create-pmos 0.53.1 → 0.53.2

package/workspace/public/pm/roadmap.js

@@ -27,6 +27,7 @@ import { loadSortable, baseOptions, dragSet } from './bd-drag.js';
 import { COPY, shortDate } from './initiatives-copy.js';
 import { getRoadmap, sigKey, place, placed, leaveNow } from './initiatives-api.js';
 import { healthSignal, say, checkBySheet, onContextMenu } from './initiatives-ui.js';
+import { openDoc } from './panel-initiatives.js';
 
 const HORIZONS = ['now', 'next', 'later'];
 
@@ -37,6 +38,7 @@ export function mountRoadmap(host, env) {
   let data = null;
   let error = null;
   let showDormant = false;
+  let showUnrecorded = false;
   let dragging = false;
   let deferred = null;
   let focusId = null;
@@ -150,6 +152,18 @@ export function mountRoadmap(host, env) {
     });
   }
 
+  // A unit with documents and no record (routes-initiatives.js unrecordedOf). It opens its PRD, or its first document; it
+  // has no menu and no grip, because only a record can be placed.
+  function unrecordedCard(u) {
+    const doc = u.artifacts.find((a) => a.role === 'PRD') || u.artifacts[0];
+    const roles = [...new Set(u.artifacts.map((a) => a.role).filter(Boolean))];
+    return card({
+      title: u.title, meta: [COPY.noRecord, ...(roles.length ? [roles.join(' · ')] : [])],
+      onOpen: () => openDoc(null, doc.path, doc.role || 'DOC'), openLabel: COPY.aria.open(u.title),
+      muted: true, attrs: { class: 'in-card', 'data-in-unrecorded-card': u.id }, openAttrs: { 'data-in-unrecorded-open': u.id },
+    });
+  }
+
   function column(h) {
     const rows = data.horizons[h] || [];
     const list = el('div', { class: 'in-list', 'data-in-list': h, role: 'list', 'aria-label': COPY.aria.column(COPY.horizons[h]) }, rows.map((r) => cardOf(r, { grip: true })));
@@ -166,6 +180,15 @@ export function mountRoadmap(host, env) {
       }));
       if (showDormant) kids.push(el('div', { class: 'in-list in-list--dormant', 'data-in-dormant': '' }, data.dormant.map((r) => cardOf(r, { grip: false }))));
     }
+    if (h === 'later' && data.unrecorded && data.unrecorded.length) {
+      const n = data.unrecorded.length;
+      kids.push(button({
+        label: showUnrecorded ? COPY.hideUnrecorded(n) : COPY.unrecorded(n), variant: 'ghost', size: 'sm',
+        icon: showUnrecorded ? 'chevron-down' : 'chevron-right', attrs: { 'data-in-unrecorded-toggle': '', 'aria-expanded': showUnrecorded ? 'true' : 'false' },
+        onClick: () => { showUnrecorded = !showUnrecorded; render(); },
+      }));
+      if (showUnrecorded) kids.push(el('div', { class: 'in-list in-list--dormant', 'data-in-unrecorded': '' }, data.unrecorded.map(unrecordedCard)));
+    }
     return el('section', { class: 'in-col', 'data-in-col': h, 'aria-label': COPY.horizons[h] }, kids);
   }
 

package/workspace/public/pm/slides-copy.js

@@ -0,0 +1,52 @@
+/* pm/slides-copy.js — every word on the biweekly slides and their deck (pm-os-absorb Run 6; PRD R22.7).
+ *
+ * Pure data and pure functions. No DOM and no import, so glossary.test.js loads this file in Node and checks each string
+ * against the glossary rules. report-slides.js draws the slides from these strings and nothing else.
+ *
+ * The slides copy the PM-OS biweekly deck word for word: the PM asked for the slide format "exactly" as PM-OS has it
+ * (2026-10-06). So GLOSSARY.exempt lifts two rules for this file only: the column and slide names "Release" and "Release
+ * notes", and the empty column "Nothing shipped.", are the PM-OS deck's own words. Everywhere else in the workspace the
+ * rules hold. A slide is still ISSUED with its report, never sent (D71): the issued-not-sent rule applies here too.
+ */
+
+export const COPY = {
+  slidesTitle: 'Slides',
+  slidesMissing: 'This report has no slides. Redraft it to get them.',
+  slidesPrev: 'Previous slide',
+  slidesNext: 'Next slide',
+  slidesClose: 'Close the slides',
+  slidesCount: (n, of) => n + ' / ' + of,
+  print: 'Print / PDF',
+  more: (n) => '+' + n + ' more',
+  roadmap: 'Roadmap',
+  list: 'Initiative progress',
+  changelog: 'Release notes',
+  issues: 'Issues',
+  duration: 'Duration',
+  initiative: 'Initiative',
+  status: 'Status',
+  nextMilestone: 'Next milestone',
+  release: 'Release',
+  overdue: (d) => 'Overdue · ' + d,
+  noBreakdown: 'No breakdown',
+  noInitiatives: 'No initiatives in this window.',
+  lastCycle: 'Last cycle',
+  nextCycle: 'Next cycle',
+  milestone: 'Milestone',
+  nothingShipped: 'Nothing shipped.',
+  nothingPlanned: 'Nothing planned.',
+  noteType: { note: 'Note', info: 'Info', warning: 'Warning' },
+  noReleaseNotes: 'No release notes logged.',
+  entries: (n) => n + (n === 1 ? ' entry' : ' entries'),
+};
+
+export const GLOSSARY = {
+  exempt: {
+    release: 'The PM-OS deck names its column "Release" and its slide "Release notes"; the PM asked for that format exactly (2026-10-06).',
+    claims: 'The PM-OS deck says "Nothing shipped." in an empty Last cycle; the PM asked for that format exactly (2026-10-06).',
+  },
+  extra: [
+    { id: 'issued-not-sent', re: /\b(?:sent|sends?|sending|e-?mail(?:s|ed|ing)?|shar(?:e|es|ed|ing)|post(?:s|ed|ing)? to)\b/i, why: 'A report is issued, never sent (D71). The slides have no control that moves a report out of the workspace.' },
+  ],
+  guide: 'report-slides.md',
+};

package/workspace/public/pm/tokens.css

@@ -66,6 +66,19 @@
   --term-bg:oklch(0.148 0.004 228.8);
   --mono:"IBM Plex Mono",ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
   --sans:"Space Grotesk",ui-sans-serif,system-ui,sans-serif;
+  /* the biweekly slides (Run 6): the PM-OS slide palette, the same in both themes because a slide is a printed page */
+  --slide-bg:oklch(1 0 0);--slide-fg:oklch(0.148 0.004 228.8);--slide-muted:oklch(0.56 0.021 213.5);
+  --slide-foot:oklch(0.556 0 0);--slide-rule:#d8d6cb;--slide-border:oklch(0.925 0.005 214.3);
+  --slide-secondary:oklch(0.967 0.001 286.375);--slide-track:oklch(0.963 0.002 197.1);
+  --slide-brand:#2433a4;--slide-primary:oklch(0.488 0.243 264.376);--slide-overdue:oklch(0.577 0.245 27.325);
+  --slide-stage:oklch(0 0 0);--slide-open:#94a3b8;--slide-done:#10b981;
+  --slide-ph-intake:#8b5cf6;--slide-ph-spec:#f59e0b;--slide-ph-build:#3b82f6;--slide-ph-evaluate:#06b6d4;
+  --slide-ph-handoff:#10b981;--slide-ph-other:#64748b;
+  --slide-now:#1a56db;--slide-next:#d97706;--slide-later:#64748b;
+  --slide-launch:#047857;--slide-launch-bg:#10b9811a;--slide-improvement:#2f6feb;--slide-improvement-bg:#2f6feb1a;
+  --slide-fix:#92400e;--slide-fix-bg:#f59e0b1f;--slide-security:#b91c1c;--slide-security-bg:#dc26261a;
+  --slide-deprecation:#4b5563;--slide-deprecation-bg:#4b55631a;--slide-beta:#6d28d9;--slide-beta-bg:#6d28d91a;
+  --slide-note-info:#2563eb;--slide-note-warning:#b45309;
 }
 [data-pm-theme="light"],html[data-pm-page-theme="light"]{
   --background:oklch(1 0 0);--foreground:oklch(0.148 0.004 228.8);

package/workspace/public/pm/topbar.js

@@ -25,9 +25,12 @@ import { COPY } from './frame-copy.js';
 /** The destinations the bar names, in order. Settings sits at the end of the bar, after Sync. */
 export const BAR_DESTS = Object.freeze(['today', 'initiatives', 'board', 'reports']);
 
-/** Is this sync reading "not in sync"? Behind, ahead or records not yet recorded. An unreadable status is not shown. */
+/** Is this sync reading "not in sync"? Behind, ahead, records not yet recorded, or `remote_stale`: no fetch in the last
+ * few minutes, so another machine's push would be invisible here and "in sync" cannot be claimed. An unreadable status
+ * is not shown. */
 export function unsyncedOf(st) {
-  return !!st && st.ok !== false && ((st.behind | 0) > 0 || (st.ahead | 0) > 0 || (st.dirty_records | 0) > 0);
+  return !!st && st.ok !== false
+    && ((st.behind | 0) > 0 || (st.ahead | 0) > 0 || (st.dirty_records | 0) > 0 || st.remote_stale === true);
 }
 
 export function createTopbar({ go, openPalette, repoMenu, sync } = {}) {

package/workspace/replaced-tests.json

@@ -23,7 +23,9 @@
       "run": "2A",
       "ref": "contract-run2 done_criteria 14 (the plan-routes.test.js Origin cases)",
       "reason": "R9 asserted the route's own no-Origin text, which named the terminal route. After Run 2 the route runs pm-guard first, so R9 now asserts pm-guard's refusal; the 403 and the nothing-written check stay.",
-      "names": ["R9 a POST with no Origin is 403 and names the terminal route; nothing is written"]
+      "names": [
+        "R9 a POST with no Origin is 403 and names the terminal route; nothing is written"
+      ]
     },
     {
       "id": "STG-SLACK",
@@ -37,6 +39,26 @@
         "G14 the new settings are checked: name length, source names, booleans",
         "I6 an unknown brief source is refused with the allowed names"
       ]
+    },
+    {
+      "id": "S6-D86",
+      "file": "workspace/d86-seams.test.js",
+      "run": "6",
+      "ref": "Run 6 contract, 'Deliberate test and budget changes' (planning/evals/pm-os-absorb-eval-rubric.md)",
+      "reason": "The draft golden gains the slides key: the drafter now writes the slide data with the draft (PRD R22.7). The assertion keeps its name and still checks every D78 section and the reason rule.",
+      "names": [
+        "10 the draft golden has every section of the D78 frame (headline, timeline, blocks, new, decided, needs your call, sources), and every block not on track has a reason"
+      ]
+    },
+    {
+      "id": "S6-FP",
+      "file": "workspace/first-paint-count.test.js",
+      "run": "6",
+      "ref": "Run 6 contract, 'Deliberate test and budget changes' (planning/evals/pm-os-absorb-eval-rubric.md)",
+      "reason": "The Reports budget rose to 15 for Present, but specimen A did not change. The calibration now reads SPECIMEN_A, specimen A's own counts, instead of EXPECT, the budgets. The name and the four numbers are unchanged.",
+      "names": [
+        "(a) calibration: the audit on specimen A gives exactly Today 17, Initiatives 24, Board 33, Reports 14 outside the dock"
+      ]
     }
   ],
   "entries": [

package/workspace/server.js

@@ -1789,6 +1789,14 @@ function readLedger(w, basename) {
 // D70 — the lifecycle ledger: the latest line for an initiative wins; `active` reopens. The same rule
 // as scripts/workflow-state.js#readLifecycle (a parity case in workspace/test.js keeps them in step).
 const syncing = new Set();   // repositories with a sync in flight — one at a time
+// D70 as amended 2026-10-06: the same Sync, run without the press at startup and when work sits unpushed and quiet.
+// Every rule it must pass is in lib/auto-sync.js; a scratch server (its own PMOS_STATE_DIR) does not auto-sync.
+const autoSync = require('./lib/auto-sync').createAutoSync({
+  roots: () => [...new Set([...workspaces.values()].map((w) => w.root))],
+  busy: syncing,
+  onDone: (root) => boardCache.invalidate(root),
+  label: `${os.hostname()} (auto-sync)`,
+});
 const STOPPED_STATES = ['closed', 'on-hold', 'cancelled'];
 function readLifecycle(w) {
   const latest = new Map();
@@ -2317,7 +2325,7 @@ function checkDueSchedules() {
 // PMOS_TICK_MS exists for the suites (same footing as PMOS_LIVENESS_MS): proactive-prepare.test.js
 // used to wait on two real minutes of this clock. Unset, the interval is the 60 seconds it always was.
 const TICK_MS = Math.max(200, Number(process.env.PMOS_TICK_MS) || 60000);
-try { const _tick = setInterval(() => { checkDueSchedules(); proactiveTick(); try { prepareTick({ manual: false }); } catch { /* the next tick tries again */ } }, TICK_MS); if (_tick.unref) _tick.unref(); } catch {}
+try { const _tick = setInterval(() => { checkDueSchedules(); proactiveTick(); try { prepareTick({ manual: false }); } catch { /* the next tick tries again */ } autoSync.tick().catch(() => {}); }, TICK_MS); if (_tick.unref) _tick.unref(); } catch {}
 
 // ── Sessions: real PTYs, owned by the server, with disk-backed scrollback + metadata. ──
 /** @type {Map<string, {id,ws,name,agent,cwd,state,note,created,pty,buf,cols,rows,clients:Set}>} */
@@ -6486,11 +6494,11 @@ async function handleRequest(req, res) {
     // Local only — no network. Safe to poll; it is what tells the PM whether a press is needed.
     const w = getWs(url.searchParams.get('ws'));
     if (!w) return json(res, { ok: false, error: 'no workspace' }, 400);
-    return json(res, { ws: w.id, name: w.name, ...(await syncLib.status(w.root)) });
+    return json(res, { ws: w.id, name: w.name, ...(await syncLib.status(w.root)), auto: autoSync.lastOf(w.root) });
   }
   if (p === '/api/sync' && req.method === 'POST') {
-    // D70 — the ONE place the workspace runs fetch / integrate / commit / push. Only the PM's press
-    // reaches it; nothing schedules or chains it, and it is off every other action's request path.
+    // D70 — the PM's press. The only other caller of the same sync is lib/auto-sync.js (D70 as amended
+    // 2026-10-06), under its own rules; neither is on any other action's request path.
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); }
     catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
@@ -7478,7 +7486,7 @@ async function handleRequest(req, res) {
     return json(res, { ok: true, changes: rows.slice(-200).reverse(), total: rows.length });
   }
   // pm-os-absorb Runs 2–5 — the planning layer's routes, one file per run (lib/route-modules.js). Last, so none shadows a route above.
-  if (await routeModules.dispatch(req, res, url, { json, readBody, getWs, invalidateNeedsAgg, boardCache, consoleState, stateDirFor, sessionList })) return;
+  if (await routeModules.dispatch(req, res, url, { json, readBody, getWs, invalidateNeedsAgg, boardCache, consoleState, stateDirFor, sessionList, initiativeIndex })) return;
   res.writeHead(404); res.end('not found');
 }
 
@@ -7544,18 +7552,27 @@ function writeChangeContext(dir) {
   catch { return null; }
 }
 
-// ── Access guard (D62): loopback is token-free; every non-loopback peer needs the bearer token. ──
+// ── Access guard (D62): loopback is token-free; every non-loopback or proxied request needs the bearer token. ──
 // Peer-based: what matters is where the request came FROM, not which listener accepted it. With the
 // remote flag off there is no non-loopback listener, so this is transparent for local dev. Headers
 // and the token are never logged (D08).
 function httpGuard(req, res) {
   // Origin/Host allowlist FIRST (D64 A1): reject a cross-site / DNS-rebinding request before the
   // token exemption for loopback can be reached. Header values are never logged (D08).
-  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds })) {
+  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: BIND.publicHost })) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'forbidden origin/host' }));
     return;
   }
+  // workspace-public-host: a request to the public hostname must have passed Cloudflare Access. A tunnel
+  // with no Access application in front fails here, before even the sign-in form can be reached.
+  if (!remoteAccess.edgeAllowed({ headers: req.headers, publicHost: BIND.publicHost })) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: false, error: 'the public host is only reachable through Cloudflare Access' }));
+    return;
+  }
+  // The cookie is Secure when the browser reached us on the public host (HTTPS at the edge).
+  const secureCookie = !!BIND.publicHost && remoteAccess.isProxied(req.headers, BIND.publicHost);
   // Token may arrive as an Authorization header, a ?token= query param, or the seeded cookie. A
   // browser only carries the token on the FIRST navigation URL — it cannot attach a header/query to
   // sub-resource loads (CSS/JS) or the WS upgrade — so the documented "open http://…/?token=<t>"
@@ -7570,7 +7587,7 @@ function httpGuard(req, res) {
     req.on('data', (c) => { body += c; if (body.length > 4096) req.destroy(); });
     req.on('end', () => {
       if (remoteAccess.tokenMatches(remoteAccess.parseAuthForm(body), TOKEN)) {
-        res.writeHead(303, { Location: '/', 'Set-Cookie': remoteAccess.sessionCookie(TOKEN), 'Cache-Control': 'no-store' });
+        res.writeHead(303, { Location: '/', 'Set-Cookie': remoteAccess.sessionCookie(TOKEN, { secure: secureCookie }), 'Cache-Control': 'no-store' });
         return res.end();
       }
       res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
@@ -7578,7 +7595,7 @@ function httpGuard(req, res) {
     });
     return;
   }
-  if (!remoteAccess.authorize({ remoteAddress: req.socket.remoteAddress,
+  if (!remoteAccess.authorize({ remoteAddress: req.socket.remoteAddress, headers: req.headers, publicHost: BIND.publicHost,
       presentedToken: remoteAccess.presentedToken(req), expectedToken: TOKEN })) {
     // A phone's browser gets a page it can act on, not JSON. API calls, scripts and anything else
     // that is not a page load keep the JSON 401 they had.
@@ -7594,11 +7611,11 @@ function httpGuard(req, res) {
   // navigation, so the browser's subsequent sub-resource + WS-upgrade requests authenticate without it
   // in the URL. HttpOnly (JS never needs it) + SameSite=Strict + the D64 Origin/Host allowlist keep a
   // foreign site from riding it; no Secure flag because the tailnet speaks plain HTTP (WireGuard-encrypted).
-  if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress)) {
+  if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress) || remoteAccess.isProxied(req.headers, BIND.publicHost)) {
     let qTok = null;
     try { qTok = new URL(req.url || '', 'http://localhost').searchParams.get('token'); } catch { /* ignore */ }
     if (qTok && remoteAccess.tokenMatches(qTok.trim(), TOKEN)) {
-      res.setHeader('Set-Cookie', remoteAccess.sessionCookie(TOKEN));
+      res.setHeader('Set-Cookie', remoteAccess.sessionCookie(TOKEN, { secure: secureCookie }));
       // workspace-phone-app: on a page load, redirect to the same URL without the token, so it does
       // not stay in the address bar, the history, or the start_url of a home-screen install.
       const clean = navigation ? remoteAccess.stripTokenParam(req.url) : null;
@@ -7620,14 +7637,15 @@ function handleUpgrade(req, socket, head) {
   // Same origin/host allowlist on the WS upgrade handshake (D64 A1): a cross-origin page must not be
   // able to open ws://127.0.0.1:<port> and spawn/type into a shell. Rejected BEFORE the socket is
   // accepted, and before loopback's token exemption applies. Header values never logged (D08).
-  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds })) {
+  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: BIND.publicHost })
+      || !remoteAccess.edgeAllowed({ headers: req.headers, publicHost: BIND.publicHost })) {
     socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     socket.destroy();
     return;
   }
   // A browser WebSocket cannot set a header or a ?token= — it authenticates via the same-origin cookie
   // seeded on the page load. presentedToken() resolves header → query → subprotocol → cookie.
-  if (!remoteAccess.authorize({ remoteAddress: socket.remoteAddress,
+  if (!remoteAccess.authorize({ remoteAddress: socket.remoteAddress, headers: req.headers, publicHost: BIND.publicHost,
       presentedToken: remoteAccess.presentedToken(req), expectedToken: TOKEN })) {
     socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
     socket.destroy();     // reject the upgrade; nothing about the request is logged (D08)
@@ -7798,6 +7816,8 @@ if (require.main === module) {
       // one started by `pmos` — otherwise the next `pmos` cannot see it and starts a second server.
       try { fs.mkdirSync(STATE, { recursive: true }); fs.writeFileSync(PID_FILE, String(process.pid)); } catch {}
       for (const line of remoteAccess.startupLines(BIND, PORT, { ansi: !!process.stdout.isTTY && !process.env.NO_COLOR })) console.log(line);
+      // bring in what another machine pushed while this one was off (D70 as amended); never on the request path
+      { const t = setTimeout(() => { autoSync.startup().catch(() => {}); }, 3000); if (t.unref) t.unref(); }
     });
   });
 }

package/workspace/skills/report-biweekly.skill

@@ -39,6 +39,7 @@ Procedure:
    - For each `<!-- pmos:note <initiative-id> -->`, one or two sentences: what moved and what it means for the reader. Start with "Warning:" when the block is off track or at risk. A note that already has text is the PM's or an earlier run's: leave it.
    - For `<!-- pmos:note report.headline -->`, one or two sentences: what the reader most needs to know. If the definition is a draft, say so in the first line.
    - For `<!-- pmos:note report.asks -->`, if the file has it: the decisions only the audience can give, one per line, each line starting with "- ". Never ask the audience for a decision that is the PM's own.
+   - Never write in `<!-- pmos:note report.changelog -->`. It holds the PM's own release notes for the changelog slide, and only the PM writes them. Leave it empty or as the PM left it.
 7. Run `pmos report draft biweekly --redraft`. The script is the one writer of the draft file: it writes the file again and keeps every note, so a line you changed outside a note marker is put back. Read the file once more and check that each note you wrote is still in place. Do not commit; the PM's Sync carries the file. Finish by saying in one line where the draft is.
    - It refuses (the slot was issued since step 4, or a block has no reason for its health): quote the refusal and stop. Say that your notes are in the file and that the file is not re-rendered, so a line outside a note marker may differ from the script's. Do not edit the file again.
 

package/workspace/test-files.json

@@ -30,6 +30,7 @@
     "start-policy.test.js",
     "state-isolation.test.js",
     "sync.test.js",
+    "auto-sync.test.js",
     "schedule-cli.test.js",
     "initiative-surface.test.js",
     "guide.test.js",
@@ -126,6 +127,7 @@
     "start-policy.test.js": 1,
     "state-isolation.test.js": 4,
     "sync.test.js": 4,
+    "auto-sync.test.js": 4,
     "schedule-cli.test.js": 3,
     "initiative-surface.test.js": 3,
     "guide.test.js": 1,

package/workspace/test-lists/run6.json

@@ -0,0 +1,9 @@
+{
+  "_comment": "pm-os-absorb Run 6 (the biweekly as slides, PRD R22.7). The browser suites run only through runs/browser-run.sh, two at a time machine-wide.",
+  "modules": ["report-slides-data.test.js"],
+  "panels": ["pm-report-slides-test.js"],
+  "seconds": {
+    "report-slides-data.test.js": 2,
+    "pm-report-slides-test.js": 45
+  }
+}

package/workspace/test-lists/workspace-public-host.json

@@ -0,0 +1,5 @@
+{
+  "_comment": "workspace-public-host: the proxied-request branches of the access guard (no loopback exemption through a proxy, the one public hostname, the Cloudflare Access presence check, the Secure cookie), driven through httpGuard and the upgrade guard as a library.",
+  "modules": ["public-host.test.js"],
+  "seconds": { "public-host.test.js": 3 }
+}