create-pmos 0.53.1 → 0.53.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.53.1",
+  "version": "0.53.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@bfd9b34
+kernel-source: pmos@439620f
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T01:59:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T02:40:00Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T01:59:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T02:40:00Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T01:59:33Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T02:40:00Z"}
 status: stable
 ---
 

package/workspace/REMOTE.md

@@ -6,7 +6,7 @@ timestamp: 2026-10-06
 
 # Reaching the workspace from your phone — over a private tailnet, never the public internet
 
-The workspace server owns **real terminal sessions (PTYs)** running your `claude` on **your own subscription**. By default it binds `127.0.0.1` only, so it is reachable solely from the machine it runs on. This runbook enables reaching **the same local server** from another of your own devices — a phone, a laptop — over a **private Tailscale tailnet**. It never exposes a public endpoint.
+The workspace server owns **real terminal sessions (PTYs)** running your `claude` on **your own subscription**. By default it binds `127.0.0.1` only, so it is reachable solely from the machine it runs on. This runbook enables reaching **the same local server** from another of your own devices — a phone, a laptop — over a **private Tailscale tailnet**. The tailnet path never exposes a public endpoint. To use your own domain instead, see [Reaching the workspace at your own domain](#reaching-the-workspace-at-your-own-domain-cloudflare-tunnel--access): the server still binds loopback only, and Cloudflare forwards to it.
 
 ## Why a tailnet, and why no public endpoint (D62)
 
@@ -67,7 +67,7 @@ A public server that owns a PTY running your Claude subscription is severe expos
 ## Security model (what is guaranteed)
 
 - **Never public.** The only addresses the server will ever bind are loopback and a `100.64.0.0/10` tailnet address. `0.0.0.0`, `::`, LAN, and public IPs are refused — the server exits with a clear error rather than binding them. There is no code path to a public bind.
-- **Token beyond loopback.** With remote mode on, every non-loopback HTTP request and WebSocket upgrade must present the bearer token, or it is rejected (`401` / socket closed). A browser page load gets the sign-in page with that `401`. The one exception is `POST /auth`, the sign-in form's target: it only compares the posted token and, on a match, sets the session cookie. It still sits behind the Origin/Host allowlist. Loopback requests stay token-free for local development. The comparison is constant-time.
+- **Token beyond loopback.** With remote mode on, every non-loopback HTTP request and WebSocket upgrade must present the bearer token, or it is rejected (`401` / socket closed). A browser page load gets the sign-in page with that `401`. The one exception is `POST /auth`, the sign-in form's target: it only compares the posted token and, on a match, sets the session cookie. It still sits behind the Origin/Host allowlist. Loopback requests stay token-free for local development, unless they arrived through a proxy (see [Why a proxy on the same machine needs special handling](#why-a-proxy-on-the-same-machine-needs-special-handling)). The comparison is constant-time.
 - **Origin/Host allowlist (D64).** Both the HTTP guard and the WebSocket-upgrade handshake reject any request whose `Origin` is foreign (not same-origin with the `Host` it arrived on) or whose `Host` hostname is not loopback/localhost or your tailnet address. This closes the cross-origin-localhost / DNS-rebinding vector: without it, **any website open in your browser** could open a WebSocket to `ws://127.0.0.1:<port>` and spawn a shell + type into it, because loopback peers are token-exempt. A same-origin page served by the workspace passes; a cross-site page is rejected `403`. Native clients / `curl` (which send no `Origin`) still pass this check and are then gated by the token.
 - **No header/token logging (D08).** The request-guard path logs nothing about the request. The token is printed at most once at startup (only when generated); a token you supply is never echoed.
 - **Rate-limited control channel (D64).** The WS messages that spawn shells (`new`/`respawn`) and feed a PTY (`input`) are per-connection rate-limited, bounding abuse if the socket is ever reached.
@@ -77,14 +77,95 @@ A public server that owns a PTY running your Claude subscription is severe expos
 
 The workspace is **tailnet-first**. The tailnet path above is the supported way to reach it from another of your own devices and needs no internet exposure. If you nonetheless expose an instance to the internet, D64 permits it **only after all three of the following are in place — never before, and never as a raw public bind**:
 
-1. **The bearer token for every non-loopback peer** (already enforced in remote mode).
-2. **The Origin/Host allowlist** (already enforced — see above).
-3. **TLS termination at the exposure boundary.** **The workspace server does not terminate TLS.** It speaks plain HTTP/WS and must sit behind something that terminates TLS for it — Tailscale's own HTTPS (`tailscale serve` / `tailscale funnel`) or a reverse proxy (Caddy, nginx, a tunnel) that holds the certificate and forwards to the loopback/tailnet listener. Do **not** put the raw HTTP port on a public interface — the server refuses non-loopback/non-tailnet binds precisely so this stays a conscious proxy decision, not an accident.
+1. **The bearer token for every non-loopback or proxied request.** A request that arrives through a reverse proxy or tunnel is never token-exempt, even though the proxy connects from `127.0.0.1` (see below).
+2. **The Origin/Host allowlist** (already enforced — see above). `PMOS_PUBLIC_HOST` adds exactly one public hostname to it.
+3. **TLS termination at the exposure boundary.** **The workspace server does not terminate TLS.** It speaks plain HTTP/WS and must sit behind something that terminates TLS for it. Do **not** put the raw HTTP port on a public interface — the server refuses non-loopback/non-tailnet binds precisely so this stays a conscious proxy decision, not an accident.
 
-When a reverse proxy forwards to the workspace, keep the forwarded `Host` set to the loopback/tailnet host the server actually binds, so the Origin/Host allowlist still recognises same-origin requests.
+**Do not rewrite the forwarded `Host` header to a loopback address.** Earlier versions of this runbook advised it. Forward the public hostname unchanged and set `PMOS_PUBLIC_HOST` to it.
+
+### Why a proxy on the same machine needs special handling
+
+A tunnel or reverse proxy that runs on the workspace machine (cloudflared, Caddy, nginx) connects to the server from `127.0.0.1`. Loopback peers are token-exempt, so without a further check every internet request would look local. The server therefore treats a request as **proxied** when it carries any of these headers, and a proxied request must always present the token:
+
+`Forwarded`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Real-IP`, `Cf-Connecting-IP`, `Cf-Ray`, `Cf-Access-Jwt-Assertion`
+
+A request to the `PMOS_PUBLIC_HOST` hostname is proxied by definition, with or without these headers.
+
+## Reaching the workspace at your own domain (Cloudflare Tunnel + Access)
+
+This runbook puts the workspace at `https://pm-os.app/` (use your own hostname). Cloudflare holds the certificate and terminates TLS. **Cloudflare Access** asks for your Google or email login before any request reaches the machine. The workspace then asks for its own token. The workspace keeps running on **your own always-on machine**; Cloudflare forwards bytes to it. It does not run on Cloudflare Workers or Containers: it holds real terminal sessions, a git checkout and your agent CLI's login, and needs a persistent disk.
+
+Two locks protect the workspace, and each one is enforced by the server:
+
+| Lock | Who checks it | What happens without it |
+|---|---|---|
+| Cloudflare Access login | Cloudflare's edge. The server refuses a request to the public host that has no `Cf-Access-Jwt-Assertion` header. | `403`, before the sign-in page. |
+| The workspace token | The server, constant-time. | `401` and the sign-in page. |
+
+The Access check in the server is a **presence check**: it confirms that Access is in front, and it fails closed when you forget the Access application. It does not verify the assertion's signature, because that needs Cloudflare's signing keys fetched over the network, and the workspace makes no outbound requests (D79). The origin listens on loopback only, so the tunnel is the only way to reach it with the public hostname.
+
+### Setup
+
+1. **Pick the machine.** Use a machine that stays on: your desktop, or a small Linux VPS. Install the workspace there as usual, and sign in to your agent CLI in a workspace terminal.
+
+2. **Move the domain's DNS to this tunnel.** In the Cloudflare dashboard, remove any existing record or Pages/Worker route for the hostname that you want to use. For `pm-os.app`, the retired PM-OS Pages project and Worker still own it.
+
+3. **Create the Access application first.** In Cloudflare Zero Trust, go to **Access › Applications › Add an application › Self-hosted**. Set the domain to `pm-os.app`. Add one policy: **Allow**, **Emails**, your own email address. Save. Do this before the tunnel, so the hostname is never reachable without a login.
+
+4. **Create the tunnel.** Install `cloudflared` on the machine, then:
+
+   ```sh
+   cloudflared tunnel login
+   cloudflared tunnel create pmos
+   cloudflared tunnel route dns pmos pm-os.app
+   ```
+
+   Write `~/.cloudflared/config.yml`:
+
+   ```yaml
+   tunnel: pmos
+   credentials-file: /home/<you>/.cloudflared/<tunnel-id>.json
+   ingress:
+     - hostname: pm-os.app
+       service: http://127.0.0.1:7433
+     - service: http_status:404
+   ```
+
+   Do not set `httpHostHeader`. The server must see the `Host: pm-os.app` that the browser sent.
+
+5. **Start the workspace in public-host mode**, from `workspace/`:
+
+   ```sh
+   PMOS_PUBLIC_HOST=pm-os.app PMOS_TOKEN='<a long random secret>' npm start
+   ```
+
+   Supply your own `PMOS_TOKEN` so that a restart does not sign out every device. Generate one with `openssl rand -base64 32`. Without `PMOS_TOKEN`, the server generates a token and prints it once.
+
+6. **Start the tunnel:** `cloudflared tunnel run pmos`. To keep it running after a reboot, install it as a service (`sudo cloudflared service install`).
+
+7. **Open `https://pm-os.app/`.** Cloudflare asks for your login. The workspace then shows its sign-in page. Paste the token. The workspace sets a `Secure` session cookie for 7 days.
+
+### Check that it is closed
+
+Run these from a machine that is **not** signed in to Access:
+
+- `curl -sI https://pm-os.app/` returns a redirect to `*.cloudflareaccess.com`, not a workspace page.
+- On the workspace machine, `curl -s -H 'Host: pm-os.app' http://127.0.0.1:7433/api/sessions` returns `403` (no Access assertion).
+- On the workspace machine, `curl -s -H 'X-Forwarded-For: 1.2.3.4' http://127.0.0.1:7433/api/sessions` returns `401` (proxied, no token).
+
+### Configuration
+
+| Variable | Effect |
+|---|---|
+| `PMOS_PUBLIC_HOST=<hostname>` | Opt in. Add this one bare hostname to the Host allowlist, and require the token and the Access header for requests to it. The server still binds loopback only (plus the tailnet when `PMOS_REMOTE=tailnet` is also set). A scheme, port, path, IP address or `localhost` is refused, and the server does not start. |
+| `PMOS_TOKEN=<t>` | The workspace token. Recommended in this mode. Never printed. |
 
 ## Troubleshooting
 
+- **`403` "the public host is only reachable through Cloudflare Access"** — the request reached the workspace without passing Access. Create the Access application for the hostname (Setup step 3).
+- **`403` "forbidden origin/host" on the public hostname** — `PMOS_PUBLIC_HOST` is not set, or it names another hostname, or the tunnel rewrites the `Host` header. Remove `httpHostHeader` from the tunnel's ingress rule.
+- **A local reverse proxy now gets `401`** — it adds a forwarding header, so its requests need the token. This is intended.
+
 - **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.
 - **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run `tailscale up`, or set `PMOS_TAILNET_IP`.
 - **"cannot bind 100.x.y.z:PORT — that address is not present on this machine"** — the pinned `PMOS_TAILNET_IP` isn't actually assigned to this machine. Check `tailscale ip -4`.

package/workspace/first-paint-audit.js

@@ -7,6 +7,7 @@
  * [draggable=true] inside the viewport on first paint.
  *
  *   EXPECT                      PRD Q5's budgets at 1280×800, counted outside the dock and the terminal
+ *   SPECIMEN_A                  specimen A's own counts (2026-10-05), the calibration the audit must reproduce
  *   audit(phone)                shoot.js's audit, verbatim; runs in the page (page.evaluate(audit, false))
  *   countIn([scope, exclude])   the same selector and visibility test, inside `scope` and outside `exclude`; in the page
  *   stableCount([scope, exclude, minus])   countIn once the screen is still (two animation frames apart); in the page,
@@ -16,7 +17,10 @@
  * Do not tune the selector or the visibility test for one surface: change them here, for all, or not at all.
  */
 
-const EXPECT = Object.freeze({ today: 17, initiatives: 24, board: 33, reports: 14 });
+// The budgets start at specimen A's counts. reports: 14 → 15 in Run 6 for Present, the one control the PM asked to keep
+// with the slides (2026-10-06). The calibration stays specimen A's own count: the specimen did not change.
+const SPECIMEN_A = Object.freeze({ today: 17, initiatives: 24, board: 33, reports: 14 });
+const EXPECT = Object.freeze({ ...SPECIMEN_A, reports: 15 });
 
 /* ── shoot.js audit(), copied verbatim (scratchpad/specimens2/shoot.js, 2026-10-05) ─────────────────────────────── */
 // runs in the page
@@ -142,4 +146,4 @@ function installCounter(page) {
   return page.addInitScript({ content: 'window.__countIn = ' + countIn.toString() + ';' });
 }
 
-module.exports = { EXPECT, audit, countIn, stableCount, installCounter };
+module.exports = { EXPECT, SPECIMEN_A, audit, countIn, stableCount, installCounter };

package/workspace/fixtures/initiatives-api/list.json

@@ -172,5 +172,18 @@
       "init": null,
       "why": "line 9: not JSON"
     }
+  ],
+  "unrecorded": [
+    {
+      "id": "fx-orphan",
+      "title": "An initiative with a PRD and no record",
+      "artifacts": [
+        {
+          "name": "fx-orphan-prd.md",
+          "path": "planning/prd/fx-orphan-prd.md",
+          "role": "PRD"
+        }
+      ]
+    }
   ]
 }

package/workspace/fixtures/initiatives-api/roadmap.json

@@ -204,5 +204,18 @@
       "init": null,
       "why": "line 9: not JSON"
     }
+  ],
+  "unrecorded": [
+    {
+      "id": "fx-orphan",
+      "title": "An initiative with a PRD and no record",
+      "artifacts": [
+        {
+          "name": "fx-orphan-prd.md",
+          "path": "planning/prd/fx-orphan-prd.md",
+          "role": "PRD"
+        }
+      ]
+    }
   ]
 }

package/workspace/fixtures/report-api/draft.json

@@ -173,5 +173,110 @@
       "path": "planning/reports/definitions/biweekly.md",
       "audience": "leadership"
     }
+  },
+  "slides": {
+    "v": 1,
+    "meta": {
+      "product": "northwind",
+      "cadence": "Biweekly",
+      "slot": "2026-10-16",
+      "today": "2026-10-16",
+      "last": {
+        "from": "2026-10-02",
+        "to": "2026-10-16"
+      },
+      "next": {
+        "from": "2026-10-16",
+        "to": "2026-10-30"
+      }
+    },
+    "roadmap": {
+      "months": [
+        "2026-09",
+        "2026-10",
+        "2026-11",
+        "2026-12",
+        "2027-01",
+        "2027-02"
+      ],
+      "today": "2026-10-16",
+      "groups": [
+        {
+          "name": "Now",
+          "rows": [
+            {
+              "id": "partner-sso",
+              "title": "Partner SSO",
+              "estimated": false,
+              "segments": [
+                {
+                  "stage": "build",
+                  "label": "Build",
+                  "start": "2026-10-01",
+                  "due": "2026-10-24"
+                }
+              ],
+              "milestones": [
+                {
+                  "title": "Pilot live",
+                  "due": "2026-10-24",
+                  "done": false
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    "list": [
+      {
+        "id": "partner-sso",
+        "title": "Partner SSO",
+        "status": "Build",
+        "pct": 58,
+        "next_milestone": {
+          "title": "Pilot live",
+          "due": "2026-10-24",
+          "overdue": false
+        },
+        "release": "2026-11-20"
+      }
+    ],
+    "initiatives": [
+      {
+        "id": "partner-sso",
+        "title": "Partner SSO",
+        "status": "Build",
+        "pct": 58,
+        "done": 7,
+        "total": 12,
+        "next_milestone": {
+          "title": "Pilot live",
+          "due": "2026-10-24",
+          "overdue": false
+        },
+        "release": "2026-11-20",
+        "last": [
+          {
+            "title": "SAML metadata",
+            "stage": "Build",
+            "owner": "Sheryl",
+            "milestone": false,
+            "done": true,
+            "date": null
+          }
+        ],
+        "next": [
+          {
+            "title": "Pilot live",
+            "stage": "Build",
+            "owner": null,
+            "milestone": true,
+            "done": false,
+            "date": "2026-10-24"
+          }
+        ]
+      }
+    ]
   }
 }

package/workspace/fixtures/reports-page/draft-biweekly-2026-10-16.md

@@ -73,6 +73,16 @@ Stage: Build · On track · 7 of 12 (+4)
 
 - Billing v2 (billing-v2), 8 Oct
 
+**Changelog** (your release notes for the changelog slide)
+
+<!-- pmos:note report.changelog -->
+Launch · Exports: Audit log CSV export
+
+Admins can download the audit log as a CSV file.
+
+- Added: CSV writer for the audit log
+<!-- /pmos:note -->
+
 ## Decided this cycle
 
 - Audit log export moved to Now, 3 Oct (planning/runs/placements.jsonl)
@@ -95,3 +105,5 @@ For leadership only.
 **Not reached**
 
 - tracker: not refreshed since 2 Oct
+
+<!-- pmos:slides v1 {"v":1,"meta":{"product":"northwind","cadence":"Biweekly","slot":"2026-10-16","today":"2026-10-16","last":{"from":"2026-10-02","to":"2026-10-16"},"next":{"from":"2026-10-16","to":"2026-10-30"}},"roadmap":{"months":["2026-09","2026-10","2026-11","2026-12","2027-01","2027-02"],"today":"2026-10-16","groups":[{"name":"Now","rows":[{"id":"audit-log","title":"Audit log export","estimated":false,"segments":[{"stage":"spec","label":"Spec","start":"2026-09-14","due":"2026-10-03"},{"stage":"build","label":"Build","start":"2026-10-04","due":"2026-10-28"},{"stage":"evaluate","label":"Evaluate","start":"2026-10-29","due":"2026-11-12"}],"milestones":[{"title":"Release","due":"2026-11-12","done":false}]},{"id":"partner-sso","title":"Partner SSO","estimated":false,"segments":[{"stage":"build","label":"Build","start":"2026-10-01","due":"2026-10-24"}],"milestones":[{"title":"Pilot live","due":"2026-10-24","done":false}]}]},{"name":"Next","rows":[{"id":"billing-v2","title":"Billing v2","estimated":true,"segments":[{"stage":"intake","label":"Intake","start":"2026-11-02","due":"2026-11-20"},{"stage":"spec","label":"Spec","start":"2026-11-23","due":"2026-12-18"}],"milestones":[]}]}]},"list":[{"id":"audit-log","title":"Audit log export","status":"Evaluate","pct":60,"next_milestone":{"title":"Retention rule","due":"2026-10-10","overdue":true},"release":"2026-11-12"},{"id":"partner-sso","title":"Partner SSO","status":"Build","pct":58,"next_milestone":{"title":"Pilot live","due":"2026-10-24","overdue":false},"release":null}],"initiatives":[{"id":"audit-log","title":"Audit log export","status":"Evaluate","pct":60,"done":3,"total":5,"next_milestone":{"title":"Retention rule","due":"2026-10-10","overdue":true},"release":"2026-11-12","last":[{"title":"CSV writer","stage":"Build","owner":"Sheryl","milestone":false,"done":true,"date":null},{"title":"Retention rule","stage":"Build","owner":"Ricky","milestone":true,"done":false,"date":"2026-10-10"}],"next":[{"title":"Retention rule","stage":"Build","owner":"Ricky","milestone":true,"done":false,"date":"2026-10-10"},{"title":"Export UI","stage":"Build","owner":"Lasantha","milestone":false,"done":false,"date":null}]},{"id":"partner-sso","title":"Partner SSO","status":"Build","pct":58,"done":7,"total":12,"next_milestone":{"title":"Pilot live","due":"2026-10-24","overdue":false},"release":null,"last":[],"next":[{"title":"Pilot live","stage":"Build","owner":null,"milestone":true,"done":false,"date":"2026-10-24"},{"title":"Pilot partners on SSO","stage":"Build","owner":"Agent","milestone":false,"done":false,"date":null}]}]} -->

package/workspace/guide/index.md

@@ -51,3 +51,4 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 - [Initiatives › Timeline](initiatives-timeline.md): when each initiative runs, one row per initiative, and how to reorder rows by their grip.
 - [Board](board.md): one Kanban for the items of every initiative, its filters, Release, and `pmos board`.
 - [Integrated work](integrated-work.md): how `pmos verify-work` turns a merged commit into Done, and what "Done · your call · not merged" means.
+- [Report slides](report-slides.md): how the Reports page shows a report as the PM-OS biweekly slides, Present and Print / PDF, and how your notes become the words on the slides.

package/workspace/guide/initiatives-roadmap.md

@@ -29,6 +29,7 @@ The first time you open the Roadmap, the file has no lines yet. The workspace th
 
 - An initiative with activity in the last 5 days reads **Now, unconfirmed**. Move it to confirm it, or move it to Next or Later.
 - An initiative with no activity for 45 days reads **dormant**, at the end of Later.
+- Documents with no initiative record (a PRD and rubric, or a prototype folder) are listed after dormant, under **with no record**. They are not placed.
 - Every other initiative is in Later, the most recent activity first.
 - An accepted or stopped initiative is never in Now. It goes to the end of Later.
 

package/workspace/guide/initiatives-screen.md

@@ -30,6 +30,7 @@ Only you can move an initiative into Now. The workspace writes the line as yours
 - **unconfirmed.** An initiative that reads Now only because it is active, with no line from you. Confirm it in the Cycle review.
 - **proposed.** An agent proposed a move. It changes nothing until you keep it in the Cycle review.
 - **Dormant.** An initiative with no activity for a long time. Press the dormant line under Later to show them.
+- **No record yet.** A PRD, rubric or prototype folder that no initiative record points at. Press the "with no record" line under Later to show them. In List they are the last group. Press one to open its PRD. Only a record can be placed, so these have no menu.
 
 ## The List
 

package/workspace/guide/layout.md

@@ -16,7 +16,8 @@ The top bar has these parts, from left to right:
 - **Repository ▾** names the current repository. Press it to choose another repository, or **All repositories** to see the work of every repository at once. All repositories replaces the old Portfolio mode.
 - **Today, Initiatives, Board and Reports** are the four places. Press one to show it. The Today count shows how many items need you.
 - **Search or capture ⌘K** opens the command palette. Type to find an initiative, a repository, an open tab or a command.
-- **Sync** shows only when the current repository is not in sync with its remote. Press it to fetch, bring in the work of the other machine, record your changes and push. When the repository is in sync, Sync is not shown.
+- **Sync** shows only when the current repository is not in sync with its remote. Press it to fetch, bring in the work of the other machine, record your changes and push. If the repository has not fetched in the last 10 minutes, Sync also shows, because a push from another machine is not visible until a fetch. When the repository fetched recently and is in sync, Sync is not shown. If Sync stops, the message names the step that stopped.
+- **Sync on its own.** If you forget to press Sync, the workspace syncs for you. It syncs each repository once when the workspace starts. It also syncs a repository that has records not yet pushed when no record changed for 5 minutes. In a document repository it syncs every changed file on any branch. In a code repository it syncs only on the default branch (for example `main`), and only when every commit not yet pushed changes records and no code. If you close the tab while records are not yet pushed, the browser asks you first. To turn automatic sync off, start the workspace with `PMOS_AUTO_SYNC=0`.
 - **Settings** opens the settings of the workspace.
 
 Each place is drawn when its run is built. Until then the place says which run brings it, for example "Board arrives in Run 4."
@@ -81,7 +82,7 @@ A key that you type in a field, or in a terminal, goes to the field or the termi
 
 A phone shows one panel at a time. The tabs at the bottom are **Today, Initiatives, Board, Reports and Agent**. Agent shows the dock, with your terminals. Search or capture ⌘K is pinned at the top of Today.
 
-The bar at the top has Back (when you are deeper than a tab), Repository, the name of the screen, ⌘K, Sync (only when the repository is not in sync) and Settings. Settings opens over the current tab. Back returns to the tab.
+The bar at the top has Back (when you are deeper than a tab), Repository, the name of the screen, ⌘K, Sync (when the repository is not in sync, or has not fetched in the last 10 minutes) and Settings. Settings opens over the current tab. Back returns to the tab.
 
 Every row has a visible ⋯ button. Every control is at least 44 pixels high. Nothing works only when you hover.
 

package/workspace/guide/report-slides.md

@@ -0,0 +1,28 @@
+---
+type: Guide
+title: "Report slides: present and print a report"
+description: "How the Reports page shows a report as the PM-OS biweekly slides, how to present and print them, and how your notes become the words on the slides."
+timestamp: 2026-10-06
+---
+
+# Report slides
+
+The Reports page shows a report as slides, in the PM-OS biweekly format: the roadmap snapshot, the initiative list, one slide for each initiative, and the release notes. **Present** shows them full screen. Use the arrow keys or swipe to move, and press Escape to close. **Print / PDF** prints one slide on each page.
+
+The script writes the data of the slides at the end of the draft, in one `<!-- pmos:slides v1 … -->` block. Do not edit that block. Your words on the slides come from the notes:
+
+- The note of an initiative is the note box on its slide. Start it with "Warning:" or "Info:" to set the type of the box. Write each point on its own line that starts with "- ". The box shows four points.
+- The `report.changelog` note is the release notes. Only you write it; the agent leaves it empty. Write one entry for each release. Put a blank line after the title, after the sentence, and between entries:
+
+```
+Launch · Sign-in: Email codes for every title
+
+Readers can sign in with a one-time code.
+
+- Added: Code entry screen
+- Changed: The login page offers codes first
+```
+
+The type is Launch, Improvement, Fix, Security, Deprecation or Beta. To give an entry its own date, add it after the title, for example `(2026-10-02)`. When the note is empty, the slide says that no release notes are logged.
+
+A draft from before the slides has no slides block. Press **Redraft** to add it. Your notes stay as you wrote them.

package/workspace/guide/reports.md

@@ -43,6 +43,8 @@ Your note. Start it with "Warning:" when the block needs attention.
 
 The headline note is `report.headline`. The asks are in the `report.asks` note, one ask on each line, each line starting with "- ". Write prose only between the markers. Do not type numbers: the script writes them.
 
+The Reports page shows a report as slides. [Report slides](report-slides.md) tells how your notes become the words on the slides.
+
 When you draft a slot again, every note stays as you wrote it, next to its initiative. The order of the blocks can change. A note for an initiative that is no longer in the window moves to "Notes kept from an earlier draft".
 
 ## The commands

package/workspace/lib/auto-sync.js

@@ -0,0 +1,83 @@
+'use strict';
+/* auto-sync — Sync without the press, for the PM who forgot to press it (D70 as amended 2026-10-06).
+ *
+ * The press (POST /api/sync) stays. This module runs the SAME lib/sync.js#sync, with every safety it has (no force,
+ * a conflict aborts the rebase whole, records only), at two moments and no others:
+ *   startup  once per repository when the server starts: brings in what another machine pushed.
+ *   idle     on the server's tick: a repository with work not yet pushed, quiet for QUIET_MS, is synced.
+ * Before either, a repository must pass every rule below. A rule that cannot be read is a no.
+ *   - auto-sync is on for this server (see enabledFor);
+ *   - the branch has an upstream;
+ *   - in a CODE repository only (profile product-code, D68): the branch is the remote's default branch, and every commit
+ *     not yet pushed touches record paths only, so a feature branch and code are never auto-pushed. A DOCUMENT
+ *     repository (profile pm-artifacts) holds only the PM's documents: any branch, every file;
+ *   - no record file changed in the last QUIET_MS: a document being written is left alone;
+ *   - no sync is running for the repository, and the last auto-sync did not fail within RETRY_MS.
+ */
+const syncLib = require('./sync');
+
+const QUIET_MS = 5 * 60 * 1000;
+const RETRY_MS = 30 * 60 * 1000;
+
+// On for a real server start. A server given its own state directory (every suite does, through test-run.js) is a
+// scratch server and does not auto-sync unless asked. PMOS_AUTO_SYNC=0 turns it off; =1 turns it on.
+function enabledFor(env = process.env) {
+  const v = String(env.PMOS_AUTO_SYNC || '').trim();
+  if (v === '0') return false;
+  if (v === '1') return true;
+  return !String(env.PMOS_STATE_DIR || '').trim();
+}
+
+// Why `root` may not auto-sync now, or null when it may. `moment` is 'startup' or 'idle'.
+async function blocker(root, moment, { now = Date.now(), lastFail = 0 } = {}) {
+  if (lastFail && now - lastFail < RETRY_MS) return 'the last auto-sync failed; it waits before trying again';
+  const st = await syncLib.status(root);
+  if (!st.ok) return st.error || 'not a git repository';
+  if (!st.upstream) return 'no upstream';
+  if (st.state === 'mid-operation') return 'a merge, rebase or cherry-pick is in progress';
+  const docs = syncLib.profileOf(root) === 'pm-artifacts';
+  const remote = st.upstream.split('/')[0];
+  const def = docs ? null : await syncLib.defaultBranchOf(root, remote);
+  if (!docs && (!def || st.branch !== def)) return `'${st.branch}' is not the default branch of ${remote}`;
+  if (st.ahead && !docs) {
+    const paths = await syncLib.unpushedPaths(root, st.upstream);
+    if (!paths) return 'the unpushed commits cannot be read';
+    const code = paths.filter((p) => !syncLib.isRecord(p));
+    if (code.length) return `unpushed commits change files that are not records (${code[0]}${code.length > 1 ? ', …' : ''})`;
+  }
+  if (moment === 'idle') {
+    if (!st.dirty_records && !st.ahead) return 'nothing to send';
+    const newest = await syncLib.newestDirtyRecordMs(root);
+    if (newest && now - newest < QUIET_MS) return 'a record changed in the last few minutes';
+  }
+  return null;
+}
+
+/* createAutoSync({ roots, busy, onDone, env }) → { startup(), tick(), lastOf(root) }
+ *   roots()       the repository roots the server holds
+ *   busy          a Set of roots with a sync running (shared with the press route)
+ *   onDone(root, result)   called after each auto-sync that ran (to refresh caches) */
+function createAutoSync({ roots, busy, onDone = () => {}, env = process.env, label = 'auto-sync' } = {}) {
+  const last = new Map();   // root -> { at, moment, ok, message, skipped? }
+  async function runFor(root, moment) {
+    if (!enabledFor(env) || busy.has(root)) return null;
+    const prev = last.get(root);
+    const why = await blocker(root, moment, { lastFail: prev && prev.ok === false ? prev.at : 0 });
+    if (why) return null;
+    busy.add(root);
+    try {
+      const out = await syncLib.sync(root, { label });
+      last.set(root, { at: Date.now(), moment, ok: !!out.ok, message: out.message, stopped_at: out.stopped_at || null });
+      try { onDone(root, out); } catch { /* a cache refresh is not the sync's business */ }
+      return out;
+    } finally { busy.delete(root); }
+  }
+  async function each(moment) {
+    const out = [];
+    for (const r of roots()) { try { out.push(await runFor(r, moment)); } catch { /* one repository never stops the others */ } }
+    return out;
+  }
+  return { startup: () => each('startup'), tick: () => each('idle'), lastOf: (root) => last.get(root) || null };
+}
+
+module.exports = { createAutoSync, blocker, enabledFor, QUIET_MS, RETRY_MS };