@erclx/canon 5.32.0 → 5.33.0

package/scripts/lib/sandbox-fixtures.sh

@@ -1,191 +0,0 @@
-#!/usr/bin/env bash
-
-# Fixture files carry this suffix so the repository's own checks ignore them.
-# A stored `index.md.fixture` is not an `index.md`, so the index walker, prettier,
-# shfmt, and shellcheck all skip it and the bytes reach the sandbox unmodified.
-FIXTURE_SUFFIX=".fixture"
-
-# The tree mirrors the scenario path, so `category` and `scenario` together match
-# `sandbox/<category>/<scenario>.sh`. Both segments are load-bearing:
-# four scenario basenames repeat across categories (`claude`, `docs`, `review`,
-# `sync`), and `docs` is also a category of its own.
-fixture_stage_dir() {
-  local category="$1"
-  local scenario="$2"
-  local arm="$3"
-  local stage="$4"
-  echo "$PROJECT_ROOT/sandbox/fixtures/$category/$scenario/$arm/$stage"
-}
-
-list_fixture_files() {
-  local source_dir="$1"
-  find "$source_dir" -type f -name "*$FIXTURE_SUFFIX" -print0 | sort -z
-}
-
-count_fixture_files() {
-  local source_dir="$1"
-  if [ ! -d "$source_dir" ]; then
-    echo 0
-    return 0
-  fi
-  find "$source_dir" -type f -name "*$FIXTURE_SUFFIX" | wc -l
-}
-
-# The copy loops match on the suffix, so a file without one would be skipped in
-# silence and the scenario would provision a tree it was never meant to have.
-assert_fixtures_suffixed() {
-  local source_dir="$1"
-  [ -d "$source_dir" ] || return 0
-
-  local stray
-  stray="$(find "$source_dir" -type f -not -name "*$FIXTURE_SUFFIX" | sort | tr '\n' ' ')"
-  [ -z "$stray" ] || log_error "Fixture missing the $FIXTURE_SUFFIX suffix: $stray"
-}
-
-fixture_target_path() {
-  local source_dir="$1"
-  local source_file="$2"
-  local relative="${source_file#"$source_dir"/}"
-  echo "${relative%"$FIXTURE_SUFFIX"}"
-}
-
-create_from_fixtures() {
-  local source_dir="$1"
-  [ -d "$source_dir" ] || return 0
-
-  local source_file target
-  while IFS= read -r -d '' source_file; do
-    target="$(fixture_target_path "$source_dir" "$source_file")"
-    mkdir -p "$(dirname "$target")"
-    cp "$source_file" "$target"
-  done < <(list_fixture_files "$source_dir")
-}
-
-# An append fixture extends a file the anchor or the injected seeds already
-# provide. A missing target means that upstream shape changed, so fail rather
-# than create the file and silently alter what the scenario provisions.
-append_from_fixtures() {
-  local source_dir="$1"
-  [ -d "$source_dir" ] || return 0
-
-  local source_file target
-  while IFS= read -r -d '' source_file; do
-    target="$(fixture_target_path "$source_dir" "$source_file")"
-    if [ ! -f "$target" ]; then
-      log_error "Append fixture has no target: $target"
-    fi
-    cat "$source_file" >>"$target"
-  done < <(list_fixture_files "$source_dir")
-}
-
-# Stages the first `count` markdown files the toolkit ships for a domain into
-# `dest`, flattening any source subfolder. Source rather than fixture tree,
-# because an arm modelling a real install wants the files a target actually
-# received and a copy under `fixtures/` would drift from them silently.
-#
-# The flattening is load-bearing rather than incidental. Both `detectUnmigrated`
-# and the sync engine match a target file to its source by basename against the
-# flat domain root, so a file lifted out of a source subfolder such as `bundled/`
-# has no flat sibling and reads as project-authored. An arm staging one claims a
-# drift or an unmigrated domain it did not stage.
-stage_toolkit_markdown() {
-  local src="$1"
-  local dest="$2"
-  local count="$3"
-
-  mkdir -p "$dest"
-  while IFS= read -r file; do
-    cp "$file" "$dest/$(basename "$file")"
-  done < <(find "$src" -maxdepth 1 -type f -name "*.md" ! -name "index.md" | sort | head -n "$count")
-}
-
-# The newest top-level path history records a deletion under that the toolkit no
-# longer ships. Read from history rather than hardcoded, so an arm stages a root
-# the walk will actually recognize instead of a name that has since come back.
-# `prompts` is preferred because it is the case measured in a real target, and
-# any other dropped root exercises the same walk.
-pick_dropped_root() {
-  local preferred="prompts"
-  local first=""
-  local candidate
-
-  while IFS= read -r candidate; do
-    [ -e "$PROJECT_ROOT/$candidate" ] && continue
-    [ "$candidate" = "$preferred" ] && {
-      echo "$preferred"
-      return 0
-    }
-    [ -n "$first" ] || first="$candidate"
-  done < <(git -C "$PROJECT_ROOT" log --all --diff-filter=D --name-only --format= |
-    awk -F/ 'NF > 1 { print $1 }' | sort -u)
-
-  echo "$first"
-}
-
-# Restores one file's exact published bytes from the commit before it was
-# deleted. Content is what the attribution matches on, so a file written by hand
-# would report unattributed and an arm would assert the wrong verdict.
-#
-# Both reads take the whole listing through a process substitution rather than a
-# pipeline ending in an early exit. `set -o pipefail` is on, and a `grep -m 1`
-# that matches the first line closes the pipe while git is still writing, so the
-# substitution returns git's SIGPIPE status and the arm fails on a listing it
-# actually read.
-restore_dropped_file() {
-  local root="$1"
-  local rel="" commit="" line
-
-  while IFS= read -r line; do
-    case "$line" in
-    "$root"/*)
-      rel="$line"
-      break
-      ;;
-    esac
-  done < <(git -C "$PROJECT_ROOT" log --all --diff-filter=D --name-only \
-    --format= -- "$root/")
-
-  [ -n "$rel" ] || return 1
-
-  while IFS= read -r line; do
-    commit="$line"
-    break
-  done < <(git -C "$PROJECT_ROOT" log --all --diff-filter=D --format=%H -- "$rel")
-
-  [ -n "$commit" ] || return 1
-
-  mkdir -p "$(dirname "$rel")"
-  git -C "$PROJECT_ROOT" show "$commit^:$rel" >"$rel" || return 1
-
-  echo "$rel"
-}
-
-# Stages one step of a scenario arm into the sandbox working directory.
-# Scenarios call this once per step so their own git operations stay between
-# the steps, where they are visible.
-stage_fixtures() {
-  local category="$1"
-  local scenario="$2"
-  local arm="$3"
-  local stage="$4"
-
-  local stage_dir
-  stage_dir="$(fixture_stage_dir "$category" "$scenario" "$arm" "$stage")"
-
-  if [ ! -d "$stage_dir" ]; then
-    log_error "Fixture stage not found: $category/$scenario/$arm/$stage"
-  fi
-
-  assert_fixtures_suffixed "$stage_dir/create"
-  assert_fixtures_suffixed "$stage_dir/append"
-
-  local staged
-  staged=$(($(count_fixture_files "$stage_dir/create") + \
-  $(count_fixture_files "$stage_dir/append")))
-  if [ "$staged" -eq 0 ]; then
-    log_error "Fixture stage provisions nothing: $category/$scenario/$arm/$stage"
-  fi
-
-  create_from_fixtures "$stage_dir/create"
-  append_from_fixtures "$stage_dir/append"
-}

package/scripts/lib/sandbox-git.sh

@@ -1,125 +0,0 @@
-#!/usr/bin/env bash
-
-# The sandbox reaches GitHub over HTTPS with the gh token so a headless run needs
-# no SSH key and no agent. `gh auth login` authenticates the CLI but leaves git
-# itself without a credential, so the harness supplies the helper rather than
-# assuming the machine carries one.
-SANDBOX_GIT_CREDENTIAL_HELPER='!gh auth git-credential'
-
-# Call from the main shell before any scenario runs. sandbox_anchor_url is used
-# inside command substitutions, where log_error would exit only the subshell and
-# leave the caller building an empty remote, so the run has to stop here instead.
-require_sandbox_anchor_config() {
-  if [ -z "${GITHUB_ORG:-}" ]; then
-    log_error "GITHUB_ORG is empty. Export GITHUB_ORG=<org>, or run from a clone whose remote.origin.url points at GitHub."
-  fi
-}
-
-resolve_sandbox_anchor_repo() {
-  printf '%s\n' "${1:-${ANCHOR_REPO:-}}"
-}
-
-sandbox_anchor_url() {
-  local repo_name
-  repo_name="$(resolve_sandbox_anchor_repo "$@")"
-
-  if [ -z "$repo_name" ] || [ -z "${GITHUB_ORG:-}" ]; then
-    log_error "sandbox_anchor_url needs GITHUB_ORG and a repository name. Call require_sandbox_anchor_config first."
-  fi
-
-  printf 'https://github.com/%s/%s.git\n' "$GITHUB_ORG" "$repo_name"
-}
-
-# credential.helper is multi-valued and git concatenates it across system, global,
-# and local, trying each in order until one returns a credential. A plain set
-# leaves an operator's existing helper ahead of this one, so a stale token wins
-# and gh never runs. The empty value resets the inherited list first.
-configure_sandbox_git_credentials() {
-  git config credential.helper ""
-  git config --add credential.helper "$SANDBOX_GIT_CREDENTIAL_HELPER"
-}
-
-resolve_sandbox_git_identity() {
-  SANDBOX_GIT_NAME="${SANDBOX_GIT_NAME:-$(git config --global user.name 2>/dev/null || true)}"
-  SANDBOX_GIT_EMAIL="${SANDBOX_GIT_EMAIL:-$(git config --global user.email 2>/dev/null || true)}"
-
-  : "${SANDBOX_GIT_NAME:=canon-sandbox}"
-  : "${SANDBOX_GIT_EMAIL:=sandbox@example.com}"
-
-  export SANDBOX_GIT_NAME SANDBOX_GIT_EMAIL
-}
-
-configure_sandbox_git_identity() {
-  resolve_sandbox_git_identity
-  git config user.name "$SANDBOX_GIT_NAME"
-  git config user.email "$SANDBOX_GIT_EMAIL"
-}
-
-# Every scenario that needs a remote points at the same throwaway repository, so
-# the name lives here rather than in each one.
-SANDBOX_ANCHOR_REPO="canon-sandbox"
-
-# A scenario calls this from its own use_anchor hook rather than this file
-# defining the hook. sandbox-hook.sh keys off `type -t use_anchor`, so
-# declaring it here would hand an anchor to the scenarios that source this file
-# for the identity helpers alone.
-use_sandbox_anchor() {
-  export ANCHOR_REPO="${1:-$SANDBOX_ANCHOR_REPO}"
-}
-
-# gh answers an absent repository and an unreachable host with the same exit
-# status, so the 404 is the only thing separating them. Anything else is a
-# network or credential fault, where creating a repository would be the wrong
-# answer and would fail for the same reason the read did.
-ensure_sandbox_anchor_repo() {
-  local repo_name gh_error
-
-  repo_name="$(resolve_sandbox_anchor_repo "$@")"
-
-  if [ -z "$repo_name" ] || [ -z "${GITHUB_ORG:-}" ]; then
-    log_error "ensure_sandbox_anchor_repo needs GITHUB_ORG and a repository name. Call require_sandbox_anchor_config first."
-  fi
-
-  if gh_error="$(gh api "repos/${GITHUB_ORG}/${repo_name}" --silent 2>&1)"; then
-    return 0
-  fi
-
-  case "$gh_error" in
-  *"HTTP 404"*) ;;
-  *) log_error "Cannot reach ${GITHUB_ORG}/${repo_name}: ${gh_error}" ;;
-  esac
-
-  # An absent anchor is nearly always a wrong GITHUB_ORG or a rename nobody
-  # performed, and provisioning stages a fixture rather than cloning while every
-  # scenario force-pushes to main, so a repository created here would carry all
-  # nine to a pass against something that is not the anchor. Refusing is the safe
-  # default and creating is the opt-in, the shape `canon tooling sync --write`
-  # already sets. `canon records push` refuses outright for the reason
-  # `canon/context/development/records.md` records, so the two still differ.
-  # The sibling SANDBOX_ flags are presence tests, so any non-empty value turns
-  # them on. This one allowlists instead, because a presence test would have
-  # SANDBOX_ANCHOR_CREATE=false provisioning a repository. Both spellings are
-  # accepted so the `true` those siblings are set to does not land on a refusal.
-  case "${SANDBOX_ANCHOR_CREATE:-}" in
-  1 | true) ;;
-  *) log_error "${GITHUB_ORG}/${repo_name} does not exist. Check GITHUB_ORG and whether a rename is pending, then create it with 'gh repo create ${GITHUB_ORG}/${repo_name} --private' or re-run with SANDBOX_ANCHOR_CREATE=true." ;;
-  esac
-
-  log_warn "${GITHUB_ORG}/${repo_name} does not exist and SANDBOX_ANCHOR_CREATE is set. Creating it as private."
-  if ! gh_error="$(gh repo create "${GITHUB_ORG}/${repo_name}" --private 2>&1)"; then
-    log_error "Could not create ${GITHUB_ORG}/${repo_name}: ${gh_error}"
-  fi
-  log_info "Created ${GITHUB_ORG}/${repo_name} as a private repository."
-}
-
-# A remote is useless without an author, so the scenarios that reach one always
-# configure both. configure_sandbox_git_identity stays callable on its own for
-# the scenarios that never push. The probe runs first so an absent remote is
-# reported before the scenario stages anything. The remove keeps this idempotent
-# against a sandbox tree that already carries an origin.
-configure_sandbox_anchor_remote() {
-  ensure_sandbox_anchor_repo "$@"
-  configure_sandbox_git_identity
-  git remote remove origin 2>/dev/null || true
-  git remote add origin "$(sandbox_anchor_url "$@")"
-}

package/scripts/lib/sandbox-path.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-# The sandbox tree lives outside the toolkit worktree. `canon sandbox run`
-# sets cwd to it for `claude -p`, and every `CLAUDE.md` between that cwd and the
-# filesystem root loads into the session. Under the repository the toolkit's own
-# instructions join that chain beside the seeded copy the scenario installed,
-# both carry the rule sending shared session scratch to the main worktree root,
-# and nothing decides which root wins. A session picking the toolkit writes its
-# output where no manifest reads it, so the run reports success while the verdict
-# reports no writes at all. The retired eval runner kept its fixture outside the
-# repository for the same reason.
-#
-# Mints a short random per-run identifier the first time it is asked for, then
-# holds it in CANON_SANDBOX_RUN_ID for the rest of this process. A direct call
-# (not `$(...)`) exports it into the caller's own shell. A call already carrying
-# the variable, inherited from a parent such as `canon sandbox run`, reuses it
-# rather than minting a new one, which is what keeps a hook on the parent's tree.
-#
-# Twin of `mintSandboxRunId` in `src/sandbox/tree.ts`.
-mint_sandbox_run_id() {
-  if [ -z "${CANON_SANDBOX_RUN_ID:-}" ]; then
-    CANON_SANDBOX_RUN_ID="$(date +%s)-$$-$RANDOM"
-  fi
-  export CANON_SANDBOX_RUN_ID
-}
-
-# The base every per-run tree nests under, with no run id appended. Split out
-# of `resolve_sandbox_dir` so a caller that needs to recognize any run's tree,
-# such as `require_project_root` in `scripts/lib/ui.sh`, tests against this
-# prefix instead of a single resolved path that changes on every call.
-sandbox_dir_prefix() {
-  printf '%s/canon/sandbox\n' "${XDG_STATE_HOME:-$HOME/.local/state}"
-}
-
-# Twin of `sandboxTree` in `src/sandbox/tree.ts`. The exec boundary rules out
-# a shared constant, so a change to the default lands on both sides.
-#
-# A bare fall-through with no per-run component is one path per machine, so
-# two sessions resolving the default at once would provision over each other
-# with neither told. `mint_sandbox_run_id` is what makes two such sessions
-# land on two different trees rather than one.
-resolve_sandbox_dir() {
-  if [ -n "${CANON_SANDBOX_DIR:-}" ]; then
-    printf '%s\n' "$CANON_SANDBOX_DIR"
-    return 0
-  fi
-
-  mint_sandbox_run_id
-  printf '%s-%s\n' "$(sandbox_dir_prefix)" "$CANON_SANDBOX_RUN_ID"
-}

package/scripts/sandbox-hook.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-# No `-u`. Scenarios ran under the retired dispatcher without it and read unset
-# variables as empty, so turning it on here changes what they provision.
-set -e
-set -o pipefail
-
-# Runs one scenario's hooks for the provisioning order in
-# `src/sandbox/provision.ts`. Scenarios and the library they call stay bash, so
-# the harness reaches them through this entry and nothing else.
-#
-#   probe <scenario>         runs `use_config` and `use_anchor` when declared
-#                            and prints every export they changed, closed by an
-#                            `@anchor=<0|1>` record
-#   stage <scenario> <file>  re-runs both hooks, runs `stage_setup` inside the
-#                            tree, and writes the exports it changed to <file>,
-#                            or an `@exited` record when the shell exits first
-#
-# Pairs are NUL-separated `NAME=value`, since a value can hold a newline. The
-# retired dispatcher ran `stage_setup` in its own shell, so an export, an `exit`,
-# or an `exec` there reached the harness, and the report carries all three: an
-# `exec` skips the EXIT trap and leaves no report at all. The stage re-runs the
-# hooks rather than receiving the probe's pairs, since they only export.
-
-SCRIPT_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
-PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
-export PROJECT_ROOT
-
-# Globals carry a prefix, since the scenario sourced below shares this shell.
-_hook_die() {
-  echo "sandbox-hook: $1" >&2
-  exit 2
-}
-_hook_mode="${1:-}"
-_hook_scenario="${2:-}"
-_hook_report="${3:-}"
-
-[[ "$_hook_mode" == "probe" || "$_hook_mode" == "stage" ]] || _hook_die "mode must be probe or stage, got: ${_hook_mode:-<empty>}"
-[ -f "$_hook_scenario" ] || _hook_die "no scenario file at: ${_hook_scenario:-<empty>}"
-[ "$_hook_mode" = "probe" ] || [ -n "$_hook_report" ] || _hook_die "stage needs a file to report its exports to"
-[ "$_hook_mode" = "probe" ] || trap 'printf "@exited\0" >"$_hook_report"' EXIT
-
-declare -A _hook_before
-_hook_snapshot() {
-  local name
-  _hook_before=()
-  for name in $(compgen -e); do
-    _hook_before[$name]="${!name}"
-  done
-}
-
-# The shell moves PWD and OLDPWD itself on every `cd`, and neither is state.
-_hook_changed() {
-  local name
-  for name in $(compgen -e); do
-    [[ "$name" == "PWD" || "$name" == "OLDPWD" ]] && continue
-    if [[ ! -v _hook_before[$name] ]] || [ "${_hook_before[$name]}" != "${!name}" ]; then
-      printf '%s=%s\0' "$name" "${!name}"
-    fi
-  done
-}
-
-# Taken before `config.sh`, so a `GITHUB_ORG` it derives from the remote reaches
-# the harness as an export like any other.
-_hook_snapshot
-
-source "$PROJECT_ROOT/scripts/config.sh"
-source "$PROJECT_ROOT/scripts/lib/ui.sh"
-source "$PROJECT_ROOT/scripts/lib/sandbox-path.sh"
-source "$PROJECT_ROOT/scripts/lib/sandbox-git.sh"
-source "$PROJECT_ROOT/scripts/lib/sandbox-fixtures.sh"
-
-# Unexported, as the dispatcher held them, so a scenario reads both while a
-# child it spawns sees neither. Shellcheck cannot see the scenario reading them.
-# shellcheck disable=SC2034
-SANDBOX="$(resolve_sandbox_dir)" SANDBOX_DIR="$PROJECT_ROOT/sandbox"
-
-# shellcheck source=/dev/null
-source "$_hook_scenario"
-
-_hook_declared() { [[ "$(type -t "$1")" == "function" ]]; }
-_hook_run() {
-  if _hook_declared use_config; then use_config; fi
-  if _hook_declared use_anchor; then use_anchor; fi
-}
-
-if [ "$_hook_mode" = "probe" ]; then
-  # Stdout carries the pairs alone, so a hook that prints is moved off it.
-  _hook_run >&2
-  _hook_changed
-  if _hook_declared use_anchor; then printf '@anchor=1\0'; else printf '@anchor=0\0'; fi
-  exit 0
-fi
-
-_hook_run
-_hook_snapshot
-cd "$SANDBOX"
-stage_setup
-trap - EXIT
-_hook_changed >"$_hook_report"

package/src/gov/standard-rules.ts

@@ -1,179 +0,0 @@
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
-import { mkdir, rm, writeFile } from 'node:fs/promises'
-import { basename, join, relative } from 'node:path'
-import { listRuleSourcePaths, rulesSourceDir } from '@/gov/install'
-import { parseFrontmatter } from '@/indexes/frontmatter'
-
-const STANDARDS_REL = 'standards'
-
-/** The band the generated rules ship in, named for what they point at. */
-export const STANDARD_RULES_BAND = 'standards'
-
-export type StandardRulesResult =
-  | { readonly ok: true; readonly written: readonly string[] }
-  | { readonly ok: false; readonly reason: string }
-
-interface StandardRule {
-  readonly name: string
-  readonly sourceRel: string
-  readonly title: string
-  readonly description: string
-  readonly paths: readonly string[]
-  readonly bullets: readonly string[]
-}
-
-export function standardRulesDir(root: string): string {
-  return join(rulesSourceDir(root), STANDARD_RULES_BAND)
-}
-
-/**
- * Generates one path-scoped rule per standard whose frontmatter carries
- * `paths:`. The standard owns the glob and the operative bullets, so the rule
- * is output, committed beside the authored bands so every reader of
- * `governance/rules/` sees it as an ordinary file.
- *
- * Every standard is read and checked before anything is written, so a refusal
- * leaves the previous output whole rather than half cleared.
- */
-export async function regenStandardRules(
-  root: string,
-): Promise<StandardRulesResult> {
-  const standardsDir = join(root, STANDARDS_REL)
-  if (!existsSync(standardsDir)) return { ok: true, written: [] }
-
-  const reserved = reservedNames(root)
-  const rules: StandardRule[] = []
-
-  for (const file of readdirSync(standardsDir).sort()) {
-    if (!file.endsWith('.md')) continue
-    const read = readStandard(root, file, reserved)
-    if (typeof read === 'string') return { ok: false, reason: read }
-    if (read !== undefined) rules.push(read)
-  }
-
-  const dir = standardRulesDir(root)
-  await rm(dir, { recursive: true, force: true })
-  if (rules.length > 0) await mkdir(dir, { recursive: true })
-
-  const written: string[] = []
-  for (const rule of rules) {
-    const dest = join(dir, `${rule.name}.md`)
-    await writeFile(dest, renderStandardRule(rule))
-    written.push(relative(root, dest))
-  }
-
-  return { ok: true, written }
-}
-
-/**
- * Band folders and authored rule basenames. A bare-word rule name equal to a
- * band would install the whole band through `--add`, and one equal to an
- * authored rule would shadow it in the name index.
- */
-function reservedNames(root: string): {
-  readonly bands: ReadonlySet<string>
-  readonly rules: ReadonlySet<string>
-} {
-  const bands = new Set<string>([STANDARD_RULES_BAND])
-  const rules = new Set<string>()
-
-  for (const rel of listRuleSourcePaths(root)) {
-    const segments = rel.split('/')
-    if (segments.length > 1) bands.add(segments[0])
-    if (segments[0] === STANDARD_RULES_BAND) continue
-    rules.add(basename(rel, '.md'))
-  }
-
-  return { bands, rules }
-}
-
-/** A rule to render, `undefined` for a standard with no `paths:`, or a reason. */
-function readStandard(
-  root: string,
-  file: string,
-  reserved: ReturnType<typeof reservedNames>,
-): StandardRule | string | undefined {
-  const sourceRel = `${STANDARDS_REL}/${file}`
-  const fields = parseFrontmatter(
-    readFileSync(join(root, STANDARDS_REL, file), 'utf8'),
-  )?.fields
-  if (fields === undefined || fields.paths === undefined) return undefined
-
-  const name = basename(file, '.md')
-  if (!isStringList(fields.paths)) {
-    return `${sourceRel}: paths must be a list of strings`
-  }
-  if (fields.rule !== undefined && !isStringList(fields.rule)) {
-    return `${sourceRel}: rule must be a list of strings`
-  }
-  if (reserved.bands.has(name)) {
-    return `${sourceRel}: name collides with a rule band folder`
-  }
-  if (reserved.rules.has(name)) {
-    return `${sourceRel}: name collides with an authored rule`
-  }
-
-  return {
-    name,
-    sourceRel,
-    title: typeof fields.title === 'string' ? fields.title : name,
-    description:
-      typeof fields.description === 'string' ? fields.description : '',
-    paths: fields.paths,
-    bullets: fields.rule ?? [],
-  }
-}
-
-function isStringList(value: unknown): value is string[] {
-  return (
-    Array.isArray(value) && value.every((entry) => typeof entry === 'string')
-  )
-}
-
-function renderStandardRule(rule: StandardRule): string {
-  const scope = rule.description.replace(/\.$/, '')
-  const pointer = [
-    `Follow the ${rule.name} standard for ${lowerFirst(scope)}.`,
-    'It is the single source.',
-    `Read it with \`canon standards ${rule.name}\`.`,
-  ].join(' ')
-
-  return [
-    '---',
-    `# Generated by \`canon gov regen\` from ${rule.sourceRel}. Edit that frontmatter, not this file.`,
-    `description: ${yamlScalar(rule.description)}`,
-    'paths:',
-    ...rule.paths.map((glob) => `  - ${yamlQuoted(glob)}`),
-    '---',
-    '',
-    `# ${rule.title.replace(/\breference$/, 'standards')}`,
-    '',
-    '## Authority',
-    '',
-    ...[pointer, ...rule.bullets].map((bullet) => `- ${bullet}`),
-    '',
-  ].join('\n')
-}
-
-function lowerFirst(text: string): string {
-  return text.charAt(0).toLowerCase() + text.slice(1)
-}
-
-/** Plain when YAML would read it back unchanged, single-quoted otherwise. */
-function yamlScalar(text: string): string {
-  const isPlain =
-    text !== '' &&
-    !/^[-?:,[\]{}#&*!|>'"%@`\s]/.test(text) &&
-    !/: |\s#|:$|\s$/.test(text)
-  return isPlain ? text : yamlQuoted(text)
-}
-
-/**
- * Quoted the way Prettier's `singleQuote` leaves YAML, so the drift check
- * never fights the formatter: single quotes unless the text holds one and
- * double quotes would need no escape.
- */
-function yamlQuoted(text: string): string {
-  if (text.includes("'") && !/["\\]/.test(text)) return `"${text}"`
-  return `'${text.replaceAll("'", "''")}'`
-}