@erclx/canon 5.17.0 → 5.18.0

package/src/context/architecture.ts

@@ -1,7 +1,7 @@
 import { access, readFile } from 'node:fs/promises'
 import { join, relative } from 'node:path'
 import { AUDITS } from '@/audits/catalog'
-import { bodyLines } from '@/markdown/scan'
+import { type BodyLine, bodyLines } from '@/markdown/scan'
 import { surfaceDir } from '@/surface-root'
 
 /**
@@ -58,9 +58,9 @@ export interface DecisionReport {
    */
   readonly checks: readonly string[]
   /**
-   * The entry's own word count, read alongside the weight judgment the
-   * standard asks a session to make by reading the file rather than counting
-   * it. Never gates, per `standards/architecture.md`'s `## Length` section.
+   * The entry's prose word count, its heading and fenced lines left out. Gates
+   * only against a per-decision cap the record states, so the report and the
+   * stage read one number.
    */
   readonly words: number
   /**
@@ -82,6 +82,12 @@ export interface ArchitectureReport {
    * only what is still open, so its weight is read the same way the file's is.
    */
   readonly risksWords?: number
+  /**
+   * List items in the Risks section, nested ones included, since a nested
+   * bullet is weight the reader pays for. Absent alongside `risksWords`, so a
+   * record with no section never reads as one holding zero bullets.
+   */
+  readonly risksBullets?: number
   /** What the record declared, absent when it states no length rule. */
   readonly allowances?: Allowances
   /** The frame plus the per-decision allowance, absent alongside it. */
@@ -92,6 +98,10 @@ export interface ArchitectureReport {
    * project that never adopted a cap is measured and never gated.
    */
   readonly entryCap?: number
+  /** The most words a decision may hold, absent when the record states none. */
+  readonly wordCap?: number
+  /** The most Risks bullets the record allows, absent when it states none. */
+  readonly riskCap?: number
   /**
    * Whether the record states that every decision closes with a revisit
    * sentence. Declared by the record for the reason the cap is, so a record
@@ -103,7 +113,9 @@ export interface ArchitectureReport {
 
 const DECISION_HEADING = /^###\s+(.+?)\s*$/
 const SECTION_HEADING = /^##\s+\S/
-/** The one H2 the standard's `## Length` section asks to be weighed by words. */
+/** A markdown list item at any depth, which is what a risk bullet is. */
+const LIST_ITEM = /^\s*(?:[-*+]|\d+[.)])\s+\S/
+/** The H2 whose bullets the standard's `## Caps` section counts. */
 const RISKS_HEADING = /^##\s+Risks\s*\/\s*open questions\s*$/i
 const CODE_SPAN = /`[^`]*`/g
 /** Dropped ahead of the figure scan, since an anchor date is not a claim. */
@@ -291,13 +303,12 @@ export function splitDecisions(source: string): RawDecision[] {
 }
 
 /**
- * Counts whitespace-delimited tokens, which is the unit the standard's
- * `## Length` section reads alongside the weight judgment a session makes by
- * reading the file. It is a report figure rather than a gate, so a fenced
- * example or a code span inflating the count costs nothing a reader corrects
- * for by reading, the same trade the line count above it already takes.
+ * Counts whitespace-delimited tokens, the unit a record's word caps are stated
+ * in. A code span counts as the tokens it holds, so a decision citing a long
+ * path pays for it the way a reader does. A caller gating on the count hands
+ * in prose with fenced lines already dropped.
  */
-function wordCount(text: string): number {
+export function wordCount(text: string): number {
   return text.match(/\S+/g)?.length ?? 0
 }
 
@@ -310,14 +321,30 @@ function wordCount(text: string): number {
  * when the section is last, which is where the standard's template puts it.
  */
 export function risksSection(source: string): string | undefined {
-  const lines = bodyLines(source)
-  const body: string[] = []
+  return risksLines(source)
+    ?.map((line) => line.text)
+    .join('\n')
+}
+
+/**
+ * Counts the list items in the Risks section, nested ones included, or
+ * nothing when the record carries no such heading. A fenced line is skipped,
+ * since a template bullet is not a risk.
+ */
+export function riskBullets(source: string): number | undefined {
+  return risksLines(source)?.filter(
+    (line) => !line.fenced && LIST_ITEM.test(line.text),
+  ).length
+}
+
+function risksLines(source: string): BodyLine[] | undefined {
+  const body: BodyLine[] = []
   let capturing = false
   let found = false
 
-  for (const line of lines) {
+  for (const line of bodyLines(source)) {
     if (line.fenced) {
-      if (capturing) body.push(line.text)
+      if (capturing) body.push(line)
       continue
     }
 
@@ -332,10 +359,10 @@ export function risksSection(source: string): string | undefined {
       continue
     }
 
-    if (capturing) body.push(line.text)
+    if (capturing) body.push(line)
   }
 
-  return found ? body.join('\n') : undefined
+  return found ? body : undefined
 }
 
 /** Cardinals a record spells rather than writes, which the corpus does for both. */
@@ -376,6 +403,14 @@ const ENTRY_CAP_CLAUSE = new RegExp(
   String.raw`\bat\s+most\s+${CARDINAL}\s+decisions?\b`,
   'i',
 )
+const WORD_CAP_CLAUSE = new RegExp(
+  String.raw`\bat\s+most\s+${CARDINAL}\s+words\s+a\s+decision\b`,
+  'i',
+)
+const RISK_CAP_CLAUSE = new RegExp(
+  String.raw`\bat\s+most\s+${CARDINAL}\s+risk\s+bullets?\b`,
+  'i',
+)
 
 function readCardinal(token: string | undefined): number | undefined {
   if (token === undefined) return undefined
@@ -413,6 +448,20 @@ export function readEntryCap(source: string): number | undefined {
   return readCardinal(source.match(ENTRY_CAP_CLAUSE)?.[1])
 }
 
+/**
+ * Reads the per-decision word cap a record declares, spelled `at most <n>
+ * words a decision`, or nothing. One spelling, the way the line allowance
+ * reads `<n> lines a decision`, so a drift falls back to reporting.
+ */
+export function readWordCap(source: string): number | undefined {
+  return readCardinal(source.match(WORD_CAP_CLAUSE)?.[1])
+}
+
+/** Reads the Risks cap a record declares, spelled `at most <n> risk bullets`. */
+export function readRiskCap(source: string): number | undefined {
+  return readCardinal(source.match(RISK_CAP_CLAUSE)?.[1])
+}
+
 const REVISIT_CLAUSE =
   /\bevery\s+decision\s+closes\s+with\s+a\s+revisit\s+sentence\b/i
 /**
@@ -486,6 +535,8 @@ export async function measureArchitecture(
 
   const allowances = readAllowances(source)
   const entryCap = readEntryCap(source)
+  const wordCap = readWordCap(source)
+  const riskCap = readRiskCap(source)
   const revisitRequired = readRevisitRule(source)
   const raw = splitDecisions(source)
   const decisions = await Promise.all(
@@ -498,13 +549,14 @@ export async function measureArchitecture(
         figures,
         ...(quantified !== undefined && { quantified }),
         checks: await namedChecks(root, entry.body),
-        words: wordCount(entry.body),
+        words: wordCount(entry.prose),
         revisit: hasRevisitSentence(entry.prose),
       }
     }),
   )
 
   const risks = risksSection(source)
+  const bullets = riskBullets(source)
 
   return {
     rel,
@@ -515,11 +567,14 @@ export async function measureArchitecture(
         .join('\n'),
     ),
     ...(risks !== undefined && { risksWords: wordCount(risks) }),
+    ...(bullets !== undefined && { risksBullets: bullets }),
     ...(allowances !== undefined && {
       allowances,
       ceiling: ceilingFor(allowances, raw.length),
     }),
     ...(entryCap !== undefined && { entryCap }),
+    ...(wordCap !== undefined && { wordCap }),
+    ...(riskCap !== undefined && { riskCap }),
     revisitRequired,
     decisions,
   }
@@ -538,6 +593,31 @@ export function isOverCount(report: ArchitectureReport): boolean {
   )
 }
 
+/**
+ * The decisions holding more prose words than the cap the record states.
+ *
+ * Empty for a record stating no word cap, for the reason `isOverCount` gives.
+ */
+export function overWords(report: ArchitectureReport): DecisionReport[] {
+  const cap = report.wordCap
+  if (cap === undefined) return []
+  return report.decisions.filter((entry) => entry.words > cap)
+}
+
+/**
+ * Whether the Risks section holds more bullets than the cap the record states.
+ *
+ * False for a record stating no cap, and false for one carrying no Risks
+ * section, which the stage reports as absent rather than as zero bullets.
+ */
+export function isOverRisks(report: ArchitectureReport): boolean {
+  return (
+    report.riskCap !== undefined &&
+    report.risksBullets !== undefined &&
+    report.risksBullets > report.riskCap
+  )
+}
+
 /**
  * The headings of decisions lacking a revisit sentence the record requires.
  *

package/src/context/gate.ts

@@ -25,6 +25,19 @@ export interface GateInput {
    * same two cases, plus a record stating no such clause.
    */
   readonly recordMissingRevisit: boolean
+  /**
+   * Whether a decision holds more words than the cap the record states, which
+   * gates under the same two modes and is false in the same two cases, plus a
+   * record stating no word cap.
+   */
+  readonly recordOverWords: boolean
+  /** The same reading for the Risks section's bullet cap. */
+  readonly recordOverRisks: boolean
+  /**
+   * Whether the requirements record holds more words than the cap it states,
+   * which gates for the reason the architecture record's caps do.
+   */
+  readonly requirementsOverWords: boolean
   readonly sections: readonly SectionFinding[]
   readonly drift: readonly FolderDrift[]
   /**
@@ -79,8 +92,10 @@ export function hasSketchWithEvidence(
  * Whether the audit found something that should fail the caller.
  *
  * An unresolved citation is a broken pointer and gates unconditionally, and so
- * does a record past its own ceiling or its own entry cap, or missing a
- * revisit sentence it requires: the record states each rule for itself, which makes those the measures here that are facts
+ * does a record past its own ceiling, entry cap, word cap, or bullet cap, or
+ * missing a revisit sentence it requires, and a requirements record past its
+ * own word cap: each record states its rules for itself, which makes those the
+ * measures here that are facts
  * rather than thresholds a reader weighs. The findings `--gate` adds are
  * the ones answerable from the file itself: a required section it does not
  * declare, an index disagreeing with its folder, and a wireframe's States
@@ -95,13 +110,25 @@ export function isGating({
   recordOverLength,
   recordOverCount,
   recordMissingRevisit,
+  recordOverWords,
+  recordOverRisks,
+  requirementsOverWords,
   sections,
   drift,
   wireframes,
   widened,
 }: GateInput): boolean {
   if (unresolvedCitations > 0) return true
-  if (recordOverLength || recordOverCount || recordMissingRevisit) return true
+  if (
+    recordOverLength ||
+    recordOverCount ||
+    recordMissingRevisit ||
+    recordOverWords ||
+    recordOverRisks ||
+    requirementsOverWords
+  ) {
+    return true
+  }
   if (!widened) return false
 
   return sections.length > 0 || hasDrift(drift) || hasStatesMismatch(wireframes)

package/src/context/requirements.ts

@@ -0,0 +1,77 @@
+import { readFile } from 'node:fs/promises'
+import { join, relative } from 'node:path'
+import { wordCount } from '@/context/architecture'
+import { bodyLines } from '@/markdown/scan'
+import { surfaceDir } from '@/surface-root'
+
+/**
+ * The record this measures, relative to `root`, resolved at either surface
+ * root for the reason `architectureRel` gives.
+ */
+export function requirementsRel(root: string): string {
+  return relative(root, surfaceDir(root, 'REQUIREMENTS.md'))
+}
+
+export interface RequirementsReport {
+  readonly rel: string
+  /** The whole record's word count, frontmatter left out. */
+  readonly words: number
+  /**
+   * The most words the record says it holds, absent when it states no cap.
+   * Declared by the record rather than held here, so a project that never
+   * adopted a cap is measured and never gated.
+   */
+  readonly wordCap?: number
+}
+
+const WORD_CAP_CLAUSE = /\bat\s+most\s+(\d+)\s+words\b/i
+
+/**
+ * Reads the word cap a record declares, spelled `at most <n> words`, or
+ * nothing. Digits only, since a cap in the hundreds is never spelled out.
+ */
+export function readRequirementsWordCap(source: string): number | undefined {
+  const digits = source.match(WORD_CAP_CLAUSE)?.[1]
+  return digits === undefined ? undefined : Number.parseInt(digits, 10)
+}
+
+function isMissing(error: unknown): boolean {
+  const code = (error as { code?: unknown }).code
+  return code === 'ENOENT' || code === 'ENOTDIR'
+}
+
+/**
+ * Measures the record, or reports nothing when the project carries none.
+ *
+ * Absent rather than zeroed, for the reason `measureArchitecture` gives, and a
+ * record present and unreadable propagates the same way.
+ */
+export async function measureRequirements(
+  root: string,
+): Promise<RequirementsReport | undefined> {
+  const rel = requirementsRel(root)
+
+  let source: string
+  try {
+    source = await readFile(join(root, rel), 'utf8')
+  } catch (error) {
+    if (!isMissing(error)) throw error
+    return undefined
+  }
+
+  const wordCap = readRequirementsWordCap(source)
+  return {
+    rel,
+    words: wordCount(
+      bodyLines(source)
+        .map((line) => line.text)
+        .join('\n'),
+    ),
+    ...(wordCap !== undefined && { wordCap }),
+  }
+}
+
+/** Whether the record holds more words than the cap it states. */
+export function isOverWordCap(report: RequirementsReport): boolean {
+  return report.wordCap !== undefined && report.words > report.wordCap
+}

package/src/gate/measures.ts

@@ -10,9 +10,12 @@ import {
 import {
   isOverCount,
   isOverLength,
+  isOverRisks,
   measureArchitecture,
   missingRevisit,
+  overWords,
 } from '@/context/architecture'
+import { isOverWordCap, measureRequirements } from '@/context/requirements'
 import {
   auditSkills,
   PRACTICE_LEDGER,
@@ -246,42 +249,80 @@ function citedPaths(record: { paths?: unknown } | undefined): string[] {
 }
 
 /**
- * The architecture record against the three rules it states for itself: the
- * line ceiling its allowances derive, the entry cap, and the revisit sentence
- * closing each decision.
+ * The canonical records against the caps each states for itself. The
+ * architecture record carries five: the line ceiling its allowances derive,
+ * the entry cap, the revisit sentence closing each decision, the words a
+ * decision may hold, and the bullets its Risks section may hold. The
+ * requirements record carries one, its own word count.
  *
  * Read in-process rather than through `context audit`, whose one gating stage
- * here runs `--citations-only` and never opens the record, which is why the
- * line ceiling went unenforced by `bun run check` until this stage. A project
- * carrying no record, or a record stating none of the three, passes, since
- * each rule belongs to the record rather than to the toolkit.
+ * here runs `--citations-only` and never opens either record, which is why
+ * the line ceiling went unenforced by `bun run check` until this stage. A
+ * project carrying neither record, or records stating none of the caps,
+ * passes, since each rule belongs to the record rather than to the toolkit.
  */
-export const architectureRecord: Measure = async (ctx) => {
-  const report = await measureArchitecture(ctx.root)
+export const canonicalRecords: Measure = async (ctx) => {
+  const [report, requirements] = await Promise.all([
+    measureArchitecture(ctx.root),
+    measureRequirements(ctx.root),
+  ])
+
+  const failures: string[] = []
+  const emissions: Emission[] = []
+
   if (report === undefined) {
-    return { emissions: [info('No architecture record to measure')] }
+    emissions.push(info('No architecture record to measure'))
+  } else {
+    const decisions = report.decisions.length
+    const lackingRevisit = missingRevisit(report)
+    const longDecisions = overWords(report)
+    failures.push(
+      ...[
+        isOverCount(report) &&
+          `${decisions} decisions against a cap of ${report.entryCap}. Merge two or retire one in ${report.rel}, never compress.`,
+        isOverLength(report) &&
+          `${report.lines} lines against a ceiling of ${report.ceiling} in ${report.rel}.`,
+        lackingRevisit.length > 0 &&
+          `No revisit sentence in ${lackingRevisit.map((heading) => `"${heading}"`).join(', ')}. Close each with one opening "Revisit when" in ${report.rel}.`,
+        longDecisions.length > 0 &&
+          `${longDecisions.map((entry) => `"${entry.heading}" (${entry.words})`).join(', ')} past ${report.wordCap} words a decision in ${report.rel}. Cut the reasoning to the trade, never split one decision across two headings.`,
+        isOverRisks(report) &&
+          `${report.risksBullets} risk bullets against a cap of ${report.riskCap} in ${report.rel}. Drop what is no longer open.`,
+      ].filter((failure): failure is string => typeof failure === 'string'),
+    )
+
+    const cap =
+      report.entryCap === undefined
+        ? 'no entry cap stated'
+        : `a cap of ${report.entryCap}`
+    emissions.push(info(`${decisions} decisions against ${cap}`))
+    if (report.riskCap !== undefined && report.risksBullets === undefined) {
+      emissions.push(
+        info(
+          `No Risks section to count against a cap of ${report.riskCap} in ${report.rel}`,
+        ),
+      )
+    }
   }
 
-  const decisions = report.decisions.length
-  const lackingRevisit = missingRevisit(report)
-  const failures = [
-    isOverCount(report) &&
-      `${decisions} decisions against a cap of ${report.entryCap}. Merge two or retire one in ${report.rel}, never compress.`,
-    isOverLength(report) &&
-      `${report.lines} lines against a ceiling of ${report.ceiling} in ${report.rel}.`,
-    lackingRevisit.length > 0 &&
-      `No revisit sentence in ${lackingRevisit.map((heading) => `"${heading}"`).join(', ')}. Close each with one opening "Revisit when" in ${report.rel}.`,
-  ].filter((failure): failure is string => typeof failure === 'string')
+  if (requirements === undefined) {
+    emissions.push(info('No requirements record to measure'))
+  } else if (isOverWordCap(requirements)) {
+    failures.push(
+      `${requirements.words} words against a cap of ${requirements.wordCap} in ${requirements.rel}.`,
+    )
+  } else {
+    const cap =
+      requirements.wordCap === undefined
+        ? 'no word cap stated'
+        : `a cap of ${requirements.wordCap}`
+    emissions.push(
+      info(`${requirements.words} requirements words against ${cap}`),
+    )
+  }
 
   if (failures.length > 0) return { emissions: [], failure: failures.join(' ') }
-
-  const cap =
-    report.entryCap === undefined
-      ? 'no entry cap stated'
-      : `a cap of ${report.entryCap}`
-  return {
-    emissions: [info(`${decisions} decisions against ${cap}`)],
-  }
+  return { emissions }
 }
 
 /**

package/src/gate/stages.ts

@@ -6,7 +6,7 @@ import {
   skillPaths,
 } from '@/gate/boundaries'
 import {
-  architectureRecord,
+  canonicalRecords,
   auditSet,
   captureStamps,
   clientCommandCitations,
@@ -346,11 +346,11 @@ export const STAGES: readonly Stage[] = [
     success: 'Context citations resolve',
   },
   {
-    // The record's three rules are facts it states about itself, unlike the
+    // Each record's caps are facts it states about itself, unlike the
     // judgment thresholds the stage above leaves out, so they gate here.
-    id: 'architecture-record',
-    label: 'Architecture record',
-    checks: [{ kind: 'measure', measure: architectureRecord }],
+    id: 'canonical-records',
+    label: 'Canonical records',
+    checks: [{ kind: 'measure', measure: canonicalRecords }],
   },
   {
     // Unscoped, since any branch can grow any document. A document past the

package/standards/architecture.md

@@ -73,18 +73,24 @@ A decision says why it won and rarely says when that reason stops holding, so an
 - Draft it from the harm the decision prevents, never from the mechanism it uses. A mechanism can keep working long after the reason for choosing it is gone, so re-checking it confirms the wrong fact.
 - Place the sentence after the reasoning and before any verification anchor, so the anchor stays the entry's last sentence.
 - Give a heading holding several principles one sentence, for the premise they share, rather than one per principle.
-- Adopt the requirement by stating the clause `Every decision closes with a revisit sentence.` in the record itself. The clause is the record's own, like the cap, so a checker reads it from the file and gates only a record that states it. A record stating none is reported and never gated.
+- Adopt the requirement by stating the clause `Every decision closes with a revisit sentence.` in the record itself. The clause is the record's own, like the caps, so a checker reads it from the file and gates only a record that states it. A record stating none is reported and never gated.
 - A checker reads presence alone. A vacuous sentence passes it, so the sentence is only as useful as the finding it names.
 
-## Entry cap
+## Caps
 
-Every session pays for this file before any work starts, so a heavy read is a real cost. A file that reads heavy is carrying too many decisions, not decisions written too long, so the bound is a count of decisions rather than of words.
+Every session pays for this file before any work starts, so a heavy read is a real cost. Weight comes from two places, too many decisions and decisions written too long, so the record caps both, and caps the open risks beside them.
 
-- State the cap in the record itself as a clause of the form `This record holds at most <n> decisions.` The cap is the record's own, so a checker reads it from the file, and a record stating none is measured and never gated.
-- Set the cap near one decision per slot plus a small margin.
-- At the cap, merge two decisions or retire one before adding another, and name which in the change that does it. Never compress a decision's prose to fit, and never pack two decisions under one heading, which the count cannot see.
+- State each cap in the record itself. A checker reads only these spellings, so a clause worded another way is reported and never gated:
+  - `This record holds at most <n> decisions.`
+  - `at most <n> words a decision`, counting a decision's prose below its heading, fenced lines left out
+  - `at most <n> risk bullets`, counting every list item under `## Risks / open questions`, nested ones included
+- The three can share one sentence, such as `This record holds at most 12 decisions, at most 150 words a decision, and at most 6 risk bullets.` Each cap is the record's own, so a record stating none is measured and never gated, and the template states the entry cap alone so the other two are adopted on purpose.
+- Set the decision cap near one decision per slot plus a small margin, the word cap near what one trade takes to state, about 150, and the risk cap at what a reader holds in mind at once, about 6.
+- At the decision cap, merge two decisions or retire one before adding another, and name which in the change that does it. Never pack two decisions under one heading, which the count cannot see.
+- At the word cap, cut a decision to the choice, the alternative that lost, the reason, and the revisit sentence. What it sheds is a mechanism or a measurement, which goes to the domain context entry it constrains, never under a second heading.
+- At the risk cap, drop what is no longer open before adding a risk.
 - Retire a decision by moving it to the domain context entry it constrains, not by deleting its reasoning.
-- A word count, for the file and for each decision, is read alongside the judgment when one is available, and it never gates.
+- The whole file's word count stays a report, read alongside the judgment, and never gates.
 - Yield to the paragraph weight checkpoint in `markdown.md`. A paragraph past the checkpoint is a defect no length guideline licenses.
 
 ## Template

package/standards/requirements.md

@@ -36,6 +36,10 @@ Does not govern:
 
 Use `## Problem`, `## Goals`, `## Non-goals`, `## MVP features`, and `## Constraints`. Add `## Distribution` when the rule below applies. Add `## Worldview` when the project holds beliefs that shape every decision, and keep a belief there only when it changes a decision, since a padded worldview turns into a second goals list. Add `## Premise` when the project exists to answer a question, stated as the question and what would count as an answer, never as the answer measured so far. Drop a section rather than pad it with filler.
 
+## Length
+
+This file loads into every session, so its weight is paid before any work starts. Cap it by stating the clause `This record holds at most <n> words.` in the record itself, where a checker reads it and counts every word below the frontmatter. The cap is the record's own, so a record stating none is measured and never gated. Set it near 600, and at the cap cut a goal or a constraint that no longer changes a decision before adding one.
+
 ## Lifecycle
 
 Once every entry in the MVP list, or in a later scope section, has shipped, delete the section. Git keeps the old text, and the document states the project as it stands. Do not annotate an entry as shipped and leave it in place. While any entry is unshipped, do not renumber the list or append to it.

package/tooling/cloudflare/configs/.github/workflows/deploy.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Skip notice
         if: steps.secrets-check.outputs.skip == 'true'
-        run: echo "::notice::CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID is not set, skipping deploy. Run the deploy-cloudflare skill to finish setup."
+        run: echo "::notice::CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID is not set, skipping deploy. Run the deploy-app skill to finish setup."
 
       # This job builds nothing and still needs a toolchain. The checkout
       # below brings bun.lock, wrangler-action reads it, picks bun on the
@@ -110,7 +110,7 @@ jobs:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           wranglerVersion: '3.90.0'
           # Fill in this project's Pages project name, set when the
-          # deploy-cloudflare skill runs wrangler pages project create.
+          # deploy-app skill runs wrangler pages project create.
           command: pages deploy dist --project-name=REPLACE_WITH_PROJECT_NAME --branch=${{ github.ref_name }}
 
       # `canon pr preview` reads this line out of the run log, so the marker is

package/tooling/cloudflare/reference.md

@@ -20,7 +20,7 @@ Three values in the seeded file have no generic default and are set once, right
 
 - The `paths:` filter under the `push` trigger. The shipped default is a single `src/**` glob. Widen it to cover every path the build reads when the build draws on catalogs or generated content living outside `src/`.
 - The `concurrency.group` name. The shipped default is `deploy-${{ github.ref_name }}`, which is enough for a single-deploy project. Give the `deploy` prefix a project-specific name only if the project runs more than one deploy workflow, and keep the ref suffix.
-- The Pages project name, written twice as `REPLACE_WITH_PROJECT_NAME`: once in the `--project-name` flag on the `wrangler pages deploy` command and once as `PROJECT_NAME` in the cleanup job. Set both to the name the `deploy-cloudflare` skill creates the Pages project under.
+- The Pages project name, written twice as `REPLACE_WITH_PROJECT_NAME`: once in the `--project-name` flag on the `wrangler pages deploy` command and once as `PROJECT_NAME` in the cleanup job. Set both to the name the `deploy-app` skill creates the Pages project under.
 
 ## Re-sync
 

package/claude/skills/deploy-cloudflare/REQUIREMENT.md

@@ -1,37 +0,0 @@
----
-name: deploy-cloudflare
-description: What the Cloudflare Pages setup gap is, which of the four manual steps this skill closes, and why the credential and the custom domain stay the operator's
----
-
-# Deploy Cloudflare requirement
-
-## Gap
-
-Without this skill, a Cloudflare Pages setup is a sequence performed from memory. Three of its four repeated acts touch a service rather than the tree, so no workflow file can absorb them, and one of the acts has already cost a broken deploy: the account ID displayed in the Cloudflare dashboard is truncated, and a value copied from there is wrong in a way that only shows up at deploy time.
-
-## Must
-
-- Create the Pages project through `wrangler pages project create`
-- Fetch the account ID from `wrangler`'s own authenticated session rather than have it typed or pasted
-- Stop for the operator to issue the API token and run `gh secret set CLOUDFLARE_API_TOKEN` themselves
-- Verify both secrets are present with `gh secret list` before continuing
-- Stop for the operator to attach the custom domain in the dashboard
-- Call `wrangler` and `gh` directly for every step those tools already cover
-
-## Must not
-
-- Accept a Cloudflare API token as input in any form. The toolkit verifies a secret exists, never what it contains.
-- Reimplement `wrangler pages project create` or `gh secret set` as a hand-built API call
-- Open a pull request or merge
-
-## Guards
-
-- `wrangler` not authenticated: stop and name the login command
-- `gh` not authenticated: stop and name the login command
-- A secret missing after the token stop: stop and name which one
-
-## Out of scope
-
-- Attaching a custom domain through the Cloudflare REST API instead of the dashboard. Measured absent from `wrangler pages` at plan time and the REST API was not read, so the dashboard stop stays for this pass.
-- Running the deploy itself once secrets and the domain are set. That is the seeded `tooling/cloudflare/configs/.github/workflows/deploy.yml` workflow, triggered by a push to main.
-- Reconfiguring an existing Pages project's build settings.