@erclx/canon 4.69.0 → 4.71.0

package/scripts/core/regen-web-previews.ts

@@ -0,0 +1,94 @@
+/**
+ * Writes `web/public/previews/design-tokens/index.html` and `design.css` by
+ * calling `renderDesignDoc` directly, the in-process pattern
+ * `regen-web-favicon.ts` already takes rather than spawning a subprocess.
+ * Writes `web/public/previews/teach-workspace/` the same way, calling
+ * `generateNav` over an isolated copy of one workspace.
+ *
+ * Both are embedded live in a landing section as an `<iframe>` rather than a
+ * screenshot, since `web/e2e/home.spec.ts` asserts no `<img>` renders inside
+ * `<main>`.
+ */
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DESIGN_DOCUMENT } from '@/design/regen'
+import { renderDesignDoc } from '@/design/render'
+import { generateNav } from '@/teach/nav'
+
+const root = new URL('../..', import.meta.url).pathname
+
+const { cssPath } = renderDesignDoc(
+  `${root}${DESIGN_DOCUMENT}`,
+  `${root}web/public/previews/design-tokens`,
+)
+
+const css = readFileSync(cssPath, 'utf8')
+if (!/--(color|space|type|radius)-/.test(css)) {
+  console.error(
+    'regen-web-previews: design-tokens render carries no custom properties, refusing an empty preview',
+  )
+  process.exit(1)
+}
+
+console.log('regen-web-previews: wrote web/public/previews/design-tokens/')
+
+/**
+ * The workspace ships alone, on its own isolated nav tree, rather than
+ * copied straight out of `.canon/teach/`. That folder cross-links every
+ * sibling workspace by relative path, including the operator's own personal
+ * study notes, so a copy carrying its live chrome would ship either dead
+ * links or a path into content never meant to be public. Regenerating the
+ * chrome over a scratch copy holding this one workspace alone is what keeps
+ * the jump menus from naming anything else.
+ *
+ * `.canon/teach/` is gitignored session scratch, per `standards/teach.md`, so
+ * it exists on the machine that authored the lesson and nowhere else,
+ * including CI. `web/public/previews/teach-workspace/` is therefore the
+ * durable copy: committed once the workspace exists, regenerated here as a
+ * local convenience when authoring continues, and left untouched by a build
+ * that cannot see the source, the same way a target without Playwright still
+ * builds against a committed capture.
+ */
+const TEACH_SLUG = '04-governance-rule-loading'
+const teachSource = `${root}.canon/teach/${TEACH_SLUG}`
+
+if (!existsSync(teachSource)) {
+  console.log(
+    `regen-web-previews: no workspace at .canon/teach/${TEACH_SLUG} on this machine, leaving the committed web/public/previews/teach-workspace/ as is`,
+  )
+} else {
+  const scratchRoot = mkdtempSync(join(tmpdir(), 'canon-teach-preview-'))
+  try {
+    cpSync(teachSource, join(scratchRoot, '.canon', 'teach', TEACH_SLUG), {
+      recursive: true,
+    })
+
+    const nav = await generateNav(scratchRoot)
+    if (!nav.ok) {
+      console.error(`regen-web-previews: ${nav.message}`)
+      process.exit(1)
+    }
+    if (nav.lessons === 0) {
+      console.error(
+        'regen-web-previews: teach-workspace render carries no lesson, refusing an empty preview',
+      )
+      process.exit(1)
+    }
+
+    const dest = `${root}web/public/previews/teach-workspace`
+    rmSync(dest, { recursive: true, force: true })
+    cpSync(join(scratchRoot, '.canon', 'teach'), dest, {
+      recursive: true,
+      // Only the rendered chrome ships. MISSION.md, RESOURCES.md, and
+      // GLOSSARY.md carry links relative to `.canon/teach/`, which resolve to
+      // nothing once copied under `web/public/`, and nothing links to them
+      // from the rendered pages anyway.
+      filter: (path) => !path.endsWith('.md'),
+    })
+  } finally {
+    rmSync(scratchRoot, { recursive: true, force: true })
+  }
+
+  console.log('regen-web-previews: wrote web/public/previews/teach-workspace/')
+}

package/src/claude/cases/misc.ts

@@ -15,7 +15,7 @@ export const MISC_CASES: readonly SkillCase[] = [
   {
     prompt:
       'This project has no logo yet. Draft one and give me a social card to go with it.',
-    expect: 'identity',
+    expect: 'draft-identity',
   },
   {
     prompt: 'Fire up the dev server the way this project documents it.',
@@ -47,4 +47,8 @@ export const MISC_CASES: readonly SkillCase[] = [
     prompt: 'Is there a page anywhere in this repo that covers retries?',
     expect: 'index-lookup',
   },
+  {
+    prompt: 'Connect this repo to Cloudflare Pages and set up the deploy.',
+    expect: 'deploy-cloudflare',
+  },
 ]

package/src/claude/cases/workflow.ts

@@ -41,7 +41,7 @@ export const WORKFLOW_CASES: readonly SkillCase[] = [
   {
     prompt:
       'The video just finished recording. Read it back and tell me what each part shows.',
-    expect: 'canon-frames-read',
+    expect: 'read-frames',
   },
   {
     prompt:
@@ -87,7 +87,7 @@ export const WORKFLOW_CASES: readonly SkillCase[] = [
   {
     prompt:
       'The screencast draft is finished. Turn it into an actual video now.',
-    expect: 'canon-record',
+    expect: 'record-screencast',
   },
   {
     prompt:
@@ -96,7 +96,7 @@ export const WORKFLOW_CASES: readonly SkillCase[] = [
   },
   {
     prompt: 'Draft me a script with beats for a screencast recording.',
-    expect: 'canon-screencast',
+    expect: 'draft-screencast',
   },
   {
     prompt:
@@ -105,7 +105,7 @@ export const WORKFLOW_CASES: readonly SkillCase[] = [
   },
   {
     prompt: 'Turn this topic into a slide deck I can render.',
-    expect: 'canon-slides-draft',
+    expect: 'draft-slides',
   },
   {
     prompt:

package/src/commands/demo.ts

@@ -54,7 +54,7 @@ export function register(program: Command): void {
   demo
     .command('compile')
     .description('Turn a screencast draft into a plan a run can drive')
-    .argument('<draft>', 'Screencast draft written by canon-screencast')
+    .argument('<draft>', 'Screencast draft written by draft-screencast')
     .helpOption('-h, --help', 'Show this help message')
     .option('-o, --out <dir>', 'Directory the plan is written to', DEFAULT_OUT)
     .option('-s, --slug <slug>', 'Plan name, defaulting to the draft filename')

package/src/commands/pr.ts

@@ -18,6 +18,7 @@ import {
 import { type CheckRunListing, collapseChecks } from '@/pr/checks'
 import { type HeadRefusal, resolveHead, resolveTip } from '@/pr/head'
 import { KEY_CHANGES } from '@/pr/paths'
+import { type ReviewListing, resolveReviewScope } from '@/pr/review-scope'
 import { intro, logInfo, logStep, logWarn, outro, plural } from '@/ui'
 
 const GH_TIMEOUT_MS = 30_000
@@ -49,7 +50,12 @@ interface ReadOptions {
 }
 
 /** Why a head-sensitive read produced no answer about a commit. */
-type PullRefusal = 'gh-missing' | 'gh-failed' | 'no-branch' | 'runs-unreadable'
+type PullRefusal =
+  | 'gh-missing'
+  | 'gh-failed'
+  | 'no-branch'
+  | 'runs-unreadable'
+  | 'reviews-unreadable'
 
 /** What a reader does about each way the two sha-keyed verbs produced nothing. */
 const PULL_REFUSALS: Record<PullRefusal | HeadRefusal, string> = {
@@ -67,6 +73,8 @@ const PULL_REFUSALS: Record<PullRefusal | HeadRefusal, string> = {
     'The pull request object reported no head commit, so there is nothing to compare the tip against.',
   'runs-unreadable':
     'The check runs for this commit could not be read. An empty answer here would report a commit as having no check rather than as unread, so nothing is reported.',
+  'reviews-unreadable':
+    'The reviews on this pull request could not be read. An empty answer here would report a reviewed pull request as never reviewed, which routes the next pass to the whole change, so nothing is reported.',
 }
 
 /** Why the read produced no comparison, ahead of the ones the compare owns. */
@@ -236,6 +244,47 @@ export function register(program: Command): void {
     .action(async (number: string | undefined, opts: ReadOptions) => {
       process.exitCode = await runChecks(number, opts)
     })
+
+  pr.command('review-state')
+    .description('Report the commit and instant the last review pass covered')
+    .argument('[number]', 'Pull request to read, defaulting to this branch')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--root <path>', 'Repository to read, defaulting to the cwd')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'A review carries two stamps GitHub writes at submission: `commit.oid`',
+        'names whatever the head was at that instant and `submittedAt` names the',
+        'instant itself. Neither describes the commit the reviewing session read.',
+        'A push landing inside the compose window moves `commit.oid` onto a commit',
+        'nobody reviewed, and the next pass then scopes its delta past that work',
+        'and reports it covered.',
+        '',
+        '`review-pr` writes the commit it read and the instant it read it as a',
+        'marker on the last line of every body it posts. This is the one place',
+        'that marker is parsed, so `review-pr` and the orchestrator poll read one',
+        'answer rather than carrying a copy of the format each.',
+        '',
+        'Read `source` before trusting the rest:',
+        '  marker    the pass wrote its own read-time record, which is authority',
+        '  fallback  a pass posted before the marker shipped, off GitHub stamps',
+        '  none      the thread carries no pass, so the next one is a first pass',
+        '',
+        'Exit codes:',
+        '  0  the thread was read, whether it carries a pass or not',
+        '  1  refused, with the reason on stderr or in the JSON record',
+        '',
+        'Examples:',
+        '  canon pr review-state',
+        '  canon pr review-state 1341 --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (number: string | undefined, opts: ReadOptions) => {
+      process.exitCode = await runReviewState(number, opts)
+    })
 }
 
 interface PullRequestRead {
@@ -768,6 +817,86 @@ async function runChecks(
   return 0
 }
 
+async function runReviewState(
+  number: string | undefined,
+  opts: ReadOptions,
+): Promise<number> {
+  const root = resolve(opts.root ?? process.cwd())
+  const emitJson = opts.json ?? false
+
+  intro('canon pr review-state')
+
+  if (Bun.which('gh') === null) {
+    return refuseWith('gh-missing', PULL_REFUSALS['gh-missing'], emitJson, root)
+  }
+
+  const args = ['pr', 'view']
+  if (number !== undefined) args.push(number)
+  // `number` rides along so the record names the pull request a caller that
+  // passed no argument was answered about. The comment families the poll reads
+  // stay out of the query, since nothing here parses one and a listing the
+  // caller discards is a payload paid for twice.
+  args.push('--json', 'number,reviews')
+
+  const stdout = await gh(root, args)
+  if (stdout === null) {
+    return refuseWith('gh-failed', PULL_REFUSALS['gh-failed'], emitJson, root)
+  }
+
+  let listing: ReviewListing & { number?: number }
+  try {
+    listing = JSON.parse(stdout)
+  } catch {
+    return refuseWith(
+      'reviews-unreadable',
+      PULL_REFUSALS['reviews-unreadable'],
+      emitJson,
+      root,
+    )
+  }
+
+  const scope = resolveReviewScope(listing)
+
+  logStep('Scope')
+  logInfo(
+    listing.number === undefined
+      ? 'the pull request on this branch'
+      : `#${listing.number}`,
+  )
+
+  if (scope.source === 'none') {
+    logStep('First pass')
+    logInfo('the thread carries no review, so nothing has been covered yet')
+  } else if (scope.source === 'marker') {
+    logStep(scope.state === 'open' ? 'Open' : 'Closed')
+    logInfo(
+      `the last pass read ${scope.commit?.slice(0, 8)} at ${scope.readAt}, which is what it covered`,
+    )
+  } else {
+    logStep(scope.state === 'open' ? 'Open' : 'Closed')
+    // Named rather than folded into the line above, since the whole point of
+    // the marker is that these two fields describe the submission and not the
+    // read, and a caller cannot tell the two apart from the values alone.
+    logWarn(
+      `the last pass carries no read-time marker, so ${scope.commit === undefined ? 'no commit' : scope.commit.slice(0, 8)} and ${scope.submittedAt ?? 'no instant'} come off GitHub's submission stamps. A push inside that pass's compose window is invisible here.`,
+    )
+  }
+
+  outro()
+
+  if (emitJson) {
+    process.stdout.write(
+      `${JSON.stringify({
+        root,
+        ...(listing.number !== undefined && { number: listing.number }),
+        ...scope,
+      })}\n`,
+    )
+  }
+
+  return 0
+}
+
 /**
  * Frames a refusal on stderr in both modes and puts the record on stdout alone,
  * so an operator reading the terminal sees the reason rather than a command

package/src/commands/tasks.ts

@@ -1,11 +1,15 @@
 import { relative } from 'node:path'
 import type { Command } from 'commander'
+import { execa } from 'execa'
+import { gitEnv } from '@/git-env'
 import { type AnswersOutcome, planAnswers } from '@/tasks/answers'
 import { type BranchOutcome, planBranch } from '@/tasks/branch'
 import {
   type ArchiveOutcome,
   archiveTask,
   type CitationOutcome,
+  type DeclineOutcome,
+  declineTask,
   type PlanCitations,
   planCitations,
 } from '@/tasks/archive'
@@ -44,12 +48,22 @@ import { mainWorktreeRoot } from '@/worktree'
 /** Returned when the board carries a finding, which is the gating result. */
 const EXIT_FINDINGS = 2
 
+/** Matches `trunk.ts`'s bound on a git subprocess this verb also shells out to. */
+const GIT_TIMEOUT_MS = 10_000
+
 interface ArchiveCommandOptions {
   readonly json?: boolean
   readonly pullRequest?: string
   readonly root?: string
 }
 
+interface DeclineCommandOptions {
+  readonly by?: string
+  readonly json?: boolean
+  readonly reason?: string
+  readonly root?: string
+}
+
 interface ValidateCommandOptions {
   readonly json?: boolean
   readonly root?: string
@@ -134,6 +148,39 @@ export function register(program: Command): void {
       process.exitCode = await runArchive(task, opts)
     })
 
+  tasks
+    .command('decline')
+    .description(
+      'Move a task decided against into .canon/tasks/declined/, recording why',
+    )
+    .argument('<task>', 'Task filename stem, as in v28.1-trigger-escalation')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--reason <text>', 'Why the task was decided against')
+    .option('--by <name>', 'Who decided, defaulting to git config user.name')
+    .option('--json', 'Emit a machine-readable record on stdout')
+    .option('--root <path>', 'Board root, defaulting to the main worktree')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'Unlike archive, decline carries no outcome-state gate: a task can be',
+        'decided against at any outcome state, and the two never share a',
+        'refusal set since they answer different questions.',
+        '',
+        'Exit codes:',
+        '  0  the task was declined',
+        '  1  refused, with the reason on stderr or in the JSON record',
+        '',
+        'Examples:',
+        '  canon tasks decline v28.1-trigger-escalation --reason "superseded by v30.2" # canon-allow-reference: illustrates the stem-selection form, not a citation of a real task',
+        '  canon tasks decline v28.1-trigger-escalation --reason "no longer needed" --by Alex --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (task: string, opts: DeclineCommandOptions) => {
+      process.exitCode = await runDecline(task, opts)
+    })
+
   tasks
     .command('validate')
     .description(
@@ -938,7 +985,7 @@ function reportValidation(
     intro('canon tasks validate')
     logStep('Board')
     logInfo(
-      `${outcome.rows} row(s) across the readiness groups, ${outcome.backlog} backlog line(s), ${outcome.tasks} task file(s)`,
+      `${outcome.rows} row(s) across the readiness groups, ${outcome.backlog} backlog line(s), ${outcome.tasks} task file(s), ${outcome.declined} declined`,
     )
 
     logStep(outcome.findings.length === 0 ? 'Clean' : 'Findings')
@@ -994,6 +1041,7 @@ function reportValidation(
         rows: outcome.rows,
         backlog: outcome.backlog,
         tasks: outcome.tasks,
+        declined: outcome.declined,
         findings: outcome.findings,
         untested: outcome.untested,
         claims: outcome.claims,
@@ -1146,3 +1194,132 @@ function recordFor(
     cut: outcome.cut,
   }
 }
+
+/**
+ * Reads the local `git config user.name` when `--by` names nobody. `--root`
+ * scopes the read so it answers for the board's own repository rather than
+ * whatever the ambient environment points at, mirroring `trunk.ts`'s guard.
+ */
+async function resolveBy(
+  root: string,
+  by: string | undefined,
+): Promise<string | undefined> {
+  if (by) return by
+
+  const result = await execa('git', ['-C', root, 'config', 'user.name'], {
+    reject: false,
+    timeout: GIT_TIMEOUT_MS,
+    env: gitEnv(),
+    extendEnv: false,
+  })
+
+  const name = result.exitCode === 0 ? result.stdout.trim() : ''
+  return name.length > 0 ? name : undefined
+}
+
+async function runDecline(
+  task: string,
+  opts: DeclineCommandOptions,
+): Promise<number> {
+  const emitJson = opts.json ?? false
+
+  if (!opts.reason) {
+    return reportDecline(
+      {
+        ok: false,
+        reason: 'bad-input',
+        message: 'No reason named. Pass --reason <text>.',
+        detail: [],
+      },
+      emitJson,
+      process.cwd(),
+    )
+  }
+
+  const root = opts.root ?? (await mainWorktreeRoot())
+  const by = await resolveBy(root, opts.by)
+
+  if (!by) {
+    return reportDecline(
+      {
+        ok: false,
+        reason: 'bad-input',
+        message:
+          'No decider named. Pass --by <name> or set git config user.name.',
+        detail: [],
+      },
+      emitJson,
+      root,
+    )
+  }
+
+  const outcome = await declineTask(root, task, opts.reason, by)
+
+  return reportDecline(outcome, emitJson, root)
+}
+
+function reportDecline(
+  outcome: DeclineOutcome,
+  emitJson: boolean,
+  root: string,
+): number {
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify(declineRecordFor(outcome, root))}\n`)
+    return outcome.ok ? 0 : 1
+  }
+
+  intro('canon tasks decline')
+
+  if (!outcome.ok) {
+    logStep('Refused')
+    logError(outcome.message)
+    if (outcome.detail.length > 0) pipeOutput(outcome.detail.join('\n'))
+    outro()
+    return 1
+  }
+
+  logStep('Declined')
+  logRemove(relative(root, outcome.from))
+  logAdd(relative(root, outcome.to))
+  if (outcome.plan) {
+    logRemove(relative(root, outcome.plan.from))
+    logAdd(relative(root, outcome.plan.to))
+    logInfo('retargeted the Plan: line')
+  }
+  if (outcome.priorityRowRemoved) logInfo('cleared the ordering row')
+  if (outcome.backlogRowRemoved) logInfo('cleared the backlog row')
+  if (outcome.indexRegenerated) logInfo('regenerated index.md')
+  outro()
+
+  return 0
+}
+
+function declineRecordFor(
+  outcome: DeclineOutcome,
+  root: string,
+): Record<string, unknown> {
+  if (!outcome.ok) {
+    return {
+      ok: false,
+      reason: outcome.reason,
+      message: outcome.message,
+      detail: outcome.detail,
+    }
+  }
+
+  return {
+    ok: true,
+    task: outcome.stem,
+    from: relative(root, outcome.from),
+    to: relative(root, outcome.to),
+    priorityRowRemoved: outcome.priorityRowRemoved,
+    backlogRowRemoved: outcome.backlogRowRemoved,
+    indexRegenerated: outcome.indexRegenerated,
+    plan: outcome.plan
+      ? {
+          from: relative(root, outcome.plan.from),
+          to: relative(root, outcome.plan.to),
+        }
+      : null,
+  }
+}

package/src/commands/teach.ts

@@ -384,6 +384,7 @@ async function runStylesheet(
         root,
         slug: outcome.slug,
         path: outcome.path,
+        basePath: outcome.basePath,
         written: outcome.written,
       })}\n`,
     )
@@ -393,6 +394,7 @@ async function runStylesheet(
   intro('canon teach stylesheet')
   logStep(outcome.written ? 'Written' : 'Already present, left alone')
   logInfo(outcome.path)
+  logInfo(outcome.basePath)
   outro()
   return 0
 }

package/src/demo/beats.ts

@@ -1,5 +1,5 @@
 /**
- * Reads the human-facing draft `canon-screencast` writes. Nothing here knows
+ * Reads the human-facing draft `draft-screencast` writes. Nothing here knows
  * about a browser: the draft is prose aimed at a person, and turning it into
  * something executable is `@/demo/compile`'s job.
  */

package/src/gate/measures.ts

@@ -708,6 +708,72 @@ export const readmeCitations: Measure = async (ctx) => {
   }
 }
 
+/**
+ * `deploy-site.yml` and `pr-visual-checks.yml` each carry their own literal
+ * copy of the eight path globs a landing-page change should trigger on, per
+ * Question 2 in `.canon/plans/archive/feature-render-visibility.md`. A YAML
+ * anchor cannot cross files here, so the two copies are read live and compared
+ * rather than one asserting a literal the other could drift behind unnoticed,
+ * mirroring how `web/e2e/home.spec.ts`'s rule-group test already reads live.
+ */
+export const visualPathGlobs: Measure = async (ctx) => {
+  const deployPath = '.github/workflows/deploy-site.yml'
+  const visualPath = '.github/workflows/pr-visual-checks.yml'
+  const deployFile = join(ctx.root, deployPath)
+  const visualFile = join(ctx.root, visualPath)
+
+  if (!existsSync(deployFile) || !existsSync(visualFile)) {
+    return {
+      emissions: [],
+      unmeasured: `${deployPath} or ${visualPath} is absent, so no path list was compared.`,
+    }
+  }
+
+  const deploy = Bun.YAML.parse(readFileSync(deployFile, 'utf8')) as {
+    readonly on?: { readonly push?: { readonly paths?: readonly string[] } }
+  }
+  const visual = Bun.YAML.parse(readFileSync(visualFile, 'utf8')) as {
+    readonly on?: {
+      readonly pull_request?: { readonly paths?: readonly string[] }
+    }
+  }
+
+  const deployPaths = deploy.on?.push?.paths ?? []
+  const visualPaths = visual.on?.pull_request?.paths ?? []
+
+  if (deployPaths.length === 0 || visualPaths.length === 0) {
+    return {
+      emissions: [],
+      unmeasured: `${deployPath} or ${visualPath} carries no path list to compare.`,
+    }
+  }
+
+  const onlyDeploy = deployPaths.filter((path) => !visualPaths.includes(path))
+  const onlyVisual = visualPaths.filter((path) => !deployPaths.includes(path))
+
+  if (onlyDeploy.length === 0 && onlyVisual.length === 0) {
+    return {
+      emissions: [
+        info(
+          `${deployPaths.length} path glob(s) agree between ${deployPath} and ${visualPath}`,
+        ),
+      ],
+    }
+  }
+
+  return {
+    emissions: [
+      ...onlyDeploy.map((path) =>
+        warn(`${deployPath} carries ${path}, absent from ${visualPath}`),
+      ),
+      ...onlyVisual.map((path) =>
+        warn(`${visualPath} carries ${path}, absent from ${deployPath}`),
+      ),
+    ],
+    failure: `${deployPath} and ${visualPath} carry different path globs. Bring the two lists back into agreement.`,
+  }
+}
+
 /**
  * `canon sandbox coverage` moves only when a person runs it, so a scenario added
  * with no expectation ships unnoticed.

package/src/gate/stages.ts

@@ -12,6 +12,7 @@ import {
   shippedReferences,
   standardCriteria,
   unreferencedRules,
+  visualPathGlobs,
 } from '@/gate/measures'
 import { SHIPPED_CORPORA } from '@/shipped/references'
 
@@ -424,6 +425,16 @@ export const STAGES: readonly Stage[] = [
     skipped: 'Neither copy.ts nor README.md changed, so no citation was read',
     checks: [{ kind: 'measure', measure: readmeCitations }],
   },
+  {
+    // Scoped to the two files carrying the literal path-glob copy, so an edit
+    // to either one runs the check.
+    id: 'visual-path-globs',
+    label: 'Visual check path globs',
+    scope: /^\.github\/workflows\/(deploy-site|pr-visual-checks)\.yml$/,
+    skipped:
+      'Neither deploy-site.yml nor pr-visual-checks.yml changed, so no path list was compared',
+    checks: [{ kind: 'measure', measure: visualPathGlobs }],
+  },
   {
     id: 'seed-standards',
     label: 'Seed standards',