@erclx/canon 5.32.0 → 5.34.0

package/src/sandbox/scenario.ts

@@ -42,15 +42,13 @@ export const FIXTURE_SUFFIX = '.fixture'
 /** A scenario whose only arm carries this name routes none, as a bash file with no picker did. */
 export const DEFAULT_ARM_NAME = 'default'
 
-/** What a bash scenario passed to `select_or_route_scenario` unless it named another. */
+/** The picker's message unless a scenario names another. */
 const ROUTE_PROMPT = 'Which scenario?'
 
 /** Every scenario that sets the anchor pushes to this one throwaway repository. */
 export const SANDBOX_ANCHOR_REPO = 'canon-sandbox'
 
-const EXTENSIONS = ['.ts', '.sh'] as const
-
-export type ScenarioKind = 'ts' | 'sh'
+const EXTENSION = '.ts'
 
 export type ArmSetup = (ctx: StageContext) => void | Promise<void>
 
@@ -60,12 +58,12 @@ export interface ScenarioDefinition {
   /** Stages the tree from the anchor fixture and names the throwaway remote. */
   readonly anchor?: boolean
   /**
-   * Stages and narrates what the bash form did ahead of `select_or_route_scenario`,
-   * so the picker's echo lands after it on the frame. Runs before the arm is
+   * Stages and narrates ahead of the picker, so the picker's echo lands after
+   * it on the frame. Runs before the arm is
    * routed, which leaves `ctx.arm` undefined.
    */
   readonly prepare?: ArmSetup
-  /** The picker's message, for a bash scenario that passed something other than the default. */
+  /** The picker's message, for a scenario that asks something other than the default. */
   readonly prompt?: string
   /** In routing order, so the first arm is the one a headless caller gets. */
   readonly arms: Readonly<Record<string, ArmSetup>>
@@ -78,43 +76,27 @@ export function scenario(definition: ScenarioDefinition): ScenarioDefinition {
 export interface ScenarioFile {
   readonly command: string
   readonly file: string
-  readonly kind: ScenarioKind
 }
 
 /**
- * Lists the scenarios in one category folder, one per stem. A stem present in
- * both forms is reported apart rather than listed twice, since picking one
- * without saying so is the failure the refusal exists to prevent.
+ * Lists the scenarios in one category folder, one per `.ts` stem. A file in any
+ * other form is ignored rather than refused, so a hand-written leftover does not
+ * break the listing.
  */
 export function listScenarioFiles(categoryDir: string): {
   scenarios: ScenarioFile[]
-  ambiguous: string[]
 } {
-  const byStem = new Map<string, ScenarioFile[]>()
+  const scenarios: ScenarioFile[] = []
   for (const entry of readdirSync(categoryDir, { withFileTypes: true })) {
-    if (!entry.isFile()) continue
-    const kind = EXTENSIONS.find((ext) => entry.name.endsWith(ext))
-    if (kind === undefined) continue
-    const command = entry.name.slice(0, -kind.length)
-    const found = byStem.get(command) ?? []
-    found.push({
-      command,
+    if (!entry.isFile() || !entry.name.endsWith(EXTENSION)) continue
+    scenarios.push({
+      command: entry.name.slice(0, -EXTENSION.length),
       file: join(categoryDir, entry.name),
-      kind: kind === '.ts' ? 'ts' : 'sh',
     })
-    byStem.set(command, found)
   }
+  scenarios.sort((a, b) => a.command.localeCompare(b.command))
 
-  const scenarios: ScenarioFile[] = []
-  const ambiguous: string[] = []
-  for (const [command, found] of [...byStem].sort(([a], [b]) =>
-    a.localeCompare(b),
-  )) {
-    if (found.length > 1) ambiguous.push(command)
-    else if (found[0] !== undefined) scenarios.push(found[0])
-  }
-
-  return { scenarios, ambiguous }
+  return { scenarios }
 }
 
 /** Every category folder under `sandbox/`, fixtures excluded. */
@@ -129,21 +111,18 @@ export function listCategories(sandboxDir: string): string[] {
 
 export type ResolvedScenario =
   | ({ readonly ok: true } & ScenarioFile)
-  | { readonly ok: false; readonly reason: 'missing' | 'ambiguous' }
+  | { readonly ok: false; readonly reason: 'missing' }
 
 export function resolveScenarioFile(
   sandboxDir: string,
   category: string,
   command: string,
 ): ResolvedScenario {
-  const found = EXTENSIONS.map((ext) =>
-    join(sandboxDir, category, `${command}${ext}`),
-  ).filter((path) => existsSync(path) && statSync(path).isFile())
-  if (found.length > 1) return { ok: false, reason: 'ambiguous' }
-  const file = found[0]
-  if (file === undefined) return { ok: false, reason: 'missing' }
-
-  return { ok: true, command, file, kind: file.endsWith('.ts') ? 'ts' : 'sh' }
+  const file = join(sandboxDir, category, `${command}${EXTENSION}`)
+  if (!existsSync(file) || !statSync(file).isFile())
+    return { ok: false, reason: 'missing' }
+
+  return { ok: true, command, file }
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -190,7 +169,7 @@ export function armNames(definition: ScenarioDefinition): string[] {
   return names.length === 1 && names[0] === DEFAULT_ARM_NAME ? [] : names
 }
 
-/** Twin of `scripts/config.sh`, which derives the organization from the toolkit's own remote. */
+/** Derives the organization from the toolkit's own remote unless `GITHUB_ORG` names one. */
 function deriveGithubOrg(root: string, env: NodeJS.ProcessEnv): string {
   if ((env.GITHUB_ORG ?? '') !== '') return env.GITHUB_ORG ?? ''
 
@@ -209,8 +188,8 @@ function deriveGithubOrg(root: string, env: NodeJS.ProcessEnv): string {
 }
 
 /**
- * What the bash probe reported for a scenario: its config, the organization
- * `config.sh` derives, and the anchor's repository name. These land in the one
+ * What provisioning reads off a scenario: its config, the derived organization,
+ * and the anchor's repository name. These land in the one
  * environment provisioning passes to every child, the seed and gov installs
  * included.
  */
@@ -447,8 +426,7 @@ export function createStageContext(options: ContextOptions): StageContext {
 
   /**
    * `gh` answers an absent repository and an unreachable host with one status,
-   * so the 404 alone separates them. Creating is the opt-in, for the reason
-   * `ensure_sandbox_anchor_repo` in `scripts/lib/sandbox-git.sh` records.
+   * so the 404 alone separates them. Creating is the opt-in.
    */
   const ensureAnchorRepo = (org: string, repo: string): void => {
     const probe = spawn(
@@ -503,7 +481,7 @@ export function createStageContext(options: ContextOptions): StageContext {
     git('remote', 'add', 'origin', `https://github.com/${org}/${repo}.git`)
   }
 
-  /** Twin of `stage_fixtures` in `scripts/lib/sandbox-fixtures.sh`. */
+  /** Copies a fixture folder into the tree. */
   const fixtures = (
     category: string,
     command: string,
@@ -602,7 +580,7 @@ export function createStageContext(options: ContextOptions): StageContext {
 }
 
 /**
- * Picks the arm the way `select_or_route_scenario` did: a routed name first,
+ * Picks the arm: a routed name first,
  * echoed on the frame, then the first arm for a headless caller, then a prompt.
  */
 async function routeArm(

package/src/sandbox/tree.ts

@@ -8,11 +8,9 @@ import { join } from 'node:path'
  * in `CANON_SANDBOX_RUN_ID` for the rest of this process, so a script that
  * spawns a child inheriting `process.env` — `canon sandbox run` calling
  * `canon sandbox` to provision and then `canon sandbox check` — resolves the same tree in every one
- * of them, as do the hook and installer children provisioning spawns. A process
+ * of them, as do the installer children provisioning spawns. A process
  * that already carries the variable, inherited from such a parent, reuses it
  * rather than minting a new one.
- *
- * Twin of `mint_sandbox_run_id` in `scripts/lib/sandbox-path.sh`.
  */
 export function mintSandboxRunId(): string {
   const existing = process.env.CANON_SANDBOX_RUN_ID
@@ -28,9 +26,7 @@ export function mintSandboxRunId(): string {
  * per-run default is unit-testable on its own rather than only through the
  * command's registration.
  *
- * Twin of `resolve_sandbox_dir` in `scripts/lib/sandbox-path.sh`. The exec
- * boundary rules out a shared constant, so a change to the default lands on
- * both sides. The fall-through used to be one path per machine, so two
+ * The fall-through used to be one path per machine, so two
  * sessions each resolving the default at once provisioned over each other
  * with neither told; `mintSandboxRunId` gives the path a per-run component
  * instead, which is what makes two such sessions land on two different trees.

package/src/standards/read.ts

@@ -60,8 +60,21 @@ export function standardRoots(root: string): StandardRoot[] {
  */
 const MOVED_STANDARDS: Readonly<Record<string, string>> = {
   board: 'claude/skills/task-board/references/board.md',
+  context: 'claude/skills/context-fold/references/context.md',
+  design: 'claude/skills/canvas-board/references/design.md',
+  docs: 'claude/skills/docs-sync/references/docs.md',
+  figures: 'claude/skills/draft-figure/references/figures.md',
+  readme: 'claude/skills/docs-sync/references/readme.md',
+  rule: 'claude/skills/create-rule/references/rule.md',
+  skill: 'claude/skills/create-skill/references/skill.md',
+  branch: 'claude/skills/git-branch/references/branch.md',
+  commit: 'claude/skills/git-commit/references/commit.md',
+  pr: 'claude/skills/git-pr/references/pr.md',
+  publish: 'claude/skills/git-pr/references/publish.md',
+  slug: 'claude/skills/git-branch/references/slug.md',
+  versioning: 'claude/skills/git-commit/references/versioning.md',
   markdown: 'claude/skills/markdown-craft/references/markdown.md',
-  canvas: 'claude/skills/canvas/references/canvas.md',
+  canvas: 'claude/skills/canvas-board/references/canvas.md',
   glossary: 'claude/skills/teach-workspace/references/glossary.md',
   groundwork: 'claude/skills/plan-groundwork/references/groundwork.md',
   'groundwork-spikes':

package/src/sync/git.ts

@@ -96,7 +96,7 @@ export function pullRequestBody(changes: readonly DomainChange[]): string {
     '',
     `Sync ${domains} from toolkit.`,
     '',
-    '## Key Changes',
+    '## Key changes',
     '',
   ]
 

package/src/tasks/archive.ts

@@ -578,7 +578,7 @@ function isBulletFor(line: string, target: string): boolean {
 
 /**
  * Resolves the `Plan:` target against the board and against the project root
- * both, which is how `context-fold` reads the same line. It accepts `../plans/x.md`
+ * both, which is how `task-complete` reads the same line. It accepts `../plans/x.md`
  * and `.canon/plans/x.md` as one file, so a gate reading only the first form
  * would pass the second and strand the plan this exists to protect.
  *
@@ -633,7 +633,7 @@ function atOneRoot(path: string, plans: string[], root: string): string {
 /**
  * Names the other live tasks whose `Plan:` line lands on the same file through
  * any of its links. This is
- * the rule `context-fold` applies before it archives a plan, held here so one
+ * the rule the `post-merge` hook applies before it archives a plan, held here so one
  * question has one implementation: a plan another live task still cites is a
  * plan the sweep is correct to leave, and a guard that read the folder instead
  * refused every task sharing one plan and deadlocked the board against the
@@ -697,7 +697,7 @@ export type CitationOutcome = PlanCitations | ArchiveRefused
 
 /**
  * Answers where one task's plan sits and who else holds it, which is the whole
- * of the last-live-citation rule. `context-fold` reads this rather than scanning
+ * of the last-live-citation rule. The archive reads this rather than scanning
  * the board itself, so the sweep that moves a plan and the gate that refuses a
  * task archive cannot drift into disagreeing about which plan is free.
  *
@@ -897,7 +897,7 @@ async function resolveStem(
 
 /**
  * Archives one task as a single unit: the move, the ordering-row removal, and
- * the index regen. The hook and `task-board` both call this, so every gate
+ * the index regen. The hook and `task-complete` both call this, so every gate
  * refuses rather than reports. A caller with nobody watching cannot act on a
  * warning, and two callers gating differently is the drift this exists to stop.
  */
@@ -918,7 +918,7 @@ export async function archiveTask(
   const from = join(dir, `${stem}.md`)
   const text = await readFile(from, 'utf8')
 
-  // `context-fold` ticks outcomes at ship time, before the merge, so an earlier
+  // `task-complete` ticks outcomes at ship time, before the merge, so an earlier
   // slice merging after the last slice shipped would find every box ticked
   // while the last slice is still open. Only the last number closes the task.
   const last = readPullRequest(text).at(-1)

package/src/tasks/branch.ts

@@ -14,10 +14,10 @@ const MARKDOWN = '.md'
  */
 export const PLAN_BRANCH_TYPE = 'feat'
 
-/** The description cap in `standards/branch.md`, in kebab-separated words. */
+/** The description cap in `claude/skills/git-branch/references/branch.md`, in kebab-separated words. */
 export const DESCRIPTION_WORD_CAP = 4
 
-/** The branch length cap in `standards/branch.md`, in characters. */
+/** The branch length cap in `claude/skills/git-branch/references/branch.md`, in characters. */
 export const BRANCH_LENGTH_CAP = 50
 
 export interface PlanBranch {
@@ -48,7 +48,7 @@ function slugOf(path: string): string {
  * of them name. It is the one derivation, so the collision check and the
  * worktree entry it gates cannot hold two answers for one plan.
  *
- * Conformance covers both caps `standards/branch.md` states, being the word
+ * Conformance covers both caps `claude/skills/git-branch/references/branch.md` states, being the word
  * count of the description and the length of the whole branch. A slug is a
  * plan's own filename rather than a name anyone chose for a branch, so a plan
  * can name a branch this refuses to grade as conforming, and reporting that is

package/src/tasks/label.ts

@@ -185,7 +185,7 @@ async function reserveLabel(root: string, label: string): Promise<boolean> {
  * the task file after this returns, so a reservation with no file behind it is
  * the ordinary state for a few seconds, and a scan blind to it would offer the
  * same label to every retry. Reservations are never expired: a claim that died
- * leaves a gap, and `standards/versioning.md` permits gaps.
+ * leaves a gap, and `claude/skills/git-commit/references/versioning.md` permits gaps.
  */
 export async function claimLabel(
   root: string,

package/src/tasks/record.ts

@@ -420,7 +420,7 @@ async function openTask(
  * resolve the board root in-process.
  *
  * `branches` names the recording branch and every name it carried before a
- * rename, since `git-ship` renames a branch after `context-fold` has already
+ * rename, since `git-ship` renames a branch after `task-complete` has already
  * written the marker under the old name. Each comes off the `Pending branch:`
  * line even when the number was already listed, so a rerun repairs a stale
  * marker.
@@ -504,7 +504,7 @@ export async function recordPlan(
 }
 
 /**
- * Marks the named outcomes `[x]` in place. `context-fold` runs this against a
+ * Marks the named outcomes `[x]` in place. `task-complete` runs this against a
  * board it can read and cannot edit from a linked worktree, and the positions
  * come from the read it already made.
  *

package/src/tasks/validate.ts

@@ -597,7 +597,7 @@ async function listTaskStems(dir: string): Promise<string[]> {
 
 /**
  * Resolves a pointer against the board and against the project root both, the
- * way `context-fold` reads the same line. A fragment is dropped first, since an
+ * way `task-complete` reads the same line. A fragment is dropped first, since an
  * anchor is part of the link and never part of the path.
  */
 function resolves(target: string, dir: string, root: string): boolean {

package/standards/index.md

@@ -7,17 +7,4 @@ subtitle: Reference docs for consistent authoring across the toolkit and target
 
 Reference docs for consistent authoring across the toolkit and target projects.
 
-- [Branch reference](branch.md): Branch naming format and type conventions
-- [Commit reference](commit.md): Commit message format and type conventions
-- [Context entry reference](context.md): Shape and content rules for canon/context/<domain>.md entries
-- [Design reference](design.md): Shape and content rules for canon/DESIGN.md
-- [Docs reference](docs.md): Reader and jurisdiction, frontmatter, page structure, what a page links out to, the diagram permission, and when a category earns a subfolder
-- [Figure reference](figures.md): When a figure earns its place, the render-first policy for a graph-shaped subject, freehand SVG as the escape hatch, and its wrapping, color, and accessibility rules
-- [Pull request reference](pr.md): Pull request title and body conventions
-- [Publish reference](publish.md): Scan an author runs against finished text, the cross-reference form each destination takes, and the response to an unreadable source
-- [Readme reference](readme.md): Readme voice, structure, and content conventions
-- [Governance rule reference](rule.md): Rule frontmatter, body shape, and voice for .claude/rules files
-- [Claude skill reference](skill.md): Skill structure and authoring rules for Claude Code
-- [Slug reference](slug.md): Transform from a git branch name to a slug, and the three responses to an empty result
 - [Standard reference](standard.md): Shape and content rules for authoring a standard
-- [Versioning reference](versioning.md): Phase label vs semver discipline across tasks, PRs, reviews, issues, commits, and tags

package/standards/standard.md

@@ -1,10 +1,6 @@
 ---
 title: Standard reference
 description: Shape and content rules for authoring a standard
-paths:
-  - 'standards/**/*.md'
-rule:
-  - 'Read it before writing or editing a standard. Do not work the shape from memory.'
 ---
 
 # Standard reference
@@ -68,9 +64,7 @@ A standard failing these questions is non-conforming even when it satisfies ever
 
 - Start the file with a frontmatter block carrying at least `title` and `description`. A consuming surface may require more.
 - `title`: names the doc type in sentence case, suffixed `reference` (`Commit reference`, `Branch reference`)
-- `description`: one line naming what the standard covers. It becomes the index link label on install, and the generated rule's description and pointer bullet.
-- `paths` (optional): the globs where the standard applies, one per entry, copied verbatim into the rule `canon gov regen` generates for it. Omit it when no path should route to the standard, and no rule is generated.
-- `rule` (optional): operative bullets the generated rule carries after its pointer bullet, one per entry, each a full sentence. Quote an entry holding a backtick, a colon, or a leading `-`.
+- `description`: one line naming what the standard covers. It becomes the index link label on install.
 
 ## Structure
 

package/tooling/base/reference.md

@@ -29,7 +29,7 @@ Seeds live in `tooling/base/seeds/`. Sync drops each once on first install and n
 - `.lintstagedrc`: the glob map below.
 - `.prettierignore`: created empty. Projects add their own entries.
 - `.github/workflows/verify.yml`: runs on pull requests targeting `main` and on `workflow_dispatch`. A project with more than one language root adds its own jobs here.
-- `.github/pull_request_template.md`: `## Summary`, `## Key Changes`, `## Technical Context`, `## Testing`. A project adds the checklist lines its own review needs.
+- `.github/pull_request_template.md`: `## Summary`, `## Key changes`, `## Technical context`, `## Testing`. A project adds the checklist lines its own review needs.
 - `canon/context/`: extend the `ci` and `development` entries with project-specific commands, workflows, or deploy steps. Canonical rationale stays in this reference.
 
 ## Tool pairing

package/tooling/base/seeds/.github/pull_request_template.md

@@ -2,12 +2,12 @@
 
 <Action Verb> <Direct Object> to <Result>.
 
-## Key Changes
+## Key changes
 
 - <Verb> <specific component/file/function> (<reason if non-obvious>)
 - <Verb> <specific component/file/function>
 
-<!-- ## Technical Context (optional, omit for docs/config/trivial changes) -->
+<!-- ## Technical context (optional, omit for docs/config/trivial changes) -->
 <!-- - <Why this approach was taken, not what changed> -->
 
 ## Testing

package/tooling/claude/reference.md

@@ -21,7 +21,7 @@ canon/
 
 .canon/
 ├── tasks/             ← seeded. One file per task plus a generated index.md, local scratch only. `archive/` holds the tasks that shipped.
-├── plans/             ← execution detail for multi-step tasks. `feature-*.md` entries swept by context-fold into `archive/`.
+├── plans/             ← execution detail for multi-step tasks. `feature-*.md` entries moved into `archive/` by `canon tasks archive` when the `post-merge` hook archives their task.
 ├── review/            ← one subfolder per producer. `branch/` no longer written, `design/` for canon design render.
 └── tmp/               ← ephemeral scratch space, safe to delete without loss
 ```

package/tooling/claude/seeds/.claude/hooks/pr-create-log.sh

@@ -24,8 +24,9 @@ IFS= read -r -d '' -t 2 input
 # its edit path prints a URL as well and is not an opening.
 command=$(printf '%s' "$input" | jq -r '.tool_input.command // empty')
 stdout=$(printf '%s' "$input" | jq -r '.tool_response.stdout // empty')
+is_hand_opened=false
 case "$command" in
-*"gh pr create"*) ;;
+*"gh pr create"*) is_hand_opened=true ;;
 *)
   printf '%s\n' "$stdout" | grep -qx 'opened=true' || exit 0
   ;;
@@ -57,4 +58,11 @@ session=$(printf '%s' "$input" | jq -r '.session_id // "unknown"')
 printf -- '- %s session=%s pr=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$session" "$url" >>"$log_dir/log.md"
 
 msg="Pull request $url just opened. If this session holds a worker's channel obligation, announce it to the controller now, per role-worker."
+# A pull request opened by hand skipped git-pr, so nothing has labelled it.
+# The verb is named only where the installed canon carries it, since a skill
+# can reach a target ahead of the release that ships the verb.
+if [ "$is_hand_opened" = true ] && canon labels apply --help >/dev/null 2>&1; then
+  msg="$msg Run canon labels apply ${url##*/} to label it."
+fi
+
 jq -nc --arg msg "$msg" '{hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:$msg}}'

package/tooling/claude/seeds/.claude/hooks/review-post-scan.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+
+# Claude Code sends a payload and closes stdin. A bare read with nothing feeding
+# it blocks forever and holds the session open, so the read is bounded. `read`
+# rather than `timeout cat`, which macOS does not ship.
+IFS= read -r -d '' -t 2 input
+[ -n "$input" ] || {
+  printf '%s reads a Claude Code hook payload on stdin and cannot be run by hand.\n' "${0##*/}" >&2
+  exit 1
+}
+
+# Every Bash call reaches this line, so the command is read in one jq pass and
+# matched with a shell pattern before anything else costs a process.
+fields=$(printf '%s' "$input" | jq -r 'if .tool_name == "Bash" then [(.cwd // ""), (.tool_input.command // "")] | @json else empty end')
+[ -n "$fields" ] || exit 0
+
+cmd=$(printf '%s' "$fields" | jq -r '.[1]')
+case "$cmd" in
+*'gh api'*) ;;
+*) exit 0 ;;
+esac
+
+# A command that only mentions a post is not one: a heredoc writing a review
+# body that quotes the command, or a search whose pattern holds it. The string
+# is cut into the commands it runs, with heredoc bodies dropped and quoted text
+# left whole, and only a command that starts with `gh api` is read further.
+# Splitting on the separators outside quotes is what keeps `echo 'a; gh api'`
+# one command rather than two.
+IFS= read -r -d '' splitter <<'AWK'
+{ s = s (NR > 1 ? "\n" : "") $0 }
+function emit() {
+  gsub(/\n/, " ", seg)
+  sub(/^[ \t]+/, "", seg)
+  if (seg != "") print seg
+  seg = ""
+}
+END {
+  n = length(s); q = ""; seg = ""; nt = 0; i = 1
+  while (i <= n) {
+    c = substr(s, i, 1)
+    if (q == "'") { seg = seg c; if (c == "'") q = ""; i++; continue }
+    if (q == "\"") {
+      if (c == "\\") { seg = seg c substr(s, i + 1, 1); i += 2; continue }
+      if (c == "\"") q = ""
+      seg = seg c; i++; continue
+    }
+    if (c == "\\") { seg = seg c substr(s, i + 1, 1); i += 2; continue }
+    if (c == "'" || c == "\"") { q = c; seg = seg c; i++; continue }
+    if (c == "#" && (seg == "" || substr(seg, length(seg), 1) ~ /[ \t]/)) {
+      while (i <= n && substr(s, i, 1) != "\n") i++
+      continue
+    }
+    if (c == "<" && substr(s, i, 2) == "<<" && substr(s, i, 3) != "<<<") {
+      j = i + 2; dash = 0
+      if (substr(s, j, 1) == "-") { dash = 1; j++ }
+      while (substr(s, j, 1) ~ /[ \t]/) j++
+      oq = substr(s, j, 1)
+      if (oq == "'" || oq == "\"") j++
+      tag = ""
+      while (substr(s, j, 1) ~ /[A-Za-z0-9_]/) { tag = tag substr(s, j, 1); j++ }
+      if (oq == "'" || oq == "\"") j++
+      if (tag != "") { nt++; tags[nt] = tag; dashes[nt] = dash; i = j; continue }
+    }
+    if (c == "\n") {
+      emit(); i++
+      for (t = 1; t <= nt; t++) {
+        while (i <= n) {
+          e = index(substr(s, i), "\n")
+          if (e == 0) { line = substr(s, i); i = n + 1 } else { line = substr(s, i, e - 1); i += e }
+          if (dashes[t]) sub(/^\t+/, "", line)
+          if (line == tags[t]) break
+        }
+      }
+      nt = 0; continue
+    }
+    if (c == ";" || c == "|" || c == "(" || c == ")" || c == "`" || c == "&") {
+      if (c == "&" && (substr(seg, length(seg), 1) ~ /[<>]/ || substr(s, i + 1, 1) == ">")) { seg = seg c; i++; continue }
+      emit(); i++; continue
+    }
+    seg = seg c; i++
+  }
+  emit()
+}
+AWK
+
+# A block reaches the session through stderr, and stdout stays empty so nothing
+# unframed lands in the hook protocol.
+deny() {
+  printf '%s\n' "$1" >&2
+  exit 2
+}
+
+# The thread a review or a comment lands on: a review post or edit, and an issue
+# or pull request comment post or edit. A pull request's inline comments are left
+# out, since no shipped skill posts one.
+seg="[^/[:space:]'\"]+"
+end="(['\" ?]|\$)"
+endpoint="(pulls/$seg/reviews(/$seg)?|issues/$seg/comments|issues/comments/$seg)$end"
+starts_gh_api="^([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*((command|exec)[[:space:]]+)?gh[[:space:]]+api([[:space:]]|\$)"
+body_inline="[[:space:]](-f|-F|--field|--raw-field)[[:space:]=]*['\"]?body="
+body_file="[[:space:]](-F|--field)[[:space:]=]*['\"]?body=@([^'\"[:space:]]+)"
+
+# Reads one command already known to start with `gh api` and returns when it
+# has nothing to scan or the scan came back clean.
+check() {
+  local call=$1 method='' file='' cwd out code warnings
+
+  [[ $call =~ $endpoint ]] || return 0
+
+  # gh sends POST when a field flag is present and no method is named, and the
+  # explicit method wins when one is. A call naming neither is a read.
+  if [[ $call =~ (-X|--method)[[:space:]=]*([A-Za-z]+) ]]; then
+    method=$(printf '%s' "${BASH_REMATCH[2]}" | tr '[:lower:]' '[:upper:]')
+  elif [[ $call =~ [[:space:]](-f|-F|--field|--raw-field|--input)([[:space:]=]|$) ]]; then
+    method=POST
+  fi
+  case "$method" in
+  POST | PATCH | PUT) ;;
+  *) return 0 ;;
+  esac
+
+  if [[ $call =~ $body_file ]]; then
+    file=${BASH_REMATCH[2]}
+  elif [[ $call =~ $body_inline ]]; then
+    deny 'This review or comment post passes its body inline, so the label scan cannot read it. Write the body to a file in an earlier call and pass it as -F body=@<file>.'
+  else
+    return 0
+  fi
+
+  [ "$file" != '-' ] || deny 'This post reads its body from stdin, so the label scan cannot read it. Write the body to a file in an earlier call and pass it as -F body=@<file>.'
+
+  if ! command -v canon >/dev/null 2>&1; then
+    jq -nc '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:"The label scan did not run on this review or comment post, since canon is not on PATH. Run canon labels scan --body-file on the body once it is."}}'
+    exit 0
+  fi
+
+  # The payload's own cwd is the directory a relative path was written against.
+  # The project dir and this process's directory can each be a different worktree.
+  cwd=$(printf '%s' "$fields" | jq -r '.[0]')
+  [ -n "$cwd" ] || cwd=${CLAUDE_PROJECT_DIR:-.}
+  case "$file" in
+  /*) ;;
+  *) file="$cwd/$file" ;;
+  esac
+
+  # A body written by the same call does not exist when this hook runs, so the
+  # post would go out unread by the scan. Blocking is the only verdict that holds.
+  [ -f "$file" ] || deny "The body file $file does not exist yet, so the label scan cannot read it. Write the body in an earlier call, then post it."
+
+  # No --title: a review body carries none, and a title would grade it as an
+  # ordinary pull request body.
+  out=$(cd "$cwd" && canon labels scan --body-file "$file" 2>&1)
+  code=$?
+  [ "$code" -ne 0 ] || return 0
+
+  warnings=$(printf '%s\n' "$out" | grep -F '!')
+  [ -n "$warnings" ] || warnings=$out
+  if [ "$code" -eq 2 ]; then
+    deny "The label scan found text this post would publish. Fix the body file and post again.
+$warnings"
+  fi
+  deny "The label scan could not grade $file (exit $code). Fix what it reports and post again.
+$warnings"
+}
+
+commands=$(printf '%s' "$cmd" | awk "$splitter")
+while IFS= read -r line; do
+  [[ $line =~ $starts_gh_api ]] || continue
+  check "$line"
+done <<<"$commands"
+exit 0

package/tooling/claude/seeds/.claude/settings.json

@@ -27,6 +27,15 @@
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/scratch-guard.sh"
           }
         ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/review-post-scan.sh"
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/governance/rules/standards/context.md

@@ -1,14 +0,0 @@
----
-# Generated by `canon gov regen` from standards/context.md. Edit that frontmatter, not this file.
-description: Shape and content rules for canon/context/<domain>.md entries
-paths:
-  - 'canon/context/**'
----
-
-# Context entry standards
-
-## Authority
-
-- Follow the context standard for shape and content rules for canon/context/<domain>.md entries. It is the single source. Read it with `canon standards context`.
-- Before non-trivial work in a domain, read its `canon/context/<domain>.md` entry. Use `canon/context/index.md` to find it.
-- Leave the entry conforming when work in its domain changes what it describes.

package/governance/rules/standards/design.md

@@ -1,12 +0,0 @@
----
-# Generated by `canon gov regen` from standards/design.md. Edit that frontmatter, not this file.
-description: Shape and content rules for canon/DESIGN.md
-paths:
-  - 'canon/DESIGN.md'
----
-
-# Design standards
-
-## Authority
-
-- Follow the design standard for shape and content rules for canon/DESIGN.md. It is the single source. Read it with `canon standards design`.