@erclx/canon 4.116.0 → 4.118.0

package/src/gate/measures.ts

@@ -12,7 +12,11 @@ import {
   isOverLength,
   measureArchitecture,
 } from '@/context/architecture'
+import { auditSkills } from '@/claude/skills-audit'
 import { listRepositoryFiles } from '@/git-files'
+import { ceilingFindings } from '@/markdown/ceiling'
+import { resolveMarkdown } from '@/markdown/files'
+import { CHECKPOINTS } from '@/markdown/structure'
 import {
   isShippedCorpus,
   REFERENCE_MARKER,
@@ -21,6 +25,7 @@ import {
   type ShippedReference,
 } from '@/shipped/references'
 import { surfaceDir } from '@/surface-root'
+import { plural } from '@/ui'
 import {
   README_PARAPHRASE_MARKER,
   readmeCitationsIn,
@@ -273,6 +278,98 @@ export const architectureRecord: Measure = async (ctx) => {
   }
 }
 
+/**
+ * Every skill body and reference against the no-dated-provenance rule, across
+ * both corpora `auditSkills` reads.
+ *
+ * Read in-process rather than through `claude skills audit`, whose exit code
+ * stays a missing requirement only, so a target running the verb is told about
+ * a date without failing on one. This repository holds the corpus at zero,
+ * which is what lets the same finding fail here.
+ */
+export const skillProvenance: Measure = async (ctx) => {
+  const report = await auditSkills(ctx.root)
+  if (report.corpora.length === 0) {
+    return {
+      emissions: [],
+      unmeasured: 'no skill corpus resolved, so no body was read.',
+    }
+  }
+
+  const found = report.datedProvenance
+  if (found.length > 0) {
+    const where = found
+      .map((finding) => `${finding.rel} ${finding.detail}`)
+      .join(', ')
+    return {
+      emissions: [],
+      failure: `${plural(found.length, 'date')} in skill prose: ${where}. Move the incident to REQUIREMENT.md under Gap or leave it to git, or fence the date or put it in a code span when it is an example.`,
+    }
+  }
+
+  return {
+    emissions: [
+      info(`No dated provenance across ${plural(report.skills, 'skill')}`),
+    ],
+  }
+}
+
+/**
+ * Every tracked markdown document against the whole-document ceiling.
+ *
+ * Report-only for now: a document past the ceiling warns and the stage still
+ * passes, since the corpus carried dozens past it when the stage landed. The
+ * flip to a failure is a separate change once the count reads zero, and it
+ * replaces the warn path rather than sitting beside it.
+ *
+ * Read in-process rather than through `canon markdown audit`, whose exit code
+ * stays bans and dead links only. The plan and groundwork skills run that audit
+ * on a gitignored record, and a gating length there would fail every long plan.
+ */
+export const documentCeiling: Measure = async (ctx) => {
+  const scope = await resolveMarkdown(ctx.root, [])
+  if (scope.kind === 'unavailable') {
+    return {
+      emissions: [],
+      unmeasured: 'git could not list the tree, so no document was measured.',
+    }
+  }
+
+  const documents = scope.files.flatMap((rel) => {
+    try {
+      return [{ rel, source: readFileSync(join(ctx.root, rel), 'utf8') }]
+    } catch {
+      return []
+    }
+  })
+  const findings = ceilingFindings(documents)
+  const over = findings.filter((finding) => finding.exempt === null)
+  const exempt = findings.length - over.length
+  const ceiling = CHECKPOINTS.ceiling
+
+  if (over.length === 0) {
+    const exemptNote = exempt > 0 ? `, ${exempt} exempt` : ''
+    return {
+      emissions: [
+        info(
+          `No document past the ${ceiling}-line ceiling across ${plural(documents.length, 'markdown file')}${exemptNote}`,
+        ),
+      ],
+    }
+  }
+
+  return {
+    emissions: [
+      ...over.map((finding) =>
+        warn(`${finding.rel}  ${finding.renderedLines} rendered lines`),
+      ),
+      info(
+        `${plural(over.length, 'document')} past the ${ceiling}-line ceiling, ${exempt} exempt. Reported only, so the push is not held.`,
+      ),
+    ],
+  }
+}
+
 /**
  * A second run of the records move should rewrite nothing, and the count is
  * only knowable once the folders themselves have landed.

package/src/gate/stages.ts

@@ -3,6 +3,7 @@ import {
   auditSet,
   captureStamps,
   clientCommandCitations,
+  documentCeiling,
   markdownBans,
   type Measure,
   pluginManifests,
@@ -12,6 +13,7 @@ import {
   seedStandards,
   rawFieldFileReference,
   shippedReferences,
+  skillProvenance,
   standardCriteria,
   unreferencedRules,
   visualPathGlobs,
@@ -333,9 +335,11 @@ export const STAGES: readonly Stage[] = [
     checks: [{ kind: 'measure', measure: unreferencedRules }],
   },
   {
-    // Only the citation half of the audit gates. Length, depth, table, and
+    // Only the citation half of the audit gates. Its length, depth, table, and
     // index findings are judgment thresholds, and failing a push on one would
-    // make the stage something to route around.
+    // make the stage something to route around. The one length reading that
+    // will gate is the whole-document ceiling, which the Document ceiling stage
+    // below owns rather than this audit.
     id: 'context-citations',
     label: 'Context citations',
     checks: [
@@ -355,6 +359,13 @@ export const STAGES: readonly Stage[] = [
     label: 'Architecture record',
     checks: [{ kind: 'measure', measure: architectureRecord }],
   },
+  {
+    // Unscoped, since any branch can grow any document. It warns and passes
+    // until the corpus sits under the ceiling, then flips to a failure.
+    id: 'document-ceiling',
+    label: 'Document ceiling',
+    checks: [{ kind: 'measure', measure: documentCeiling }],
+  },
   {
     // A rule citing a file that moved fails silently. The consumed-copy drift
     // stage passes an authored rule and its copy that are wrong together, and
@@ -458,6 +469,14 @@ export const STAGES: readonly Stage[] = [
     ],
     success: 'Skill requirements present',
   },
+  {
+    // The audit verb only reports a dated line, so a target is told without
+    // failing. This stage makes the same finding fail here, where the corpus is
+    // held at zero. Unscoped, since any branch can add a line to any body.
+    id: 'skill-provenance',
+    label: 'Skill provenance',
+    checks: [{ kind: 'measure', measure: skillProvenance }],
+  },
   {
     id: 'standard-criteria',
     label: 'Standard success criteria',

package/src/gov/adapter.ts

@@ -44,12 +44,13 @@ export function indexSourceRules(root: string): Map<string, string> {
  * path, so a rule that moved between subdirectories in the toolkit still
  * syncs into the subdirectory the target already uses.
  *
- * Declares no `projectSubdir`. That exemption existed to keep a project's
- * `.claude/rules/project/` folder out of the walk by location before any
- * name lookup ran, and `installedRoot` narrowing to `.claude/rules/canon/`
- * already leaves `project/` outside the walked root, so a second exemption
- * computing a stale `canon/project/` destination would be wrong rather than
- * merely redundant.
+ * Declares `ownsInstalledRoot` and no `projectSubdir`. A project keeps its own
+ * rules under `.claude/rules/project/`, which `installedRoot` narrowing to
+ * `.claude/rules/canon/` leaves outside the walk, so everything the walk does
+ * reach is the toolkit's. A rule there with no source is one the toolkit
+ * retired or renamed, and the sync deletes it rather than leaving it loaded.
+ * A `projectSubdir` would compute a stale `canon/project/` destination, which
+ * is wrong rather than merely redundant.
  */
 export function createGovAdapter(root: string): SyncAdapter {
   const index = indexSourceRules(root)
@@ -65,6 +66,7 @@ export function createGovAdapter(root: string): SyncAdapter {
       index.get(basename(file.path, '.md')),
     collectRetired: (target: string) => collectRetiredGov(target),
     collectMissing: (target: string) => collectMissingGov(root, target),
+    ownsInstalledRoot: true,
     stamp: { domain: 'governance', toolkitRoot: root },
   }
 }

package/src/markdown/ceiling.ts

@@ -0,0 +1,70 @@
+import { basename } from 'node:path'
+import { bodyLines } from '@/markdown/scan'
+import { CHECKPOINTS, documentHeight } from '@/markdown/structure'
+
+/**
+ * The marker exempting one document from the ceiling, written as a whole line
+ * outside a fence and naming a reason.
+ *
+ * The whole line rather than anywhere on it, so a standard quoting the marker
+ * inside a code span to document it does not exempt itself. A marker with no
+ * reason does not count, for the reason `isMarked` in `src/exempt-marker.ts`
+ * gives: a bare token reads as a line that meant to say something and did not.
+ */
+const EXEMPT_MARKER = /^<!--\s*canon-length-exempt:[ \t]*(\S.*?)\s*-->$/
+
+/**
+ * A changelog is exempt by name because the release tool rewrites it and would
+ * not keep a marker in place. A committed list of exempt paths was the
+ * alternative, and it turns every rename into a second edit with nothing to
+ * check the list against the tree.
+ */
+const CHANGELOG = 'CHANGELOG.md'
+const CHANGELOG_REASON = 'CHANGELOG.md is written by the release tool'
+
+export interface CeilingDocument {
+  readonly rel: string
+  readonly source: string
+}
+
+export interface CeilingFinding {
+  readonly rel: string
+  readonly renderedLines: number
+  /** The stated reason, or null where the document is not exempt. */
+  readonly exempt: string | null
+}
+
+/** The reason a document is exempt from the ceiling, or null where it is not. */
+export function lengthExemption(rel: string, source: string): string | null {
+  if (basename(rel) === CHANGELOG) return CHANGELOG_REASON
+
+  for (const line of bodyLines(source)) {
+    if (line.fenced) continue
+    const match = EXEMPT_MARKER.exec(line.text.trim())
+    if (match) return match[1]
+  }
+
+  return null
+}
+
+/**
+ * Every document past the ceiling, longest first, exempt ones included with
+ * their reason so a report can count them rather than hide them.
+ */
+export function ceilingFindings(
+  documents: readonly CeilingDocument[],
+): CeilingFinding[] {
+  return documents
+    .map(({ rel, source }) => ({
+      rel,
+      renderedLines: documentHeight(source),
+      source,
+    }))
+    .filter(({ renderedLines }) => renderedLines > CHECKPOINTS.ceiling)
+    .map(({ rel, renderedLines, source }) => ({
+      rel,
+      renderedLines,
+      exempt: lengthExemption(rel, source),
+    }))
+    .sort((a, b) => b.renderedLines - a.renderedLines)
+}

package/src/markdown/structure.ts

@@ -116,6 +116,7 @@ export const CHECKPOINTS = {
   cadence: 3,
   spread: 5,
   opener: 2,
+  ceiling: 300,
 } as const
 
 /**
@@ -167,6 +168,11 @@ export interface Checkpoints {
   readonly spread: number
   /** Times one opening word may open a sentence in a paragraph before it is a pattern. */
   readonly opener: number
+  /**
+   * Rendered lines a whole document may reach, read by the Document ceiling
+   * gate stage rather than by any exit code of the audit.
+   */
+  readonly ceiling: number
 }
 
 export interface BulletFinding {
@@ -247,6 +253,22 @@ export function renderedHeight(text: string, width = RENDER_WIDTH): number {
   return Math.max(1, Math.ceil(visibleText(text).length / width))
 }
 
+/**
+ * Height a whole source occupies once wrapped, frontmatter and fenced blocks
+ * included.
+ *
+ * Nothing is excluded because a session pays for every line it loads, which is
+ * what separates this from the depth measure. The context audit's length
+ * reading and the document ceiling both count through here, so the two report
+ * one unit.
+ */
+export function documentHeight(source: string, width = RENDER_WIDTH): number {
+  return source
+    .replace(/\n$/, '')
+    .split('\n')
+    .reduce((sum, text) => sum + renderedHeight(text, width), 0)
+}
+
 /**
  * Reports whether a run is the peer list the standard exempts.
  *

package/src/records/validate.ts

@@ -271,7 +271,9 @@ const PLAN_SECTIONS = [
   'Summary',
   'Constraints',
   'Files to touch',
+  'Verification',
   'Risks',
+  'Review focus',
   'Questions',
 ] as const
 
@@ -280,7 +282,9 @@ type PlanSection = (typeof PLAN_SECTIONS)[number]
 const PLAN_REQUIRED: readonly PlanSection[] = [
   'Summary',
   'Files to touch',
+  'Verification',
   'Risks',
+  'Review focus',
   'Questions',
 ]
 
@@ -293,7 +297,7 @@ const MARKER_LINE = /^(?:##[ \t]+(.+?)|\*\*(.+?):\*\*)[ \t]*$/
 
 /**
  * A section opens as a bold label or as an H2 and both count. The corpus writes
- * `Summary` as a heading and the other four as bold labels, and roughly a fifth
+ * `Summary` as a heading and the others as bold labels, and roughly a fifth
  * of it swaps one for the other. Reporting the variant would fail nearly every
  * plan present on the rule a reader is least served by, which is what teaches
  * them to skip the output.

package/src/sync/check.ts

@@ -79,6 +79,7 @@ export interface StateCounts {
   readonly orphaned: number
   readonly stranded: number
   readonly missing: number
+  readonly retired: number
 }
 
 export interface DomainReport {
@@ -314,6 +315,7 @@ export function countStates(entries: readonly ScanEntry[]): StateCounts {
     orphaned: count(entries, 'orphaned'),
     stranded: count(entries, 'stranded'),
     missing: count(entries, 'missing'),
+    retired: count(entries, 'retired'),
   }
 }
 
@@ -342,6 +344,9 @@ export function countStates(entries: readonly ScanEntry[]): StateCounts {
  * sync that adds a rule silently changes what a project is governed by, and
  * nobody chose that, so gating CI on the count would pressure a target into
  * adopting a rule nobody picked.
+ *
+ * `retired` counts, since a sync deletes it mechanically. A target's CI goes
+ * red the day a release retires a rule it holds, and one sync clears it.
  */
 export function hasDrift(report: CheckReport): boolean {
   if (report.unmigrated.length > 0) return true
@@ -351,7 +356,8 @@ export function hasDrift(report: CheckReport): boolean {
       domain.counts.stale +
         domain.counts.customized +
         domain.counts.drifted +
-        domain.counts.stranded >
+        domain.counts.stranded +
+        domain.counts.retired >
       0,
   )
 }

package/src/sync/engine.ts

@@ -8,8 +8,11 @@ import {
   type DomainHashes,
   hashFile,
   readStamp,
+  type Stamp,
+  type StampDomain,
   type StampSource,
   stampedHashes,
+  stampedVersion,
   toStampKey,
   writeStamp,
 } from '@/sync/stamp'
@@ -26,6 +29,8 @@ import {
   palette,
   select,
 } from '@/ui'
+import { compareVersions, parseVersion } from '@/version/compare'
+import { readInstalled, UNKNOWN_LABEL } from '@/version/installed'
 
 /**
  * One installed file in three path flavours: absolute, relative to the
@@ -58,10 +63,12 @@ export type SyncChange =
  * who moved it. `stale` and `customized` need the stamp to tell apart, so
  * `drifted` stays the verdict for a difference no stamp covers.
  *
- * `orphaned` and `stranded` both mean the walk found no source, and they are
- * separate because they need opposite treatment. A project-authored file is
- * orphaned and stays that way forever. A stamped file the toolkit no longer
- * installs to is stranded, which is a relocation waiting on a decision.
+ * `orphaned`, `retired`, and `stranded` all mean the walk found no source, and
+ * they are separate because they need different treatment. A project-authored
+ * file is orphaned and stays that way forever. A file under a root the toolkit
+ * owns outright is retired, since only the toolkit ever wrote there, and a
+ * sync deletes it. A stamped file the toolkit no longer installs to is
+ * stranded, which is a relocation waiting on a decision.
  *
  * `missing` is the one state the walk cannot produce on its own, since the
  * walk only iterates files that exist. It comes from `collectMissing`
@@ -73,6 +80,7 @@ export type EntryState =
   | 'customized'
   | 'drifted'
   | 'orphaned'
+  | 'retired'
   | 'stranded'
   | 'missing'
 
@@ -152,6 +160,14 @@ export interface SyncAdapter {
    * inference orphans a file sitting anywhere else.
    */
   readonly projectSubdir?: string
+  /**
+   * Every file under `installedRoot` is the toolkit's, so a walked file with
+   * no source is a leftover of a rule the toolkit retired or renamed rather
+   * than something a project wrote. Setting it turns that file into a
+   * `retired` entry and queues its delete, edited or not, whatever the stamp
+   * holds. Unset, the file stays `orphaned` and untouched.
+   */
+  readonly ownsInstalledRoot?: boolean
   /** Defaults to applying. */
   readonly nonInteractive?: NonInteractivePolicy
   /** Runs on a completed sync, including one with no changes. */
@@ -195,15 +211,18 @@ export function listInstalled(
 
 /**
  * Classifies every installed file against its source without writing anything.
- * A file with no source is left alone rather than deleted, which is what keeps
- * project-authored rules alive across a sync.
+ * A file with no source is deleted only when the adapter owns its installed
+ * root outright, and left alone otherwise, which is what keeps a
+ * project-authored file alive across a sync of a root the project shares.
  */
 export function planSync(adapter: SyncAdapter, target: string): SyncPlan {
   const entries: ScanEntry[] = []
   const changes: SyncChange[] = []
   const unattributed: UnattributedFile[] = []
 
-  const hashes = stampedHashes(readStamp(target), adapter.stamp?.domain)
+  const stamp = readStamp(target)
+  const hashes = stampedHashes(stamp, adapter.stamp?.domain)
+  const newerInstall = newerInstallingVersion(stamp, adapter.stamp?.domain)
   const walked = new Set<string>()
 
   for (const file of listInstalled(
@@ -222,7 +241,18 @@ export function planSync(adapter: SyncAdapter, target: string): SyncPlan {
     const source = adapter.locateSource(file)
 
     if (source === undefined || !existsSync(source)) {
-      entries.push(misplacedOrphan(adapter, target, file))
+      if (adapter.ownsInstalledRoot !== true) {
+        entries.push(misplacedOrphan(adapter, target, file))
+      } else if (newerInstall !== undefined) {
+        entries.push(heldForNewerInstall(file, newerInstall))
+      } else {
+        entries.push({
+          state: 'retired',
+          rel: file.rel,
+          notice: `${file.rel} (no longer shipped by the toolkit, removing)`,
+        })
+        changes.push({ kind: 'delete', dest: file.path, rel: file.rel })
+      }
       continue
     }
 
@@ -438,6 +468,8 @@ function report(adapter: SyncAdapter, plan: SyncPlan): void {
       )
     else if (entry.state === 'customized')
       logWarn(`${entry.rel} (locally customized)`)
+    else if (entry.state === 'retired')
+      logWarn(entry.notice ?? `${entry.rel} (no longer shipped by the toolkit)`)
     else if (entry.state === 'stranded')
       logWarn(`${entry.rel} (installed here by an older toolkit, now moved)`)
     else if (entry.state === 'missing')
@@ -528,6 +560,10 @@ function isProjectAuthored(adapter: SyncAdapter, file: InstalledFile): boolean {
  * Naming the destination is all this does. Moving the file rewrites a path the
  * project's own rules, skills, and docs may cite, so the sync leaves it where
  * it is.
+ *
+ * An adapter declaring `ownsInstalledRoot` never reaches this, since owning
+ * the root answers the question neither the name nor the stamp can, and its
+ * sourceless file is retired instead.
  */
 function misplacedOrphan(
   adapter: SyncAdapter,
@@ -549,6 +585,49 @@ function misplacedOrphan(
   }
 }
 
+/**
+ * The release that last wrote this domain, when it is newer than the one
+ * running. A binary older than that release cannot tell a rule it retired
+ * from one added after it, so it holds every sourceless file rather than
+ * deleting rules the newer release installed. An unparseable side holds too,
+ * since deleting on a comparison that never ran is the failure this guards.
+ * A stamp with no version predates the field and is never newer.
+ */
+function newerInstallingVersion(
+  stamp: Stamp | undefined,
+  domain: StampDomain | undefined,
+): { readonly stamped: string; readonly running: string } | undefined {
+  if (domain === undefined) return undefined
+
+  const stamped = stampedVersion(stamp, domain)
+  if (stamped === undefined) return undefined
+
+  const running = readInstalled().version ?? UNKNOWN_LABEL
+  const parsedStamped = parseVersion(stamped)
+  const parsedRunning = parseVersion(running)
+
+  if (
+    parsedStamped !== undefined &&
+    parsedRunning !== undefined &&
+    compareVersions(parsedStamped, parsedRunning) <= 0
+  ) {
+    return undefined
+  }
+
+  return { stamped, running }
+}
+
+function heldForNewerInstall(
+  file: InstalledFile,
+  versions: { readonly stamped: string; readonly running: string },
+): ScanEntry {
+  return {
+    state: 'orphaned',
+    rel: file.rel,
+    notice: `${file.rel} (installed by canon ${versions.stamped}, newer than this ${versions.running}. Upgrade canon to sync it.)`,
+  }
+}
+
 function isInside(target: string, path: string): boolean {
   const rel = relative(target, path)
   return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel)
@@ -567,8 +646,9 @@ function hasUnattributedDrift(plan: SyncPlan): boolean {
 /**
  * Records what the toolkit placed, after the copies land, so a partial apply
  * that throws leaves the previous stamp rather than a claim the target does not
- * meet. A file with no source, or one orphaned by location, is
- * project-authored and stays out.
+ * meet. A file with no source stays out, whether it is project-authored or a
+ * retired leftover a declined sync did not delete, and so does one orphaned by
+ * location.
  *
  * Reads the installed tree rather than the caller's file list, so a partial
  * install still stamps the domain's whole installed set.

package/src/sync/stamp.ts

@@ -5,6 +5,8 @@ import { dirname, join, sep } from 'node:path'
 import { execa } from 'execa'
 import { resolveExisting } from '@/legacy-path'
 import { recordTarget } from '@/targets/registry'
+import { compareVersions, parseVersion } from '@/version/compare'
+import { readInstalled } from '@/version/installed'
 
 /**
  * Domains the stamp can record. Governance and design both attribute file by
@@ -38,6 +40,14 @@ export type DomainHashes = Readonly<Record<string, string>>
 export interface DomainStamp {
   /** Toolkit revision this domain last synced from. Absent outside a git clone. */
   readonly commit?: string
+  /**
+   * Newest canon release that has written this domain. A sync deletes an
+   * installed file its toolkit does not ship, and a binary older than the one
+   * that installed the file cannot tell a retired file from one added after
+   * its own release, so this is what it reads before deleting anything.
+   * Absent on a stamp written before the field existed.
+   */
+  readonly version?: string
   readonly syncedAt: string
   readonly files: DomainHashes
   /**
@@ -178,6 +188,14 @@ function readStampFile(path: string): Stamp | undefined {
   }
 }
 
+/** The newest canon release that has written this domain, when one was recorded. */
+export function stampedVersion(
+  stamp: Stamp | undefined,
+  domain: StampDomain,
+): string | undefined {
+  return stamp?.domains[domain]?.version
+}
+
 /** The revision this domain last synced from, which bounds its upstream range. */
 export function stampedCommit(
   stamp: Stamp | undefined,
@@ -245,9 +263,11 @@ async function putDomain(
   const previous = readStamp(target)
   const previousRecord = previous?.domains[source.domain]
   const commit = await toolkitCommit(source.toolkitRoot)
+  const version = newerVersion(readInstalled().version, previousRecord?.version)
 
   const record: DomainStamp = {
     ...(commit === undefined ? {} : { commit }),
+    ...(version === undefined ? {} : { version }),
     syncedAt: now.toISOString(),
     files: payload.files ?? previousRecord?.files ?? {},
     ...resolveChainField(payload.chain, previousRecord?.chain),
@@ -304,6 +324,27 @@ async function readCommit(root: string): Promise<string | undefined> {
     : undefined
 }
 
+/**
+ * Keeps the newer of the running release and the one already recorded, so an
+ * older binary syncing after a newer one cannot lower the mark and let a later
+ * run delete a rule the newer release installed. An unparseable side loses to
+ * a parseable one, and a recorded value survives an unreadable manifest.
+ */
+function newerVersion(
+  running: string | undefined,
+  recorded: string | undefined,
+): string | undefined {
+  if (running === undefined) return recorded
+  if (recorded === undefined) return running
+
+  const parsedRunning = parseVersion(running)
+  const parsedRecorded = parseVersion(recorded)
+  if (parsedRecorded === undefined) return running
+  if (parsedRunning === undefined) return recorded
+
+  return compareVersions(parsedRecorded, parsedRunning) > 0 ? recorded : running
+}
+
 /**
  * A write naming no chain keeps the domain's previous one rather than dropping
  * it, since `writeStamp` and `writeChainStamp` each touch one half of a
@@ -365,6 +406,9 @@ function isDomainStamp(value: unknown): value is DomainStamp {
   if (value.commit !== undefined && typeof value.commit !== 'string') {
     return false
   }
+  if (value.version !== undefined && typeof value.version !== 'string') {
+    return false
+  }
   if (value.chain !== undefined && !isStringArray(value.chain)) return false
 
   return Object.values(value.files).every((hash) => typeof hash === 'string')