@erclx/canon 4.0.0

package/scripts/core/check-ignore-parity.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+GITIGNORE="$PROJECT_ROOT/.gitignore"
+MANIFEST="$PROJECT_ROOT/tooling/claude/manifest.toml"
+SECTION="# Claude"
+
+# Divergences this repository has decided to keep, one `<entry>|<reason>` per
+# line, matched after the trailing slash is stripped. Each names a path the
+# enclosing repository ignores and the claude manifest deliberately does not
+# ship, so a target keeps tracking it.
+#
+# This is the canonical list. `.gitignore` and the manifest carry a pointer
+# beside their own entries rather than a second copy of the reason, and
+# `.claude/context/tooling.md` carries the narrative behind both.
+#
+# A sanction that no longer describes a divergence fails the same as an
+# unsanctioned one. An exception outliving its reason is what teaches the next
+# reader to widen the list rather than to read it.
+SANCTIONED=(
+  ".claude/diagrams|a target that tracks its diagrams keeps the context audit's default coverage of them, which ignoring the folder for every target would take away. This repository backs the folder through its records remote instead."
+  ".claude/README.md|the landing page a records pull writes back into a repository that set up a records remote. A target has not, so it never receives the file."
+)
+
+if [ ! -f "$GITIGNORE" ]; then
+  echo "No .gitignore at ${GITIGNORE#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
+  exit 1
+fi
+
+if [ ! -f "$MANIFEST" ]; then
+  echo "No claude manifest at ${MANIFEST#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
+  exit 1
+fi
+
+# A gitignore pattern and a manifest entry describe the same folder whether or
+# not either spells the trailing slash, so presence is compared with it dropped.
+# `.claude/.tmp` and `.claude/.tmp/` are the live instance of that pair.
+normalize() {
+  printf '%s\n' "${1%/}"
+}
+
+# Every pattern the file carries, comments and blank lines dropped. The whole
+# file rather than one header, because `.claude/teach/` sits under a header of
+# its own and reading the `# Claude` header alone would report it missing from a
+# list that carries it.
+gitignore_patterns() {
+  awk '{ sub(/[[:space:]]+$/, "") } $0 ~ /^[[:space:]]*#/ || $0 == "" { next } { print }' "$GITIGNORE"
+}
+
+# Every entry of the named array in the manifest's `[gitignore]` table. The
+# array is accumulated to its closing bracket before the quoted strings are read
+# out, so a formatter wrapping it across lines does not silently empty this.
+manifest_entries() {
+  awk -v key="\"$SECTION\"" '
+    /^\[/ { table = $0 }
+    table != "[gitignore]" { next }
+    index($0, key) == 1 { collecting = 1; buf = "" }
+    collecting { buf = buf $0 }
+    collecting && index($0, "]") > 0 {
+      collecting = 0
+      buf = substr(buf, index(buf, "["))
+      count = split(buf, parts, "\"")
+      for (i = 2; i <= count; i += 2) print parts[i]
+    }
+  ' "$MANIFEST"
+}
+
+contains() {
+  local needle=$1
+  shift
+  local candidate
+  for candidate in "$@"; do
+    [ "$candidate" = "$needle" ] || continue
+    return 0
+  done
+  return 1
+}
+
+ignored=()
+while IFS= read -r pattern; do
+  [ -n "$pattern" ] || continue
+  ignored+=("$(normalize "$pattern")")
+done < <(gitignore_patterns)
+
+shipped=()
+while IFS= read -r entry; do
+  [ -n "$entry" ] || continue
+  shipped+=("$(normalize "$entry")")
+done < <(manifest_entries)
+
+# An empty read on either side is a parse that failed rather than a repository
+# ignoring nothing, and reporting parity off it would say the two lists agree
+# having compared none of their entries.
+if [ ${#ignored[@]} -eq 0 ]; then
+  echo "No patterns read from .gitignore, ignore parity unverifiable." >&2
+  exit 1
+fi
+
+if [ ${#shipped[@]} -eq 0 ]; then
+  echo "No entries read from the \"$SECTION\" array in ${MANIFEST#"$PROJECT_ROOT/"}, ignore parity unverifiable." >&2
+  exit 1
+fi
+
+failures=""
+sanction_notes=""
+
+# Entries the manifest ships that this repository does not ignore. A target is
+# told to ignore a folder the toolkit itself tracks, which no decision sanctions,
+# so this direction carries no exception list.
+for entry in "${shipped[@]}"; do
+  contains "$entry" "${ignored[@]}" && continue
+  failures="$failures  $entry is shipped by the manifest and absent from .gitignore"$'\n'
+done
+
+# Claude-scoped patterns this repository ignores that the manifest does not
+# ship. Scoped to `.claude/` because the manifest is the claude stack and says
+# nothing about `node_modules/` or `.env`.
+for pattern in "${ignored[@]}"; do
+  case "$pattern" in
+  .claude/*) ;;
+  *) continue ;;
+  esac
+  contains "$pattern" "${shipped[@]}" && continue
+
+  matched=false
+  for sanction in "${SANCTIONED[@]}"; do
+    [ "${sanction%%|*}" = "$pattern" ] || continue
+    matched=true
+    sanction_notes="$sanction_notes  $pattern stays out of the manifest: ${sanction#*|}"$'\n'
+    break
+  done
+
+  if [ "$matched" = false ]; then
+    failures="$failures  $pattern is ignored here and absent from the manifest"$'\n'
+  fi
+done
+
+# A sanction naming a path that is no longer divergent, either because the
+# manifest took it or because .gitignore dropped it.
+for sanction in "${SANCTIONED[@]}"; do
+  entry="${sanction%%|*}"
+  if contains "$entry" "${ignored[@]}" && ! contains "$entry" "${shipped[@]}"; then
+    continue
+  fi
+  failures="$failures  $entry is sanctioned as a divergence and is no longer one"$'\n'
+done
+
+if [ -n "$failures" ]; then
+  echo "The ignore set a target receives disagrees with this repository's own:" >&2
+  printf '%s' "$failures" >&2
+  echo "Add the entry to the \"$SECTION\" array in ${MANIFEST#"$PROJECT_ROOT/"} and to .gitignore, or record it in SANCTIONED in scripts/core/check-ignore-parity.sh with the reason it stays apart." >&2
+  exit 1
+fi
+
+if [ -n "$sanction_notes" ]; then
+  echo "Sanctioned divergences from the ignore set a target receives:"
+  printf '%s' "$sanction_notes"
+fi

package/scripts/core/check-plugin-boundary.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+INTERNAL_ROOT="$PROJECT_ROOT/internal"
+PLUGIN_ROOT="$PROJECT_ROOT/claude"
+
+# `find` writes to stderr and returns non-zero for a missing root, inside a
+# process substitution whose status nothing reads. Without this the walk covers
+# nothing and the check reports the boundary clean having never measured it.
+if [ ! -d "$PLUGIN_ROOT" ]; then
+  echo "No plugin root at ${PLUGIN_ROOT#"$PROJECT_ROOT/"}, boundary unverifiable." >&2
+  exit 1
+fi
+
+# `realpath` resolves each walked path below. Absent, `set -e` aborts on the
+# substitution and the stage reports a leak for a tool that is not installed,
+# which is the same unmeasured-tree-with-a-verdict shape the guard above closes.
+if ! command -v realpath >/dev/null 2>&1; then
+  echo "realpath is not installed, boundary unverifiable." >&2
+  exit 1
+fi
+
+# The plugin reaches `standards/` and `snippets/` through symlinks, which an
+# installer dereferences with no code in the path to filter. Walking the plugin
+# tree with symlinks followed is what an install actually copies, so resolving
+# each file and rejecting anything under `internal/` asserts the boundary at the
+# only place it can be measured.
+leaked=""
+while IFS= read -r file; do
+  resolved=$(realpath "$file")
+  case "$resolved" in
+  "$INTERNAL_ROOT"/*) leaked="$leaked  ${file#"$PROJECT_ROOT/"} -> ${resolved#"$PROJECT_ROOT/"}"$'\n' ;;
+  esac
+done < <(find -L "$PLUGIN_ROOT" -type f)
+
+if [ -n "$leaked" ]; then
+  echo "Plugin ships toolkit-internal content:" >&2
+  printf '%s' "$leaked" >&2
+  echo "Author internal content under internal/, which nothing under claude/ reaches." >&2
+  exit 1
+fi

package/scripts/core/check-seed-independence.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+source "$PROJECT_ROOT/scripts/lib/tooling.sh"
+
+TOOLKIT_TOKEN="canon"
+TOOLING_ROOT="$PROJECT_ROOT/tooling"
+
+# `find` writes to stderr and returns non-zero for a missing root, inside a
+# process substitution whose status nothing reads. Without this the walk covers
+# nothing and the check reports the seeds independent having never read one.
+if [ ! -d "$TOOLING_ROOT" ]; then
+  echo "No tooling root at ${TOOLING_ROOT#"$PROJECT_ROOT/"}, seed independence unverifiable." >&2
+  exit 1
+fi
+
+# An empty discovery is a real state rather than a broken walk, and the Seed
+# standards stage already reports it as a skip. Failing here would have the two
+# stages disagree about what the same condition means.
+seed_roots=$(collect_seed_roots)
+if [ -z "$seed_roots" ]; then
+  echo "No seed root carries .claude/, nothing to check." >&2
+  exit 0
+fi
+
+# Markdown alone. The seed tree also ships hooks that call the toolkit CLI on
+# purpose, each reporting a named stale-index warning when the binary is absent,
+# and scoping by extension leaves them outside this walk without an exemption
+# list that would have to be maintained against them.
+cited=""
+measured=0
+while IFS= read -r seed_root; do
+  while IFS= read -r file; do
+    measured=$((measured + 1))
+    while IFS= read -r hit; do
+      cited="$cited  ${file#"$PROJECT_ROOT/"}:$hit"$'\n'
+    done < <(grep -n "$TOOLKIT_TOKEN" "$file" || true)
+  done < <(find "$PROJECT_ROOT/$seed_root" -type f -name '*.md')
+done <<<"$seed_roots"
+
+# Roots resolved and no markdown under any of them is a walk that covered
+# nothing, which is the verdict-without-a-measurement the guards above refuse for
+# a missing tree. Reporting a pass here would say the seeds cite no CLI on the
+# strength of having read no prose.
+if [ "$measured" -eq 0 ]; then
+  echo "Seed roots resolved but carry no markdown, seed independence unverifiable." >&2
+  exit 1
+fi
+
+if [ -n "$cited" ]; then
+  echo "Seed prose cites the toolkit CLI:" >&2
+  printf '%s' "$cited" >&2
+  echo "A scaffolded project may not have $TOOLKIT_TOKEN installed. State the capability the line needs rather than the binary that supplies it." >&2
+  exit 1
+fi

package/scripts/core/check-skill-paths.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+SKILLS_DIR="$PROJECT_ROOT/claude/skills"
+
+# A shipped skill runs from a target project, where the toolkit's own wiki/ does
+# not exist. Anchoring on a non-path character keeps a target's .claude/wiki/ legal.
+BANNED_PATH_PATTERN='(^|[^[:alnum:]._/-])wiki/'
+
+[ -d "$SKILLS_DIR" ] || exit 0
+
+matches=$(grep -rnE "$BANNED_PATH_PATTERN" "$SKILLS_DIR" || true)
+
+[ -z "$matches" ] && exit 0
+
+echo "Shipped skills reference a repo-local path that does not exist in a target project:"
+echo "$matches" | sed "s|^$PROJECT_ROOT/||"
+echo
+echo "Reach supporting prose through a canon docs command, a standard cited at the flat root, or inlined text."
+exit 1

package/scripts/core/clean.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+source "$PROJECT_ROOT/scripts/lib/ui.sh"
+
+check_dependencies() {
+  command -v bun >/dev/null 2>&1 || log_error "bun is not installed"
+}
+
+main() {
+  check_dependencies
+
+  echo -e "${GREY}┌${NC}"
+
+  echo -e "${GREY}├${NC} ${WHITE}Cleaning artifacts${NC}"
+  rm -rf node_modules
+
+  log_rem "node_modules/"
+
+  log_step "Cleaning cache"
+  bun pm cache rm
+  log_info "Package manager cache cleared"
+
+  log_step "Rehydrating project"
+  bun install
+  log_info "Dependencies installed"
+
+  echo -e "${GREY}└${NC}\n"
+  echo -e "${GREEN}✓ Clean complete${NC}"
+}
+
+main "$@"

package/scripts/core/install-check.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+source "$PROJECT_ROOT/scripts/lib/ui.sh"
+
+TMP_ROOT="$PROJECT_ROOT/.claude/.tmp/install-check"
+CLONE_DIR="$TMP_ROOT/clone"
+TARGET_DIR="$TMP_ROOT/target"
+KEEP=0
+
+for arg in "$@"; do
+  case "$arg" in
+  --keep) KEEP=1 ;;
+  --help | -h)
+    cat <<HELP
+Usage: scripts/core/install-check.sh [--keep]
+
+Verifies the README install path end to end:
+  1. Clones this repo into .claude/.tmp/install-check/clone
+  2. Runs bun install in the clone
+  3. Runs the CLI with --help to confirm it executes
+  4. Scaffolds a fresh project in .claude/.tmp/install-check/target
+  5. Runs canon init and asserts a scaffold landed
+
+Flags:
+  --keep    Keep the tmp tree on exit for inspection
+HELP
+    exit 0
+    ;;
+  esac
+done
+
+cleanup() {
+  if [ "$KEEP" = "1" ]; then
+    log_info "Kept artifacts at $TMP_ROOT"
+  else
+    rm -rf "$TMP_ROOT"
+  fi
+  close_timeline
+}
+trap cleanup EXIT
+
+rm -rf "$TMP_ROOT"
+mkdir -p "$TMP_ROOT"
+
+open_timeline "Install verification"
+
+log_step "Clone"
+git clone --quiet "$PROJECT_ROOT" "$CLONE_DIR" 2>&1 | pipe_output || true
+log_info "Cloned to $CLONE_DIR"
+
+log_step "Install dependencies"
+(cd "$CLONE_DIR" && bun install --silent 2>&1 | pipe_output) || log_error "bun install failed"
+log_info "Dependencies installed"
+
+log_step "Confirm CLI runs"
+(cd "$CLONE_DIR" && bun run src/cli.ts --help >/dev/null) || log_error "canon --help failed"
+log_info "canon --help ran clean"
+
+log_step "Scaffold fresh project"
+mkdir -p "$TARGET_DIR"
+(cd "$TARGET_DIR" && git init --quiet)
+log_info "Initialized git in $TARGET_DIR"
+
+log_step "Run canon init"
+(cd "$TARGET_DIR" && CANON_NON_INTERACTIVE=1 bun run "$CLONE_DIR/src/cli.ts" init --stack base 2>&1 | pipe_output) || log_error "canon init failed"
+log_info "canon init completed"
+
+log_step "Assert scaffold"
+# Every domain canon init installs needs at least one path here. A domain with
+# no assertion can truncate silently: init still exits 0 because run_domain
+# catches a failed domain, and the gate stays green while the target is
+# missing everything that domain provides.
+#
+# Standards and snippets name no path because neither corpus installs into a
+# target. A scaffold reads a standard through `canon standards <name>` and a
+# snippet through the plugin's live `claude/snippets` symlink, both resolving
+# against the toolkit rather than a copy this gate could assert on. The
+# `@`-reference convention rule is the one snippets-domain file that still
+# installs, since `base` carries `governance/rules/snippets/` as a
+# folder-whole entry the same way it does `core` and `claude`.
+for path in "CLAUDE.md" ".claude/wiki/index.md" ".claude" ".claude/context/index.md" ".claude/wireframes/index.md" ".claude/diagrams/index.md" \
+  ".prettierrc" ".editorconfig" ".lintstagedrc" ".husky/pre-commit" ".github/workflows/verify.yml" "scripts/verify.sh" \
+  ".claude/rules/core/000-constitution.md" ".claude/rules/snippets/505-at-references.md"; do
+  if [ ! -e "$TARGET_DIR/$path" ]; then
+    log_error "Missing after canon init: $path"
+  fi
+  log_info "Found: $path"
+done
+
+if [ ! -x "$TARGET_DIR/scripts/verify.sh" ]; then
+  log_error "Not executable after canon init: scripts/verify.sh"
+fi
+log_info "Executable: scripts/verify.sh"
+
+log_step "Verification passed"
+log_info "Manual check still needed: bun link and global canon invocation"

package/scripts/core/list-seed-roots.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Prints every seed root carrying a `.claude/`, one per line and relative to
+# the project root.
+#
+# The discovery rule has one definition, `collect_seed_roots` in
+# `scripts/lib/tooling.sh`, which `check-seed-independence.sh` already reads.
+# This file is the route a caller outside bash takes to that same answer, so a
+# stack seeding `.claude/` later reaches both readers and the two stages
+# measuring seed content cannot disagree about which roots exist.
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+source "$PROJECT_ROOT/scripts/lib/tooling.sh"
+
+collect_seed_roots

package/scripts/core/regen-claude-copies.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+# `.claude/rules/` is a subset rather than a mirror, so it resolves through the
+# stack machinery. The record naming the subset is `internal/governance.toml`.
+bun "$PROJECT_ROOT/src/cli.ts" gov regen --root "$PROJECT_ROOT"

package/scripts/core/regen-hero.sh

@@ -0,0 +1,217 @@
+#!/usr/bin/env bash
+# Fills assets/hero.html.tmpl from the CLI catalogs and writes assets/hero.html.
+#
+# Only the HTML regenerates here. The PNG beside it is a chromium render whose
+# bytes move with the browser version, so asserting it in verify.sh would fail
+# on a machine whose chromium differs rather than on a stale count. Rebuild the
+# image with `canon capture assets/hero.html` after this script reports a change.
+# That capture also writes assets/hero.stamp, which records the digest of the
+# markup it rendered and is what the Hero stage compares, so all three files
+# commit together. The frame carries no version. `package.json` is bumped on main by the release
+# tooling, so embedding it drifts every open branch on the next release and the
+# stage then fails for work that touched nothing.
+#
+# Clone-only. `src/capture` is excluded from the published tarball, and this
+# script reads the repository's own catalogs, so a registry install has neither.
+set -e
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="${PROJECT_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+TEMPLATE="$PROJECT_ROOT/assets/hero.html.tmpl"
+OUTPUT="$PROJECT_ROOT/assets/hero.html"
+LISTED=10
+
+# `bun src/cli.ts` rather than `canon`, since a globally linked binary resolves to
+# the main checkout no matter which worktree is running.
+catalog() {
+  (cd "$PROJECT_ROOT" && CANON_NON_INTERACTIVE=1 bun src/cli.ts "$@" --json 2>/dev/null)
+}
+
+if [ ! -f "$TEMPLATE" ]; then
+  echo "regen-hero: missing template at $TEMPLATE" >&2
+  exit 1
+fi
+
+# The commands have no `--json` catalog of their own, so the count comes from
+# `canon gov counts`, which already reads the registration block in the CLI
+# entry point to judge a document stating its own command count. Reading that
+# figure here rather than re-deriving it with a second regex is what keeps the
+# two readings of `src/cli.ts` from drifting apart unwatched, which is the
+# defect `canon gov counts` itself exists to catch.
+# `gov counts` exits non-zero on an ordinary finding, unlike every `list` verb
+# below, so its output is read past that under `set -e` rather than aborting
+# a hero rebuild for a stale count somewhere unrelated in the tree.
+COUNTS_JSON="$(catalog gov counts || true)"
+SKILLS_JSON="$(catalog claude skills list)"
+GOV_JSON="$(catalog gov list)"
+STANDARDS_JSON="$(catalog standards list)"
+SNIPPETS_JSON="$(catalog snippets list)"
+TOOLING_JSON="$(catalog tooling list)"
+
+for payload in "$COUNTS_JSON" "$SKILLS_JSON" "$GOV_JSON" "$STANDARDS_JSON" "$SNIPPETS_JSON" "$TOOLING_JSON"; do
+  if [ -z "$payload" ]; then
+    echo "regen-hero: a catalog returned nothing, refusing to write a zeroed hero" >&2
+    exit 1
+  fi
+done
+
+# The catalogs reach the eval as files rather than as environment entries. Linux
+# caps a single env string at 128KB, and the standards payload crossed it, which
+# fails the exec with E2BIG before any stage can report a stale count. A file
+# path is bounded whatever the catalogs grow to.
+PAYLOAD_DIR="$(mktemp -d)"
+trap 'rm -rf "$PAYLOAD_DIR"' EXIT
+
+printf '%s' "$COUNTS_JSON" >"$PAYLOAD_DIR/counts.json"
+printf '%s' "$SKILLS_JSON" >"$PAYLOAD_DIR/skills.json"
+printf '%s' "$GOV_JSON" >"$PAYLOAD_DIR/gov.json"
+printf '%s' "$STANDARDS_JSON" >"$PAYLOAD_DIR/standards.json"
+printf '%s' "$SNIPPETS_JSON" >"$PAYLOAD_DIR/snippets.json"
+printf '%s' "$TOOLING_JSON" >"$PAYLOAD_DIR/tooling.json"
+
+export PAYLOAD_DIR
+export TEMPLATE OUTPUT LISTED PROJECT_ROOT
+
+bun --eval '
+const { readFileSync } = require("node:fs")
+
+const { PAYLOAD_DIR, TEMPLATE, OUTPUT, LISTED, PROJECT_ROOT } = process.env
+
+const payload = (name) => readFileSync(PAYLOAD_DIR + "/" + name + ".json", "utf8")
+
+const COUNTS_JSON = payload("counts")
+const SKILLS_JSON = payload("skills")
+const GOV_JSON = payload("gov")
+const STANDARDS_JSON = payload("standards")
+const SNIPPETS_JSON = payload("snippets")
+const TOOLING_JSON = payload("tooling")
+
+const listed = Number(LISTED)
+const skills = JSON.parse(SKILLS_JSON).skills.map((entry) => entry.name)
+const gov = JSON.parse(GOV_JSON)
+// Rule names carry a numeric prefix that orders the load, not the identity a
+// reader knows them by, so the frame shows the slug alone.
+const slug = (entry) => entry.name.replace(/^\d+-/, "")
+const rules = gov.rules.map(slug)
+// A rule no stack names is opt-in behind `--add`, so featuring one advertises
+// an entry no ordinary `canon gov install` delivers. The column samples the
+// stack-reached subset while its count and remainder describe the whole catalog.
+const stacked = new Set(gov.stacks.flatMap((stack) => stack.rules))
+const deliveredRules = gov.rules.filter((entry) => stacked.has(entry.name)).map(slug)
+const standards = JSON.parse(STANDARDS_JSON).standards.map((entry) => entry.name)
+const snippets = new Set(
+  JSON.parse(SNIPPETS_JSON).categories.flatMap((category) => category.entries),
+)
+const toolingStacks = JSON.parse(TOOLING_JSON).stacks
+const commandCount = JSON.parse(COUNTS_JSON).catalogs.commands
+if (!commandCount) {
+  console.error("regen-hero: gov counts read no commands catalog, refusing to write a zeroed hero")
+  process.exit(1)
+}
+
+const escape = (value) =>
+  value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+
+// Even spacing across the sorted catalog rather than its first N, so a column
+// whose names share a prefix does not read as a narrower catalog than the one
+// that ships. Rules and standards sample. Skills do not, because the even step
+// lands on the entries closest to commodity and on none of the workflow the
+// toolkit exists to carry.
+const sample = (names) => {
+  if (names.length <= listed) return names
+  const step = names.length / listed
+  return Array.from({ length: listed }, (_, i) => names[Math.floor(i * step)])
+}
+
+// The first seven are the method and exist nowhere else. The last three are
+// recognizable on sight and are what keeps a column of chosen names from
+// reading as an all-`claude-` catalog, which is the failure the sampler above
+// was written against.
+const FEATURED_SKILLS = [
+  "claude-feature",
+  "claude-groundwork",
+  "claude-intake",
+  "claude-orchestrate",
+  "claude-autoship",
+  "claude-pr-review",
+  "claude-tasks",
+  "git-ship",
+  "setup-init",
+  "systematic-debugging",
+]
+
+// A chosen name is maintained by hand where a sample never goes stale, so a
+// rename has to fail the run rather than quietly shrink the column. This is
+// what makes the trade acceptable.
+//
+// The length is asserted because the `+N more` figure below counts down from
+// `listed` rather than from what this returns, so a list of any other length
+// renders a remainder that is wrong by the difference.
+const featured = (names, chosen) => {
+  if (chosen.length !== listed) {
+    console.error(`regen-hero: ${chosen.length} featured skills, expected ${listed}`)
+    process.exit(1)
+  }
+  const catalog = new Set(names)
+  const missing = chosen.filter((name) => !catalog.has(name))
+  if (missing.length > 0) {
+    console.error(`regen-hero: featured skills missing from the catalog: ${missing.join(", ")}`)
+    process.exit(1)
+  }
+  return chosen
+}
+
+const markup = (names) =>
+  names
+    .map((name) => `            <div class="entry">${escape(name)}</div>`)
+    .join("\n")
+
+const entries = (names) => markup(sample(names))
+
+const remaining = (names) => String(Math.max(0, names.length - listed))
+
+// An empty array is well-formed JSON, so the shell guard on an empty payload
+// does not catch a catalog whose tree went missing. A zeroed count would ship a
+// frame claiming the domain has nothing in it.
+for (const [label, list] of [
+  ["skills", skills], ["rules", rules], ["standards", standards],
+  ["snippets", [...snippets]], ["tooling stacks", toolingStacks], ["gov stacks", gov.stacks],
+  ["stack-delivered rules", deliveredRules],
+]) {
+  if (list.length === 0) {
+    console.error(`regen-hero: the ${label} catalog is empty, refusing to write a zeroed hero`)
+    process.exit(1)
+  }
+}
+
+const values = {
+  SKILL_COUNT: String(skills.length),
+  RULE_COUNT: String(rules.length),
+  STANDARD_COUNT: String(standards.length),
+  SNIPPET_COUNT: String(snippets.size),
+  GOV_STACK_COUNT: String(gov.stacks.length),
+  TOOLING_STACK_COUNT: String(toolingStacks.length),
+  COMMAND_COUNT: String(commandCount),
+  SKILL_ENTRIES: markup(featured(skills, FEATURED_SKILLS)),
+  RULE_ENTRIES: entries(deliveredRules),
+  STANDARD_ENTRIES: entries(standards),
+  SKILL_MORE: remaining(skills),
+  RULE_MORE: remaining(rules),
+  STANDARD_MORE: remaining(standards),
+}
+
+let html = await Bun.file(TEMPLATE).text()
+for (const [key, value] of Object.entries(values)) {
+  html = html.replaceAll(`{{${key}}}`, value)
+}
+
+const unresolved = html.match(/{{[A-Z_]+}}/g)
+if (unresolved) {
+  console.error(`regen-hero: unresolved placeholders ${[...new Set(unresolved)].join(", ")}`)
+  process.exit(1)
+}
+
+await Bun.write(OUTPUT, html)
+'