@erclx/canon 4.102.0 → 4.104.0

package/docs/target-projects.md

@@ -51,19 +51,19 @@ claude --plugin-dir <toolkit>/claude
 Two steps, in order:
 
 1. Run the framework's own scaffold if the project needs one, such as `bun init`, `npm create vite`, or `npm create astro`. The toolkit does not wrap framework scaffolding.
-2. Invoke `canon:setup-init` in Claude Code. The skill detects the stack, resolves flags, previews the full chain, and runs it end-to-end.
+2. Invoke `canon:target-setup` in Claude Code. The skill detects the stack, resolves flags, previews the full chain, and runs it end-to-end.
 
 The chain is:
 
 - `canon init` installs base tooling, Claude seeds, and governance rules into `.claude/rules/` in the same pass
 - `canon tooling sync <stack> --write` adds stack-specific deps, scripts, and gitignore entries
 - The agent reads `canon tooling reference <stack>` (plus parents) as its audit context, follows it to generate eslint, vitest, playwright configs and the stack's setup script, and extends `canon/context/ci.md` and `canon/context/development.md` per the reference's extend sections <!-- audit-ignore-citations: canon/context/development.md -->
-- `setup-verify` runs the installed `package.json` scripts (lint, typecheck, check, test, build) and reports pass or fail
-- `setup-indexes` bootstraps the `index.md` system over the project's own documentation folders, confirming candidate folders with the operator rather than running unattended
+- The `verify` phase runs the installed `package.json` scripts (lint, typecheck, check, test, build) and reports pass or fail
+- The `indexes` phase bootstraps the `index.md` system over the project's own documentation folders, confirming candidate folders with the operator rather than running unattended
 
-The chain stops at the project edge. `repo-metadata` and `git-commit` also ship, reaching a remote and the project's history respectively, and neither runs as part of it. The chain serves a fresh scaffold and names a destination for the three states it does not. An existing project goes to `canon:canon-operator`, which reads what the project already carries before naming a per-domain command. An install wanting the Claude layer without the tooling chain runs `canon claude init` for the seed docs and then `canon:setup-indexes` for the index system. A language the toolkit ships no stack for is the one of the three the chain still runs for, on `base`, with the fallback marked in the preview so it can be declined there.
+The chain stops at the project edge. `repo-metadata` and `git-commit` also ship, reaching a remote and the project's history respectively, and neither runs as part of it. The chain serves a fresh scaffold and names a destination for the three states it does not. An existing project goes to `canon:canon-operator`, which reads what the project already carries before naming a per-domain command. An install wanting the Claude layer without the tooling chain runs `canon claude init` for the seed docs and then `canon:target-setup indexes` for the index system. A language the toolkit ships no stack for is the one of the three the chain still runs for, on `base`, with the fallback marked in the preview so it can be declined there.
 
-Run `canon:setup-smoke` by hand once `setup-verify` passes, for the heavier server smoke, end-to-end, and screenshot pass, since the same flakiness reasons that excluded those stages from `setup-verify` keep it out of this unattended chain too.
+Run `canon:target-setup verify deep` by hand once the default depth passes, for the heavier server smoke, end-to-end, and screenshot pass, since the same flakiness reasons that keep those stages out of the default depth keep them out of this unattended chain too.
 
 Keep the `## Scripts` table in `canon/context/development.md` current as scripts are added. Base tooling seeds that entry with the commands it installs, and each stack reference extends the table. `project-commands` reads it to start the app or run a check on request, so a command missing from the table cannot be run that way. A project whose entry outgrew one file and split into `canon/context/development/` keeps the table in `overview.md`, which is where the skill looks next. <!-- audit-ignore-citations: canon/context/development.md -->
 
@@ -86,13 +86,13 @@ Each diagram entry records the commit and date it was last verified against, and
 
 The default path is `base`. `canon init` on `base` installs base tooling configs, Claude seeds, and governance core rules, and scaffolds an empty `.claude/wiki/`. Most projects need nothing more.
 
-Escalate only for real web apps. The `setup-init` skill reads `package.json` and root configs, then picks the matching tooling stack (`canon tooling list --json` names the current set) and the matching governance stack (`react`, `astro`, `node`).
+Escalate only for real web apps. The `target-setup` skill reads `package.json` and root configs, then picks the matching tooling stack (`canon tooling list --json` names the current set) and the matching governance stack (`react`, `astro`, `node`).
 
 `node-server` is named rather than detected. It carries the server-side security and persistence rules for a project writing request handlers or a persistence layer in TypeScript, and the detect step matches a runtime or a framework against stack names, so nothing there marks a project as a backend. Pass it deliberately with `canon init --stack node-server` or `canon gov install node-server <target>`.
 
 Markdown-heavy projects, CLI tools, docs sites, research notebooks, and scripting repos stay on `base`. Escalation is a ceiling move, not a default.
 
-A project the toolkit ships no stack for lands on `base` the same way, and the skill marks that resolution as a fallback in its preview rather than reporting it as a match. Configs, seeds, and gitignore entries land either way, and the JavaScript development dependencies, scripts, and hook activation land only where a `package.json` exists to carry them. A project outside that ecosystem declines at the preview and takes `canon:setup-gov` for the governance layer alone, which is language-neutral.
+A project the toolkit ships no stack for lands on `base` the same way, and the skill marks that resolution as a fallback in its preview rather than reporting it as a match. Configs, seeds, and gitignore entries land either way, and the JavaScript development dependencies, scripts, and hook activation land only where a `package.json` exists to carry them. A project outside that ecosystem declines at the preview and takes `canon:target-setup gov` for the governance layer alone, which is language-neutral.
 
 Run `canon tooling list --json` and `canon gov list --json` to see the current catalogs. Never hardcode stack names.
 
@@ -115,9 +115,9 @@ The plugin corpus carries runtime behavior rather than reference prose alone, be
 
 When a new need appears after scaffold, install the one domain without re-running `canon init`.
 
-- Governance rule for a newly adopted library: invoke `canon:setup-gov`, or run `canon gov install <stack> --add <rule> <path>`
+- Governance rule for a newly adopted library: invoke `canon:target-setup gov`, or run `canon gov install <stack> --add <rule> <path>`
 - Project-specific rule the toolkit does not ship: invoke `canon:create-rule`. It scaffolds a rule into `.claude/rules/` with a non-colliding number, and `canon gov sync` leaves it untouched.
-- Index.md system for a markdown-heavy folder that emerged: invoke `canon:setup-indexes`
+- Index.md system for a markdown-heavy folder that emerged: invoke `canon:target-setup indexes`
 
 Standards and snippets are not on that list, and there is nothing to add for either. Neither installs into a project, by default or by flag, so a session reads a standard with `canon standards <name>` and a snippet through its `@` reference off the live plugin symlink, both resolving against the toolkit rather than a project copy. A project holding a `.claude/standards/` or `.claude/snippets/` folder from an older toolkit is carrying a stale artifact nothing reads, and deleting it is safe.
 
@@ -215,6 +215,8 @@ Neither `canon sync --check` nor any other command notices a surface still sitti
 
 `canon sync --check <path>` reports what has drifted without writing anything. It splits each difference by cause, which is the question that decides what to do next.
 
+`canon:target-check` is the same reading grouped by domain rather than by cause, run from inside the project. It reports the toolkit version, the `canon/` folder, governance rules, tooling, and seeds from the verbs that own each comparison, and reports the Claude harness as unchecked because no verb reads it. It repairs nothing, so it is what to run before deciding rather than instead of deciding.
+
 #### The binary first
 
 The report opens by naming the binary running it. The installed version reads against the newest published one, and a version behind that points you at `canon upgrade`, since every section under it is a reading taken by whichever toolkit you happen to have. An unreachable registry reports unknown with its reason rather than failing, so `--exit-code` still gates on the drift the check measured locally and an offline machine stays green.
@@ -298,7 +300,7 @@ cd <your-project>
 claude
 ```
 
-In the session, invoke `canon:setup-init`. The skill detects no framework and resolves tooling to `base` and governance to `base`. The preview marks both stacks as fallbacks, since neither came from a match, then the chain runs `canon init`.
+In the session, invoke `canon:target-setup`. The skill detects no framework and resolves tooling to `base` and governance to `base`. The preview marks both stacks as fallbacks, since neither came from a match, then the chain runs `canon init`.
 
 Ongoing: run `canon sync --check .` to see what has drifted, then invoke `canon:seed-sync` for seed drift or `canon sync .` for a catch-all refresh.
 
@@ -309,7 +311,7 @@ bun create vite my-app && cd my-app
 claude
 ```
 
-Invoke `canon:setup-init`. The skill reads `package.json` and the Vite config, resolves tooling to `vite-react` and governance to `react`, and runs `canon init` with the resolved flags.
+Invoke `canon:target-setup`. The skill reads `package.json` and the Vite config, resolves tooling to `vite-react` and governance to `react`, and runs `canon init` with the resolved flags.
 
 Ongoing maintenance:
 

package/docs/workflow/ai-workflow.md

@@ -200,19 +200,14 @@ This section is the corpus the coverage claim is measured against: every name `c
 
 ### Set up a project
 
-| Skill                  | When to use                                                                                                     |
-| ---------------------- | --------------------------------------------------------------------------------------------------------------- |
-| `canon:setup-init`     | On a fresh scaffold, to detect the stack and run the whole install chain in one pass                            |
-| `canon:canon-operator` | On a project that already exists, to read what it carries before an install is picked                           |
-| `canon:setup-gov`      | When the governance rules are wanted without the tooling chain                                                  |
-| `canon:setup-indexes`  | When a markdown-heavy folder needs an `index.md` a session can browse                                           |
-| `canon:setup-plugins`  | On a new machine, to install the community and official plugins user-scoped                                     |
-| `canon:setup-verify`   | After the agent generates configs, to run the installed scripts and report pass or fail                         |
-| `canon:setup-smoke`    | After `setup-verify` passes, to check the dev and preview servers, end-to-end tests, and the screenshot harness |
-| `canon:sketch-design`  | Before `design-extract`'s greenfield path, to trace a design direction from reference images or URLs            |
-| `canon:design-extract` | Before the first UI feature, to draft `canon/DESIGN.md`                                                         |
-| `canon:draft-diagram`  | Once the architecture is written, to draft per-kind entries under `.canon/diagrams/`                            |
-| `canon:repo-metadata`  | When the GitHub About text, homepage, or topics may have drifted, to reconcile them against the README          |
+| Skill                  | When to use                                                                                            |
+| ---------------------- | ------------------------------------------------------------------------------------------------------ |
+| `canon:target-setup`   | On a fresh scaffold, to detect the stack and run the install chain, or to reach one phase of it alone  |
+| `canon:canon-operator` | On a project that already exists, to read what it carries before an install is picked                  |
+| `canon:sketch-design`  | Before `design-extract`'s greenfield path, to trace a design direction from reference images or URLs   |
+| `canon:design-extract` | Before the first UI feature, to draft `canon/DESIGN.md`                                                |
+| `canon:draft-diagram`  | Once the architecture is written, to draft per-kind entries under `.canon/diagrams/`                   |
+| `canon:repo-metadata`  | When the GitHub About text, homepage, or topics may have drifted, to reconcile them against the README |
 
 ### Decide what to build
 
@@ -289,16 +284,17 @@ This section is the corpus the coverage claim is measured against: every name `c
 
 ### Keep the project current with the toolkit
 
-| Skill                            | When to use                                                                        |
-| -------------------------------- | ---------------------------------------------------------------------------------- |
-| `canon:seed-sync`                | After a toolkit update, to reconcile installed seeds without losing customizations |
-| `canon:migration-claude-md`      | When `CLAUDE.md` grew past what always-load context should carry                   |
-| `canon:migration-context`        | When `docs/` holds agent-flavored files belonging in `canon/context/`              |
-| `canon:migration-superseded`     | When a drift report names a `.claude/` file a folder has replaced                  |
-| `canon:migration-standards-drop` | When the project still holds an installed `.claude/standards/` tree                |
-| `canon:canon-feedback-file`      | When something in the toolkit is broken, missing, or off                           |
-| `canon:canon-feedback-triage`    | In the toolkit repo, to work through the open feedback issues                      |
-| `canon:canon-rollout`            | In the toolkit repo, to take one change out to every consuming project at once     |
+| Skill                            | When to use                                                                            |
+| -------------------------------- | -------------------------------------------------------------------------------------- |
+| `canon:target-check`             | In a target project, to report per domain what it holds against what the toolkit ships |
+| `canon:seed-sync`                | After a toolkit update, to reconcile installed seeds without losing customizations     |
+| `canon:migration-claude-md`      | When `CLAUDE.md` grew past what always-load context should carry                       |
+| `canon:migration-context`        | When `docs/` holds agent-flavored files belonging in `canon/context/`                  |
+| `canon:migration-superseded`     | When a drift report names a `.claude/` file a folder has replaced                      |
+| `canon:migration-standards-drop` | When the project still holds an installed `.claude/standards/` tree                    |
+| `canon:canon-feedback-file`      | When something in the toolkit is broken, missing, or off                               |
+| `canon:canon-feedback-triage`    | In the toolkit repo, to work through the open feedback issues                          |
+| `canon:canon-rollout`            | In the toolkit repo, to take one change out to every consuming project at once         |
 
 ### Generate an artifact on demand
 

package/governance/rules/ci/700-ci-workflow.md

@@ -39,6 +39,17 @@ paths:
 - Install with `bun install --frozen-lockfile`.
 - Key the Playwright browser cache on the Playwright version string, never a static key.
 
+## Commit-back
+
+- Commit a refreshed file back to the pull request branch only when the branch's own change moved it. Report the diff without committing when something outside the branch can move it, such as a count read at build time or a font that renders differently per machine, since that commit lands on a branch that never asked for it.
+- Commit only what a deterministic step regenerates from source, and run the diff check before the commit step so an unchanged capture pushes nothing.
+- Skip a pull request from a fork with `github.event.pull_request.head.repo.full_name == github.repository`, since the default token cannot push to a fork's branch.
+- Set the concurrency group on the ref so a newer push cancels the run committing onto a stale head.
+- Set `HUSKY: 0` on the commit step when the runner lacks a tool a hook shells out to.
+- Never commit back to the trunk. A commit with no pull request and no reviewer needs an operator's decision, not a workflow's.
+- Leave `workflow_dispatch` off a commit-back workflow. A manual run has no branch to commit onto, so the trigger would pass and do nothing.
+- Fail a template's first step while a path list still holds its placeholder, so an unfinished install fails loudly rather than never firing.
+
 ## Authority
 
 - Load the `canon:ci-workflow` skill for the workflow template and the per-project adaptation. Report it rather than proceeding silently when the skill does not resolve.

package/governance/rules/ui/400-ui.md

@@ -9,11 +9,6 @@ paths:
 
 # UI copy standards
 
-## Casing
-
-- Use sentence case for all rendered UI text: headings, labels, nav items, tab titles, and dialog titles.
-- Retain original casing for proper nouns and product names: `GitHub`, `macOS`, `TypeScript`.
-
 ## Punctuation
 
 - Do not use em dashes (`—`). Use a comma or period, or restructure the sentence.

package/governance/rules/ui/460-design-taste.md

@@ -25,5 +25,5 @@ paths:
 
 - Accessibility, keyboard interaction and ARIA are a separate topic. `410-a11y` routes them, on every rendered path.
 - States, empty and loading coverage, and destructive confirmation are a separate topic. `430-ux-completeness` routes them.
-- Rendered copy casing, button labels and error wording are a separate topic. `400-ui` routes them.
+- Rendered copy casing is a separate topic. `465-interface-casing` routes it. Button labels and error wording are separate too, and `400-ui` routes them.
 - The floor those three carry is not restated in the skill, and it is not traded against a preference where the two collide.

package/governance/rules/ui/465-interface-casing.md

@@ -0,0 +1,31 @@
+---
+description: Enforce casing for interface text in markup, MDX, and content modules, where copy lives in a content folder
+paths:
+  - '**/*.tsx'
+  - '**/*.jsx'
+  - '**/*.astro'
+  - '**/*.html'
+  - '**/*.mdx'
+  - '**/content/**/*.ts'
+---
+
+# Interface casing standards
+
+## Sentence case
+
+- Use sentence case for all rendered interface text: headings, labels, nav items, tab titles, and dialog titles.
+- Retain original casing for proper nouns and product names: `GitHub`, `macOS`, `TypeScript`.
+- Treat title case on every heading as a template tell, since it reads as a default rather than a choice.
+
+## Uppercase labels
+
+- Keep small uppercase labels above headings to one per three sections, with the first screen counting as one. More than `ceil(sections / 3)` is too many, and the fix is usually to delete the label, since a section's position already says what it is.
+- Treat the count as a judgment, since a glob cannot check it.
+
+## Where it applies
+
+- The rule covers markup, MDX, and content modules under a `content/` folder. Copy kept elsewhere, such as a locale file, is not reached, so apply the same casing there without the rule firing.
+
+## Overriding
+
+- Depart from sentence case where the case needs it, such as an acronym, a brand mark, or a set-in-caps identity the design chose on purpose.

package/governance/stacks/astro.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["210-astro", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "470-motion"]
+rules = ["210-astro", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "465-interface-casing","470-motion"]

package/governance/stacks/react.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "470-motion"]
+rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "465-interface-casing","470-motion"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.102.0",
+  "version": "4.104.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/scripts/core/regen-hero.sh

@@ -197,7 +197,7 @@ const FEATURED_SKILLS = [
   "review-pr",
   "task-board",
   "git-ship",
-  "setup-init",
+  "target-setup",
   "systematic-debugging",
 ]
 

package/scripts/core/regen-web-previews.ts

@@ -21,6 +21,7 @@ const root = new URL('../..', import.meta.url).pathname
 const { cssPath } = renderDesignDoc(
   `${root}${DESIGN_DOCUMENT}`,
   `${root}web/public/previews/design-tokens`,
+  { embedFonts: true },
 )
 
 const css = readFileSync(cssPath, 'utf8')

package/src/claude/cases/setup.ts

@@ -1,39 +1,40 @@
 import type { SkillCase } from '@/claude/skills-rank'
 
 /**
- * `setup-*`, `migration-*`, `canon-*`, and `create-rule`: scaffolding,
+ * `target-setup`, `migration-*`, `canon-*`, and `create-rule`: scaffolding,
  * proposal-only migrations, and the toolkit's own reference and feedback
  * surfaces.
+ *
+ * The five `target-setup` cases are one skill read through five entry phrasings
+ * rather than five rows that collapsed to a duplicate. Each names a different
+ * phase, and the merged description has to carry every one of them, which is
+ * the discrimination the six-skill family failed at from the other direction.
  */
 export const SETUP_CASES: readonly SkillCase[] = [
   {
     prompt:
       'This project has no rules installed yet, get the right governance in place.',
-    expect: 'setup-gov',
+    expect: 'target-setup',
   },
   {
     prompt:
       "Get the index.md system bootstrapped across this project's folders.",
-    expect: 'setup-indexes',
+    expect: 'target-setup',
   },
   {
     prompt:
       'This is a brand-new project, get the toolkit bootstrapped in one shot.',
-    expect: 'setup-init',
-  },
-  {
-    prompt: 'Get the usual Claude Code plugins provisioned on this machine.',
-    expect: 'setup-plugins',
+    expect: 'target-setup',
   },
   {
     prompt:
       "Run through the generated scaffold's scripts and confirm each one passes.",
-    expect: 'setup-verify',
+    expect: 'target-setup',
   },
   {
     prompt:
       'Check that the dev server actually starts and the end-to-end suite passes against the scaffold.',
-    expect: 'setup-smoke',
+    expect: 'target-setup',
   },
   {
     prompt:
@@ -76,7 +77,7 @@ export const SETUP_CASES: readonly SkillCase[] = [
   {
     prompt:
       "Whatever the right toolkit command is, get this project's rules installed.",
-    expect: 'setup-gov',
+    expect: 'target-setup',
   },
   {
     prompt:
@@ -91,6 +92,14 @@ export const SETUP_CASES: readonly SkillCase[] = [
       'Take this change out to every project that installed the toolkit and get each one to a pull request.',
     expect: 'canon-rollout',
   },
+  // Reporting per domain is what separates this from canon-operator, which
+  // diagnoses on the way to running the operation an intent named. This answers
+  // one fixed question across a fixed domain list and repairs nothing.
+  {
+    prompt:
+      'Report what this project has fallen behind the toolkit on, domain by domain, and fix nothing.',
+    expect: 'target-check',
+  },
   {
     prompt:
       "This project needs its own coding rule that the toolkit doesn't ship.",

package/src/commands/design.ts

@@ -119,7 +119,11 @@ export function register(program: Command): void {
       'Output directory',
       creationRel(process.cwd(), SCRATCH, 'render', 'design'),
     )
-    .action((opts: { source: string; out: string }) => {
+    .option(
+      '--embed-fonts',
+      'Declare each vendored face the typography table names, and set the page body in the body stack',
+    )
+    .action((opts: { source: string; out: string; embedFonts?: boolean }) => {
       const sourcePath = resolve(process.cwd(), opts.source)
       const outDir = resolve(process.cwd(), opts.out)
       const { GREEN, GREY, NC, RED, WHITE } = palette(process.stderr)
@@ -133,7 +137,9 @@ export function register(program: Command): void {
       process.stderr.write(
         `${GREY}┌${NC}\n${GREY}│${NC} ${WHITE}Render design tokens${NC}\n`,
       )
-      const result = renderDesignDoc(sourcePath, outDir)
+      const result = renderDesignDoc(sourcePath, outDir, {
+        embedFonts: opts.embedFonts,
+      })
       process.stderr.write(
         `${GREY}│${NC} ${GREEN}✓${NC} ${result.htmlPath}\n${GREY}│${NC} ${GREEN}✓${NC} ${result.cssPath}\n${GREY}└${NC}\n`,
       )

package/src/commands/sync.ts

@@ -109,7 +109,7 @@ function renderCheck(report: CheckReport): void {
     logStep('Not a toolkit project')
     logWarn('No .claude/ directory and no CLAUDE.md at the target.')
     logInfo(
-      'Run `canon init` to install, or /canon:setup-init to resolve a stack.',
+      'Run `canon init` to install, or /canon:target-setup to resolve a stack.',
     )
     outro()
     return

package/src/design/css.ts

@@ -136,14 +136,17 @@ ${component.rules}`,
  * installed. Defaults to the mono stack's primary family; teach passes its own
  * three faces instead of widening this default for every consumer.
  */
-function fontFaceBlock(faces: readonly FontFace[]): string {
+export function fontFaceBlock(
+  faces: readonly FontFace[],
+  display: 'swap' | 'block' = 'swap',
+): string {
   return faces
     .map(
       (face) => `@font-face {
   font-family: '${face.family}';
   font-weight: ${face.weight};
   font-style: normal;
-  font-display: swap;
+  font-display: ${display};
   src: url(data:font/woff2;base64,${face.base64}) format('woff2');
 }`,
     )

package/src/design/render.ts

@@ -2,6 +2,9 @@ import { mkdirSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import type { Cell, DesignDoc, Row } from '@/design/parse'
 import { parseDesignDoc } from '@/design/parse'
+import { fontFaceBlock } from '@/design/css'
+import type { FontFace } from '@/design/fonts'
+import { FONT_FACES } from '@/design/fonts'
 import { colorValue } from '@/design/tokens'
 
 export interface RenderResult {
@@ -19,19 +22,55 @@ const FAVICON_HREF = `data:image/svg+xml,${encodeURIComponent(
   `<svg xmlns="http://www.w3.org/2000/svg" viewBox="10 10 80 80"><path d="M34,20 L15,28 L15,72 L34,80 Z M66,20 L85,28 L85,72 L66,80 Z" fill="${FAVICON_COLOR}" /><rect x="44" y="15" width="12" height="70" rx="2" fill="${FAVICON_COLOR}" /></svg>`,
 )}`
 
+export interface RenderOptions {
+  /**
+   * Declare each vendored face the typography table names, and let the page
+   * body take the body role's stack. Off by default, since a face is a large
+   * base64 block a target's render would otherwise grow by unasked.
+   */
+  readonly embedFonts?: boolean
+}
+
 export function renderDesignDoc(
   sourcePath: string,
   outDir: string,
+  options: RenderOptions = {},
 ): RenderResult {
   const doc = parseDesignDoc(sourcePath)
   mkdirSync(outDir, { recursive: true })
   const cssPath = join(outDir, 'design.css')
   const htmlPath = join(outDir, 'index.html')
-  writeFileSync(cssPath, buildCss(doc))
-  writeFileSync(htmlPath, buildHtml(doc))
+  const faces = options.embedFonts ? namedFaces(doc) : []
+  writeFileSync(cssPath, buildCss(doc, faces))
+  writeFileSync(htmlPath, buildHtml(doc, bodyFamily(doc, faces)))
   return { htmlPath, cssPath }
 }
 
+/** The vendored faces whose family appears in a typography `Family` cell. */
+function namedFaces(doc: DesignDoc): FontFace[] {
+  const named = new Set(
+    doc.typography.flatMap((row) =>
+      val(row, 'Family')
+        .split(',')
+        .map((family) => family.trim().replace(/^['"]|['"]$/g, '')),
+    ),
+  )
+  return FONT_FACES.filter((face) => named.has(face.family))
+}
+
+/** A stack lands raw in a `<style>` block, where HTML escaping does nothing. */
+const SAFE_STACK = /^[\w\s,'"-]+$/
+
+/** The stack the body role names, once a face for it is embedded. */
+function bodyFamily(doc: DesignDoc, faces: readonly FontFace[]): string {
+  if (!faces.length) return 'system-ui, sans-serif'
+  const row =
+    doc.typography.find((r) => slug(val(r, 'Role')) === 'body') ??
+    doc.typography[0]
+  const family = val(row, 'Family')
+  return SAFE_STACK.test(family) ? family : 'system-ui, sans-serif'
+}
+
 function slug(s: string): string {
   return s
     .toLowerCase()
@@ -105,7 +144,7 @@ function confidence(doc: DesignDoc): Confidence {
   return { tagged, total }
 }
 
-function buildCss(doc: DesignDoc): string {
+function buildCss(doc: DesignDoc, faces: readonly FontFace[]): string {
   const lines: string[] = [':root {']
   for (const row of doc.color) {
     if (val(row, 'Value')) {
@@ -135,7 +174,8 @@ function buildCss(doc: DesignDoc): string {
     }
   }
   lines.push('}')
-  return lines.join('\n') + '\n'
+  const root = lines.join('\n') + '\n'
+  return faces.length ? `${fontFaceBlock(faces, 'block')}\n\n${root}` : root
 }
 
 function escape(s: string): string {
@@ -178,7 +218,7 @@ function previewChrome(): string {
   return ['  :root {', ...lines, '  }'].join('\n')
 }
 
-function buildHtml(doc: DesignDoc): string {
+function buildHtml(doc: DesignDoc, bodyStack: string): string {
   const sections = [
     sectionPersonality(doc.personality),
     sectionColor(doc.color),
@@ -205,7 +245,7 @@ function buildHtml(doc: DesignDoc): string {
 <link rel="stylesheet" href="design.css">
 <style>
 ${previewChrome()}
-  body { font-family: system-ui, sans-serif; margin: 2rem; max-width: 960px; color: var(--preview-ink); background: var(--preview-paper); }
+  body { font-family: ${bodyStack}; margin: 2rem; max-width: 960px; color: var(--preview-ink); background: var(--preview-paper); }
   h1 { margin-top: 0; }
   h2 { margin-top: 2rem; border-bottom: 1px solid var(--preview-rule); padding-bottom: 0.25rem; }
   table { border-collapse: collapse; width: 100%; margin-top: 0.5rem; }

package/src/gate/measures.ts

@@ -629,6 +629,63 @@ export const shippedReferences: Measure = async (ctx) => {
   }
 }
 
+const RAW_FIELD_FILE_REFERENCE = /(?:^|\s)(?:-f|--raw-field)[ =]\S+=@/
+
+/**
+ * A `gh api` raw-string flag carrying a file reference, over the seven shipped
+ * corpora.
+ *
+ * `-f body=@<path>` sends the literal path as the field value, so a comment
+ * edited that way is overwritten with the path itself and loses the marker a
+ * later read resolves it by. `-F` is the flag that reads the file. The pattern
+ * requires `=@`, so `-F`, `--field`, and a raw string such as `-f body="text"`
+ * all pass.
+ *
+ * It scans prose rather than parsing a command, so a body quoting the wrong
+ * spelling to explain it fails too. Reword it rather than exempting it, since an
+ * exemption is what lets a real occurrence hide.
+ */
+export const rawFieldFileReference: Measure = async (ctx) => {
+  const files = shippedCorpusFiles(ctx.root)
+
+  if (files.length === 0) {
+    return {
+      emissions: [],
+      unmeasured: `No corpus under ${SHIPPED_CORPORA.join(', ')} is present, so no shipped file was read.`,
+    }
+  }
+
+  const found = files.flatMap((file) =>
+    readFileSync(join(ctx.root, file), 'utf8')
+      .split('\n')
+      .flatMap((text, index) =>
+        RAW_FIELD_FILE_REFERENCE.test(text) ? [`${file}:${index + 1}`] : [],
+      ),
+  )
+
+  if (found.length === 0) {
+    return {
+      emissions: [
+        info(
+          `No raw-field file reference across ${files.length} files in ${SHIPPED_CORPORA.length} shipped corpora`,
+        ),
+      ],
+    }
+  }
+
+  return {
+    emissions: found.map((location) =>
+      warn(
+        `${location} passes a file reference through a raw-string flag, which posts the path as the field value. Use -F instead`,
+      ),
+    ),
+    failure:
+      found.length === 1
+        ? 'One raw-field file reference in the shipped corpora. Change -f or --raw-field to -F or --field where the value reads a file with @, or reword a prose line quoting the wrong spelling.'
+        : `${found.length} raw-field file references in the shipped corpora. Change -f or --raw-field to -F or --field where the value reads a file with @, or reword a prose line quoting the wrong spelling.`,
+  }
+}
+
 /**
  * Every git-tracked file quoting a listed client command with the wrong
  * argument, over the whole tree rather than one corpus, since a wrong

package/src/gate/stages.ts

@@ -10,6 +10,7 @@ import {
   recordIdempotence,
   sandboxCoverage,
   seedStandards,
+  rawFieldFileReference,
   shippedReferences,
   standardCriteria,
   unreferencedRules,
@@ -207,20 +208,6 @@ export const STAGES: readonly Stage[] = [
     ],
     success: 'Hero clean',
   },
-  {
-    id: 'tooling-paths',
-    label: 'Tooling paths',
-    checks: [
-      script('regen-tooling-paths.sh', 'Tooling-path regen failed'),
-      {
-        kind: 'drift',
-        pathspec: 'claude/skills/canon-cli/SKILL.md',
-        failure:
-          'The overwrite contract drifted from what the stacks hold. Run bun run check and commit claude/skills/canon-cli/SKILL.md.',
-      },
-    ],
-    success: 'Tooling paths clean',
-  },
   {
     // `canon/DESIGN.md`, the base stylesheet, the web stylesheet, and the
     // tab icon are all written from `src/design/tokens.ts` and none is edited
@@ -423,6 +410,15 @@ export const STAGES: readonly Stage[] = [
     skipped: 'No shipped corpus changed, so no reference was read',
     checks: [{ kind: 'measure', measure: shippedReferences }],
   },
+  {
+    // Same corpora as shipped-references and a separate stage, since the
+    // verdict is a flag spelling rather than an unresolvable reference.
+    id: 'raw-field-file-reference',
+    label: 'Raw-field file references',
+    scope: new RegExp(SHIPPED_CORPORA.map((corpus) => `^${corpus}/`).join('|')),
+    skipped: 'No shipped corpus changed, so no flag was read',
+    checks: [{ kind: 'measure', measure: rawFieldFileReference }],
+  },
   {
     // Scoped to the two files a citation can drift between, so an edit to
     // either one runs the check. web/src/content/copy.ts carries the anchors

package/src/gov/list.ts

@@ -30,7 +30,7 @@ export interface GovCatalog {
 
 /**
  * Reports each stack's own entries expanded, so a folder entry reaches a
- * consumer as the rules it stands for. `setup-gov` dedupes `--add` extras
+ * consumer as the rules it stands for. the `setup` skill dedupes `--add` extras
  * against this list, and a stack answering `core` there would re-add every
  * rule that folder already carries.
  *

package/src/sandbox/census.ts

@@ -71,9 +71,9 @@ export function listSkills(root: string): string[] {
  *
  * `<category>-<command>` is the rule `canon/context/sandbox/coverage.md` states, and it
  * alone pairs 29 of 54 skills. The bare `<command>` fallback is what reaches the
- * rest: `claude/setup-init.sh` drives the `setup-init` skill, not a
- * `claude-setup-init` that does not exist. Stating one spelling and shipping two
- * is what let the audit report a paired skill as unpaired.
+ * rest: `claude/target-setup.sh` drives the `target-setup` skill, not a `claude-target-setup` that
+ * does not exist. Stating one spelling and shipping two is what let the audit
+ * report a paired skill as unpaired.
  *
  * Returns undefined for a scenario driving no skill at all, which is every
  * `infra/` and `tooling/` scenario. Those exercise a CLI domain rather than a