create-pmos 0.53.0 → 0.53.2

package/workspace/public/pm/today-goals.js

@@ -0,0 +1,172 @@
+/* pm/today-goals.js — the goals for today at the top of Today (initiative today-goals, PRD G5 and G6).
+ *
+ *   goalsSection({ ws, setState })  → the section node, or null in fixture mode
+ *   goalsSig(ws)                    → a string that changes whenever what the section shows changes
+ *
+ * The server joins the goals to what the morning-brief session read and to Today's cards (lib/goals.js planDay, GET /api/proactive/goals).
+ * This module draws that answer and sends the PM's presses: add, done, drop, reopen, remove, "Prepare my day" (runs the
+ * morning-brief schedule) and, on an agent step that names an initiative, Prepare then Queue it (the shipped background
+ * prepare: one approval is one prompt hash).
+ *
+ * FIRST PAINT. Folded, the section is one control (its toggle) and a list of the goals as text, so Today keeps inside its
+ * control budget (first-paint-today.test.js). The input and the buttons are drawn only when the PM opens it.
+ */
+
+import { el } from './dom.js';
+import { button, field, badge, toast } from './primitives.js';
+import { pmGet, pmPost } from './http.js';
+import { FIXTURE } from './state.js';
+import { COPY } from './today-copy.js';
+
+const G = COPY.goals;
+const POLL_MS = 30000;
+const cache = new Map();        // ws -> { data, error, at }
+let open = false;
+let draft = '';
+const prepared = new Map();     // step ref -> { key, branch, item_id, prompt_sha, initiative_id, ws } (a plan shown, not yet queued)
+let rerender = () => {};
+let timer = null;
+
+async function load(ws) {
+  const out = await pmGet('/api/proactive/goals' + (ws ? '?ws=' + encodeURIComponent(ws) : ''));
+  const prev = cache.get(ws);
+  const next = out && out.ok ? { data: out, error: null, at: Date.now() } : { data: prev ? prev.data : null, error: (out && out.error) || G.unreached, at: Date.now() };
+  cache.set(ws, next);
+  if (!prev || JSON.stringify(prev.data) !== JSON.stringify(next.data) || prev.error !== next.error) rerender();
+}
+
+function ensure(ws) {
+  if (!cache.has(ws)) { cache.set(ws, { data: null, error: null, at: 0 }); load(ws); }
+  if (!timer && typeof window !== 'undefined') {
+    timer = setInterval(() => { for (const w of cache.keys()) load(w); }, POLL_MS);
+  }
+}
+
+async function press(ws, body) {
+  const r = await pmPost('/api/proactive/goals', body);
+  if (!r || r.ok === false) { toast({ text: G.refused((r && r.error) || G.unreached), tone: 'destructive' }); return false; }
+  await load(ws);
+  return true;
+}
+
+async function prepareDay(ws) {
+  const r = await pmPost('/api/proactive/goals/plan', { ws });
+  toast({ text: r && r.ok ? G.started : G.refused((r && r.error) || G.unreached), tone: r && r.ok ? undefined : 'destructive' });
+  load(ws);
+}
+
+async function prepareStep(ws, st) {
+  const r = await pmPost('/api/proactive/prepare/plan', { ws, initiative_id: st.initiative_id });
+  if (!r || r.ok === false) { toast({ text: G.refused((r && r.error) || G.unreached), tone: 'destructive' }); return; }
+  if (r.refused) { toast({ text: G.refused(r.refused.why) }); return; }
+  prepared.set(st.ref, { key: r.item.key, branch: r.plan && r.plan.branch, item_id: r.item.id, prompt_sha: r.prompt_sha, initiative_id: st.initiative_id, ws: r.ws || ws });
+  rerender();
+}
+
+async function queueStep(ref) {
+  const p = prepared.get(ref);
+  if (!p) return;
+  const r = await pmPost('/api/proactive/prepare/queue', { confirm: true, ws: p.ws, initiative_id: p.initiative_id, item_id: p.item_id, prompt_sha: p.prompt_sha });
+  prepared.delete(ref);
+  toast({ text: r && r.ok ? G.queued(p.key) : G.refused((r && r.error) || G.unreached), tone: r && r.ok ? undefined : 'destructive' });
+  rerender();
+}
+
+const hhmm = (iso) => { const d = new Date(iso); return Number.isNaN(d.getTime()) ? String(iso) : `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`; };
+
+function stepNode(ws, st, opened) {
+  const who = st.owner === 'pm' ? G.you : G.agent;
+  const meta = [st.source, st.mention ? G.mention : null, st.effort].filter(Boolean).join(' · ');
+  const p = prepared.get(st.ref);
+  const acts = !opened || !st.prepare ? null
+    : p ? el('span', { class: 'td-goal__prep' }, el('span', { class: 'td-goal__prep-text' }, G.prepareShows(p.key, p.branch)),
+      button({ label: G.queue, size: 'sm', attrs: { 'data-goal-queue': st.ref }, onClick: () => queueStep(st.ref) }))
+      : button({ label: G.prepare, size: 'sm', variant: 'ghost', attrs: { 'data-goal-prepare': st.ref }, onClick: () => prepareStep(ws, st) });
+  return el('li', { class: 'td-goal__step', 'data-goal-step': st.ref },
+    badge({ text: who, tone: st.owner === 'pm' ? 'outline' : 'muted' }),
+    el('span', { class: 'td-goal__step-title' }, st.title),
+    meta ? el('span', { class: 'td-goal__meta' }, meta) : null,
+    acts);
+}
+
+function goalNode(ws, g, opened) {
+  const closed = g.status !== 'open';
+  const ctrls = opened ? el('span', { class: 'td-goal__ctrls' },
+    ...(closed
+      ? [button({ label: G.reopen, size: 'sm', variant: 'ghost', attrs: { 'data-goal-act': 'reopen' }, onClick: () => press(ws, { action: 'reopen', id: g.id }) })]
+      : [button({ label: G.done, size: 'sm', attrs: { 'data-goal-act': 'done' }, onClick: () => press(ws, { action: 'done', id: g.id }) }),
+        button({ label: G.drop, size: 'sm', variant: 'ghost', attrs: { 'data-goal-act': 'drop' }, onClick: () => press(ws, { action: 'drop', id: g.id }) })]),
+    button({ label: G.remove, size: 'sm', variant: 'ghost', attrs: { 'data-goal-act': 'remove' }, onClick: () => press(ws, { action: 'remove', id: g.id }) })) : null;
+  const ctx = (g.context || []).map((e) => el('li', { class: 'td-goal__ctx' }, `${hhmm(e.start)} ${e.title}${e.with ? ' · ' + e.with : ''}`));
+  const body = opened && !closed ? el('div', { class: 'td-goal__body' },
+    ctx.length ? el('ul', { class: 'td-goal__ctx-list' }, ...ctx) : null,
+    g.steps.length ? el('ul', { class: 'td-goal__steps' }, ...g.steps.map((st) => stepNode(ws, st, opened))) : el('p', { class: 'td-goal__none' }, G.noStep)) : null;
+  return el('li', { class: 'td-goal' + (closed ? ' td-goal--closed' : ''), 'data-goal': g.id, 'data-goal-coverage': g.coverage },
+    el('div', { class: 'td-goal__head' },
+      el('span', { class: 'td-goal__text' }, g.text),
+      badge({ text: G.coverage[g.coverage] || g.coverage, tone: g.coverage === 'needs-plan' ? 'warning' : 'muted' }),
+      g.initiative_id ? el('span', { class: 'td-goal__meta' }, g.initiative_id) : null,
+      ctrls),
+    body);
+}
+
+function stepList(ws, title, steps, attr) {
+  if (!steps.length) return null;
+  return el('div', { class: 'td-goals__also', 'data-goals': attr },
+    el('p', { class: 'td-goals__sub' }, title),
+    el('ul', { class: 'td-goal__steps' }, ...steps.map((st) => stepNode(ws, st, true))));
+}
+
+/** The section. `ws` is the repository whose Today cards the goals are joined to. */
+export function goalsSection({ ws, setState } = {}) {
+  if (FIXTURE) return null;
+  // like Today's own feeds, a read that lands re-renders only while the section is on the page: a hidden Today must not
+  // cause a whole-page render under whatever the PM is doing elsewhere
+  if (setState) rerender = () => { if (document.querySelector('[data-today="goals"]')) setState({}); };
+  ensure(ws);
+  const c = cache.get(ws) || {};
+  const d = c.data;
+  const plan = d && d.plan;
+  const goals = plan ? plan.goals : [];
+  const openN = goals.filter((g) => g.status === 'open').length;
+  const toggle = button({ label: G.toggle(openN, goals.length), variant: 'ghost', iconEnd: open ? 'chevron-down' : 'chevron-right',
+    attrs: { 'data-goals': 'toggle', 'aria-expanded': open ? 'true' : 'false' }, onClick: () => { open = !open; rerender(); } });
+  const list = goals.length ? el('ol', { class: 'td-goals__list', 'data-goals': 'list' }, ...goals.map((g) => goalNode(ws, g, open))) : null;
+  const kids = [el('div', { class: 'td-goals__head' }, toggle), list];
+  if (c.error) kids.push(el('p', { class: 'td-goals__note', role: 'status' }, G.refused(c.error)));
+  if (open) {
+    if (!goals.length) kids.push(el('p', { class: 'td-goals__note' }, G.intro));
+    const max = (d && d.max_goals) || 7;
+    if (goals.length < max) {
+      const f = field({ label: G.inputLabel, value: draft, placeholder: G.inputHint, hideLabel: true, attrs: { 'data-goals': 'input', maxlength: '140' },
+        onCommit: async (v) => {
+          draft = v;
+          if (!String(v).trim()) return;
+          if (await press(ws, { action: 'add', text: v })) { draft = ''; if (f.control.resetCommitted) f.control.resetCommitted(''); rerender(); }
+        } });
+      f.control.addEventListener('input', () => { draft = f.control.value; });   // a rebuild keeps what is typed
+      kids.push(f);
+    } else kids.push(el('p', { class: 'td-goals__note' }, G.full(max)));
+    kids.push(el('div', { class: 'td-goals__bar' },
+      button({ label: G.prepareDay, attrs: { 'data-goals': 'prepare-day', title: G.prepareDayHint }, disabled: !openN, onClick: () => prepareDay(ws) })));
+    if (plan) {
+      const lines = [];
+      if (!plan.brief) lines.push(G.noBrief);
+      else if (!plan.brief.fresh) lines.push(G.stale(plan.brief.date));
+      if (plan.time) {
+        lines.push(G.free(plan.time.free_minutes, plan.time.until));
+        if (plan.time.next) lines.push(G.comingUp(plan.time.next.title, hhmm(plan.time.next.start)));
+      }
+      if (plan.not_read && plan.not_read.length) lines.push(G.notRead(plan.not_read.map((x) => x.source).join(', ')));
+      if (lines.length) kids.push(el('p', { class: 'td-goals__note', 'data-goals': 'context' }, lines.join(' ')));
+      kids.push(stepList(ws, G.also, plan.also || [], 'also'));
+      kids.push(stepList(ws, G.worthAsking, plan.worth_asking || [], 'worth-asking'));
+    }
+  }
+  return el('section', { class: 'td-goals', 'data-today': 'goals', 'aria-label': G.title }, ...kids.filter(Boolean));
+}
+
+export function goalsSig(ws) {
+  const c = cache.get(ws) || {};
+  return JSON.stringify([open, c.data && c.data.plan, c.error, [...prepared.keys()]]);
+}

package/workspace/public/pm/tokens.css

@@ -66,6 +66,19 @@
   --term-bg:oklch(0.148 0.004 228.8);
   --mono:"IBM Plex Mono",ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
   --sans:"Space Grotesk",ui-sans-serif,system-ui,sans-serif;
+  /* the biweekly slides (Run 6): the PM-OS slide palette, the same in both themes because a slide is a printed page */
+  --slide-bg:oklch(1 0 0);--slide-fg:oklch(0.148 0.004 228.8);--slide-muted:oklch(0.56 0.021 213.5);
+  --slide-foot:oklch(0.556 0 0);--slide-rule:#d8d6cb;--slide-border:oklch(0.925 0.005 214.3);
+  --slide-secondary:oklch(0.967 0.001 286.375);--slide-track:oklch(0.963 0.002 197.1);
+  --slide-brand:#2433a4;--slide-primary:oklch(0.488 0.243 264.376);--slide-overdue:oklch(0.577 0.245 27.325);
+  --slide-stage:oklch(0 0 0);--slide-open:#94a3b8;--slide-done:#10b981;
+  --slide-ph-intake:#8b5cf6;--slide-ph-spec:#f59e0b;--slide-ph-build:#3b82f6;--slide-ph-evaluate:#06b6d4;
+  --slide-ph-handoff:#10b981;--slide-ph-other:#64748b;
+  --slide-now:#1a56db;--slide-next:#d97706;--slide-later:#64748b;
+  --slide-launch:#047857;--slide-launch-bg:#10b9811a;--slide-improvement:#2f6feb;--slide-improvement-bg:#2f6feb1a;
+  --slide-fix:#92400e;--slide-fix-bg:#f59e0b1f;--slide-security:#b91c1c;--slide-security-bg:#dc26261a;
+  --slide-deprecation:#4b5563;--slide-deprecation-bg:#4b55631a;--slide-beta:#6d28d9;--slide-beta-bg:#6d28d91a;
+  --slide-note-info:#2563eb;--slide-note-warning:#b45309;
 }
 [data-pm-theme="light"],html[data-pm-page-theme="light"]{
   --background:oklch(1 0 0);--foreground:oklch(0.148 0.004 228.8);

package/workspace/public/pm/topbar.js

@@ -25,9 +25,12 @@ import { COPY } from './frame-copy.js';
 /** The destinations the bar names, in order. Settings sits at the end of the bar, after Sync. */
 export const BAR_DESTS = Object.freeze(['today', 'initiatives', 'board', 'reports']);
 
-/** Is this sync reading "not in sync"? Behind, ahead or records not yet recorded. An unreadable status is not shown. */
+/** Is this sync reading "not in sync"? Behind, ahead, records not yet recorded, or `remote_stale`: no fetch in the last
+ * few minutes, so another machine's push would be invisible here and "in sync" cannot be claimed. An unreadable status
+ * is not shown. */
 export function unsyncedOf(st) {
-  return !!st && st.ok !== false && ((st.behind | 0) > 0 || (st.ahead | 0) > 0 || (st.dirty_records | 0) > 0);
+  return !!st && st.ok !== false
+    && ((st.behind | 0) > 0 || (st.ahead | 0) > 0 || (st.dirty_records | 0) > 0 || st.remote_stale === true);
 }
 
 export function createTopbar({ go, openPalette, repoMenu, sync } = {}) {

package/workspace/replaced-tests.json

@@ -23,7 +23,42 @@
       "run": "2A",
       "ref": "contract-run2 done_criteria 14 (the plan-routes.test.js Origin cases)",
       "reason": "R9 asserted the route's own no-Origin text, which named the terminal route. After Run 2 the route runs pm-guard first, so R9 now asserts pm-guard's refusal; the 403 and the nothing-written check stay.",
-      "names": ["R9 a POST with no Origin is 403 and names the terminal route; nothing is written"]
+      "names": [
+        "R9 a POST with no Origin is 403 and names the terminal route; nothing is written"
+      ]
+    },
+    {
+      "id": "STG-SLACK",
+      "file": "workspace/proactive.test.js",
+      "run": "today-goals",
+      "ref": "planning/prd/today-goals-prd.md G2 (slack becomes a brief source)",
+      "reason": "These four assertions used slack as the example of an unknown brief source. today-goals G2 makes slack a known source, so each now uses teams as the unknown name; the refusal and its reason are asserted unchanged.",
+      "names": [
+        "G5 a non-object, a bad date and an unknown source are refused with the reason",
+        "G6 a confidence outside 0 to 1, a bad owner, a bad effort, a missing why_now and an unknown item source are each refused",
+        "G14 the new settings are checked: name length, source names, booleans",
+        "I6 an unknown brief source is refused with the allowed names"
+      ]
+    },
+    {
+      "id": "S6-D86",
+      "file": "workspace/d86-seams.test.js",
+      "run": "6",
+      "ref": "Run 6 contract, 'Deliberate test and budget changes' (planning/evals/pm-os-absorb-eval-rubric.md)",
+      "reason": "The draft golden gains the slides key: the drafter now writes the slide data with the draft (PRD R22.7). The assertion keeps its name and still checks every D78 section and the reason rule.",
+      "names": [
+        "10 the draft golden has every section of the D78 frame (headline, timeline, blocks, new, decided, needs your call, sources), and every block not on track has a reason"
+      ]
+    },
+    {
+      "id": "S6-FP",
+      "file": "workspace/first-paint-count.test.js",
+      "run": "6",
+      "ref": "Run 6 contract, 'Deliberate test and budget changes' (planning/evals/pm-os-absorb-eval-rubric.md)",
+      "reason": "The Reports budget rose to 15 for Present, but specimen A did not change. The calibration now reads SPECIMEN_A, specimen A's own counts, instead of EXPECT, the budgets. The name and the four numbers are unchanged.",
+      "names": [
+        "(a) calibration: the audit on specimen A gives exactly Today 17, Initiatives 24, Board 33, Reports 14 outside the dock"
+      ]
     }
   ],
   "entries": [

package/workspace/server.js

@@ -94,6 +94,8 @@ const judgmentLib = require('./lib/judgment');
 const proactiveLib = require('./lib/proactive');
 const learnLib = require('./lib/learn');
 const briefLib = require('./lib/brief');
+const goalsLib = require('./lib/goals');
+const todayLib = require('./lib/today');
 const prepareQueue = require('./lib/prepare-queue');
 const harness = require('./lib/harness-parse');
 const transcript = require('./lib/transcript-read');
@@ -1787,6 +1789,14 @@ function readLedger(w, basename) {
 // D70 — the lifecycle ledger: the latest line for an initiative wins; `active` reopens. The same rule
 // as scripts/workflow-state.js#readLifecycle (a parity case in workspace/test.js keeps them in step).
 const syncing = new Set();   // repositories with a sync in flight — one at a time
+// D70 as amended 2026-10-06: the same Sync, run without the press at startup and when work sits unpushed and quiet.
+// Every rule it must pass is in lib/auto-sync.js; a scratch server (its own PMOS_STATE_DIR) does not auto-sync.
+const autoSync = require('./lib/auto-sync').createAutoSync({
+  roots: () => [...new Set([...workspaces.values()].map((w) => w.root))],
+  busy: syncing,
+  onDone: (root) => boardCache.invalidate(root),
+  label: `${os.hostname()} (auto-sync)`,
+});
 const STOPPED_STATES = ['closed', 'on-hold', 'cancelled'];
 function readLifecycle(w) {
   const latest = new Map();
@@ -2315,7 +2325,7 @@ function checkDueSchedules() {
 // PMOS_TICK_MS exists for the suites (same footing as PMOS_LIVENESS_MS): proactive-prepare.test.js
 // used to wait on two real minutes of this clock. Unset, the interval is the 60 seconds it always was.
 const TICK_MS = Math.max(200, Number(process.env.PMOS_TICK_MS) || 60000);
-try { const _tick = setInterval(() => { checkDueSchedules(); proactiveTick(); try { prepareTick({ manual: false }); } catch { /* the next tick tries again */ } }, TICK_MS); if (_tick.unref) _tick.unref(); } catch {}
+try { const _tick = setInterval(() => { checkDueSchedules(); proactiveTick(); try { prepareTick({ manual: false }); } catch { /* the next tick tries again */ } autoSync.tick().catch(() => {}); }, TICK_MS); if (_tick.unref) _tick.unref(); } catch {}
 
 // ── Sessions: real PTYs, owned by the server, with disk-backed scrollback + metadata. ──
 /** @type {Map<string, {id,ws,name,agent,cwd,state,note,created,pty,buf,cols,rows,clients:Set}>} */
@@ -3621,6 +3631,21 @@ function prepareTick({ manual = false } = {}) {
 const PRO_SIGNALS = () => path.join(STATE, 'signals.jsonl');
 const PRO_FEEDBACK = () => path.join(STATE, 'proactive-feedback.jsonl');
 const PRO_SETTINGS = () => path.join(STATE, 'proactive-settings.json');
+// today-goals: one goals file per local day, and the newest stored brief (the same read GET /api/proactive/brief makes).
+const GOALS_DIR = () => path.join(STATE, 'goals');
+const goalsCardsMemo = new Map();   // ws -> { at, cards, error }: GET /api/proactive/goals reads Today's cards at most every 30 s
+function readGoalsDay(date) {
+  let raw = null;
+  try { raw = JSON.parse(fs.readFileSync(path.join(GOALS_DIR(), date + '.json'), 'utf8')); } catch { /* none yet */ }
+  return goalsLib.readDay(raw, date);
+}
+function latestBrief() {
+  try {
+    const dir = path.join(STATE, 'briefs');
+    const f = fs.readdirSync(dir).filter((n) => /^\d{4}-\d{2}-\d{2}\.json$/.test(n)).sort().pop();
+    return f ? JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')) : null;
+  } catch { return null; }
+}
 let proLastScan = 0;
 const PRO_SCAN_EVERY_MS = 10 * 60 * 1000;
 function proSettings() {
@@ -4977,6 +5002,29 @@ async function handleRequest(req, res) {
     res.writeHead(200, { 'Content-Type': 'image/svg+xml', 'Cache-Control': 'max-age=86400' });
     return res.end(svg);
   }
+  // workspace-phone-app: what Add to Home Screen reads, so the phone opens the workspace full screen
+  // with its own icon. The manifest is built here rather than shipped as a file because its colours
+  // are the dark theme's tokens and its start_url must be the bare page: never a ?token= URL, which
+  // would store the secret in the phone's home-screen entry. No service worker, on purpose: this is
+  // live state, and an offline cache would show a stale board as if it were current.
+  if (p === '/manifest.webmanifest') {
+    res.writeHead(200, { 'Content-Type': 'application/manifest+json', 'Cache-Control': 'no-cache' });
+    return res.end(JSON.stringify({
+      name: 'PMOS workspace', short_name: 'PMOS', id: '/', start_url: '/', scope: '/',
+      display: 'standalone', orientation: 'any', background_color: '#090b0c', theme_color: '#090b0c',
+      icons: [
+        { src: '/icons/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
+        { src: '/icons/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any' },
+        // The mark sits inside the central 62%, so the same image survives an Android maskable crop.
+        { src: '/icons/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'maskable' },
+      ],
+    }));
+  }
+  // The three icons, by name (an allowlist, like /lib/ above). iOS also asks for /apple-touch-icon.png
+  // at the root unprompted, so that path answers too.
+  if (p === '/icons/icon-192.png' || p === '/icons/icon-512.png' || p === '/icons/apple-touch-icon.png' || p === '/apple-touch-icon.png') {
+    return serveFile(res, path.join(PUB, 'icons', path.basename(p)), 'image/png');
+  }
   // xterm assets straight from node_modules (offline; no CDN)
   if (p === '/vendor/xterm.js') return serveFile(res, path.join(XROOT, 'xterm', 'lib', 'xterm.js'));
   if (p === '/vendor/xterm.css') return serveFile(res, path.join(XROOT, 'xterm', 'css', 'xterm.css'));
@@ -6446,11 +6494,11 @@ async function handleRequest(req, res) {
     // Local only — no network. Safe to poll; it is what tells the PM whether a press is needed.
     const w = getWs(url.searchParams.get('ws'));
     if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
-    return json(res, { ws: w.id, name: w.name, ...(await syncLib.status(w.root)) });
+    return json(res, { ws: w.id, name: w.name, ...(await syncLib.status(w.root)), auto: autoSync.lastOf(w.root) });
   }
   if (p === '/api/sync' && req.method === 'POST') {
-    // D70 — the ONE place the workspace runs fetch / integrate / commit / push. Only the PM's press
-    // reaches it; nothing schedules or chains it, and it is off every other action's request path.
+    // D70 — the PM's press. The only other caller of the same sync is lib/auto-sync.js (D70 as amended
+    // 2026-10-06), under its own rules; neither is on any other action's request path.
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); }
     catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
@@ -6911,6 +6959,66 @@ async function handleRequest(req, res) {
     if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
     return json(res, { ok: true, ws: w.id, name: w.name, ...validateLib.readFindings(validationFindingsFile(w)) });
   }
+  /* ── today-goals (G1, G4, G5): the PM's goals for the day, the plan that joins them to the brief and Today, and "plan my
+   *    day". The goals routes write only goals/<date>.json in the state folder. "Plan my day" seeds the morning-brief
+   *    schedule when the repository has none and runs it through fireSchedule, the run-now path. Nothing else starts. ── */
+  if (p === '/api/proactive/goals' && req.method === 'GET') {
+    const now = Date.now();
+    const date = briefLib.localDate(now);
+    const w = getWs(url.searchParams.get('ws'));
+    const day = readGoalsDay(date);
+    const brief = latestBrief();
+    let cards = []; let cardsError = null;
+    // Today's cards are read only when an open goal can take them, and at most once per 30 seconds per repository: the
+    // read is synchronous and heavy on a large repository, and the Today feed itself must not wait behind it.
+    if (w && day.goals.some((x) => x.status === 'open')) {
+      const memo = goalsCardsMemo.get(w.id);
+      if (memo && now - memo.at < 30000) ({ cards, error: cardsError } = memo);
+      else {
+        let sess = []; try { sess = sessionList(); } catch { /* no session cards */ }
+        const t = todayLib.todayFor(w, { stateDir: stateDirFor(w), sessions: sess, registered: (root) => { const x = workspaces.get(wsId(root)); return !!x && path.resolve(x.root) === path.resolve(root); } });
+        if (t.ok) cards = t.cards; else cardsError = t.error;
+        goalsCardsMemo.set(w.id, { at: now, cards, error: cardsError });
+      }
+    }
+    const plan = goalsLib.planDay({ day, brief, cards, now });
+    const sched = readSchedules().find((x) => x.skill === 'morning-brief' && (!w || x.ws === w.id)) || null;
+    return json(res, { ok: true, ws: w ? w.id : null, today: date, plan, cards_error: cardsError, max_goals: goalsLib.MAX_GOALS,
+      schedule: sched ? { id: sched.id, time: sched.time, lastRun: sched.lastRun, lastStatus: sched.lastStatus } : null,
+      note: 'Goals are kept in the workspace state folder on this computer. The plan joins them to the morning brief and Today by goal id or initiative, never by guessing.' });
+  }
+  if (p === '/api/proactive/goals' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const now = Date.now();
+    const date = briefLib.localDate(now);
+    const r = goalsLib.edit(readGoalsDay(date), body, { now });
+    if (!r.ok) return json(res, { ok: false, error: r.error }, /no goal with that id/.test(r.error) ? 404 : 400);
+    try { fs.mkdirSync(GOALS_DIR(), { recursive: true }); fs.writeFileSync(path.join(GOALS_DIR(), date + '.json'), JSON.stringify(r.day) + '\n'); }
+    catch (e) { warnWriteFail('goals', e); return json(res, { ok: false, error: 'could not save — nothing changed' }, 500); }
+    return json(res, { ok: true, day: r.day, goal: r.goal });
+  }
+  if (p === '/api/proactive/goals/plan' && req.method === 'POST') {
+    // A PM press: make sure the morning brief is scheduled for this repository, then run it now. The session reads the
+    // goals with `pmos proactive goals` and submits a brief whose items name them.
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const w = getWs(body.ws);
+    if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
+    const open = readGoalsDay(briefLib.localDate(Date.now())).goals.filter((g) => g.status === 'open');
+    if (!open.length) return json(res, { ok: false, error: 'add a goal for today first: the plan is made for your goals' }, 409);
+    let sched = readSchedules().find((x) => x.ws === w.id && x.skill === 'morning-brief');
+    let seeded = false;
+    if (!sched) {
+      if (!taskById('morning-brief', w.root)) return json(res, { ok: false, error: 'the morning-brief skill is not installed for this repository' }, 409);
+      const norm = scheduleLogic.normalizeSchedule({ ...SEED_SETS.brief[0], task: 'morning-brief' });
+      if (!norm.ok) return json(res, { ok: false, error: norm.error }, 500);
+      sched = { id: 'sc-' + Date.now().toString(36) + 'g', ws: w.id, ...norm.schedule, profile: null, lastRun: null, lastStatus: null };
+      sched.nextRun = scheduleLogic.nextRun(sched);
+      const list = readSchedules(); list.unshift(sched); writeSchedules(list); seeded = true;
+    }
+    const result = fireSchedule(sched);
+    return json(res, { ok: !!result.ok, seeded, schedule: { id: sched.id, time: sched.time }, result, goals: open.length,
+      ...(result.ok ? {} : { error: result.reason || 'the morning-brief session did not start' }) }, result.ok ? 200 : 500);
+  }
   /* ── background prepare (D3): plan is read-only; queue records an approval; the runner starts it later ── */
   if (p === '/api/proactive/prepare/plan' && req.method === 'POST') {
     let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
@@ -6984,7 +7092,8 @@ async function handleRequest(req, res) {
     const dir = path.join(STATE, 'briefs');
     if (req.method === 'POST') {
       let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
-      const v = briefLib.validateBrief(body, { now: Date.now(), settings: proSettings() });
+      const bday = body && typeof body.date === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(body.date) ? body.date : briefLib.localDate(Date.now());
+      const v = briefLib.validateBrief(body, { now: Date.now(), settings: proSettings(), goalIds: readGoalsDay(bday).goals.map((g) => g.id) });
       if (!v.ok) return json(res, { ok: false, error: v.error }, 400);
       try { fs.mkdirSync(dir, { recursive: true }); fs.writeFileSync(path.join(dir, v.brief.date + '.json'), JSON.stringify(v.brief) + '\n'); }
       catch (e) { warnWriteFail('briefs', e); return json(res, { ok: false, error: 'could not save — nothing changed' }, 500); }
@@ -7377,7 +7486,7 @@ async function handleRequest(req, res) {
     return json(res, { ok: true, changes: rows.slice(-200).reverse(), total: rows.length });
   }
   // pm-os-absorb Runs 2–5 — the planning layer's routes, one file per run (lib/route-modules.js). Last, so none shadows a route above.
-  if (await routeModules.dispatch(req, res, url, { json, readBody, getWs, invalidateNeedsAgg, boardCache, consoleState, stateDirFor, sessionList })) return;
+  if (await routeModules.dispatch(req, res, url, { json, readBody, getWs, invalidateNeedsAgg, boardCache, consoleState, stateDirFor, sessionList, initiativeIndex })) return;
   res.writeHead(404); res.end('not found');
 }
 
@@ -7443,25 +7552,57 @@ function writeChangeContext(dir) {
   catch { return null; }
 }
 
-// ── Access guard (D62): loopback is token-free; every non-loopback peer needs the bearer token. ──
+// ── Access guard (D62): loopback is token-free; every non-loopback or proxied request needs the bearer token. ──
 // Peer-based: what matters is where the request came FROM, not which listener accepted it. With the
 // remote flag off there is no non-loopback listener, so this is transparent for local dev. Headers
 // and the token are never logged (D08).
 function httpGuard(req, res) {
   // Origin/Host allowlist FIRST (D64 A1): reject a cross-site / DNS-rebinding request before the
   // token exemption for loopback can be reached. Header values are never logged (D08).
-  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds })) {
+  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: BIND.publicHost })) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'forbidden origin/host' }));
     return;
   }
+  // workspace-public-host: a request to the public hostname must have passed Cloudflare Access. A tunnel
+  // with no Access application in front fails here, before even the sign-in form can be reached.
+  if (!remoteAccess.edgeAllowed({ headers: req.headers, publicHost: BIND.publicHost })) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: false, error: 'the public host is only reachable through Cloudflare Access' }));
+    return;
+  }
+  // The cookie is Secure when the browser reached us on the public host (HTTPS at the edge).
+  const secureCookie = !!BIND.publicHost && remoteAccess.isProxied(req.headers, BIND.publicHost);
   // Token may arrive as an Authorization header, a ?token= query param, or the seeded cookie. A
   // browser only carries the token on the FIRST navigation URL — it cannot attach a header/query to
   // sub-resource loads (CSS/JS) or the WS upgrade — so the documented "open http://…/?token=<t>"
   // phone flow (REMOTE.md + startup banner) must reach THIS page-load guard, and every later request
   // rides the cookie we seed just below. presentedToken() resolves all channels. (local hotfix)
-  if (!remoteAccess.authorize({ remoteAddress: req.socket.remoteAddress,
+  // workspace-phone-app: the sign-in form posts here. It is the one route an unauthorized peer may
+  // reach, and all it can do is compare a token (constant-time) and, on a match, seed the same
+  // cookie a valid ?token= navigation seeds. The body is capped; nothing about it is logged (D08).
+  const navigation = remoteAccess.isPageNavigation({ method: req.method, accept: req.headers.accept });
+  if (req.method === 'POST' && (req.url || '').split('?')[0] === remoteAccess.AUTH_PATH) {
+    let body = '';
+    req.on('data', (c) => { body += c; if (body.length > 4096) req.destroy(); });
+    req.on('end', () => {
+      if (remoteAccess.tokenMatches(remoteAccess.parseAuthForm(body), TOKEN)) {
+        res.writeHead(303, { Location: '/', 'Set-Cookie': remoteAccess.sessionCookie(TOKEN, { secure: secureCookie }), 'Cache-Control': 'no-store' });
+        return res.end();
+      }
+      res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+      res.end(remoteAccess.signInPage({ failed: true }));
+    });
+    return;
+  }
+  if (!remoteAccess.authorize({ remoteAddress: req.socket.remoteAddress, headers: req.headers, publicHost: BIND.publicHost,
       presentedToken: remoteAccess.presentedToken(req), expectedToken: TOKEN })) {
+    // A phone's browser gets a page it can act on, not JSON. API calls, scripts and anything else
+    // that is not a page load keep the JSON 401 they had.
+    if (navigation) {
+      res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8', 'WWW-Authenticate': 'Bearer', 'Cache-Control': 'no-store' });
+      return res.end(req.method === 'HEAD' ? undefined : remoteAccess.signInPage());
+    }
     res.writeHead(401, { 'Content-Type': 'application/json', 'WWW-Authenticate': 'Bearer' });
     res.end(JSON.stringify({ ok: false, error: 'unauthorized' }));
     return;
@@ -7470,12 +7611,18 @@ function httpGuard(req, res) {
   // navigation, so the browser's subsequent sub-resource + WS-upgrade requests authenticate without it
   // in the URL. HttpOnly (JS never needs it) + SameSite=Strict + the D64 Origin/Host allowlist keep a
   // foreign site from riding it; no Secure flag because the tailnet speaks plain HTTP (WireGuard-encrypted).
-  if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress)) {
+  if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress) || remoteAccess.isProxied(req.headers, BIND.publicHost)) {
     let qTok = null;
     try { qTok = new URL(req.url || '', 'http://localhost').searchParams.get('token'); } catch { /* ignore */ }
     if (qTok && remoteAccess.tokenMatches(qTok.trim(), TOKEN)) {
-      res.setHeader('Set-Cookie',
-        `${remoteAccess.COOKIE_NAME}=${encodeURIComponent(TOKEN)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=604800`);
+      res.setHeader('Set-Cookie', remoteAccess.sessionCookie(TOKEN, { secure: secureCookie }));
+      // workspace-phone-app: on a page load, redirect to the same URL without the token, so it does
+      // not stay in the address bar, the history, or the start_url of a home-screen install.
+      const clean = navigation ? remoteAccess.stripTokenParam(req.url) : null;
+      if (clean) {
+        res.writeHead(303, { Location: clean, 'Cache-Control': 'no-store' });
+        return res.end();
+      }
     }
   }
   return handleRequest(req, res);
@@ -7490,14 +7637,15 @@ function handleUpgrade(req, socket, head) {
   // Same origin/host allowlist on the WS upgrade handshake (D64 A1): a cross-origin page must not be
   // able to open ws://127.0.0.1:<port> and spawn/type into a shell. Rejected BEFORE the socket is
   // accepted, and before loopback's token exemption applies. Header values never logged (D08).
-  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds })) {
+  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: BIND.publicHost })
+      || !remoteAccess.edgeAllowed({ headers: req.headers, publicHost: BIND.publicHost })) {
     socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     socket.destroy();
     return;
   }
   // A browser WebSocket cannot set a header or a ?token= — it authenticates via the same-origin cookie
   // seeded on the page load. presentedToken() resolves header → query → subprotocol → cookie.
-  if (!remoteAccess.authorize({ remoteAddress: socket.remoteAddress,
+  if (!remoteAccess.authorize({ remoteAddress: socket.remoteAddress, headers: req.headers, publicHost: BIND.publicHost,
       presentedToken: remoteAccess.presentedToken(req), expectedToken: TOKEN })) {
     socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
     socket.destroy();     // reject the upgrade; nothing about the request is logged (D08)
@@ -7667,7 +7815,9 @@ if (require.main === module) {
       // old EADDRINUSE advice told the PM to do, on another port) has to leave the same trace as
       // one started by `pmos` — otherwise the next `pmos` cannot see it and starts a second server.
       try { fs.mkdirSync(STATE, { recursive: true }); fs.writeFileSync(PID_FILE, String(process.pid)); } catch {}
-      for (const line of remoteAccess.startupLines(BIND, PORT)) console.log(line);
+      for (const line of remoteAccess.startupLines(BIND, PORT, { ansi: !!process.stdout.isTTY && !process.env.NO_COLOR })) console.log(line);
+      // bring in what another machine pushed while this one was off (D70 as amended); never on the request path
+      { const t = setTimeout(() => { autoSync.startup().catch(() => {}); }, 3000); if (t.unref) t.unref(); }
     });
   });
 }

package/workspace/skills/morning-brief.skill

@@ -1,20 +1,21 @@
 ---
 name: morning-brief
 label: "Morning brief"
-description: "Prepare today's brief: the calendar, the priorities and what is worth asking. Read-only on every source; it submits the brief to the workspace and sends nothing."
+description: "Prepare today's brief and plan the PM's goals for the day: the calendar, Slack, Jira and Confluence mentions, the priorities and what is worth asking. Read-only on every source; it submits the brief to the workspace and sends nothing."
 run: agent
 agent: claude
 output:
+  - Goals
   - Calendar
   - Priorities
   - Worth asking
   - Sources reached and not reached
 ---
 
-/morning-brief — prepare today's brief for the PM.
+/morning-brief — prepare today's brief for the PM, and plan the goals they set for today.
 
 Rules that always hold:
-1. READ-ONLY on every source. Never send, reply, forward, post, comment, create, edit, accept, decline, transition, label, archive or delete anything in mail, chat, Jira, Confluence, calendar, Wispr Flow or any other source.
+1. READ-ONLY on every source. Never send, reply, forward, post, react, comment, create, edit, accept, decline, transition, label, archive, mark read or delete anything in mail, Slack, Jira, Confluence, calendar, Wispr Flow or any other source.
 2. SETTINGS DECIDE THE SOURCES. Run `pmos proactive settings`. Read a source only if its line under "brief sources" says on. A source that is off is reported as "off". Mail is off unless the PM turned it on.
 3. LIGHT ON CONTENT. Titles, times, names and ids only. Never copy a message body, an attachment, a token or a credential. Skip anything marked private, personal, confidential or HR. At most one short evidence line per item.
 4. NOTHING INVENTED. A source you cannot reach in this session is reported as "not-reached". If nothing is waiting, submit a brief with no items. An honest short brief is correct.
@@ -23,21 +24,26 @@ Rules that always hold:
 
 Procedure:
 1. Run `pmos proactive settings` and `pmos proactive today`. The second lists what the workspace derived from the ledgers. Each of its items may become a priority with source "derived".
+   Then run `pmos proactive goals`. It lists the PM's goals for today, each with its id (g-xxxxxxxx), its status and, if set, an initiative. The goals are what the PM wants done today: plan for them first.
    Then run `pmos proactive learn lessons`. Each line is a preference the PM approved, written from their own feedback. Use it only to decide how confident to be and where an item goes. A lesson never asks you to read another source, to switch a setting on, or to write anything.
 2. Read today's events from the calendar and today's and tomorrow's meeting notes from Wispr Flow, if those sources are on and reachable. Read Jira issues assigned to the PM or due soon, and Confluence pages changed since yesterday, if on and reachable. Read mail only if on: subjects and senders of threads waiting on the PM, no bodies.
-3. For each thing the PM should act on today, write one item: a short title, why it is for today, its source, the initiative id if one applies, who acts (pm or agent), effort (minutes, an-hour, half-day, day), your confidence from 0 to 1 that it belongs on today's list, and one short evidence line. Give a low confidence when you are guessing. The workspace shows an item under 0.5 as "worth asking", not as a priority.
+   Read MENTIONS of the PM since yesterday morning, if the source is on and reachable: Slack messages that @-mention the PM or are direct messages to them; Jira issues and comments that mention the PM; Confluence pages and comments that mention the PM. For each, keep only where it is (channel, issue key, page title), who wrote it, and a one-line paraphrase of what is asked. Never copy the message itself.
+3. PLAN EACH OPEN GOAL. For each open goal, find what moves it today in what you read and in `pmos proactive today`: a meeting where it is decided, a mention that blocks it, an issue or page it needs, a step an agent can prepare. Write each as an item with "goal": "<the goal id>". An agent step names the initiative it advances, so the PM can prepare it from Today. A calendar event that belongs to a goal also gets "goal". If you find nothing for a goal, write nothing for it: the workspace shows that goal as needing a plan. Never invent a step.
+   Then ANTICIPATE: for each other thing the PM should act on today (a mention waiting on them, a meeting to prepare for, an issue due), write one item with no goal.
+   For each item, write: a short title, why it is for today, its source, the initiative id if one applies, who acts (pm or agent), effort (minutes, an-hour, half-day, day), your confidence from 0 to 1 that it belongs on today's list, and one short evidence line. Set "mention": true on an item that comes from a mention of the PM. Give a low confidence when you are guessing. The workspace shows an item under 0.5 as "worth asking", not as a priority.
 4. Write the brief as a JSON file in the scratch folder of this session, in this shape, and nothing else:
    ```
-   {"date": "YYYY-MM-DD", "sources": {"calendar": "read", "wispr": "not-reached", "mail": "off", "jira": "read", "confluence": "read"},
-    "calendar": [{"start": "<ISO date and time>", "end": "<ISO>", "title": "…", "with": "…"}],
-    "items": [{"title": "…", "why_now": "…", "source": "calendar|wispr|mail|jira|confluence|derived", "initiative_id": "<id or omit>", "owner": "pm|agent", "effort": "minutes|an-hour|half-day|day", "confidence": 0.0, "evidence": "…"}],
+   {"date": "YYYY-MM-DD", "sources": {"calendar": "read", "wispr": "not-reached", "mail": "off", "slack": "read", "jira": "read", "confluence": "read"},
+    "calendar": [{"start": "<ISO date and time>", "end": "<ISO>", "title": "…", "with": "…", "goal": "<goal id or omit>"}],
+    "items": [{"title": "…", "why_now": "…", "source": "calendar|wispr|mail|slack|jira|confluence|derived", "initiative_id": "<id or omit>", "goal": "<goal id or omit>", "mention": false, "owner": "pm|agent", "effort": "minutes|an-hour|half-day|day", "confidence": 0.0, "evidence": "…"}],
     "judgment": {"used": false}}
    ```
-   Only report calendar events if calendar is "read". Only give an item a source that is "read" (or "derived").
+   Only report calendar events if calendar is "read". Only give an item a source that is "read" (or "derived"). Only use a goal id that `pmos proactive goals` listed today: the workspace refuses any other.
 5. Run `pmos proactive brief submit --file <that file>`. If it is refused, read the reason, fix the file and submit once more. Do not work around a refusal.
-6. Finish by saying in two lines how many priorities and worth-asking items you submitted and which sources were not reached.
+6. Finish by saying in three lines how many goals have a step and which have none, how many priorities and worth-asking items you submitted, and which sources were not reached.
 
 Output contract — produce EXACTLY these sections in your final message:
+- Goals
 - Calendar
 - Priorities
 - Worth asking