create-pmos 0.59.1 → 0.59.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.59.1",
+  "version": "0.59.3",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@2d3ee9f
+kernel-source: pmos@ad3caaf
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T13:37:09Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T14:43:28Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T13:37:09Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T14:43:28Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T13:37:09Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T14:43:28Z"}
 status: stable
 ---
 

package/workspace/REMOTE.md

@@ -217,7 +217,7 @@ Run these from a machine that is **not** signed in to Access:
 - **`403` "the public host is only reachable through Cloudflare Access"** — the request reached the workspace without passing Access. Create the Access application for the hostname (Setup step 3).
 - **`403` "forbidden origin/host" on the public hostname** — `PMOS_PUBLIC_HOST` is not set, or it names another hostname, or the tunnel rewrites the `Host` header. Remove `httpHostHeader` from the tunnel's ingress rule.
 - **A local reverse proxy now gets `401`** — it adds a forwarding header, so its requests need the token. This is intended.
-- **`403` "your Cloudflare sign-in could not be verified for this workspace"** (Online switch) — check the AUD tag, the team domain and the email in **Settings › Online**. The email must be the one you sign in with. If the Online section says the keys did not load, check the team domain.
+- **`403` "your Cloudflare sign-in could not be verified for this workspace"** (Online switch) — check the AUD tag, the team domain and the email in **Settings › Online**. The email must be the one you sign in with. Settings › Online on the desktop names the check that refused the last sign-in. To see which email Cloudflare signed you in with, open `https://<your address>/cdn-cgi/access/get-identity` and read `email`.
 - **Cloudflare error 1033** — the tunnel is not running. In **Settings › Online**, check the status line, and read `online-tunnel.log` in the workspace state folder. Another `cloudflared` for the same tunnel (for example a service you installed) also serves the hostname.
 
 - **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.

package/workspace/guide/layout.md

@@ -31,7 +31,7 @@ Settings holds settings only, in seven sections:
 - **Profiles**: the Claude profiles a session can start with. They open in the detail.
 - **New sessions**: the default CLI and the default model for a new session in the dock.
 - **Validate consent**: the consent of the current repository. Turn it on or off here. **Open Validate** opens the Validate page as a tab.
-- **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
+- **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. When a sign-in at the address is refused, this section names the check that failed, such as the email or the AUD tag. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
 - **Theme**: Dark or Light.
 - **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, a button shows for each part that is older:
   - **Update the kit** does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.59.1",
+  "version": "0.59.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.59.1",
+  "version": "0.59.3",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/dest-settings.js

@@ -204,6 +204,7 @@ function onlineSection() {
     lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-tunnel' },
       r.running ? P.onlineRunning : r.lastExit ? P.onlineExited(r.lastExit.code) : P.onlineStarting));
     if (d.keys && !d.keys.keys) lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-keys' }, d.keys.lastError ? P.onlineKeysError(d.keys.lastError) : P.onlineKeysWait));
+    if (d.lastRefusal) lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-refused', role: 'status' }, P.onlineRefused(d.lastRefusal.reason, d.lastRefusal.at)));
   }
   if (!d.canChange) return section('online', P.online, [...lines, el('p', { class: 'fr-set__note' }, P.onlineRemote)]);
   const f = (key, label, placeholder) => field({

package/workspace/public/pm/frame-copy.js

@@ -170,6 +170,18 @@ export const COPY = {
     onlineEnv: (host) => `Online at https://${host}/, set by PMOS_PUBLIC_HOST when the workspace started. It signs in with the token. Restart the workspace without PMOS_PUBLIC_HOST to use this switch.`,
     onlineRemote: 'Only the computer that runs the workspace can change this.',
     onlineUnread: 'The Online settings did not load.',
+    onlineRefused: (reason, at) => `The last sign-in at the public address was refused${at ? ` (${at.slice(11, 16)} UTC)` : ''}: ${({
+      malformed: 'Cloudflare sent no sign-in, or one PMOS cannot read. Check that the Access application covers the public address.',
+      algorithm: 'the sign-in was not signed the way Cloudflare Access signs.',
+      'unknown key': 'it was signed with a key this team does not publish. Check the team domain.',
+      'no keys': 'Cloudflare\'s sign-in keys are not loaded. Check the team domain.',
+      signature: 'its signature did not match. Check the team domain.',
+      issuer: 'it came from another Cloudflare team. Check the team domain.',
+      audience: 'it was for another Access application. Check the audience (AUD) tag: copy it from the application for the public address.',
+      expired: 'it had expired, or this computer\'s clock is wrong. Sign in again.',
+      'not yet valid': 'it is not valid yet, so this computer\'s clock is probably wrong.',
+      email: 'you signed in with another email. The email field must be the address you sign in to Cloudflare with.',
+    })[reason] || reason}`,
     updates: 'Updates',
     updatesCheck: 'Check for updates',
     updatesChecking: 'Checking for updates…',

package/workspace/server.js

@@ -302,7 +302,8 @@ const TOKEN = BIND.token || null;                     // non-loopback peers must
 const onlineMode = require('./lib/online-mode');
 const accessJwt = require('./lib/access-jwt');
 const accessKeys = require('./lib/access-keys');
-const ONLINE = { settings: onlineMode.read(STATE), keys: null, keysTeam: null, fetchKeys: accessKeys.fetchCerts, find: onlineMode.findCloudflared };
+const ONLINE = { settings: onlineMode.read(STATE), keys: null, keysTeam: null, fetchKeys: accessKeys.fetchCerts, find: onlineMode.findCloudflared,
+  lastRefusal: null };   // { reason, at } of the last refused sign-in: a fixed reason word only, never the assertion or a claim (D08)
 const tunnel = onlineMode.createTunnel({ stateDir: STATE, find: () => ONLINE.find() });
 /** The public hostname the guards admit right now: the environment's, else the Online switch's while it is on. */
 function publicHost() { return BIND.publicHost || (ONLINE.settings.on ? ONLINE.settings.host : null); }
@@ -331,21 +332,26 @@ function applyOnline() {
 /** The D89 decision for one request: { ok: true } or { ok: false, reason }. The assertion is never logged (D08). */
 async function accessVerdict(headers) {
   const s = ONLINE.settings; const store = ONLINE.keys;
-  if (!store) return { ok: false, reason: 'no keys' };
+  if (!store) { const v = { ok: false, reason: 'no keys' }; noteVerdict(v); return v; }
   try { await store.ensure(); } catch { /* the store records its own error */ }
   const token = (headers || {})['cf-access-jwt-assertion'];
   const opts = { keyFor: store.keyFor, teamDomain: s.team, audience: s.audience, email: s.email, now: Math.floor(Date.now() / 1000) };
   let v = accessJwt.verify(token, opts);
   if (!v.ok && v.reason === 'unknown key' && v.kid && await store.refetchFor(v.kid)) v = accessJwt.verify(token, opts);
+  noteVerdict(v);
   return v;
 }
+/** Keep the reason of the last refusal for Settings › Online, so the PM can see which check failed. A pass clears it. */
+function noteVerdict(v) {
+  ONLINE.lastRefusal = v && v.ok ? null : { reason: String((v && v.reason) || 'unknown'), at: new Date().toISOString() };
+}
 /** The Online record and state, as GET /api/online returns it. Nothing secret is in it: the fields are not credentials. */
 function onlineView(req) {
   const s = ONLINE.settings;
   return {
     ok: true, on: s.on, host: s.host, tunnel: s.tunnel, team: s.team, audience: s.audience, email: s.email,
     complete: onlineMode.complete(s), envHost: BIND.publicHost || null, cloudflared: !!ONLINE.find(),
-    running: tunnel.status(), keys: ONLINE.keys ? ONLINE.keys.status() : null,
+    running: tunnel.status(), keys: ONLINE.keys ? ONLINE.keys.status() : null, lastRefusal: ONLINE.lastRefusal,
     canChange: onlineChangeAllowed(req),
   };
 }
@@ -8192,7 +8198,7 @@ function httpGuard(req, res) {
     accessVerdict(req.headers).then((v) => {
       if (v.ok) return handleRequest(req, res);
       res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-      res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace' }));
+      res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace. Settings › Online on the computer that runs it says which check failed' }));
     }, () => {
       res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
       res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace' }));