@erclx/canon 4.33.0 → 4.34.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "4.33.0",
+  "version": "4.34.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/canon-cli/SKILL.md

@@ -41,6 +41,7 @@ Run `canon tooling sync <stack> <target> --check` for the list resolved against
 
 - `.editorconfig`
 - `.github/pull_request_template.md`
+- `.github/workflows/phase-label-gate.yml`
 - `.github/workflows/verify.yml`
 - `.husky/commit-msg`
 - `.husky/post-merge`

package/claude/skills/claude-pr-review/SKILL.md

@@ -228,7 +228,7 @@ The `What is right` section is optional, capped at three bullets, and included o
 
 Close the body with `🤖 Reviewed by Claude Code` on its own line so the review reads as an independent machine pass, not a human sign-off.
 
-Before posting, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the body. The hook skips `.canon/tmp/`, so this scan is the only gate ahead of the post. A finding phrased against an internal phase label is what the label half of the scan catches here. This repository reads the same text again once posted, on `phase-label-gate.yml`'s `pull_request_review` trigger, which is what closes the gap this scan leaves open for a review a person writes and posts by hand with no scripted step in front of it. That workflow is not seeded to any target this skill ships to, so a target's coverage stops at this pre-post scan, even though the `canon labels scan` verb behind it already reads a review payload once triggered.
+Before posting, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the body. The hook skips `.canon/tmp/`, so this scan is the only gate ahead of the post. A finding phrased against an internal phase label is what the label half of the scan catches here. This repository reads the same text again once posted, on `phase-label-gate.yml`'s `pull_request_review` trigger, which is what closes the gap this scan leaves open for a review a person writes and posts by hand with no scripted step in front of it. That workflow now reaches every target on the `base` stack, seeded at `tooling/base/configs/.github/workflows/phase-label-gate.yml` invoking the published CLI rather than this checkout's own source tree, so a target's coverage extends past this pre-post scan to the same post-trigger re-read this repository gets.
 
 Do not run the command below when `<prior-heading>` from Step 2 reads `## Review closed` and this pass carries nothing owed. That pass replaces the standing comment rather than adding one, under `### A close-out that repeats the standing one` at the end of this step. Posting first and reaching that section afterward leaves two close-outs both naming the new head, which is worse than the pair the guard exists against.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.33.0",
+  "version": "4.34.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/tooling/base/configs/.github/workflows/phase-label-gate.yml

@@ -0,0 +1,29 @@
+name: Phase Label Gate
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+    branches:
+      - main
+  # pull_request_review carries no branches filter GitHub Actions reads, so the
+  # base ref is checked in the job's own `if:` below instead.
+  pull_request_review:
+    types: [submitted, edited]
+  workflow_dispatch:
+
+jobs:
+  phase-label-gate:
+    name: 🏷️ Phase Label Gate
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Scan the pull request or review for a phase label, a board identifier, or a session link
+        run: bunx -y @erclx/canon labels scan --event "$GITHUB_EVENT_PATH"

package/tooling/base/seeds/.cspell/tech-stack.txt

@@ -4,6 +4,7 @@ bunx
 commitlint
 dbaeumer
 dotfolders
+erclx
 esbenp
 frontmatter
 lintstagedrc