' ' + SLIDES_CLOSE, '');
   return out.join('\n');
 }
 
@@ -575,5 +603,5 @@ function writeDraft(root, draft, { actor, notes, fresh } = {}) {
 
 module.exports = {
   draftOf, render, writeDraft, readNotes, noteBlock, NOTE_OPEN, NOTE_CLOSE, NOTE_RE, NOTE_ID_RE,
-  readDefinition, stateRel, draftPath, definitionPath, FRAME, HEADLINE_NOTE, ASKS_NOTE,
+  readDefinition, stateRel, draftPath, definitionPath, FRAME, HEADLINE_NOTE, ASKS_NOTE, CHANGELOG_NOTE, SLIDES_OPEN,
 };

package/workspace/lib/report-slides-data.js

@@ -0,0 +1,141 @@
+'use strict';
+/* report-slides-data.js — the data of the biweekly slides, folded with the draft (pm-os-absorb Run 6; PRD R22.7).
+ *
+ *   slidesData(input) → { v: 1, meta, roadmap, list, initiatives }
+ *
+ * The PM asked for the PM-OS biweekly deck, cut to four slides: the roadmap snapshot, the initiative list, one slide per
+ * initiative and the changelog (2026-10-06); the changelog is the PM's own `report.changelog` note, not data folded
+ * here (the PM's card answer, 2026-10-06). report-draft.js calls this inside draftOf and render() writes the result
+ * into the draft as one `<!-- pmos:slides v1 … -->` block, so an issued report freezes its slides with its text. The
+ * page (public/pm/report-slides.js) only draws what is here: it computes nothing.
+ *
+ * Pure: no file, no clock and no git. Everything comes in through `input`, so two calls with the same input give the
+ * same bytes (the drafter's determinism rule, X18). Proposed and withdrawn items never count, as in the blocks.
+ */
+
+const DAY = 86400000;
+/** YYYY-MM-DD of a time, or null when the time is not a time: one bad row is skipped, never fatal to the draft. */
+const dayOf = (t) => { const d = new Date(t); return Number.isFinite(d.getTime()) ? d.toISOString().slice(0, 10) : null; };
+const byText = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const MONTHS_SHOWN = 6;
+const HORIZON_WORD = { now: 'Now', next: 'Next', later: 'Later' };
+const RELEASE_RE = /\brelease\b/i;
+const ESTIMATED_STATES = new Set(['todo']);
+
+/** "person:Sheryl" -> "Sheryl"; you -> "You"; agent -> "Agent"; none -> null. */
+function ownerName(owner) {
+  const s = String(owner || '');
+  if (!s) return null;
+  if (s === 'you') return 'You';
+  if (s === 'agent') return 'Agent';
+  const m = /^(?:person|tracker):(.+)$/.exec(s);
+  return m ? m[1] : s;
+}
+
+/** The first day of the month `n` months after the month of `ymd`, as YYYY-MM. */
+function monthPlus(ymd, n) {
+  const y = Number(ymd.slice(0, 4)); const m = Number(ymd.slice(5, 7)) - 1 + n;
+  const yy = y + Math.floor(m / 12); const mm = ((m % 12) + 12) % 12;
+  return `${yy}-${String(mm + 1).padStart(2, '0')}`;
+}
+
+/** Does [start, due] (either may be missing) touch [from, to]? All YYYY-MM-DD. */
+function overlaps(start, due, from, to) {
+  const s = start || due; const e = due || start;
+  return !!s && s <= to && e >= from;
+}
+
+/**
+ * input = {
+ *   product, cadence, slot, nowMs, window: { from, to },  cycleDays,
+ *   blocks,                                   // the draft's blocks, in the report's order
+ *   rows,                                     // the work-lane records: { id, title, stopped? }
+ *   itemsOf(id) → fold items,  stageLabel(id, stageId) → label,  horizonOf(id) → now|next|later|null,  rankOf(id) → number,
+ *   isDone(item) → bool
+ * }
+ */
+function slidesData(input) {
+  const { product, cadence, slot, nowMs, window, cycleDays, blocks, rows, itemsOf, stageLabel, horizonOf, rankOf, isDone } = input;
+  const today = dayOf(nowMs);
+  const lastFrom = dayOf(Date.parse(window.from));
+  const lastTo = dayOf(Date.parse(window.to));
+  const nextTo = dayOf(nowMs + cycleDays * DAY);
+  const live = (id) => itemsOf(id).filter((it) => it && !it.proposed && it.state !== 'withdrawn');
+  const itemOut = (id, it) => ({
+    title: it.title, stage: stageLabel(id, it.stage), owner: ownerName(it.owner), milestone: !!it.milestone, done: isDone(it),
+    date: it.milestone ? (it.due || it.start || null) : null,
+  });
+  const milestonesOf = (its) => its.filter((it) => it.milestone && (it.due || it.start));
+  const nextMilestone = (id, its) => {
+    const open = milestonesOf(its).filter((it) => !isDone(it))
+      .sort((a, b) => byText(a.due || a.start, b.due || b.start) || byText(a.id, b.id));
+    if (!open.length) return null;
+    const d = open[0].due || open[0].start;
+    return { title: open[0].title, due: d, overdue: d < today };
+  };
+  const releaseOf = (its) => {
+    const r = milestonesOf(its).filter((it) => RELEASE_RE.test(it.title)).sort((a, b) => byText(b.due || b.start, a.due || a.start));
+    return r.length ? r[0].due || r[0].start : null;
+  };
+
+  /* the roadmap snapshot: every live work initiative with dated items, grouped Now / Next / Later in Roadmap order */
+  const fromMonth = monthPlus(today, -1);
+  const months = Array.from({ length: MONTHS_SHOWN }, (_, k) => monthPlus(fromMonth + '-01', k));
+  const groups = [];
+  for (const h of ['now', 'next', 'later']) {
+    const inH = rows.filter((r) => !r.stopped && horizonOf(r.id) === h)
+      .sort((a, b) => (rankOf(a.id) - rankOf(b.id)) || byText(a.id, b.id));
+    const out = [];
+    for (const r of inH) {
+      const its = live(r.id).filter((it) => it.start || it.due);
+      if (!its.length) continue;
+      const byStage = new Map();
+      for (const it of its) {
+        const s = it.start || it.due; const e = it.due || it.start;
+        const g = byStage.get(it.stage);
+        if (!g) byStage.set(it.stage, { stage: it.stage, label: stageLabel(r.id, it.stage), start: s, due: e });
+        else { if (s < g.start) g.start = s; if (e > g.due) g.due = e; }
+      }
+      const segments = [...byStage.values()].sort((a, b) => byText(a.start, b.start) || byText(a.due, b.due) || byText(String(a.stage), String(b.stage)));
+      out.push({
+        id: r.id, title: r.title || r.id,
+        estimated: its.every((it) => ESTIMATED_STATES.has(it.state)),
+        segments,
+        milestones: milestonesOf(its).map((it) => ({ title: it.title, due: it.due || it.start, done: isDone(it) }))
+          .sort((a, b) => byText(a.due, b.due) || byText(a.title, b.title)),
+      });
+    }
+    if (out.length) groups.push({ name: HORIZON_WORD[h], rows: out });
+  }
+
+  /* one slide per active initiative, and the list of them: the blocks of the draft, nothing more */
+  const initiatives = blocks.map((b) => {
+    const its = live(b.id);
+    const doneDay = (it) => (it.doneAt ? dayOf(Date.parse(it.doneAt)) : null);
+    const lastItems = its.filter((it) => (isDone(it) && doneDay(it) && doneDay(it) >= lastFrom && doneDay(it) <= lastTo)
+      || (!isDone(it) && overlaps(it.start, it.due, lastFrom, lastTo)));
+    const nextIds = new Set((b.coming_cycle.items || []).map((x) => x.id));
+    for (const c of b.last_cycle.carried || []) nextIds.add(c.id);
+    const nextItems = its.filter((it) => nextIds.has(it.id) || (!isDone(it) && overlaps(it.start, it.due, lastTo, nextTo)));
+    const total = b.progress.total;
+    return {
+      id: b.id, title: b.title, status: b.stage,
+      pct: total ? Math.round((100 * b.progress.done) / total) : null, done: b.progress.done, total,
+      next_milestone: nextMilestone(b.id, its), release: releaseOf(its),
+      last: lastItems.map((it) => itemOut(b.id, it)),
+      next: nextItems.map((it) => itemOut(b.id, it)),
+    };
+  });
+  const list = initiatives.map((x) => ({ id: x.id, title: x.title, status: x.status, pct: x.pct, next_milestone: x.next_milestone, release: x.release }))
+    .sort((a, b) => ((a.release ? 0 : 1) - (b.release ? 0 : 1)) || byText(a.release || '', b.release || ''));
+
+  return {
+    v: 1,
+    meta: { product: product || '', cadence: cadence[0].toUpperCase() + cadence.slice(1), slot, today, last: { from: lastFrom, to: lastTo }, next: { from: lastTo, to: nextTo } },
+    roadmap: { months, today, groups },
+    list,
+    initiatives,
+  };
+}
+
+module.exports = { slidesData, ownerName, monthPlus, overlaps };

package/workspace/lib/routes-initiatives.js

@@ -178,6 +178,39 @@ function roadmapOf(w, F) {
   };
 }
 
+/**
+ * The units the library groups as an initiative (a PRD, a rubric, a prototype folder) with no record behind them. The
+ * panel lists them under "no record"; without this the Roadmap and the List hid them, so a PRD-only initiative was
+ * invisible on Initiatives. They are listed, never placed: a record is what anchors and places an initiative (D59).
+ */
+function unrecordedOf(ctx, root, rows) {
+  if (!ctx.initiativeIndex) return [];
+  const known = new Set((rows || []).map((r) => r && r.id).filter(Boolean));
+  const claimed = claimedPaths(root, rows);
+  let groups = [];
+  try { groups = ctx.initiativeIndex(root).initiatives || []; } catch { return []; }
+  // A unit is unrecorded when no record has its id AND no record points at its documents (a record's `prd_path` may name
+  // a file whose stem is not the record's id).
+  const own = (g) => (g.artifacts || []).filter((a) => !a.shared);
+  return groups.filter((g) => g && g.id && !known.has(g.id) && own(g).length && !own(g).every((a) => claimed.has(String(a.path || '').split(path.sep).join('/'))))
+    .map((g) => ({ id: g.id, title: g.title || g.id, artifacts: g.artifacts.filter((a) => !a.shared).map((a) => ({ name: a.name, path: a.path, role: a.role || null })) }))
+    .sort((a, b) => a.title.localeCompare(b.title));
+}
+
+/** Every repository-relative `.md` path a record's frontmatter names (prd_path, rubric_path, brief_path, …). */
+function claimedPaths(root, rows) {
+  const out = new Set();
+  for (const r of rows || []) {
+    if (!r || !r.record) continue;
+    let text = '';
+    try { text = fs.readFileSync(path.isAbsolute(r.record) ? r.record : path.join(root, r.record), 'utf8'); } catch { continue; }
+    const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+    if (!fm) continue;
+    for (const m of fm[1].matchAll(/^[A-Za-z_]+:\s*["']?([^"'\n]+?\.md)["']?\s*$/gm)) out.add(m[1].trim().replace(/^\.\//, ''));
+  }
+  return out;
+}
+
 function listOf(w, F) {
   const all = Object.values(F.placed.order).flat().filter((id) => F.byId.has(id)).map((id) => rowOf(F, F.byId.get(id)));
   const groups = new Map();      // objective key -> { objective, anchors: Map(anchorKey -> group) }
@@ -327,7 +360,7 @@ async function handle(req, res, url, ctx) {
         return true;
       }
       const body = view === 'list' ? listOf(w, F) : roadmapOf(w, F);
-      ctx.json(res, { ...head, view, sig, now: new Date(now).toISOString(), rules: F.rules, ...body });
+      ctx.json(res, { ...head, view, sig, now: new Date(now).toISOString(), rules: F.rules, ...body, unrecorded: unrecordedOf(ctx, w.root, rows) });
     } catch (e) {
       ctx.json(res, { ok: false, error: 'the initiatives could not be read: ' + String((e && e.message) || e).slice(0, 160) }, 500);
     }
@@ -368,4 +401,4 @@ async function handle(req, res, url, ctx) {
   return true;
 }
 
-module.exports = { prefixes: ['/api/initiatives', '/api/placements', '/api/measurements'], handle, sigOf, rowOf, frameOf, roadmapOf, listOf, sheetOf };
+module.exports = { prefixes: ['/api/initiatives', '/api/placements', '/api/measurements'], handle, sigOf, rowOf, frameOf, roadmapOf, listOf, sheetOf, unrecordedOf };

package/workspace/lib/routes-reports.js

@@ -5,7 +5,7 @@
  *                                                with the `sig` the page watches (public/pm/sig-watch.js, 10 s)
  *   GET  /api/report/draft?ws=&cadence=&slot=    one report file as it is now: its markdown, its note texts, its blob sha
  *   POST /api/report/draft   { ws, cadence, slot?, redraft? }   Draft now, and Redraft (the notes are kept)
- *   POST /api/report/note    { ws, cadence, slot, id, text }    one note, by initiative id (or report.headline, report.asks)
+ *   POST /api/report/note    { ws, cadence, slot, id, text }    one note, by initiative id (or report.headline, report.asks, report.changelog)
  *   POST /api/report/issue   { ws, cadence, slot, sha }          Issue: the PM's act (R25)
  *
  * WHICH GUARD. A draft and a note are page writes, not PM-only acts: both call pm-guard.js requirePagePress. Issue is a
@@ -135,10 +135,10 @@ async function handle(req, res, url, ctx) {
   if (p === '/api/report/note') {
     if (!cs.slot) return refuse(ctx, res, 400, 'slot must be a date, YYYY-MM-DD');
     const id = String(body.id || '');
-    if (!NOTE_ID_RE.test(id)) return refuse(ctx, res, 400, 'id must be an initiative id, report.headline or report.asks');
+    if (!NOTE_ID_RE.test(id)) return refuse(ctx, res, 400, 'id must be an initiative id, report.headline, report.asks or report.changelog');
     if (typeof body.text !== 'string') return refuse(ctx, res, 400, 'text must be a string');
     if (body.text.length > MAX_NOTE) return refuse(ctx, res, 413, `a note is at most ${MAX_NOTE} characters`);
-    if (/<!--\s*\/?pmos:note/.test(body.text)) return refuse(ctx, res, 400, 'a note cannot hold a note marker');
+    if (/<!--\s*\/?pmos:(?:note|slides)/.test(body.text)) return refuse(ctx, res, 400, 'a note cannot hold a note marker or a slides block');
     const old = findReport(RN.reportsOf(root), cs.cadence, cs.slot);
     const file = old ? readFile(root, old.path) : null;
     if (!file) return refuse(ctx, res, 404, `there is no ${cs.cadence} draft for ${cs.slot}; press Draft now first`);

package/workspace/lib/routes-timeline.js

@@ -105,7 +105,7 @@ function workInitiatives(root, engine) {
     try { fm = engine.parseLeadingFrontmatter(fs.readFileSync(file, 'utf8')) || {}; } catch { fm = {}; }
     const declared = String(fm.lane || '').trim();
     const lane = declared && defs[declared] ? declared : fallback;
-    if (!defs[lane] || defs[lane].group !== 'work') continue;
+    if (planTree.viewGroup(defs, declared) !== 'work') continue;
     const lc = stopped.get(id);
     if (lc && lc.state !== 'active') continue;
     out.push({ id, title: String(fm.title || id), lane });