@erclx/canon 5.32.0 → 5.33.0

package/docs/workflow/parallel-features.md

@@ -38,23 +38,23 @@ The plan's shape is fixed by `claude/skills/plan-feature/references/plan.md`: th
 
 An execution that picks other than the suggestion rewrites the `- Suggested:` line as `overridden at execution to <pick>,` followed by the measurement that moved it, and leaves the slot blank. That fixed phrase is how a reader of the archived plan tells an override from a suggestion the execution accepted, since an authored suggestion often carries a number of its own. The same deviation takes one line in the open task's `## Findings`, which is the register that survives the plan being archived. A deviation from a question somebody already answered goes back to whoever answered it instead, since a filled slot is a decision already made.
 
-`canon records validate plans` reports where a plan and that standard disagree: a filename that is not `feature-<slug>.md`, a missing required section, a files-to-touch entry naming no file, and a question carrying a suggestion with no answer slot. The same verb takes `groundwork`, `intake`, `memory`, and `teach`, which are governed the same way and were unreachable for the same reason. Nothing fires it automatically, because all five folders are gitignored and every check the repository runs reads changed files from git. It reports and never writes, since the folders are per-machine scratch with no history to recover a wrong repair from.
+`canon records validate plans` reports where a plan and that standard disagree: a filename that is not `feature-<slug>.md`, a missing required section, a files-to-touch entry naming no file, and a question carrying a suggestion with no answer slot. The same verb takes `groundwork`, `intake`, and `teach`, which are governed the same way and were unreachable for the same reason. Nothing fires it automatically, because all four folders are gitignored and every check the repository runs reads changed files from git. It reports and never writes, since the folders are per-machine scratch with no history to recover a wrong repair from.
 
 `canon records push` carries these folders off the disk they live on, and `canon records pull` brings them back. Every top-level entry under `.canon/` is backed except `tmp`, `ordinal-locks`, and `.records.git`, so a folder added later enters the payload on its own rather than waiting on a name written into a list. Push names each folder it carries the first time it sees it, which is what keeps a stray folder visible instead of silently entering the payload. It refuses the whole push, naming each path, when a new or changed file is over 25 MB or carries a credential `canon secrets scan` would report. The history lives in a second git directory at `.canon/.records.git` with `.canon/` as its work tree, so every path a task file cites stays where it is.
 
 A person points it at a private repository once and both verbs refuse until they have, and `push` refuses when that origin is also a remote of the project, since the payload is the task board and the groundwork trails. `.husky/post-merge` runs the push after its archive loop, on every merge rather than only on one that closed a task. See [records push](../agents/records-push.md) for the refusal table.
 
-`canon records size` reports what each of these folders holds, heaviest first, along with `.canon/tmp`. Each row carries the file count, the bytes, how many files were written in the last 7 and 30 days, and the dates of the least and most recently written one. Nothing fails on a number, because a record folder has no correct size. What the verb replaces is a reading somebody had to remember to take: the memory pen went from 44 entries to 236 between two counts made by hand a fortnight apart, and nothing reported the rate in between.
+`canon records size` reports what each of these folders holds, heaviest first, along with `.canon/tmp`. Each row carries the file count, the bytes, how many files were written in the last 7 and 30 days, and the dates of the least and most recently written one. Nothing fails on a number, because a record folder has no correct size. What the verb replaces is a reading somebody had to remember to take: a pen went from 44 entries to 236 between two counts made by hand a fortnight apart, and nothing reported the rate in between.
 
 `canon records prune-tmp` reports scratch under `.canon/tmp` nobody has touched inside an age window, and deletes it only with `--write`. A `tmp/handoff/` folder and the live `tmp/pr/poll/` baseline are never offered, since a reader deletes a handoff once it is read and a poll baseline is state a session still needs. See [records](../agents/records.md) for the candidate shapes and the exit codes.
 
-`canon records stale memory` reads the memory pen as a review queue. It names each entry due for review, meaning one carrying no `reviewed` date or one older than 30 days, and every backticked path an entry cites that the tree no longer holds. Due entries come first, with the ones citing a missing path ahead of the rest, so a review takes the first batch rather than the whole pen. It writes nothing. See [records stale](../agents/records-stale.md) for how a path is read and the refusals.
+`canon records stale canonical` reports when the requirements record was last reviewed and how many releases have shipped since, so a review of it starts from a count rather than from the tag list. It writes nothing. See [records stale](../agents/records-stale.md) for how the count is taken and the refusals.
 
 A plan that ships is archived, never deleted. `canon tasks archive` moves it to `.canon/plans/archive/` alongside the task it belonged to and retargets that task's `Plan:` line at the new location, so a completed task still leads to the reasoning behind it. An archive sits inside the record folder it archives rather than beside it, so one ignore entry and one backed-folder entry cover a record and everything it has retired. The folder is gitignored, which is why a deleted plan had no recovery path. A plan cited by more than one task stays put until the last of them closes, since moving it early would strand every other pointer.
 
-An older branch review report takes the other route and is swept rather than archived. It sits flat in `.canon/review/` as `branch-<slug>.md`, the session addressing it read it once, and the durable record of what a review found is the comment `review-pr` posts on the pull request, so `context-fold` deletes any report whose branch is gone. The body that writes a report owns how long it lives, which leaves the shipping branch's own report on disk through the run that cites it and collects it a branch later. What that loses is a local-only review on a branch that never opened a pull request, which is why the report says so where a reader meets it.
+An older branch review report takes the other route and is swept rather than archived. It sits flat in `.canon/review/` as `branch-<slug>.md`, the session addressing it read it once, and the durable record of what a review found is the comment `review-pr` posts on the pull request, so `canon:task-complete` deletes any report whose branch is gone. The body that writes a report owns how long it lives, which leaves the shipping branch's own report on disk through the run that cites it and collects it a branch later. What that loses is a local-only review on a branch that never opened a pull request, which is why the report says so where a reader meets it.
 
-`canon:context-fold` decides which task closed by reading the diff rather than the conversation. It resolves a merge base against `origin/main`, unions the committed diff with the working tree and untracked files, then matches unchecked outcomes on the board against what shipped. A task that shipped without ever being discussed still gets marked. Decisions and design stay session-sourced, because a diff cannot carry a judgment. The requirements record is never folded. A direction change gets one report line naming `canon:document-health`, which reviews that record only when asked.
+`canon:task-complete` decides which task closed by reading the diff rather than the conversation, as the ship-chain step after `canon:context-fold`. It resolves a merge base against `origin/main`, unions the committed diff with the working tree and untracked files, then matches unchecked outcomes on the board against what shipped. A task that shipped without ever being discussed still gets marked. Decisions stay session-sourced, because a diff cannot carry a judgment, and `canon:context-fold` folds them into the context entries. The requirements record is never folded. A direction change gets one report line naming `canon:document-health`, which reviews that record only when asked.
 
 ## Shipping a fan-out
 
@@ -87,12 +87,12 @@ A hand-maintained `priority.md` sits beside the index carrying execution order a
 
 Past that shape, it checks what a surviving row claims against what the tree holds: every plan pointer resolves, every task file is named by a board row or a backlog line and never by both, no task sits in two groups, and every row marked ready names its files. One check across both surfaces is what lets a task move between the board and the backlog without the move reading as a dropped file. Paths two ready rows share go to a `shared` array moving no exit code, the candidate list the orchestrator's conflict check reads. Blockers re-takes what a parked row waits on, reporting one whose cited task reached the trunk and one whose cited file nothing running still holds. A cited task settles the row by being archived, or by closing every outcome and naming a pull request the trunk carries, since the checkbox alone is marked while the branch is still in review. Both halves read a citation out of the blocker cell, so a row citing neither is reported as untested rather than counted clean, and so is a cited task the trunk could not answer for. It reports and never writes, because a row is the orchestrator's claim and a validator repairing one would assert the claim it exists to test. Nothing fires it automatically, since the board is gitignored per-machine scratch with no shared moment to hang a hook on, so the orchestrator's sweep calls it at the point the readiness claim is made and follows it with the parked re-test.
 
-`canon:task-board` owns the two operations that bracket a task's life. It creates the file, holding the filename convention and the frontmatter contract so a malformed write cannot break the index for every sibling, and it moves a shipped task to `.canon/tasks/archive/`. Creation is where the origin invariant is enforced: every task names a plan, a groundwork folder, an intake folder, or an issue, since a task with no origin is either lost context or work nobody decided to do.
+`canon:task-board` creates the file, holding the filename convention and the frontmatter contract so a malformed write cannot break the index for every sibling, and declines a task decided against. `canon:task-complete` marks a shipped task's outcomes and moves one the merge hook left to `.canon/tasks/archive/`. Creation is where the origin invariant is enforced: every task names a plan, a groundwork folder, an intake folder, or an issue, since a task with no origin is either lost context or work nobody decided to do.
 
 Archiving a task carries its plan with it, in the same act. The merge is what settles a plan, and the hook below reaches the archive with nobody watching, so a second call after it would be a second failure point leaving the task archived and the plan live. A task whose plan a sibling still cites archives on its own and leaves the plan live, since moving it on the first task to close strands every other pointer at a path that has gone.
 
 Nothing chained that archive until the `post-merge` git hook landed. Every earlier step fires from `canon:auto-ship` or `canon:git-ship`, both of which finish while the pull request is still open, so a task archived there would close for work that may be abandoned. The board is gitignored, which rules out reading it from anywhere but the machine that pulled. The hook archives the task a merged pull request closed, through the same verb the base stack ships to every target, and does nothing on a project with no board.
 
-The archive gates on a pull request number the merge carried and a closed task, because outcomes are marked on the branch and a task can read all `[x]` while its pull request is still open, so `canon:task-board` still confirms the work reached `main` when a person archives by hand. A companion `post-rewrite` hook carries the same steps for anyone pulling with rebase, which fires that event instead of `post-merge`.
+The archive gates on a pull request number the merge carried and a closed task, because outcomes are marked on the branch and a task can read all `[x]` while its pull request is still open, so `canon:task-complete` still confirms the work reached `main` when a person archives by hand. A companion `post-rewrite` hook carries the same steps for anyone pulling with rebase, which fires that event instead of `post-merge`.
 
 The hook archives through `canon tasks archive`, which carries the refusals above, so a task whose pull request has not merged stays where it is. Both hooks ship with the `base` tooling stack, so a target project running this workflow gets the same trigger, and `CANON_SKIP_RECLAIM`, `CANON_SKIP_UPGRADE`, and `CANON_SKIP_PLUGIN_UPDATE` turn off the three steps that act on the machine.

package/docs/workflow/skill-map-on-request.md

@@ -25,15 +25,15 @@ These two groups hold the skills no single moment in a project's life calls for,
 
 ## Answer a question at any point
 
-| Skill                       | When to use                                                                                                                                                            |
-| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `canon:canon-cli`           | Before running an unfamiliar verb, a sync, or an install, to learn which command to run, which reference doc covers it, or what it overwrites, merges, or leaves alone |
-| `canon:youtube-transcripts` | When a video transcript is wanted in the repo as context                                                                                                               |
-| `canon:read-frames`         | To read a recorded demo back frame by frame and report what each one shows, with no verdict on whether the recording looks right                                       |
-| `canon:teach-workspace`     | To learn a subject across sessions, in a workspace that holds the progress                                                                                             |
-| `canon:markdown-craft`      | Before a substantial markdown edit, for the format and structure rules and the audit that follows                                                                      |
-| `canon:write-human`         | Before drafting or revising prose, for voice, rhythm, and density                                                                                                      |
+| Skill                       | When to use                                                                                                                      |
+| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `canon:canon-cli`           | To pick the `canon` verb that does a job, or before a sync or migrate, to learn which verbs can lose the project's edits         |
+| `canon:youtube-transcripts` | When a video transcript is wanted in the repo as context                                                                         |
+| `canon:read-frames`         | To read a recorded demo back frame by frame and report what each one shows, with no verdict on whether the recording looks right |
+| `canon:teach-workspace`     | To learn a subject across sessions, in a workspace that holds the progress                                                       |
+| `canon:markdown-craft`      | Before a substantial markdown edit, for the format and structure rules and the audit that follows                                |
+| `canon:write-human`         | Before drafting or revising prose, for voice, rhythm, and density                                                                |
 
 Every row answers a question rather than marking a point in a project's life, so filing one under a phase on the [skill map](skill-map.md) would send a reader to the wrong group.
 
-A learning workspace produces two halves and only one of them leaves. A lesson is worked through once and stays in the workspace, and a reference page or a glossary carries no learner, so it belongs wherever the project already keeps prose on that subject. Asking `canon:teach-workspace` to promote sorts each durable page by who owns its subject, sending an Anthropic-owned subject to the wiki, an internal one to the matching context entry, and everything else, subject-neutral material included, to the public docs. It proposes and waits, because a promoted page is public prose that needs a line naming who owns the subject, and it writes nothing to a destination: each page the operator confirms goes to a handoff file that `canon:context-fold` folds in from a branch. A project with no wiki folder gets a refusal naming `canon wiki init` rather than a folder it never asked for.
+A learning workspace produces two halves and only one of them leaves. A lesson is worked through once and stays in the workspace, and a reference page or a glossary carries no learner, so it belongs wherever the project already keeps prose on that subject. Asking `canon:teach-workspace` to promote sorts each durable page by who owns its subject, sending an Anthropic-owned subject to the wiki, an internal one to the matching context entry, and everything else, subject-neutral material included, to the public docs. It proposes and waits, because a promoted page is public prose that needs a line naming who owns the subject, and it writes nothing to a destination: each page the operator confirms goes to a handoff file that `canon:teach-workspace` folds in from a branch in its fold mode. A project with no wiki folder gets a refusal naming `canon wiki init` rather than a folder it never asked for.

package/docs/workflow/skill-map.md

@@ -29,8 +29,8 @@ Each row sits under the group its skill's `metadata.family` names. The landing p
 | `canon:plan-groundwork`    | When the state is unmeasured and more than one approach is live                   |
 | `canon:decision-escalate`  | When open decisions turn on your preference and want batching into one set        |
 | `canon:draft-and-pick`     | When the call is taste and wants several candidates rendered side by side         |
-| `canon:canvas`             | When a direction should be drawn as frames the operator can see, select, and edit |
-| `canon:task-board`         | When a decided item needs a file on the board, or a shipped one needs archiving   |
+| `canon:canvas-board`       | When a direction should be drawn as frames the operator can see, select, and edit |
+| `canon:task-board`         | When a decided item needs a file on the board, or one is decided against          |
 | `canon:plan-feature`       | When the approach is settled and the next step is a plan                          |
 | `canon:codebase-layout`    | When a plan or change adds a file and you need to decide which folder holds it    |
 
@@ -63,15 +63,16 @@ Each row sits under the group its skill's `metadata.family` names. The landing p
 
 ## Ship it
 
-| Skill                | When to use                                                                        |
-| -------------------- | ---------------------------------------------------------------------------------- |
-| `canon:git-ship`     | To run the whole post-feature chain from the verify gate through open PR           |
-| `canon:context-fold` | When decisions diverged from the plan, or a shipped task needs its outcomes marked |
-| `canon:docs-sync`    | When a change since main left `README.md` or `docs/` stale                         |
-| `canon:git-stage`    | When the staged set spans several concerns and wants one commit each               |
-| `canon:git-commit`   | When the staged set is one concern, or was staged hunk by hand                     |
-| `canon:git-branch`   | When a branch name needs generating or renaming to conventional form               |
-| `canon:git-pr`       | When a pull request needs a title and body written from the diff                   |
+| Skill                 | When to use                                                                                     |
+| --------------------- | ----------------------------------------------------------------------------------------------- |
+| `canon:git-ship`      | To run the whole post-feature chain from the verify gate through open PR                        |
+| `canon:context-fold`  | When decisions diverged from the plan, or the diff left a context entry stale                   |
+| `canon:task-complete` | After the fold, to mark the outcomes the diff shipped, or to archive a task the merge hook left |
+| `canon:docs-sync`     | When a change since main left `README.md` or `docs/` stale                                      |
+| `canon:git-stage`     | When the staged set spans several concerns and wants one commit each                            |
+| `canon:git-commit`    | When the staged set is one concern, or was staged hunk by hand                                  |
+| `canon:git-branch`    | When a branch name needs generating or renaming to conventional form                            |
+| `canon:git-pr`        | When a pull request needs a title and body written from the diff                                |
 
 ## After the pull request opens
 

package/docs/workflow/visual-design-workflow.md

@@ -20,7 +20,7 @@ Claude Code reads it and writes the implementation. Works for CLI tools, interna
 
 ### Seed shape
 
-The toolkit seed in `tooling/claude/seeds/canon/DESIGN.md` ships a token-table template with a starting set of roles, and `standards/design.md` carries the same tables under `## Template` with placeholder rows. The column headers are what the renderer parses, so they stay verbatim in either, while the rows and values are the project's own.
+The toolkit seed in `tooling/claude/seeds/canon/DESIGN.md` ships a token-table template with a starting set of roles, and `claude/skills/canvas-board/references/design.md` carries the same tables under `## Template` with placeholder rows. The column headers are what the renderer parses, so they stay verbatim in either, while the rows and values are the project's own.
 
 `canon design render` writes an HTML plus CSS preview to `.canon/tmp/render/design/` for eyeballing the current system without leaving Claude Code. See `canon/context/design/index.md`.
 
@@ -39,7 +39,7 @@ A cell no source anchors ends in `? verify`, and the preview shows that marker b
 - `canon:ux-audit` for UX gap detection on existing surfaces
 - `canon:ux-measure` for what a running surface costs to paint, read against published thresholds
 - `canon:draft-and-pick` for a call settled by looking, drafting several candidates as frames on the canvas and taking your pick
-- `canon:canvas` for a direction worked out over several turns, drawn as HTML frames you drag, select, and restyle in the browser while the session reads your changes back. Only the pick moves into `canon/DESIGN.md`, since the canvas folder is gitignored
+- `canon:canvas-board` for a direction worked out over several turns, drawn as HTML frames you drag, select, and restyle in the browser while the session reads your changes back. Only the pick moves into `canon/DESIGN.md`, since the canvas folder is gitignored
 - `canon:draft-identity` to draft a project's logo mark and compose it into an icon sequence and a social card, through `draft-and-pick`'s own render-and-pick loop. On an Astro project holding the card route scaffold, the card lands as a route the project keeps and is captured through a running server, so it reads the project's real stylesheet rather than typed copies of every color. Everywhere else it ships as a PNG and the run says so.
 - Anthropic's `frontend-design` plugin optional for light visual steering
 

package/governance/renames.toml

@@ -13,10 +13,6 @@
 # resolves A only while both links stay. A key must name no live rule and every
 # chain must end on one, which `src/gov/renames.test.ts` checks against this
 # file.
-#
-# A numbered rule replaced by the rule `canon gov regen` generates from its
-# standard is a rename too: the generated rule keeps every glob and bullet, so
-# the pair is one-to-one identity under the standard's name.
 [renamed]
 "015-output" = "566-output"
 "035-tasks" = "602-tasks"
@@ -25,22 +21,15 @@
 "087-git" = "606-git"
 "510-context" = "610-context"
 "511-indexes" = "611-indexes"
-"550-design" = "650-design"
 "555-tasks" = "655-tasks"
 "558-plan" = "658-plan"
 "501-markdown" = "801-markdown"
-"580-readme" = "880-readme"
-"591-standard-authoring" = "891-standard-authoring"
 "065-spelling" = "765-spelling"
 "075-dependencies" = "775-dependencies"
 "080-config-comments" = "780-config-comments"
 "090-code-comments" = "790-code-comments"
 "658-plan" = "plan"
 "610-context" = "context"
-"650-design" = "design"
 "655-tasks" = "tasks"
 "570-skill" = "skill"
-"590-rule-authoring" = "rule"
 "801-markdown" = "markdown"
-"880-readme" = "readme"
-"891-standard-authoring" = "standard"

package/governance/rules/canon/context.md

@@ -0,0 +1,13 @@
+---
+description: Route edits under canon/context/ to the context-fold skill for the entry shape, and keep each entry conforming to the work in its domain
+paths:
+  - 'canon/context/**'
+---
+
+# Context standards
+
+## Context entries
+
+- Load the `canon:context-fold` skill before a hand edit under `canon/context/`. It carries the entry shape and the content rules for a domain entry. Report it rather than proceeding silently when the skill does not resolve.
+- Before non-trivial work in a domain, read its `canon/context/<domain>/` entry. Use `canon/context/index.md` to find it.
+- Leave the entry conforming when work in its domain changes what it describes.

package/governance/rules/claude/skill.md

@@ -0,0 +1,17 @@
+---
+description: Route edits to a skill body or its requirement to the create-skill skill for the shape, and hold the creation-time questions and the re-read rule
+paths:
+  - '.claude/skills/**/SKILL.md'
+  - 'claude/skills/**/SKILL.md'
+  - '.claude/skills/**/REQUIREMENT.md'
+  - 'claude/skills/**/REQUIREMENT.md'
+---
+
+# Skill standards
+
+## Skill files
+
+- Load the `canon:create-skill` skill before a hand edit to a `SKILL.md` or a `REQUIREMENT.md`. It carries the skill structure, the requirement shape, and the path rules for a skill body. Report it rather than proceeding silently when the skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
+- Confirm `canon:create-skill`'s two creation-time questions are answered before a new `SKILL.md` lands, whether drafted by hand, by another skill, or by `canon:create-skill` itself. Carry the third question into the sibling `REQUIREMENT.md`'s `Must not` section as a review criterion rather than a gate.
+- Re-read a skill body this session edited before invoking that skill again in the same session.
+- Do not read a resolved file path in a held body as evidence the body is current.

package/governance/stacks/base.toml

@@ -5,7 +5,5 @@ extends = ""
 # session conduct and `.claude/` authoring rules, `tooling` the dev setup and
 # CI workflow rules, and `writing` the prose and document-shape rules. The
 # `code` group is left to the stacks that write code, so a docs or writing
-# project loads no rule it can never apply. `standards` holds one rule per
-# standard routing its paths to it, generated by `canon gov regen` from each
-# standard's frontmatter rather than authored.
-rules = ["canon", "claude", "standards", "tooling", "writing"]
+# project loads no rule it can never apply.
+rules = ["canon", "claude", "tooling", "writing"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.32.0",
+  "version": "5.33.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {
@@ -26,9 +26,9 @@
   },
   "scripts": {
     "check:spell": "cspell '**' '.*/**' '.*' --no-progress --color --show-context",
-    "format": "prettier --write --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --write --indent 2 scripts/ sandbox/ tooling/ claude/",
-    "check:format": "prettier --check --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --diff --indent 2 scripts/ sandbox/ tooling/ claude/",
-    "check:shell": "find scripts sandbox tooling claude .claude/hooks -name '*.sh' -exec shellcheck --severity=warning {} + && find .husky -maxdepth 1 -type f -exec shellcheck --severity=warning --shell=sh {} +",
+    "format": "prettier --write --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --write --indent 2 scripts/ tooling/ claude/",
+    "check:format": "prettier --check --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --diff --indent 2 scripts/ tooling/ claude/",
+    "check:shell": "find scripts tooling claude .claude/hooks -name '*.sh' -exec shellcheck --severity=warning {} + && find .husky -maxdepth 1 -type f -exec shellcheck --severity=warning --shell=sh {} +",
     "check:types": "tsc --noEmit",
     "check:install": "./scripts/core/install-check.sh",
     "test": "bun --bun vitest run",

package/scripts/core/install-check.sh

@@ -55,10 +55,10 @@ open_timeline "Install verification"
 # nothing, so the excluded tree has to exist here before its absence below can
 # mean the publish left it out.
 log_step "Assert excluded path exists in source"
-if [ ! -f "$PROJECT_ROOT/sandbox/run.sh" ]; then
-  log_error "sandbox/run.sh is missing from the source tree, so the absence check below would pass on nothing"
+if [ ! -f "$PROJECT_ROOT/sandbox/exempt.toml" ]; then
+  log_error "sandbox/exempt.toml is missing from the source tree, so the absence check below would pass on nothing"
 fi
-log_info "Present: sandbox/run.sh"
+log_info "Present: sandbox/exempt.toml"
 
 log_step "Pack"
 TARBALL_PATH="$(cd "$PROJECT_ROOT" && bun pm pack --quiet --ignore-scripts --destination "$PACK_DIR" | tail -n 1)"

package/scripts/lib/ui.sh

@@ -6,12 +6,6 @@ if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
   exit 1
 fi
 
-# Resolved from this file's own location rather than `$PROJECT_ROOT`, because
-# `require_project_root` is what several scripts call before anything has
-# established a root.
-# shellcheck source=/dev/null
-source "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/sandbox-path.sh"
-
 # `NO_COLOR` follows the published convention, where any non-empty value turns
 # color off whatever the value says.
 supports_color() {
@@ -111,156 +105,3 @@ guard_root() {
     log_error "Cannot run against toolkit root. Files here are the source of truth."
   fi
 }
-
-require_project_root() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local sandbox in_sandbox=0
-  if [ -n "${CANON_SANDBOX_DIR:-}" ]; then
-    sandbox="$CANON_SANDBOX_DIR"
-    [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* ]] && in_sandbox=1
-  else
-    sandbox="$(sandbox_dir_prefix)"
-    [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* || "$PWD" == "$sandbox"-* ]] && in_sandbox=1
-  fi
-  if [ "$in_sandbox" -eq 1 ]; then
-    echo -e "${GREY}┌${NC}" >&2
-    log_error "Execution restricted: Command cannot be run from inside the sandbox environment."
-  fi
-  if [[ "$PWD" != "$PROJECT_ROOT"* ]]; then
-    echo -e "${GREY}┌${NC}" >&2
-    log_error "Context Error: You must run this command from inside the repository."
-  fi
-}
-
-# The retired spelling stays honored, and permanently. This variable is the
-# documented way to drive any command headlessly, so every skill body, CI job,
-# and operator script already written sets the old name, and those callers live
-# in repositories and plugin caches this release cannot reach. Dropping it
-# leaves them waiting on a TTY nobody is watching.
-is_non_interactive() {
-  # canon-keep-retired
-  [[ "${CANON_NON_INTERACTIVE:-}" == "1" || "${AITK_NON_INTERACTIVE:-}" == "1" ]]
-}
-
-ask() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local prompt_text=$1
-  local var_name=$2
-  local default_val=$3
-  local input=""
-  local char
-  local display_default=""
-  if [ -n "$default_val" ]; then
-    display_default=" (${default_val})"
-  fi
-  if is_non_interactive; then
-    echo -e "${GREY}│${NC}" >&2
-    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${default_val}${NC}" >&2
-    export "$var_name"="$default_val"
-    return
-  fi
-  echo -e "${GREY}│${NC}" >&2
-  echo -ne "${GREEN}◆${NC} ${prompt_text}${display_default} " >&2
-  while IFS= read -r -s -n1 char; do
-    if [[ $char == $'\x1b' ]]; then
-      read -rsn2 -t 0.001 _ || true
-      echo -ne "\r\033[K" >&2
-      echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
-      exit 1
-    elif [[ $char == $'\x7f' || $char == $'\x08' ]]; then
-      if [ -n "$input" ]; then
-        input="${input%?}"
-        echo -ne "\b \b" >&2
-      fi
-    elif [[ -z "$char" ]]; then
-      break
-    else
-      input+="$char"
-      echo -n "$char" >&2
-    fi
-  done
-  [ -z "$input" ] && input="$default_val"
-  echo -ne "\r\033[K" >&2
-  echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${input}${NC}" >&2
-  export "$var_name"="$input"
-}
-
-select_or_route_scenario() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local prompt_text=$1
-  shift
-  local options=("$@")
-
-  if [ -n "${SANDBOX_SCENARIO:-}" ]; then
-    echo -e "${GREY}│${NC}" >&2
-    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${SANDBOX_SCENARIO}${NC}" >&2
-    export SELECTED_OPTION="$SANDBOX_SCENARIO"
-    return
-  fi
-
-  select_option "$prompt_text" "${options[@]}"
-}
-
-select_option() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local prompt_text=$1
-  shift
-  local options=("$@")
-  local cur=0
-  local count=${#options[@]}
-
-  if is_non_interactive; then
-    echo -e "${GREY}│${NC}" >&2
-    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${options[0]}${NC}" >&2
-    export SELECTED_OPTION="${options[0]}"
-    return
-  fi
-
-  if [ ! -t 0 ]; then
-    log_error "${prompt_text} requires a TTY. Pass an argument or set CANON_NON_INTERACTIVE=1."
-  fi
-
-  echo -e "${GREY}│${NC}" >&2
-  echo -ne "${GREEN}◆${NC} ${prompt_text}\n" >&2
-
-  while true; do
-    for i in "${!options[@]}"; do
-      if [ "$i" -eq "$cur" ]; then
-        echo -e "${GREY}│${NC}  ${GREEN}❯ ${options[$i]}${NC}" >&2
-      else
-        echo -e "${GREY}│${NC}    ${GREY}${options[$i]}${NC}" >&2
-      fi
-    done
-
-    read -rsn1 key
-    case "$key" in
-    $'\x1b')
-      if read -rsn2 -t 0.001 key_seq; then
-        if [[ "$key_seq" == "[A" ]]; then cur=$(((cur - 1 + count) % count)); fi
-        if [[ "$key_seq" == "[B" ]]; then cur=$(((cur + 1) % count)); fi
-      else
-        echo -ne "\033[$((count + 1))A\033[J" >&2
-        echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
-        exit 1
-      fi
-      ;;
-    "k") cur=$(((cur - 1 + count) % count)) ;;
-    "j") cur=$(((cur + 1) % count)) ;;
-    "q")
-      echo -ne "\033[$((count + 1))A\033[J" >&2
-      echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
-      exit 1
-      ;;
-    "") break ;;
-    esac
-    echo -ne "\033[${count}A" >&2
-  done
-
-  echo -ne "\033[$((count + 1))A\033[J" >&2
-  echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${options[$cur]}${NC}" >&2
-  export SELECTED_OPTION="${options[$cur]}"
-}

package/src/audits/catalog.ts

@@ -468,7 +468,6 @@ const RECORD_KINDS: readonly (readonly [string, Corpus])[] = [
   ['plans', 'per-machine'],
   ['groundwork', 'per-machine'],
   ['intake', 'per-machine'],
-  ['memory', 'per-machine'],
   ['standards', 'tracked'],
   ['teach', 'per-machine'],
 ]

package/src/claude/cases/misc.ts

@@ -25,7 +25,7 @@ export const MISC_CASES: readonly SkillCase[] = [
   {
     prompt:
       'Draw the signup screen as a frame on the canvas, then restyle the element I just selected there.',
-    expect: 'canvas',
+    expect: 'canvas-board',
   },
   {
     prompt:

package/src/claude/cases/setup.ts

@@ -40,6 +40,10 @@ export const SETUP_CASES: readonly SkillCase[] = [
       "Before I run this sync, tell me exactly what it's going to overwrite.",
     expect: 'canon-cli',
   },
+  {
+    prompt: 'Which canon command tells me if my markdown breaks the rules?',
+    expect: 'canon-cli',
+  },
   {
     prompt:
       'Something about the toolkit itself is broken, write it up and send it back to the maintainers.',

package/src/claude/cases/workflow.ts

@@ -31,7 +31,7 @@ export const WORKFLOW_CASES: readonly SkillCase[] = [
   },
   {
     prompt:
-      'Fold what we decided this session into the context entries and mark off what shipped on the task board.',
+      'Fold what we decided this session into the context entries before this branch goes out.',
     expect: 'context-fold',
   },
   {
@@ -127,6 +127,11 @@ export const WORKFLOW_CASES: readonly SkillCase[] = [
     prompt: 'Open a new entry on the task board for this piece of work.',
     expect: 'task-board',
   },
+  {
+    prompt:
+      'This branch finished the pagination work, so tick off whichever board outcomes it actually delivered.',
+    expect: 'task-complete',
+  },
   {
     prompt: 'Open a learning workspace so I can study this topic properly.',
     expect: 'teach-workspace',

package/src/claude/seeds.ts

@@ -17,7 +17,7 @@ const HOOKS = 'hooks'
  * stem in an older layout, which is what `@/sync/layout` pairs a target against
  * to find a superseded artifact.
  */
-export const SUBDIRS: readonly string[] = [HOOKS, 'context', 'memory', 'tasks']
+export const SUBDIRS: readonly string[] = [HOOKS, 'context', 'tasks']
 
 export type SeedScope = 'claude' | 'root'
 

package/src/claude/skills-audit.ts

@@ -7,7 +7,7 @@ import { bodyLines, maskDisplayed } from '@/markdown/scan'
 /** Returned when a skill folder carries no `REQUIREMENT.md`, the gating check. */
 export const EXIT_MISSING_REQUIREMENT = 2
 
-/** The description ceiling stated in the frontmatter rules of `standards/skill.md`. */
+/** The description ceiling stated in the frontmatter rules of `claude/skills/create-skill/references/skill.md`. */
 export const DESCRIPTION_LIMIT = 1024
 
 /** The two headings the requirement template declares, matched at any level. */
@@ -160,7 +160,7 @@ interface SkillText {
 }
 
 /**
- * Measures both skill corpora against the rules `standards/skill.md` states
+ * Measures both skill corpora against the rules `claude/skills/create-skill/references/skill.md` states
  * mechanically. A corpus the project does not carry is skipped rather than
  * reported, so a target holding only `.claude/skills/` reads as in scope.
  *

package/src/cli/help.ts

@@ -10,6 +10,8 @@ type HelpStream = { isTTY?: boolean }
 
 // The grouping mirrors the README's domain table and has no other source, so a
 // command added to the program needs a row here or help-option.test.ts fails.
+// A row here also needs a `canon <verb>` line in claude/skills/canon-cli, or a
+// name in TOOLKIT_ONLY in canon-cli-skill.test.ts, which reads this list.
 export const COMMAND_GROUPS: { title: string; rows: CommandRow[] }[] = [
   {
     title: 'Project',
@@ -25,7 +27,7 @@ export const COMMAND_GROUPS: { title: string; rows: CommandRow[] }[] = [
     title: 'Domains',
     rows: [
       ['gov [cmd]', 'Governance rules (install, sync, list)'],
-      ['standards [cmd]', 'Standards (install, sync, list, <name>)'],
+      ['standards [cmd]', 'Standards (list, <name>)'],
       ['tooling [cmd]', 'Tooling stacks (sync, ref, create)'],
       ['claude [cmd]', 'Claude workflow (init, sync, setup)'],
       ['wiki [cmd]', 'Wiki pages (init)'],

package/src/cli/ui.ts

@@ -154,9 +154,8 @@ export function isNonInteractive(): boolean {
 }
 
 /**
- * `nonInteractiveDefault` opts a prompt into the `select_option` behavior from
- * `scripts/lib/ui.sh`, where `CANON_NON_INTERACTIVE=1` resolves to the first
- * option instead of failing. Callers that would rather fail loudly than pick
+ * `nonInteractiveDefault` opts a prompt into resolving to its first option
+ * under `CANON_NON_INTERACTIVE=1` instead of failing. Callers that would rather fail loudly than pick
  * for the user leave it off.
  */
 export async function select<Value>(opts: {

package/src/commands/claude.ts

@@ -386,7 +386,7 @@ export function register(program: Command): void {
   skills
     .command('audit')
     .description(
-      'Report both skill corpora against the mechanical rules in standards/skill.md',
+      'Report both skill corpora against the mechanical rules in claude/skills/create-skill/references/skill.md',
     )
     .argument('[path]', 'Project root, defaulting to the current directory')
     .helpOption('-h, --help', 'Show this help message')

package/src/commands/gov.ts

@@ -12,7 +12,6 @@ import { checkoutMismatchWarning, PROJECT_ROOT } from '@/roots/project'
 import { creationRel, SCRATCH } from '@/roots/record'
 import { createGovAdapter } from '@/gov/adapter'
 import { regenConsumedRules } from '@/gov/consumed'
-import { regenStandardRules } from '@/gov/standard-rules'
 import { installRules, lookupRules } from '@/gov/install'
 import { buildGovCatalog, describeRule, describeStack } from '@/gov/list'
 import { buildRulesPayload, listRuleFiles } from '@/gov/payload'
@@ -191,18 +190,14 @@ export function register(program: Command): void {
 
   gov
     .command('regen')
-    .description(
-      "Rebuild the standard-pointer rules and a repository's own .claude/rules/",
-    )
+    .description("Rebuild a repository's own .claude/rules/")
     .helpOption('-h, --help', 'Show this help message')
     .option('--root <path>', 'Repository root to regenerate', PROJECT_ROOT)
     .addHelpText(
       'after',
       [
         '',
-        'First writes governance/rules/standards/ from the paths: and rule:',
-        'fields in each standard under standards/. Then reads',
-        'internal/governance.toml and installs the stack it names, plus any',
+        'Reads internal/governance.toml and installs the stack it names, plus any',
         'rules under internal/rules/. Unlike install and sync, this runs',
         'against the toolkit root, whose .claude/rules/ is produced output.',
         '',
@@ -1121,14 +1116,6 @@ async function runRegen(
 
   const root = resolve(opts.root ?? PROJECT_ROOT)
 
-  // The consumed copy installs from `governance/rules/`, so the band this
-  // writes has to be fresh before that copy is built from it.
-  const generated = await regenStandardRules(root)
-  if (!generated.ok) {
-    process.stderr.write(`Standard-rules regen failed: ${generated.reason}\n`)
-    return 1
-  }
-
   const result = await regenConsumedRules(root)
 
   if (!result.ok) {