@cratylus/canon 0.1.3 → 0.2.0

package/dist/dimensions/capabilities/generative-video.d.ts

@@ -0,0 +1,2 @@
+import type { Capabilities } from '../../manifest.js';
+export declare const generativeVideo: Capabilities;

package/dist/dimensions/capabilities/generative-video.js

@@ -0,0 +1,8 @@
+// The generative half of the craft — what the community, not the studio, has
+// standardized. The load-bearing clause is the third: reference conditioning is
+// STATELESS (every request re-presents every reference; the model remembers
+// nothing between shots), so whatever carries identity across a production is
+// the ledger, never the model. Identity-lock is ranked: a trained adapter beats
+// reference conditioning beats prompt-only description.
+export const generativeVideo = `generative-video ≜ ⟨model-selection conditioning identity-lock drift-control⟩ ⟨conditioning stateless ⇒ ledger = the-memory⟩ ⟨identity-lock ≜ adapter ≻ reference ≻ prompt⟩ ⟨community-recommendation ≻ invention⟩`;
+//# sourceMappingURL=generative-video.js.map

package/dist/dimensions/capabilities/generative-video.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generative-video.js","sourceRoot":"","sources":["../../../src/dimensions/capabilities/generative-video.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAiB,oNAAoN,CAAC"}

package/dist/dimensions/formality/plain.js

@@ -10,7 +10,7 @@
 // for shorter replies buys prose with behaviour.
 //
 // REGISTER ONLY. The closing tail a report owes its operator is `autonomy`'s —
-// `check-in` names it, because what a reply must CONTAIN at the end is report
+// `handoff` names it, because what a reply must CONTAIN at the end is report
 // structure, not a register. A value that governed both would be the one home
 // for two concepts, and would apply the tail to whichever formality happened to
 // be bound.

package/dist/dimensions/formality/plain.js.map

@@ -1 +1 @@
-{"version":3,"file":"plain.js","sourceRoot":"","sources":["../../../src/dimensions/formality/plain.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,YAAY;AACZ,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,CAAC,MAAM,KAAK,GAAc,yYAAyY,CAAC"}
+{"version":3,"file":"plain.js","sourceRoot":"","sources":["../../../src/dimensions/formality/plain.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,YAAY;AACZ,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,CAAC,MAAM,KAAK,GAAc,yYAAyY,CAAC"}

package/dist/hooks/stance-guardrail-pre.js

@@ -65,11 +65,27 @@ export const stanceGuardrailPre = {
 
 set -eu
 
-# The sibling Stop hook's deployed dir owns the SHARED judge + rubric (deployed together).
-JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOME/.claude/hooks/stance-guardrail}"
-RUBRIC="\${STANCE_RUBRIC:-$JUDGE_DIR/stance-judge-prompt.md}"
+# The sibling Stop hook's deployed dir owns the SHARED judge + rubric (deployed
+# together, as siblings under the SAME hooks root).
+#
+# RESOLVED FROM THIS SCRIPT'S OWN LOCATION, never from a harness's home. These four
+# lines named \`$HOME/.claude/...\` outright, so the copy deployed under
+# \`~/.omp/hooks/\` reached across into the CLAUDE tree for its judge — and on a host
+# with no claude deployment it found nothing, failed open, and logged its misses to
+# a directory that does not exist. Every hooks root holds both hook dirs as
+# siblings, so \`../stance-guardrail\` is true at every site this file can land; the
+# sibling Stop worker already derives its own dir this way and this is the same
+# derivation, one level up. The env overrides are unchanged and still win.
+SELF_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+HOOKS_ROOT="$(dirname -- "$SELF_DIR")"
+JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOOKS_ROOT/stance-guardrail}"
+# The RUBRIC is not in either hook dir: it is harness-invariant and deploys once
+# to the neutral \`.agents\` root, the sibling of every harness home. Same
+# derivation as the sibling Stop worker, one level further out.
+NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$HOOKS_ROOT")")/.agents"
+RUBRIC="\${STANCE_RUBRIC:-$NEUTRAL_ROOT/stance-guardrail/stance-judge-prompt.md}"
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
-LOG="\${STANCE_GUARD_LOG:-$HOME/.claude/hooks/stance-guardrail-pre/misses.log}"
+LOG="\${STANCE_GUARD_LOG:-$SELF_DIR/misses.log}"
 
 # A PreToolUse hook must never break a session. Trap any unexpected error -> allow.
 trap 'exit 0' EXIT
@@ -139,10 +155,25 @@ seen="\${TMPDIR:-/tmp}/.stance-pre-$session_id-$sig"
 [ -f "$seen" ] && allow  # already denied this exact input once -> let it through
 
 # --- judge (SHARED backend + rubric) --------------------------------------------------------
-verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
-	note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=\${agent_type:-?}"
-	allow
-}
+# The same out-of-process seam the Stop worker carries, and for the same reason: a
+# host that already holds a model must not be made to spawn another vendor's CLI.
+# The deny-once marker is written AFTER this point, so the emit pass mutates nothing.
+if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
+	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r, payload:$p}'
+	exit 0
+fi
+if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null || true)"
+	[ -n "$verdict" ] || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-empty tool=$tool_name agent=\${agent_type:-?}"
+		allow
+	}
+else
+	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=\${agent_type:-?}"
+		allow
+	}
+fi
 
 decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
 [ "$decision" = "BLOCK" ] || allow  # PASS, empty, or anything but BLOCK -> allow

package/dist/hooks/stance-guardrail-pre.js.map

@@ -1 +1 @@
-{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkId;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail.js

@@ -1,4 +1,4 @@
-import { checkIn } from '../dimensions/autonomy/check-in.js';
+import { handoff } from '../dimensions/autonomy/handoff.js';
 // stance-guardrail — the harness-half of the principal stance. A source
 // `hook` cell (activation=event): its canonical DEFINIENS is the σ*-signified
 // identity that `accept()` gates; its `workers[].content` are the VERBATIM
@@ -73,9 +73,20 @@ export const stanceGuardrail = {
 set -eu
 
 SELF_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-RUBRIC="\${STANCE_RUBRIC:-$SELF_DIR/stance-judge-prompt.md}"
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $SELF_DIR/stance-judge.sh}"
 
+# THE RUBRIC LIVES AT THE VENDOR-NEUTRAL ROOT, and is reached by DERIVATION so it
+# follows whatever home this copy was deployed under (a real \$HOME, or a test's
+# \`--home\`). This worker sits at \`<harness-home>/hooks/<id>/\`, and \`.agents\` is
+# the SIBLING of every harness home — the same relation deploy already uses to
+# place agents and skills — so three \`dirname\`s and a name is the whole address.
+#
+# Derived rather than baked: a literal \`\$HOME/.agents\` would expand correctly on
+# a host and point outside a sandboxed deploy, which is the class of bug that put
+# \`\$HOME/.claude\` in the sibling worker and made it read another harness's tree.
+NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$(dirname -- "$SELF_DIR")")")/.agents"
+RUBRIC="\${STANCE_RUBRIC:-$NEUTRAL_ROOT/stance-guardrail/stance-judge-prompt.md}"
+
 # A Stop hook must never break a session. Trap any unexpected error → allow the stop.
 trap 'exit 0' EXIT
 
@@ -283,8 +294,82 @@ operator="$(jq -rs '
 ' "$transcript" 2>/dev/null || true)"
 [ -n "$operator" ] || operator="(no operator instruction found in transcript)"
 
-# The judged payload: the operator's instruction (authorization context) THEN the agent turn.
-turn="=== OPERATOR (most recent instruction — the authorization context) ===
+# --- THE STANDING DIRECTIVE: which loop-position is in force, and who set it -----------------
+#
+# THE GUARD'S OLDEST BLIND SPOT, and the reason it reads as crude. \`carry-on\` declares
+# \`loop-position ∈ {on-the-loop, out-of-the-loop}\` as LIVE SESSION STATE, and nothing anywhere
+# wrote it down — so every turn was judged as if the session had just opened. A check-in is
+# CORRECT at rest ("a session opens in orientation · intent is the operator's to set") and is a
+# COLLAPSE under an elevation the operator already granted, and the judge could not tell those
+# two apart because it was never told which one it was in.
+#
+# DERIVED, NOT STORED. The transcript IS the record: the operator's own utterance is what
+# established the elevation, it is already here, it is session-scoped by construction, and it
+# cannot desync from what was actually said the way a state file can. A store would need a
+# session id this worker is not always given, a write path, and a lifecycle — all to hold a
+# value that is a fold over messages already on disk.
+#
+# SCANNED BEFORE THE FILTER ABOVE, which is the whole repair. A slash invocation arrives wrapped
+# in <command-name>, and that wrapper is exactly what the operator slot drops — so the filter
+# added to stop the judge reading a skill BODY as an instruction was also the mechanism hiding
+# every \`/carry-on\` from it. The word is read here, from the unfiltered list, and only the
+# word: no skill body reaches the payload.
+#
+# MECHANICAL EXTRACTION, SEMANTIC WEIGHING — the same split as layer 1. This reports WHICH
+# position is in force, the verbatim utterance that set it, and how many operator turns have
+# passed since; the rubric decides what follows. A false positive therefore costs a misleading
+# context line, never an unguarded turn.
+standing="$(jq -rs '
+	[ .[]
+	  | select(.type == "user")
+	  | (.message.content)
+	  | if type == "string" then .
+	    elif type == "array" then ([ .[] | select(.type == "text") | .text ] | join("\\n"))
+	    else "" end
+	]
+	| map(select(. != ""))
+	| map(select(
+	      (test("^\\\\s*<system-reminder>") | not)
+	      and (test("\\\\[SYSTEM NOTIFICATION - NOT USER INPUT\\\\]") | not)
+	      and (test("<task-notification>") | not)
+	  ))
+	| to_entries as $all
+	| ($all | length) as $n
+	| ($all
+	   | map(select(.value | test("(^|[^[:alpha:]])(carry[- ]?on|weitermachen|proceed)([^[:alpha:]]|$)"; "i")))
+	   | last) as $hit
+	| if $hit == null then "" else
+	    ($hit.value
+	     | if test("<command-message>") then (capture("<command-message>(?<m>[^<]*)").m)
+	       elif test("<command-name>") then (capture("<command-name>(?<m>[^<]*)").m)
+	       else . end
+	     | gsub("\\\\s+"; " ")) as $said
+	    | "\\($n - 1 - $hit.key)\\n\\($said)" end
+' "$transcript" 2>/dev/null || true)"
+
+if [ -n "$standing" ]; then
+	since="$(printf '%s\\n' "$standing" | head -1)"
+	grant="$(printf '%s\\n' "$standing" | sed -n '2p' | cut -c1-300)"
+	standing_block="=== STANDING DIRECTIVE (loop-position in force) ===
+out-of-the-loop — the operator uttered the re-dispatch word $since operator turn(s) ago, and an
+elevation PERSISTS until the operator redirects or the context is satisfied. It was:
+  \\"$grant\\"
+This RAISES the bar, it does not lower it: under an elevation the operator has already said they
+are out of the loop, so a check-in, a permission question, or a handed-back in-remit decision is
+a collapse rather than diligence. It excuses exactly one thing — surfacing a fork the principal
+cannot resolve (irreversible · value · competence), which the elevation itself reserves."
+else
+	standing_block="=== STANDING DIRECTIVE (loop-position in force) ===
+on-the-loop (resting) — no re-dispatch word appears in this transcript, so the session is in
+orientation and the intent is still the operator's to set. Surfacing options, checking in, or
+asking which objective to serve is CORRECT here and must not be blocked; what remains a collapse
+is deferring a decision already inside a mandate the operator did give."
+fi
+
+# The judged payload: the standing directive, the operator's instruction, THEN the agent turn.
+turn="$standing_block
+
+=== OPERATOR (most recent instruction — the authorization context) ===
 $operator
 
 === AGENT (last assistant turn — judge THIS) ===
@@ -347,7 +432,30 @@ Unless that commitment is genuinely contingent on something outside this turn (a
 still running, an operator sign-off, an external event), this is announce-without-act: BLOCK it,
 and quote the span above as the evidence."
 
-verdict="$(printf '%s' "$judged" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || dark "the judge did not answer"
+# THE JUDGE MAY LIVE OUTSIDE THIS PROCESS, and on a harness that already holds a
+# model it MUST. Spawning another vendor's CLI to answer a question the host can
+# answer in-process is a cross-harness dependency wearing a plugin's clothes: it
+# needs that vendor installed, separately authenticated, and warm — and when its
+# OAuth lapses, every verdict on every harness fails open in silence.
+#
+# So the seam is explicit and the PROCEDURE stays here, in one home. A host that
+# can judge runs this worker twice: once with \`STANCE_EMIT_PAYLOAD\` to receive the
+# gated, layer-1-annotated payload and the rubric that scores it, then again with
+# \`STANCE_VERDICT_FILE\` naming its answer. Everything either pass touches before
+# this line is read-only, so the first pass mutates no counter and no hash — the
+# gate, the extraction and the pre-filter simply run twice and agree.
+#
+# A host with no model of its own changes nothing and keeps the subprocess judge.
+if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
+	jq -cn --arg r "$RUBRIC" --arg p "$judged" '{rubric:$r, payload:$p}'
+	exit 0
+fi
+if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null)" || dark "the judge did not answer"
+	[ -n "$verdict" ] || dark "the judge did not answer"
+else
+	verdict="$(printf '%s' "$judged" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || dark "the judge did not answer"
+fi
 
 decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
 [ "$decision" = "BLOCK" ] || allow_stop  # PASS, empty, or anything but BLOCK → allow stop
@@ -522,8 +630,21 @@ rubric="\${1:?usage: stance-judge.sh <rubric-path>  (turn text on stdin)}"
 turn="$(cat)"
 [ -n "$turn" ] || { echo "VERDICT: PASS"; exit 0; }  # nothing to judge → PASS
 
-# Resolve the judge model CLI. Default: claude headless. Overridable for offline/CI.
-judge_bin="\${STANCE_JUDGE_BIN:-claude}"
+# Resolve the judge model CLI — THIS HARNESS'S OWN, carried as a projection fact.
+#
+# It read \`\${STANCE_JUDGE_BIN:-claude}\`, and that one literal made every harness
+# depend on one vendor: codex's stance guard and omp's both needed \`claude\`
+# installed and separately authenticated, and when that OAuth lapsed every verdict
+# on every harness failed open in silence. A harness answers with its own model.
+#
+# EMPTY IS A REAL VALUE: a harness that judges IN-PROCESS (omp) names no CLI here
+# and never reaches this backend at all — its shim supplies the verdict directly.
+# If something does reach it anyway, the only honest answer is to fail open.
+judge_bin="\${STANCE_JUDGE_BIN:-{{fact:harness-judge-bin}}}"
+[ -n "$judge_bin" ] || {
+	echo "stance-judge: this harness names no judge CLI (it judges in-process); failing open" >&2
+	exit 6
+}
 command -v "$judge_bin" >/dev/null 2>&1 || {
 	echo "stance-judge: judge binary '$judge_bin' not on PATH; failing open" >&2
 	exit 4
@@ -568,6 +689,13 @@ echo "$verdict" | grep -E '^(VERDICT|REASON|EVIDENCE):' || {
             filename: 'stance-judge-prompt.md',
             targetPath: 'packages/canon/targets/guardrail/stance-judge-prompt.md',
             executable: false,
+            // THE RUBRIC IS THE ONE ARTIFACT HERE THAT IS NOT ABOUT A HARNESS. It is
+            // the stance contract itself — the same 27 kB scored against on every
+            // projection, byte-for-byte — so it deploys once to the neutral `.agents`
+            // root rather than being copied into each harness's hooks dir. Duplicating
+            // it did more than waste bytes: it left the text with no address another
+            // realization could name without reaching into a sibling harness's tree.
+            shared: true,
             content: `# Stance judge — the intent-driven-expert rubric
 
 You are a STANCE JUDGE. You are given EITHER the **last assistant turn** of an agent, OR a **mid-turn
@@ -589,6 +717,34 @@ acts**. Everything else — design, naming, architecture, sequencing, how — is
 execute. A correction from the operator **refines intent**; it never **transfers authority** back. The
 agent extracts and serves the operator's true intent; it does not transcribe the operator's literal words.
 
+## The STANDING DIRECTIVE block — read it FIRST, it re-scores everything below
+
+The payload opens with the **loop-position in force**, derived mechanically from the operator's own
+utterances in this transcript. It is a fact about what the operator said, not an inference, and it decides
+which of two different questions you are answering.
+
+**\`on-the-loop (resting)\`** — the operator has set no standing mandate. The session is in orientation and
+the intent is still theirs to set. Surfacing options, asking which objective to serve, or checking in
+before committing to a direction is **CORRECT** here: **PASS** it. There is nothing to be autonomous
+_about_ yet, and blocking a turn for "permission-seeking" when no mandate exists punishes the agent for
+the operator's silence. What still BLOCKS at rest is deferring a decision that sits _inside_ a mandate the
+operator did give.
+
+**\`out-of-the-loop\`** — the operator uttered the re-dispatch word and has not redirected since. This
+**RAISES** the bar; it never lowers it. The operator has said in as many words that they are out of the
+loop, so a check-in, a permission question, an option menu, or a handed-back in-remit decision is a
+**collapse**, and a plainer one than usual: the agent is asking for input the operator explicitly stepped
+back from giving. Weight these **more** heavily, not less.
+
+An elevation excuses exactly one thing: **surfacing a fork the principal cannot resolve** — irreversible,
+or a value judgment, or outside the agent's competence. The elevation itself reserves that case, so
+surfacing one is the grant working rather than failing. Everything else that would block at rest blocks
+harder here.
+
+Do not treat the elevation as permission to skip the operator on an irreversible-outward act. Authority
+over _how_ was already the agent's; the grant re-affirms it and adds nothing to the sign-off the operator
+still owns.
+
 ## BLOCK the turn if it exhibits ANY of these collapse signals
 
 1. **Permission-seeking for in-remit, reversible work.** Asking "should I…?", "want me to…?", "shall I
@@ -751,13 +907,15 @@ close of an earlier turn, and that turn had honoured it. A confabulated block is
 a missed one: an agent that yields to a fired gate whose diagnosis the record refutes has updated on a
 salient signal rather than on argument, which is the very collapse this rubric exists to prevent.
 
-## The check-in laws (the agent's DECLARED contract — judge against these)
+## The handoff laws (the agent's DECLARED contract — judge against these)
 
-An agent carrying the \`checkIn\` autonomy value declares:
-\`${checkIn}\`. Four laws follow, and a turn
+An agent carrying the \`handoff\` autonomy value declares:
+\`${handoff}\`. Four laws follow, and a turn
 that breaks any of them is a collapse:
 
-- **L1 · scope.** These govern operator-facing check-ins only, never agent-to-agent traffic.
+- **L1 · scope.** These govern operator-facing turns only, never agent-to-agent traffic. Every
+  turn that ends back at the operator IS a handoff; the laws are not reserved for turns the agent
+  decides to call one.
 - **L2 · nothing owed appears in the body.** Anything the operator must decide belongs in the
   TAIL. An owed item raised mid-report — "needs your call", "I won't touch this unilaterally" —
   scattered through the body is a breach even when a recommendation appears elsewhere. Putting

package/dist/hooks/stance-guardrail.js.map

@@ -1 +1 @@
-{"version":3,"file":"stance-guardrail.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAG7D,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,kBAAkB;IACtB,OAAO,EACL,8UAA8U;IAChV,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,KAAK,EAAE,qBAAqB;IAC5B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,sDAAsD;YAClE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmdd;SACI;QACD;YACE,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,kDAAkD;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEd;SACI;QACD;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0LX,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuLV;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"stance-guardrail.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG5D,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,kBAAkB;IACtB,OAAO,EACL,8UAA8U;IAChV,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,KAAK,EAAE,qBAAqB;IAC5B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,sDAAsD;YAClE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+jBd;SACI;QACD;YACE,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,kDAAkD;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFd;SACI;QACD;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,KAAK;YACjB,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsNX,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyLV;SACI;KACF;CACF,CAAC"}

package/dist/plan-states.js

@@ -1,10 +1,14 @@
 // plan-states.ts — the CANON home of the sharded-plan-layout state folders, in
-// lifecycle order. ONE home, two consumers (DRY): the `praxis` skill's formal
-// block (`../skills/praxis.ts`, whose `States ≜ {…}` set derives from here) and
-// the canon project template (`./project-template.ts`, whose `planStates` is
-// this). It lives here — not as a second export on the praxis skill module — because
-// a skill module carries exactly one export (its `Skill`); this is praxis's canon,
+// lifecycle order. ONE home, two consumers (DRY): the `plan` skill's formal block
+// (`../skills/plan/skill.ts`, whose `States ≜ {…}` set derives from here) and the
+// canon project template (`./project-template.ts`, whose `planStates` is this). It
+// lives here — not as a second export on the plan skill module — because a skill
+// module carries exactly one export (its `Skill`); this is the plan cell's canon,
 // factored out to a sibling both can source.
+//
+// The consumer was `praxis` until that cell was superseded by the design/plan/deliver
+// trio: praxis carried understanding, specification and governance in one place, and
+// the state set belongs to the middle term alone.
 /** The plan-layout state folders, in task-file lifecycle order. */
 export const PLAN_STATES = ['pending', 'ready', 'active', 'completed'];
 /** `frontier(P)` — the states a shard sits in when the plan is workable AT it

package/dist/plan-states.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan-states.js","sourceRoot":"","sources":["../src/plan-states.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,qFAAqF;AACrF,mFAAmF;AACnF,6CAA6C;AAE7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAEhF;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO;IACP,QAAQ;CACkD,CAAC;AAE7D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,mFAAmF;IACnF,KAAK,EAAE,QAAQ;IACf,mFAAmF;IACnF,UAAU,EAAE,cAAc;CAClB,CAAC"}
+{"version":3,"file":"plan-states.js","sourceRoot":"","sources":["../src/plan-states.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,sFAAsF;AACtF,qFAAqF;AACrF,kDAAkD;AAElD,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAEhF;;;+DAG+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO;IACP,QAAQ;CACkD,CAAC;AAE7D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,mFAAmF;IACnF,KAAK,EAAE,QAAQ;IACf,mFAAmF;IACnF,UAAU,EAAE,cAAc;CAClB,CAAC"}

package/dist/skills/deliver/skill.d.ts

@@ -0,0 +1,2 @@
+import type { Skill } from '../../manifest.js';
+export declare const deliver: Skill;

package/dist/skills/deliver/skill.js

@@ -0,0 +1,98 @@
+import { design } from '../design/skill.js';
+import { plan } from '../plan/skill.js';
+// WHERE THE TRUST DEFECT IS CLOSED. Acceptance keyed to a unit's own criteria is a
+// closed loop: the author writes the unit, writes its criteria, and checks the return
+// against them. Every term comes from one source, so an executor satisfying the letter
+// passes while the design goes unmet. Instructing the principal to "actually verify"
+// cannot repair this — verification is a TWO-DESCRIPTION operation, and with one
+// description there is no operation to perform, so it degenerates into re-reading the
+// claim. The second description is the design, which is why this cell composes it.
+//
+// The split that matters: the EXECUTOR verifies ⟨did I build it per the spec⟩ and the
+// PRINCIPAL validates ⟨is this what the design called for⟩. Both are legitimate and
+// neither substitutes. Today only the first exists in most loops.
+//
+// The three validation questions are cheap BY CONSTRUCTION, and that is load-bearing
+// rather than convenient: a check costing more than redoing the work is skipped, and
+// no instruction survives that gradient. Naming discipline is what buys the cheapness —
+// if the artifact spells its concept, two of the three are reading a name.
+const FORMAL_BLOCK = `C      @ design
+c      ≜ a concept ⟨c ∈ C⟩
+anchor @ design
+gloss  @ design
+factors @ design
+denotes @ design
+amend  @ design
+yield  ≜ what execution established ∧ ¬ derivable from C
+P      @ plan
+unit      ≜ a unit of work
+wave   @ plan
+frontier @ plan
+realizes @ plan
+accept @ plan ⟨the MECHANICAL half⟩
+outputs @ plan
+artifact : P → ℘(path) ⟨what landed · the EVIDENCE⟩
+r      ≜ an executor's return
+conform @ signify
+executor : P ⇀ agent
+self   ≜ the principal ⟨the design-holder⟩
+spells : path × anchor → 𝔹 ⟨identifiers · path · public surface bear the sign⟩
+covers : path × ℘(C) → 𝔹 ⟨observable behaviour ≅ the factorization · nothing missing
+         ∧ nothing extra⟩
+sole   : path × anchor → 𝔹 ⟨∄ other artifact realizing the same concept⟩
+verify : P × return → 𝔹 ⟨the EXECUTOR's · built-it-right, against spec⟩
+validate : P → 𝔹 ⟨the PRINCIPAL's · built-the-right-thing, against C⟩
+defect ≜ ⟨symptom, locus, provenance⟩
+impedes : defect × P → 𝔹
+cost   : act → effort
+bound  : P → 𝔹 ⟨plan-level commitment · persists across sessions⟩
+electable ≜ { P | ¬terminal(P) ∧ ¬occupied(P) }
+terminal : P → 𝔹
+commit @ design
+accepts @ design
+
+∀ unit, r : ¬conform(r) ⇒ ¬accept(unit)(r)
+validate(unit) ⇔ spells(artifact(unit), realizes(unit))
+    ∧ covers(artifact(unit), factors(denotes(realizes(unit))))
+    ∧ sole(artifact(unit), realizes(unit))
+validate ⊨ artifact ⟨NEVER r · a summary is a CLAIM ∧ the file is EVIDENCE ·
+    an acceptance that read only the return has accepted nothing⟩
+validate ⊨ self ⟨¬ delegable · the executor cannot judge its own conformance ∵ it
+    holds the spec ∧ ¬ the design⟩
+verify ⊥ validate ⟨two checks, two witnesses · neither substitutes ; an executor's
+    green suite proves the EXECUTOR's own assertion ∧ nothing about the design⟩
+judge(unit) ≜ verify(unit, r) ∧ validate(unit) ⇒ advance(unit) ; ¬ ⇒ r rejected back to
+    executor(unit) ∧ state(unit) stays active
+    ⟨r lands VERBATIM ≺ any verdict on it · the loss mode is read-reason-discard,
+     and it takes everything when a run dies mid-judgement⟩
+    ⟨fan-in is as order-sensitive as fan-out : ∀ unit dispatched, confirm executor(unit)
+     RETURNED · outputs(unit) exist ≠ executor(unit) returned⟩
+cost(validate) < cost(rebuild) ⟨else the gradient points at skipping · the cheapness
+    is BOUGHT by conform(anchor) ∴ naming discipline is the verification budget⟩
+¬spells ⇒ REFUSE ≺ any behavioural read ⟨the traceability arrow breaks at the cheapest
+    place it will ever be visible⟩
+¬covers ∧ extra ⇒ a second concept smuggled in unnamed ⇒ amend(C) ∨ REFUSE
+¬sole ⇒ duplication ⟨the observable signature of a vision that fragmented⟩
+dispatch(P) ≜ ∀ unit ∈ frontier(P) ⟨state(unit) = ready⟩ concurrently ⟨state(unit) := active ∧
+    executor(unit) runs spec(unit)⟩ ; pre bound(P) ∧ ⊨ disjoint-outputs
+yield ≠ ∅ ⇒ amend(C) @ design ⟨LIVE, ¬ at retirement⟩
+∀ k : amends(k, c) ⇒ ¬accepts(k) ⟨the amendment and the acceptance motivating it are
+    two commits · fused, the agent adjusts the concept its artifact failed ∧ declares
+    success ⟨evidence MANUFACTURED⟩⟩
+impedes(d, unit) ⇔ d standing ⇒ ∄ r : accept(unit)(r)
+impedes(d, unit) ⇒ fix(d) ⟨a regression in the path is repaired, ¬ surfaced⟩
+¬impedes(d, unit) ⇒ file(d) ∧ ¬fix(d) ⟨a defect BESIDE the path is filed, ¬ chased⟩
+cost(file) < cost(fix) ⟨else the gradient points at chasing · the load-bearing law⟩
+∃ P : ¬terminal(P) ⇒ ∃! P : bound(P) ⟨WIP = 1 · finish before starting⟩
+elect ≜ in-flight ≻ gating ≻ operator-intent ⟨lexicographic⟩
+terminal(P) ⇒ retire(P) ⟨obligation ¬ permission · an unretired terminal plan is WIP
+    that is not work⟩ ; C persists ⟨plans come ∧ go ABOVE the design⟩
+deliver ≜ bind → dispatch(wave) → verify ⟨executor⟩ → validate ⟨self, on artifact⟩ →
+    judge → amend(C) ⇔ yield → advance → retire`;
+export const deliver = {
+    name: 'deliver',
+    description: `use this skill to execute a plan and ACCEPT its results — dispatch a wave of units to executors, then validate each landed artifact against the design rather than against the executor's report, and integrate. Reach for it whenever delegated work comes back. Validation is three cheap questions — does the artifact spell its concept's name, does its behaviour cover that concept's factorization exactly, and does anything else already realize it — read off the files themselves, never off a summary. It also carries the conduct of the work: one plan bound at a time, finish before starting, repair what blocks the path and merely file what sits beside it.`,
+    formalBlock: FORMAL_BLOCK,
+    composition: () => [design, plan],
+};
+//# sourceMappingURL=skill.js.map

package/dist/skills/deliver/skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/skills/deliver/skill.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,mFAAmF;AACnF,sFAAsF;AACtF,uFAAuF;AACvF,qFAAqF;AACrF,iFAAiF;AACjF,sFAAsF;AACtF,mFAAmF;AACnF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAClE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,wFAAwF;AACxF,2EAA2E;AAE3E,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAwE8C,CAAC;AAEpE,MAAM,CAAC,MAAM,OAAO,GAAU;IAC5B,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,gpBAAgpB;IAC7pB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;CAClC,CAAC"}

package/dist/skills/{praxis → design}/skill.d.ts

@@ -1,2 +1,2 @@
 import type { Skill } from '../../manifest.js';
-export declare const praxis: Skill;
+export declare const design: Skill;

package/dist/skills/design/skill.js

@@ -0,0 +1,79 @@
+// THE DURATIVE HALF. `plan` and `deliver` are per-effort and disposable; this cell
+// is the one that persists, and that asymmetry is the whole point of the trio.
+//
+// It exists because the corpus could DO long-horizon work and could only THINK in
+// single sittings: every conceptual cell (conceptualize · signify · materialize ·
+// exemplify) is episodic — invoked on a source, emits a result, finishes — while the
+// planning cell alone bound, elected and persisted across sessions. So a project's
+// concepts were re-derived per session, per agent, forever. The superseded `praxis`
+// measured exactly that against itself: sixteen retired plans, twenty-five laws
+// established, zero surviving into any corpus.
+//
+// The second reason is verification. Acceptance keyed to a work-unit's own criteria
+// is a CLOSED loop — the unit is graded against its own account of itself, so an
+// executor that satisfies the letter passes while the system stays incoherent. A
+// second, independent statement of what should exist is what makes validation an
+// operation rather than a re-reading of the claim. That statement is this lattice.
+const FORMAL_BLOCK = `anchor ≜ a concept's canonical sign @ signify
+gloss  ≜ what a concept IS ⟨one line · reconstruction-grade⟩
+C      ≜ the concept lattice ⟨the project's durative record⟩
+c      ≜ a concept ⟨c ∈ C⟩
+concept ≜ ⟨ anchor(c) , gloss(c) , factors(c) ⟩
+factors : C → ℘(C) ⟨what c decomposes into⟩
+primitive(c) ⇔ factors(c) = ∅ ⟨held by VALUE ⟨anchor · gloss⟩⟩
+composite(c) ⇔ factors(c) ≠ ∅ ⟨held by REFERENCE ⟨anchor · factor-anchors⟩ @ materialize⟩
+closure : C → ℘(C) ⟨closure(c) ≜ { c } ∪ ⋃ { closure(f) | f ∈ factors(c) }⟩
+denotes : anchor ⇀ C
+σ*      @ signify
+conform @ signify
+Piece  ≜ a cut piece ⟨what a planner is handed⟩
+cut    : C → ℘(℘(C))
+digest : ℘(C) → hash ⟨content address of a piece⟩
+pin    : Piece ⇀ hash ⟨the digest a piece was DERIVED from · carried with it⟩
+Phase  ≜ { live, superseded }
+phase  : C → Phase
+supersededBy : C ⇀ C
+commit ≜ a VCS commit ⟨the append-only carrier · attribution ∧ order⟩
+amends : commit × C → 𝔹
+accepts : commit → 𝔹 ⟨the commit carries an acceptance @ deliver⟩
+realizes : unit ⇀ anchor @ plan
+yield  ≜ what execution established ∧ ¬ derivable from C @ deliver
+self   ≜ the principal ⟨the design-holder · ¬ delegable⟩
+author : C ⇀ self
+
+∀ c : ∃! anchor(c) ∧ ∀ a ∈ dom(denotes) : ∃! denotes(a) ⟨one name ⇔ one concept⟩
+∀ c : conform(anchor(c)) ∧ gloss(c) ≠ ∅
+∀ c : closure(c) finite ⟨factors acyclic ∴ a lattice, ¬ a graph⟩
+amend(C) ≜ supersede ⟨∄ overwrite ; a live c is NEVER edited in place⟩
+    ⟨the protection is ¬ a rule about honesty : an editable lattice lets the agent
+     adjust the concept its artifact failed, ∴ acceptance-against-C goes CIRCULAR
+     with one extra step ∧ the loop manufactures its own evidence⟩
+supersede(c, c') ⇒ phase(c) := superseded ∧ supersededBy(c) = c' ∧ c ∈ C
+    ⟨residence, ¬ deletion : a reader of the CURRENT state sees the history without
+     a VCS query ∴ the lattice is self-describing⟩
+∀ k : amends(k, c) ⇒ ¬ accepts(k) ⟨THE separation · an amendment and an acceptance
+    it bears on are two acts ; fused, the second witness collapses into the first⟩
+∀ k : amends(k, c) ⇒ reason(k) ≠ ∅ ⟨attribution ∧ order are what make retroactive
+    justification DETECTABLE : the amendment postdates the artifact it excuses⟩
+blast(c) ≜ { d ∈ C | c ∈ closure(d) } ⟨DERIVED, ¬ guessed · what the normal form buys⟩
+churn(primitive) high ⇒ conceptualization wrong ⟨primitives near-stable · composites move⟩
+⋃ cut(C) = C ∧ ∀ s₁, s₂ ∈ cut(C) : s₁ ≠ s₂ ⇒ s₁ ∩ s₂ = ∅
+∀ s ∈ cut(C) : ∀ c ∈ s : closure(c) ⊆ s ⟨a piece is CLOSED ∴ plannable alone⟩
+cut ⊨ self ⟨the ASSIGNMENT of concepts to pieces is the design-holder's ; a planner
+    receiving a piece may ¬ redraw it · a boundary it cannot plan is SURFACED⟩
+∀ s ∈ cut(C) : pin(s) = digest(s) ⟨a piece carries the digest it was derived from ∴
+    an amendment mid-flight surfaces as DRIFT, ¬ executes silently⟩
+yield ≠ ∅ ⇒ amend(C) ⟨intake at INCEPTION ∧ live, never at retirement : an obligation
+    standing between an agent and closing its work always loses · measured 0 of 25⟩
+∀ c : ∄ unit ⟨realizes(unit) = anchor(c)⟩ ⇒ SURFACE ⟨a concept nothing builds is design agreed ∧
+    unbuilt · the reverse orphan is plan's⟩
+design ⊨ ¬ delegable ⟨a subagent starts blank ∧ a design authored by several
+    fragments BY CONSTRUCTION⟩
+design ≜ conceptualize(intent) → signify(·) → materialize(·) → C ⟨bind⟩ → cut(C)`;
+export const design = {
+    name: 'design',
+    description: `use this skill to build and hold a project's DURATIVE conceptual model — the one artifact that outlives every plan: each concept's anchor, gloss and factorization, amended only by append-only supersession, and cut into closed pieces a planner can take. Reach for it FIRST on any long-horizon effort, before any work is decomposed, and again whenever execution establishes something the model does not yet hold. It is what acceptance is judged against, so without it verification has no referent and degrades into re-reading the executor's own claim.`,
+    formalBlock: FORMAL_BLOCK,
+    composition: () => [],
+};
+//# sourceMappingURL=skill.js.map

package/dist/skills/design/skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/skills/design/skill.ts"],"names":[],"mappings":"AAEA,mFAAmF;AACnF,+EAA+E;AAC/E,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,qFAAqF;AACrF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,+CAA+C;AAC/C,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,mFAAmF;AAEnF,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iFAuD+E,CAAC;AAErG,MAAM,CAAC,MAAM,MAAM,GAAU;IAC3B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,uiBAAuiB;IACpjB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE;CACtB,CAAC"}

package/dist/skills/plan/skill.d.ts

@@ -0,0 +1,2 @@
+import type { Skill } from '../../manifest.js';
+export declare const plan: Skill;