create-pmos 0.53.1 → 0.53.2

package/workspace/lib/remote-access.js

@@ -16,6 +16,13 @@
  *      Comparison is constant-time. The token is generated if not supplied and printed ONCE at
  *      startup — never logged thereafter, and request headers are never logged (D08).
  *
+ *   3. Public host (workspace-public-host) — PMOS_PUBLIC_HOST=<hostname> lets a TLS-terminating
+ *      tunnel on this machine (Cloudflare Tunnel + Cloudflare Access) forward that ONE hostname to the
+ *      loopback listener. It adds the hostname to the Host allowlist and mints a token; it never
+ *      changes what the server binds. A request that arrived through a proxy is never loopback-exempt
+ *      (see isProxied), and a request addressed to the public host must also carry Cloudflare
+ *      Access's assertion header, so a tunnel without an Access application in front fails closed.
+ *
  * Pure and side-effect-light so the guard logic is unit-testable without a live tailnet peer.
  */
 const crypto = require('crypto');
@@ -82,9 +89,28 @@ function remoteRequested(env) {
 // The one function that decides what the server may bind. Fail-closed: anything that is not
 // loopback or a tailnet address REFUSES (the server exits), so a public bind is unreachable by
 // construction. Returns {remote, binds, token, tailnetIp, generated} or {remote, refused:<msg>}.
+// A public hostname is a plain DNS name: no scheme, port, path or IP literal, and never localhost.
+// Anything else is a mistake to refuse, not a value to guess at.
+function parsePublicHost(raw) {
+  const h = String(raw == null ? '' : raw).trim().toLowerCase();
+  if (!h) return { host: null };
+  const valid = h.length <= 253 && /^(?=.*[a-z])[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(h);
+  if (!valid || h === 'localhost' || h.endsWith('.localhost') || parseIPv4(h)) {
+    return { refused: `refusing PMOS_PUBLIC_HOST="${h}": give a bare DNS hostname such as pm-os.app (no scheme, port, path or IP address).` };
+  }
+  return { host: h };
+}
+
 function resolveBinds({ env = process.env, detect = detectTailnetIp } = {}) {
+  const pub = parsePublicHost(env.PMOS_PUBLIC_HOST);
+  if (pub.refused) return { remote: false, refused: pub.refused };
+  const publicHost = pub.host;
   if (!remoteRequested(env)) {
-    return { remote: false, binds: [LOOPBACK], token: null, tailnetIp: null, generated: false };
+    if (!publicHost) return { remote: false, binds: [LOOPBACK], token: null, tailnetIp: null, generated: false, publicHost: null };
+    // Public-host mode alone: still loopback ONLY — the tunnel connects to it from this machine.
+    const supplied = (env.PMOS_TOKEN || '').trim();
+    const token = supplied || crypto.randomBytes(32).toString('base64url');
+    return { remote: false, binds: [LOOPBACK], token, tailnetIp: null, generated: !supplied, publicHost };
   }
   // An explicit bind address, when given, must itself be loopback or tailnet — never public.
   const requested = (env.PMOS_BIND_ADDR || '').trim();
@@ -103,7 +129,7 @@ function resolveBinds({ env = process.env, detect = detectTailnetIp } = {}) {
   }
   const supplied = (env.PMOS_TOKEN || '').trim();
   const token = supplied || crypto.randomBytes(32).toString('base64url');
-  return { remote: true, binds: [LOOPBACK, ip], token, tailnetIp: ip, generated: !supplied };
+  return { remote: true, binds: [LOOPBACK, ip], token, tailnetIp: ip, generated: !supplied, publicHost };
 }
 
 // ── Token extraction ──────────────────────────────────────────────────────────────────
@@ -184,20 +210,21 @@ function authorityOf(value) {
   if (scheme !== -1) h = h.slice(scheme + 3);
   return h.split('/')[0];   // host[:port]
 }
-function hostnameAllowed(authority, binds) {
+function hostnameAllowed(authority, binds, publicHost) {
   const h = hostnameOf(authority);
   if (!h) return false;
   if (h === 'localhost') return true;
   if (isLoopbackAddr(h)) return true;
   for (const b of (binds || [])) if (isTailnetIp(b) && unmap(h) === unmap(b)) return true;
+  if (publicHost && h === publicHost) return true;   // workspace-public-host: the one named hostname
   return false;
 }
 // The single decision, called from BOTH the HTTP guard and the WS-upgrade guard. Returns true when
 // the request is allowed to proceed (it may still be rejected by the token guard afterwards).
-function checkHostOrigin({ origin, host, binds }) {
+function checkHostOrigin({ origin, host, binds, publicHost }) {
   // 1. If a Host header is present, its hostname must be loopback/localhost/tailnet (anti-rebinding).
   if (host != null && host !== '') {
-    if (!hostnameAllowed(host, binds)) return false;
+    if (!hostnameAllowed(host, binds, publicHost)) return false;
   }
   // 2. If an Origin header is present, it must be same-origin with the Host it arrived on, and its
   //    hostname must itself be in the allowlist. "null"/opaque/garbage Origins are rejected.
@@ -206,11 +233,11 @@ function checkHostOrigin({ origin, host, binds }) {
     if (!oa) return false;
     const ha = authorityOf(host);
     if (ha && oa !== ha) return false;               // cross-origin → reject
-    if (!hostnameAllowed(oa, binds)) return false;   // Host absent but Origin foreign → reject
+    if (!hostnameAllowed(oa, binds, publicHost)) return false;   // Host absent but Origin foreign → reject
   }
   return true;
 }
-function isAllowedOrigin(origin, { host, binds } = {}) { return checkHostOrigin({ origin, host, binds }); }
+function isAllowedOrigin(origin, { host, binds, publicHost } = {}) { return checkHostOrigin({ origin, host, binds, publicHost }); }
 
 // Constant-time token comparison. Length is checked first (timingSafeEqual throws on a length
 // mismatch); a differing length is already a non-match, so this leaks nothing useful.
@@ -222,11 +249,41 @@ function tokenMatches(presented, expected) {
   try { return crypto.timingSafeEqual(a, b); } catch { return false; }
 }
 
+// ── Proxied requests (workspace-public-host) ────────────────────────────────────────────
+// A reverse proxy or tunnel on this machine (cloudflared, Caddy, nginx) connects from 127.0.0.1, so
+// the peer address alone would make every internet request look local and token-exempt. Each of
+// these headers is added by a proxy and never by a browser talking to the server directly, so a
+// request that carries one came from somewhere else and must present the token like any remote
+// peer. Only header NAMES are read here; no value is logged (D08).
+const PROXY_HEADERS = ['forwarded', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip',
+  'cf-connecting-ip', 'cf-ray', 'cf-access-jwt-assertion'];
+// Cloudflare Access adds this signed assertion to every request it lets through to the origin.
+const ACCESS_HEADER = 'cf-access-jwt-assertion';
+function hasHeader(headers, name) {
+  const v = (headers || {})[name];
+  return v != null && String(v) !== '';
+}
+function isProxied(headers = {}, publicHost = null) {
+  if (PROXY_HEADERS.some((n) => hasHeader(headers, n))) return true;
+  return !!publicHost && hostnameOf(headers.host) === publicHost;
+}
+// The edge check for the public host: a request addressed to it must have passed Cloudflare Access.
+// This is a PRESENCE check, not a signature check — verifying the JWT needs Cloudflare's signing keys
+// fetched over the network, which the no-network property forbids without a PM decision (D79). It
+// is still meaningful: the origin listens on loopback only, so the one way a request reaches it with
+// the public Host is through the tunnel, and a tunnel with no Access application in front sends no
+// assertion. That case fails closed (403) instead of leaving the token as the only lock.
+function edgeAllowed({ headers = {}, publicHost = null } = {}) {
+  if (!publicHost || hostnameOf(headers.host) !== publicHost) return true;
+  return hasHeader(headers, ACCESS_HEADER);
+}
+
 // The single authorization decision, PEER-based (what matters is where the request came FROM, not
-// which listener it hit). Loopback is always exempt; every non-loopback peer must present a valid
-// bearer token. Fail-closed: with no token configured, a non-loopback peer is rejected.
-function authorize({ remoteAddress, presentedToken, expectedToken }) {
-  if (isLoopbackAddr(remoteAddress)) return true;
+// which listener it hit). A loopback peer is exempt unless the request arrived through a proxy;
+// every other request must present a valid bearer token. Fail-closed: with no token configured, a
+// non-loopback or proxied request is rejected.
+function authorize({ remoteAddress, presentedToken, expectedToken, headers = {}, publicHost = null }) {
+  if (isLoopbackAddr(remoteAddress) && !isProxied(headers, publicHost)) return true;
   return tokenMatches(presentedToken, expectedToken);
 }
 
@@ -242,7 +299,27 @@ function authorize({ remoteAddress, presentedToken, expectedToken }) {
 function phoneUrl(bind, port) {
   return `http://${bind.tailnetIp}:${port}/?token=${encodeURIComponent(bind.token)}`;
 }
+function publicLines(bind) {
+  const lines = [
+    `  public:  https://${bind.publicHost}/   (through Cloudflare Tunnel + Access only; the server still binds loopback)`,
+  ];
+  if (bind.generated && !bind.remote) {
+    lines.push(`  token (generated — shown ONCE, copy it now): ${bind.token}`);
+  } else if (!bind.generated) {
+    lines.push('  token: using PMOS_TOKEN from the environment (not shown)');
+  }
+  lines.push(`  sign in: open https://${bind.publicHost}/, pass Cloudflare Access, then paste the token.`);
+  lines.push('  proxied requests always need the token; requests to the public host also need Cloudflare Access.');
+  return lines;
+}
 function startupLines(bind, port, { ansi = false } = {}) {
+  if (bind && !bind.remote && bind.publicHost) {
+    return [
+      'pmos workspace server — PUBLIC-HOST mode',
+      `  local:   http://${LOOPBACK}:${port}`,
+      ...publicLines(bind),
+    ];
+  }
   if (!bind || !bind.remote) {
     return [`pmos workspace server — http://${LOOPBACK}:${port}  (loopback only, D62)`];
   }
@@ -264,6 +341,7 @@ function startupLines(bind, port, { ansi = false } = {}) {
     lines.push(`  phone: open http://${bind.tailnetIp}:${port}/ and paste your PMOS_TOKEN into the sign-in field`);
   }
   lines.push('  loopback requests are token-free; every tailnet request must present the token.');
+  if (bind.publicHost) lines.push(...publicLines(bind));
   return lines;
 }
 
@@ -293,10 +371,11 @@ function stripTokenParam(url) {
 }
 
 // The cookie a valid token seeds. HttpOnly (no script needs it) + SameSite=Strict + the Origin/Host
-// allowlist keep a foreign site from riding it. No Secure flag: the tailnet speaks plain HTTP inside
-// WireGuard. 7 days, unchanged from workspace-mobile-remote-access.
-function sessionCookie(token) {
-  return `${COOKIE_NAME}=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=604800`;
+// allowlist keep a foreign site from riding it. No Secure flag on the tailnet: it speaks plain HTTP
+// inside WireGuard. On the public host the browser is on HTTPS (TLS ends at the edge), so the cookie
+// is Secure there and is never sent over plain HTTP. 7 days, unchanged from workspace-mobile-remote-access.
+function sessionCookie(token, { secure = false } = {}) {
+  return `${COOKIE_NAME}=${encodeURIComponent(token)}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Strict; Path=/; Max-Age=604800`;
 }
 
 // The sign-in form posts application/x-www-form-urlencoded `token=<t>` to /auth.
@@ -331,7 +410,7 @@ function signInPage({ failed = false } = {}) {
 <body><main>
   <h1>Sign in to the PMOS workspace</h1>
   ${failed ? '<p class="err" role="alert">That token does not match. Check it and try again.</p>' : ''}
-  <p>Paste the token that <code>PMOS_REMOTE=tailnet npm start</code> printed, or scan its QR code again.</p>
+  <p>Paste the token the workspace server printed when it started (<code>PMOS_REMOTE=tailnet npm start</code> or <code>PMOS_PUBLIC_HOST</code>), or scan its QR code again.</p>
   <form method="post" action="${AUTH_PATH}">
     <input type="text" name="username" value="pmos" autocomplete="username" hidden>
     <label for="token">Token</label>
@@ -346,6 +425,7 @@ module.exports = {
   LOOPBACK, isLoopbackAddr, isTailnetIp, detectTailnetIp, remoteRequested,
   resolveBinds, extractHttpToken, extractWsToken, tokenMatches, authorize, startupLines,
   checkHostOrigin, isAllowedOrigin, hostnameAllowed,
+  parsePublicHost, PROXY_HEADERS, ACCESS_HEADER, isProxied, edgeAllowed,
   COOKIE_NAME, extractCookieToken, presentedToken,
   phoneUrl, isPageNavigation, stripTokenParam, sessionCookie, AUTH_PATH, parseAuthForm, signInPage,
 };

package/workspace/lib/report-draft.js

@@ -62,6 +62,7 @@ const itemSpans = require('./item-spans.js');
 const actorLib = require('./actor.js');
 const reviewGate = require('./review-gate.js');
 const { readRules } = require('./plan-rules.js');
+const { slidesData } = require('./report-slides-data.js');
 
 const NOTE_OPEN = (id) => `<!-- pmos:note ${id} -->`;
 const NOTE_CLOSE = '<!-- /pmos:note -->';
@@ -85,6 +86,12 @@ function noteBlock(id, text) {
 /** The two notes that belong to the report, not to an initiative: the agent's headline and its asks to the audience. */
 const HEADLINE_NOTE = 'report.headline';
 const ASKS_NOTE = 'report.asks';
+/** The changelog slide's release notes (Run 6): the PM's own words; the agent never writes them (the PM's card, 2026-10-06). */
+const CHANGELOG_NOTE = 'report.changelog';
+/** The slide data block render() appends: one HTML comment on one line, so a markdown reader shows nothing of it and
+ * md-newlines --fix has no paragraph to join. */
+const SLIDES_OPEN = '<!-- pmos:slides v1';
+const SLIDES_CLOSE = '-->';
 /** The frame, in its frozen order (D78 as amended by D86 point 3). A definition's `sections` must name these. */
 const FRAME = Object.freeze(['headline', 'timeline', 'initiatives', 'new', 'decided', 'needs', 'sources']);
 const CADENCE_RE = /^[a-z][a-z0-9-]{0,39}$/;
@@ -143,7 +150,7 @@ function readJsonl(file) {
  */
 function readDefinition(root, cadence) {
   const rel = definitionPath(root, cadence);
-  const out = { path: rel, exists: false, cadence: null, audience: null, sections: FRAME.slice(), errors: [] };
+  const out = { path: rel, exists: false, cadence: null, audience: null, product: null, sections: FRAME.slice(), errors: [] };
   let text;
   try { text = fs.readFileSync(path.join(path.resolve(String(root)), rel), 'utf8'); } catch { return out; }
   out.exists = true;
@@ -164,6 +171,7 @@ function readDefinition(root, cadence) {
   out.cadence = isStr(map.cadence) ? map.cadence : null;
   if (out.cadence !== cadence) out.errors.push(`its cadence is ${JSON.stringify(out.cadence)}, not ${cadence}`);
   out.audience = isStr(map.audience) && map.audience.trim() ? map.audience.trim() : null;
+  out.product = isStr(map.product) && map.product.trim() ? map.product.trim() : null;
   if (!out.audience) out.errors.push('it names no audience, so Needs your call stays empty (X23)');
   if (Array.isArray(map.sections)) {
     const got = map.sections.map((s) => String(s).trim());
@@ -441,11 +449,30 @@ function draftOf(root, { cadence, slot, now, health } = {}) {
     : [`${plural(moved, 'initiative', 'initiatives')} moved`, off ? `${off} ${off === 1 ? 'is' : 'are'} off track` : null,
       risk ? `${risk} ${risk === 1 ? 'is' : 'are'} at risk` : null].filter(Boolean).join('; ') + '.';
 
+  // The slides (Run 6, R22.7): the roadmap snapshot, the initiative list, a slide per block and the changelog, folded
+  // here with the rest of the draft so an issued report freezes them too.
+  const stageCache = new Map();
+  const stageLabel = (id, sid) => {
+    if (!stageCache.has(id)) stageCache.set(id, new Map(planTree.stagesFor(abs, id).map((x) => [x.id, x.label])));
+    const lab = stageCache.get(id).get(sid);
+    return lab || cap(String(sid || ''));
+  };
+  const integratedAll = new Set();
+  for (const r of rows) for (const w of ((factoryJoin.factoryOf(fj, r.id) || {}).items || [])) if (w && w.integrated && w.plan_item) integratedAll.add(w.plan_item);
+  const slides = slidesData({
+    product: def.product || path.basename(main), cadence, slot: theSlot, nowMs, window, cycleDays: cycle,
+    blocks, rows, itemsOf,
+    stageLabel, horizonOf: (id) => placements.horizonOf(plc, id),
+    rankOf: (id) => (has(plc.byInit, id) && Number.isFinite(plc.byInit[id].rank) ? plc.byInit[id].rank : Infinity),
+    isDone: (it) => it.state === 'done' || integratedAll.has(it.id),
+  });
+
   return {
     ok: true, cadence, slot: theSlot, window, path: rel,
     issued: issuedHere ? { at: issuedHere.at, by: actorLib.pageName(issuedHere.by), sha: issuedHere.sha, path: issuedHere.path } : null,
     headline, timeline, blocks, new_since_last: newSince, decided, needs_your_call: asks,
     sources: { reached, not_reached: notReached, definition: { path: def.exists ? def.path : null, audience: def.audience } },
+    slides,
   };
 }
 
@@ -499,7 +526,7 @@ function render(draft, { notes } = {}) {
   push('## New since last report', '');
   if (!draft.new_since_last.length) push('None.');
   for (const x of draft.new_since_last) push(`- ${x.title} (${x.id}), ${short(x.at)}`);
-  push('');
+  push('', '**Changelog** (your release notes for the changelog slide)', '', noteBlock(CHANGELOG_NOTE, noteOf(CHANGELOG_NOTE)), '');
 
   push('## Decided this cycle', '');
   if (!draft.decided.length) push('None.');
@@ -520,12 +547,14 @@ function render(draft, { notes } = {}) {
   push('');
 
   // Every note is kept, byte for byte: a note whose initiative left the window moves here instead of being lost.
-  const placed = new Set([HEADLINE_NOTE, ...(audience ? [ASKS_NOTE] : []), ...draft.blocks.map((b) => b.id)]);
+  const placed = new Set([HEADLINE_NOTE, CHANGELOG_NOTE, ...(audience ? [ASKS_NOTE] : []), ...draft.blocks.map((b) => b.id)]);
   const orphans = Object.keys(n).filter((k) => !placed.has(k)).sort(byText);
   if (orphans.length) {
     push('## Notes kept from an earlier draft', '', 'These initiatives are not in this window. Their notes are kept as they were written.', '');
     for (const k of orphans) push(noteBlock(k, n[k]), '');
   }
+  // The slides' data, frozen with the text. JSON escapes "<" and ">" so the block cannot close early or open a marker.
+  if (draft.slides) push(SLIDES_OPEN + ' ' + JSON.stringify(draft.slides).replace(/</g, '\\u003c').replace(/>/g, '\\u003e') + ' ' + SLIDES_CLOSE, '');
   return out.join('\n');
 }
 
@@ -574,5 +603,5 @@ function writeDraft(root, draft, { actor, notes, fresh } = {}) {
 
 module.exports = {
   draftOf, render, writeDraft, readNotes, noteBlock, NOTE_OPEN, NOTE_CLOSE, NOTE_RE, NOTE_ID_RE,
-  readDefinition, stateRel, draftPath, definitionPath, FRAME, HEADLINE_NOTE, ASKS_NOTE,
+  readDefinition, stateRel, draftPath, definitionPath, FRAME, HEADLINE_NOTE, ASKS_NOTE, CHANGELOG_NOTE, SLIDES_OPEN,
 };

package/workspace/lib/report-slides-data.js

@@ -0,0 +1,141 @@
+'use strict';
+/* report-slides-data.js — the data of the biweekly slides, folded with the draft (pm-os-absorb Run 6; PRD R22.7).
+ *
+ *   slidesData(input) → { v: 1, meta, roadmap, list, initiatives }
+ *
+ * The PM asked for the PM-OS biweekly deck, cut to four slides: the roadmap snapshot, the initiative list, one slide per
+ * initiative and the changelog (2026-10-06); the changelog is the PM's own `report.changelog` note, not data folded
+ * here (the PM's card answer, 2026-10-06). report-draft.js calls this inside draftOf and render() writes the result
+ * into the draft as one `<!-- pmos:slides v1 … -->` block, so an issued report freezes its slides with its text. The
+ * page (public/pm/report-slides.js) only draws what is here: it computes nothing.
+ *
+ * Pure: no file, no clock and no git. Everything comes in through `input`, so two calls with the same input give the
+ * same bytes (the drafter's determinism rule, X18). Proposed and withdrawn items never count, as in the blocks.
+ */
+
+const DAY = 86400000;
+/** YYYY-MM-DD of a time, or null when the time is not a time: one bad row is skipped, never fatal to the draft. */
+const dayOf = (t) => { const d = new Date(t); return Number.isFinite(d.getTime()) ? d.toISOString().slice(0, 10) : null; };
+const byText = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const MONTHS_SHOWN = 6;
+const HORIZON_WORD = { now: 'Now', next: 'Next', later: 'Later' };
+const RELEASE_RE = /\brelease\b/i;
+const ESTIMATED_STATES = new Set(['todo']);
+
+/** "person:Sheryl" -> "Sheryl"; you -> "You"; agent -> "Agent"; none -> null. */
+function ownerName(owner) {
+  const s = String(owner || '');
+  if (!s) return null;
+  if (s === 'you') return 'You';
+  if (s === 'agent') return 'Agent';
+  const m = /^(?:person|tracker):(.+)$/.exec(s);
+  return m ? m[1] : s;
+}
+
+/** The first day of the month `n` months after the month of `ymd`, as YYYY-MM. */
+function monthPlus(ymd, n) {
+  const y = Number(ymd.slice(0, 4)); const m = Number(ymd.slice(5, 7)) - 1 + n;
+  const yy = y + Math.floor(m / 12); const mm = ((m % 12) + 12) % 12;
+  return `${yy}-${String(mm + 1).padStart(2, '0')}`;
+}
+
+/** Does [start, due] (either may be missing) touch [from, to]? All YYYY-MM-DD. */
+function overlaps(start, due, from, to) {
+  const s = start || due; const e = due || start;
+  return !!s && s <= to && e >= from;
+}
+
+/**
+ * input = {
+ *   product, cadence, slot, nowMs, window: { from, to },  cycleDays,
+ *   blocks,                                   // the draft's blocks, in the report's order
+ *   rows,                                     // the work-lane records: { id, title, stopped? }
+ *   itemsOf(id) → fold items,  stageLabel(id, stageId) → label,  horizonOf(id) → now|next|later|null,  rankOf(id) → number,
+ *   isDone(item) → bool
+ * }
+ */
+function slidesData(input) {
+  const { product, cadence, slot, nowMs, window, cycleDays, blocks, rows, itemsOf, stageLabel, horizonOf, rankOf, isDone } = input;
+  const today = dayOf(nowMs);
+  const lastFrom = dayOf(Date.parse(window.from));
+  const lastTo = dayOf(Date.parse(window.to));
+  const nextTo = dayOf(nowMs + cycleDays * DAY);
+  const live = (id) => itemsOf(id).filter((it) => it && !it.proposed && it.state !== 'withdrawn');
+  const itemOut = (id, it) => ({
+    title: it.title, stage: stageLabel(id, it.stage), owner: ownerName(it.owner), milestone: !!it.milestone, done: isDone(it),
+    date: it.milestone ? (it.due || it.start || null) : null,
+  });
+  const milestonesOf = (its) => its.filter((it) => it.milestone && (it.due || it.start));
+  const nextMilestone = (id, its) => {
+    const open = milestonesOf(its).filter((it) => !isDone(it))
+      .sort((a, b) => byText(a.due || a.start, b.due || b.start) || byText(a.id, b.id));
+    if (!open.length) return null;
+    const d = open[0].due || open[0].start;
+    return { title: open[0].title, due: d, overdue: d < today };
+  };
+  const releaseOf = (its) => {
+    const r = milestonesOf(its).filter((it) => RELEASE_RE.test(it.title)).sort((a, b) => byText(b.due || b.start, a.due || a.start));
+    return r.length ? r[0].due || r[0].start : null;
+  };
+
+  /* the roadmap snapshot: every live work initiative with dated items, grouped Now / Next / Later in Roadmap order */
+  const fromMonth = monthPlus(today, -1);
+  const months = Array.from({ length: MONTHS_SHOWN }, (_, k) => monthPlus(fromMonth + '-01', k));
+  const groups = [];
+  for (const h of ['now', 'next', 'later']) {
+    const inH = rows.filter((r) => !r.stopped && horizonOf(r.id) === h)
+      .sort((a, b) => (rankOf(a.id) - rankOf(b.id)) || byText(a.id, b.id));
+    const out = [];
+    for (const r of inH) {
+      const its = live(r.id).filter((it) => it.start || it.due);
+      if (!its.length) continue;
+      const byStage = new Map();
+      for (const it of its) {
+        const s = it.start || it.due; const e = it.due || it.start;
+        const g = byStage.get(it.stage);
+        if (!g) byStage.set(it.stage, { stage: it.stage, label: stageLabel(r.id, it.stage), start: s, due: e });
+        else { if (s < g.start) g.start = s; if (e > g.due) g.due = e; }
+      }
+      const segments = [...byStage.values()].sort((a, b) => byText(a.start, b.start) || byText(a.due, b.due) || byText(String(a.stage), String(b.stage)));
+      out.push({
+        id: r.id, title: r.title || r.id,
+        estimated: its.every((it) => ESTIMATED_STATES.has(it.state)),
+        segments,
+        milestones: milestonesOf(its).map((it) => ({ title: it.title, due: it.due || it.start, done: isDone(it) }))
+          .sort((a, b) => byText(a.due, b.due) || byText(a.title, b.title)),
+      });
+    }
+    if (out.length) groups.push({ name: HORIZON_WORD[h], rows: out });
+  }
+
+  /* one slide per active initiative, and the list of them: the blocks of the draft, nothing more */
+  const initiatives = blocks.map((b) => {
+    const its = live(b.id);
+    const doneDay = (it) => (it.doneAt ? dayOf(Date.parse(it.doneAt)) : null);
+    const lastItems = its.filter((it) => (isDone(it) && doneDay(it) && doneDay(it) >= lastFrom && doneDay(it) <= lastTo)
+      || (!isDone(it) && overlaps(it.start, it.due, lastFrom, lastTo)));
+    const nextIds = new Set((b.coming_cycle.items || []).map((x) => x.id));
+    for (const c of b.last_cycle.carried || []) nextIds.add(c.id);
+    const nextItems = its.filter((it) => nextIds.has(it.id) || (!isDone(it) && overlaps(it.start, it.due, lastTo, nextTo)));
+    const total = b.progress.total;
+    return {
+      id: b.id, title: b.title, status: b.stage,
+      pct: total ? Math.round((100 * b.progress.done) / total) : null, done: b.progress.done, total,
+      next_milestone: nextMilestone(b.id, its), release: releaseOf(its),
+      last: lastItems.map((it) => itemOut(b.id, it)),
+      next: nextItems.map((it) => itemOut(b.id, it)),
+    };
+  });
+  const list = initiatives.map((x) => ({ id: x.id, title: x.title, status: x.status, pct: x.pct, next_milestone: x.next_milestone, release: x.release }))
+    .sort((a, b) => ((a.release ? 0 : 1) - (b.release ? 0 : 1)) || byText(a.release || '', b.release || ''));
+
+  return {
+    v: 1,
+    meta: { product: product || '', cadence: cadence[0].toUpperCase() + cadence.slice(1), slot, today, last: { from: lastFrom, to: lastTo }, next: { from: lastTo, to: nextTo } },
+    roadmap: { months, today, groups },
+    list,
+    initiatives,
+  };
+}
+
+module.exports = { slidesData, ownerName, monthPlus, overlaps };

package/workspace/lib/routes-initiatives.js

@@ -178,6 +178,39 @@ function roadmapOf(w, F) {
   };
 }
 
+/**
+ * The units the library groups as an initiative (a PRD, a rubric, a prototype folder) with no record behind them. The
+ * panel lists them under "no record"; without this the Roadmap and the List hid them, so a PRD-only initiative was
+ * invisible on Initiatives. They are listed, never placed: a record is what anchors and places an initiative (D59).
+ */
+function unrecordedOf(ctx, root, rows) {
+  if (!ctx.initiativeIndex) return [];
+  const known = new Set((rows || []).map((r) => r && r.id).filter(Boolean));
+  const claimed = claimedPaths(root, rows);
+  let groups = [];
+  try { groups = ctx.initiativeIndex(root).initiatives || []; } catch { return []; }
+  // A unit is unrecorded when no record has its id AND no record points at its documents (a record's `prd_path` may name
+  // a file whose stem is not the record's id).
+  const own = (g) => (g.artifacts || []).filter((a) => !a.shared);
+  return groups.filter((g) => g && g.id && !known.has(g.id) && own(g).length && !own(g).every((a) => claimed.has(String(a.path || '').split(path.sep).join('/'))))
+    .map((g) => ({ id: g.id, title: g.title || g.id, artifacts: g.artifacts.filter((a) => !a.shared).map((a) => ({ name: a.name, path: a.path, role: a.role || null })) }))
+    .sort((a, b) => a.title.localeCompare(b.title));
+}
+
+/** Every repository-relative `.md` path a record's frontmatter names (prd_path, rubric_path, brief_path, …). */
+function claimedPaths(root, rows) {
+  const out = new Set();
+  for (const r of rows || []) {
+    if (!r || !r.record) continue;
+    let text = '';
+    try { text = fs.readFileSync(path.isAbsolute(r.record) ? r.record : path.join(root, r.record), 'utf8'); } catch { continue; }
+    const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+    if (!fm) continue;
+    for (const m of fm[1].matchAll(/^[A-Za-z_]+:\s*["']?([^"'\n]+?\.md)["']?\s*$/gm)) out.add(m[1].trim().replace(/^\.\//, ''));
+  }
+  return out;
+}
+
 function listOf(w, F) {
   const all = Object.values(F.placed.order).flat().filter((id) => F.byId.has(id)).map((id) => rowOf(F, F.byId.get(id)));
   const groups = new Map();      // objective key -> { objective, anchors: Map(anchorKey -> group) }
@@ -327,7 +360,7 @@ async function handle(req, res, url, ctx) {
         return true;
       }
       const body = view === 'list' ? listOf(w, F) : roadmapOf(w, F);
-      ctx.json(res, { ...head, view, sig, now: new Date(now).toISOString(), rules: F.rules, ...body });
+      ctx.json(res, { ...head, view, sig, now: new Date(now).toISOString(), rules: F.rules, ...body, unrecorded: unrecordedOf(ctx, w.root, rows) });
     } catch (e) {
       ctx.json(res, { ok: false, error: 'the initiatives could not be read: ' + String((e && e.message) || e).slice(0, 160) }, 500);
     }
@@ -368,4 +401,4 @@ async function handle(req, res, url, ctx) {
   return true;
 }
 
-module.exports = { prefixes: ['/api/initiatives', '/api/placements', '/api/measurements'], handle, sigOf, rowOf, frameOf, roadmapOf, listOf, sheetOf };
+module.exports = { prefixes: ['/api/initiatives', '/api/placements', '/api/measurements'], handle, sigOf, rowOf, frameOf, roadmapOf, listOf, sheetOf, unrecordedOf };

package/workspace/lib/routes-reports.js

@@ -5,7 +5,7 @@
  *                                                with the `sig` the page watches (public/pm/sig-watch.js, 10 s)
  *   GET  /api/report/draft?ws=&cadence=&slot=    one report file as it is now: its markdown, its note texts, its blob sha
  *   POST /api/report/draft   { ws, cadence, slot?, redraft? }   Draft now, and Redraft (the notes are kept)
- *   POST /api/report/note    { ws, cadence, slot, id, text }    one note, by initiative id (or report.headline, report.asks)
+ *   POST /api/report/note    { ws, cadence, slot, id, text }    one note, by initiative id (or report.headline, report.asks, report.changelog)
  *   POST /api/report/issue   { ws, cadence, slot, sha }          Issue: the PM's act (R25)
  *
  * WHICH GUARD. A draft and a note are page writes, not PM-only acts: both call pm-guard.js requirePagePress. Issue is a
@@ -135,10 +135,10 @@ async function handle(req, res, url, ctx) {
   if (p === '/api/report/note') {
     if (!cs.slot) return refuse(ctx, res, 400, 'slot must be a date, YYYY-MM-DD');
     const id = String(body.id || '');
-    if (!NOTE_ID_RE.test(id)) return refuse(ctx, res, 400, 'id must be an initiative id, report.headline or report.asks');
+    if (!NOTE_ID_RE.test(id)) return refuse(ctx, res, 400, 'id must be an initiative id, report.headline, report.asks or report.changelog');
     if (typeof body.text !== 'string') return refuse(ctx, res, 400, 'text must be a string');
     if (body.text.length > MAX_NOTE) return refuse(ctx, res, 413, `a note is at most ${MAX_NOTE} characters`);
-    if (/<!--\s*\/?pmos:note/.test(body.text)) return refuse(ctx, res, 400, 'a note cannot hold a note marker');
+    if (/<!--\s*\/?pmos:(?:note|slides)/.test(body.text)) return refuse(ctx, res, 400, 'a note cannot hold a note marker or a slides block');
     const old = findReport(RN.reportsOf(root), cs.cadence, cs.slot);
     const file = old ? readFile(root, old.path) : null;
     if (!file) return refuse(ctx, res, 404, `there is no ${cs.cadence} draft for ${cs.slot}; press Draft now first`);

package/workspace/lib/sync.js

@@ -18,6 +18,10 @@ const { execFile } = require('child_process');
 const RECORD_PATHS = ['planning', 'pmos', '.pmos-profile', '.gitattributes'];
 const NET_TIMEOUT_MS = 60000;
 const LOCAL_TIMEOUT_MS = 10000;
+// A reading compares HEAD with the remote-tracking ref the LAST fetch left, so it can say nothing about what another
+// machine pushed since. Past this age (or with no fetch on record) the reading is `remote_stale`: the bar offers Sync
+// rather than claim the repository is in sync on old evidence. Still no network: the age is the mtime of FETCH_HEAD.
+const REMOTE_FRESH_MS = 10 * 60 * 1000;
 
 function run(root, args, { net = false, raw = false } = {}) {
   return new Promise((resolve) => {
@@ -28,6 +32,23 @@ function run(root, args, { net = false, raw = false } = {}) {
   });
 }
 
+// When this clone last heard from its remote: the mtime of FETCH_HEAD, which every fetch rewrites. null = never.
+async function remoteCheckedAt(root) {
+  const p = await run(root, ['rev-parse', '--git-path', 'FETCH_HEAD']);
+  if (!p.ok || !p.out) return null;
+  try { return fs.statSync(path.resolve(root, p.out)).mtime; } catch { return null; }
+}
+
+// A document repository (`.pmos-profile` says pm-artifacts, D68) holds nothing but the PM's documents, so every file
+// in it is a record. A code repository's records are RECORD_PATHS only.
+function profileOf(root) {
+  try {
+    const prof = fs.readFileSync(path.join(root, '.pmos-profile'), 'utf8').split('\n').map((l) => l.replace(/#.*$/, '').trim()).find(Boolean);
+    return prof === 'pm-artifacts' ? 'pm-artifacts' : 'product-code';
+  } catch { return 'product-code'; }
+}
+const recordTestFor = (root) => (profileOf(root) === 'pm-artifacts' ? () => true : isRecord);
+
 const isRecord = (rel) => RECORD_PATHS.some((p) => rel === p || rel.startsWith(`${p}/`));
 
 // PM repositories append ledgers from several machines; `merge=union` keeps both sides' lines instead
@@ -55,8 +76,9 @@ async function status(root) {
   const up = await run(root, ['rev-parse', '--abbrev-ref', `${branch}@{upstream}`]);
   const porcelain = await run(root, ['status', '--porcelain', '--untracked-files=all'], { raw: true });
   const files = porcelain.out ? porcelain.out.split('\n').filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, '').replace(/.* -> /, '')) : [];
-  const dirtyRecords = files.filter(isRecord);
-  const dirtyOther = files.filter((f) => !isRecord(f));
+  const rec = recordTestFor(root);
+  const dirtyRecords = files.filter(rec);
+  const dirtyOther = files.filter((f) => !rec(f));
   let ahead = null; let behind = null;
   if (up.ok) {
     const c = await run(root, ['rev-list', '--left-right', '--count', `HEAD...${up.out}`]);
@@ -64,11 +86,14 @@ async function status(root) {
   }
   const mid = ['MERGE_HEAD', 'rebase-merge', 'rebase-apply', 'CHERRY_PICK_HEAD']
     .some((f) => fs.existsSync(path.join(root, '.git', f)));
+  const checked = up.ok ? await remoteCheckedAt(root) : null;
+  const remoteStale = up.ok && (!checked || Date.now() - checked.getTime() > REMOTE_FRESH_MS);
   const state = mid ? 'mid-operation' : !up.ok ? 'no-upstream'
     : ahead && behind ? 'diverged' : behind ? 'behind' : ahead ? 'ahead'
-      : dirtyRecords.length ? 'dirty' : 'in-sync';
+      : dirtyRecords.length ? 'dirty' : remoteStale ? 'unchecked' : 'in-sync';
   return { ok: true, branch, upstream: up.ok ? up.out : null, ahead, behind,
     dirty_records: dirtyRecords.length, dirty_other: dirtyOther.length, state,
+    remote_checked_at: checked ? checked.toISOString() : null, remote_stale: remoteStale,
     network_used: false };
 }
 
@@ -93,8 +118,9 @@ async function sync(root, { label } = {}) {
   const addedAttr = ensureUnionAttribute(root);
   const s1 = await status(root);
   if (s1.dirty_records || addedAttr) {
-    const present = RECORD_PATHS.filter((p) => fs.existsSync(path.join(root, p)));
-    const add = await run(root, ['add', '--', ...present]);
+    // a document repository records every change; a code repository its record paths only
+    const present = profileOf(root) === 'pm-artifacts' ? ['-A'] : ['--', ...RECORD_PATHS.filter((p) => fs.existsSync(path.join(root, p)))];
+    const add = await run(root, ['add', ...present]);
     if (!add.ok) return stop('commit', `could not stage records — ${add.err}`);
     const staged = await run(root, ['diff', '--cached', '--name-only']);
     if (staged.out) {
@@ -129,4 +155,33 @@ async function sync(root, { label } = {}) {
   return { ok: true, steps, message: 'in sync', after: await status(root) };
 }
 
-module.exports = { status, sync, ensureUnionAttribute, RECORD_PATHS, isRecord };
+// ── facts the idle auto-sync needs (D70 as amended 2026-10-06). All local: no network. ──────────
+
+// The paths this machine's unpushed commits touch, or null when they cannot be read.
+async function unpushedPaths(root, upstream) {
+  const d = await run(root, ['diff', '--name-only', `${upstream}...HEAD`]);
+  return d.ok ? d.out.split('\n').filter(Boolean) : null;
+}
+
+// The newest mtime (ms) among the uncommitted record files, or 0 when none is dirty.
+async function newestDirtyRecordMs(root) {
+  const porcelain = await run(root, ['status', '--porcelain', '--untracked-files=all'], { raw: true });
+  const files = porcelain.out ? porcelain.out.split('\n').filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, '').replace(/.* -> /, '')) : [];
+  let newest = 0;
+  for (const f of files.filter(recordTestFor(root))) {
+    try { newest = Math.max(newest, fs.statSync(path.join(root, f)).mtimeMs); } catch { /* deleted: no time to read */ }
+  }
+  return newest;
+}
+
+// The remote's default branch as this clone last saw it (refs/remotes/<remote>/HEAD), else main or master if the
+// remote has one. null when none of these is known.
+async function defaultBranchOf(root, remote) {
+  const h = await run(root, ['symbolic-ref', '--short', `refs/remotes/${remote}/HEAD`]);
+  if (h.ok && h.out.startsWith(`${remote}/`)) return h.out.slice(remote.length + 1);
+  for (const b of ['main', 'master']) if ((await run(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/${remote}/${b}`])).ok) return b;
+  return null;
+}
+
+module.exports = { status, sync, ensureUnionAttribute, RECORD_PATHS, isRecord, REMOTE_FRESH_MS,
+  unpushedPaths, newestDirtyRecordMs, defaultBranchOf, profileOf };

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.53.1",
+  "version": "0.53.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {