@erclx/canon 5.32.0 → 5.34.0

package/governance/detect.toml

@@ -0,0 +1,201 @@
+# Evidence that marks a project as wanting an opt-in rule. Each table is keyed by
+# a rule basename, the same key `renames.toml` and the stacks use, so a rename
+# sweep reaches this file too. `canon gov detect` reads it and proposes every
+# rule whose evidence a target holds, and `target-setup` puts those proposals to
+# the operator before anything installs.
+#
+# `deps` are package names read from `package.json` (`dependencies` and
+# `devDependencies`), `pyproject.toml`, `go.mod`, and `composer.json`, at the
+# root and in every folder to depth two. `files` are globs matched against the
+# target's git-listed paths to depth two, and against each folder on those
+# paths, so `.github/workflows` matches a folder holding a workflow. A glob with
+# no wildcard is also tested on disk, which reaches a gitignored path such as
+# `.canon/canvas`.
+#
+# Every rule no stack reaches needs a table here, which the `unreferenced-rules`
+# gate stage checks, along with every key naming a live rule. A table for a rule
+# a stack already reaches is harmless, since the verb leaves out every rule the
+# caller's stack resolves.
+
+["skill"]
+deps = []
+files = [".claude/skills", "claude/skills"]
+
+["700-ci-workflow"]
+deps = []
+files = [".github/workflows"]
+
+["765-spelling"]
+deps = ["cspell"]
+files = [".cspell", "cspell.json", ".cspell.json", "cspell.config.*"]
+
+["775-dependencies"]
+deps = []
+files = ["**/package.json", "**/pyproject.toml", "**/go.mod", "**/composer.json"]
+
+["780-config-comments"]
+deps = []
+files = [".editorconfig", "**/Dockerfile*", "**/*.config.*", "**/.env.example"]
+
+["790-code-comments"]
+deps = []
+files = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "**/*.sh", "**/*.py"]
+
+["130-go"]
+deps = []
+files = ["**/go.mod"]
+
+["140-php"]
+deps = []
+files = ["**/composer.json"]
+
+["200-react"]
+deps = ["react"]
+files = []
+
+["210-astro"]
+deps = ["astro"]
+files = ["**/astro.config.*"]
+
+["220-fastapi"]
+deps = ["fastapi"]
+files = []
+
+["230-nextjs"]
+deps = ["next"]
+files = ["**/next.config.*"]
+
+["250-tailwind"]
+deps = ["tailwindcss", "@tailwindcss/vite", "@tailwindcss/postcss"]
+files = ["**/tailwind.config.*"]
+
+["260-shadcn"]
+deps = []
+files = ["**/components.json"]
+
+["305-e2e-reliability"]
+deps = ["@playwright/test", "playwright", "cypress"]
+files = ["**/e2e"]
+
+["306-test-scope"]
+deps = ["@playwright/test", "playwright", "cypress"]
+files = ["**/e2e"]
+
+["310-zod"]
+deps = ["zod"]
+files = []
+
+["320-tanstack-query"]
+deps = [
+  "@tanstack/react-query",
+  "@tanstack/vue-query",
+  "@tanstack/solid-query",
+  "@tanstack/svelte-query",
+  "@tanstack/query-core",
+]
+files = []
+
+["335-testing-go"]
+deps = []
+files = ["**/go.mod"]
+
+["336-testing-php"]
+deps = ["phpunit/phpunit", "pestphp/pest"]
+files = ["**/phpunit.xml", "**/phpunit.xml.dist"]
+
+["340-pydantic"]
+deps = ["pydantic"]
+files = []
+
+["350-security-web"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["360-security-server"]
+deps = [
+  "express",
+  "fastify",
+  "hono",
+  "koa",
+  "elysia",
+  "@nestjs/core",
+  "fastapi",
+  "django",
+  "flask",
+  "starlette",
+  "laravel/framework",
+  "symfony/http-kernel",
+  "slim/slim",
+  "github.com/gin-gonic/gin",
+  "github.com/labstack/echo/v4",
+  "github.com/go-chi/chi/v5",
+  "github.com/gofiber/fiber/v2",
+]
+files = []
+
+["370-database"]
+deps = [
+  "prisma",
+  "@prisma/client",
+  "drizzle-orm",
+  "typeorm",
+  "sequelize",
+  "knex",
+  "kysely",
+  "mongoose",
+  "pg",
+  "mysql2",
+  "better-sqlite3",
+  "sqlalchemy",
+  "alembic",
+  "psycopg",
+  "psycopg2",
+  "psycopg2-binary",
+  "asyncpg",
+  "django",
+  "doctrine/orm",
+  "illuminate/database",
+  "gorm.io/gorm",
+  "github.com/jackc/pgx/v5",
+]
+files = ["**/migrations", "**/schema.prisma", "**/*.sql"]
+
+["400-ui"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["410-a11y"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["420-forms"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["430-ux-completeness"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["440-surface-capture"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["450-link-behavior"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["460-design-taste"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["canon/DESIGN.md", "index.html", "*/index.html"]
+
+["465-interface-casing"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["470-motion"]
+deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
+files = ["index.html", "*/index.html"]
+
+["480-canvas"]
+deps = []
+files = [".canon/canvas"]

package/governance/renames.toml

@@ -13,10 +13,6 @@
 # resolves A only while both links stay. A key must name no live rule and every
 # chain must end on one, which `src/gov/renames.test.ts` checks against this
 # file.
-#
-# A numbered rule replaced by the rule `canon gov regen` generates from its
-# standard is a rename too: the generated rule keeps every glob and bullet, so
-# the pair is one-to-one identity under the standard's name.
 [renamed]
 "015-output" = "566-output"
 "035-tasks" = "602-tasks"
@@ -25,22 +21,15 @@
 "087-git" = "606-git"
 "510-context" = "610-context"
 "511-indexes" = "611-indexes"
-"550-design" = "650-design"
 "555-tasks" = "655-tasks"
 "558-plan" = "658-plan"
 "501-markdown" = "801-markdown"
-"580-readme" = "880-readme"
-"591-standard-authoring" = "891-standard-authoring"
 "065-spelling" = "765-spelling"
 "075-dependencies" = "775-dependencies"
 "080-config-comments" = "780-config-comments"
 "090-code-comments" = "790-code-comments"
 "658-plan" = "plan"
 "610-context" = "context"
-"650-design" = "design"
 "655-tasks" = "tasks"
 "570-skill" = "skill"
-"590-rule-authoring" = "rule"
 "801-markdown" = "markdown"
-"880-readme" = "readme"
-"891-standard-authoring" = "standard"

package/governance/rules/canon/context.md

@@ -0,0 +1,13 @@
+---
+description: Route edits under canon/context/ to the context-fold skill for the entry shape, and keep each entry conforming to the work in its domain
+paths:
+  - 'canon/context/**'
+---
+
+# Context standards
+
+## Context entries
+
+- Load the `canon:context-fold` skill before a hand edit under `canon/context/`. It carries the entry shape and the content rules for a domain entry. Report it rather than proceeding silently when the skill does not resolve.
+- Before non-trivial work in a domain, read its `canon/context/<domain>/` entry. Use `canon/context/index.md` to find it.
+- Leave the entry conforming when work in its domain changes what it describes.

package/governance/rules/claude/skill.md

@@ -0,0 +1,17 @@
+---
+description: Route edits to a skill body or its requirement to the create-skill skill for the shape, and hold the creation-time questions and the re-read rule
+paths:
+  - '.claude/skills/**/SKILL.md'
+  - 'claude/skills/**/SKILL.md'
+  - '.claude/skills/**/REQUIREMENT.md'
+  - 'claude/skills/**/REQUIREMENT.md'
+---
+
+# Skill standards
+
+## Skill files
+
+- Load the `canon:create-skill` skill before a hand edit to a `SKILL.md` or a `REQUIREMENT.md`. It carries the skill structure, the requirement shape, and the path rules for a skill body. Report it rather than proceeding silently when the skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
+- Confirm `canon:create-skill`'s two creation-time questions are answered before a new `SKILL.md` lands, whether drafted by hand, by another skill, or by `canon:create-skill` itself. Carry the third question into the sibling `REQUIREMENT.md`'s `Must not` section as a review criterion rather than a gate.
+- Re-read a skill body this session edited before invoking that skill again in the same session.
+- Do not read a resolved file path in a held body as evidence the body is current.

package/governance/rules/code/000-code.md

@@ -1,5 +1,5 @@
 ---
-description: Code placement, shape, dependency, error, and naming choices a model does not make by default
+description: Routes code placement and shape decisions to the skills that carry them
 ---
 
 # Code standards
@@ -7,19 +7,7 @@ description: Code placement, shape, dependency, error, and naming choices a mode
 ## Placement
 
 - Load the `canon:codebase-layout` skill before placing a new file, and report it rather than proceeding silently when it does not resolve.
-- Prioritize native platform capabilities over third-party libraries.
-- Ensure data and configuration reside in designated Single Source of Truth locations.
 
 ## Shape
 
 - Load the `canon:code-craft` skill before deciding the shape of a new function, class, or module, and report it rather than proceeding silently when it does not resolve.
-
-## Errors
-
-- Return structured error types for recoverable failures.
-- Never expose internal implementation details in error messages.
-
-## Naming
-
-- Prefix booleans with `is`, `has`, `should`, or `can`: `isLoading`, `hasAccess`.
-- Prefix event handlers with `handle`: `handleClick`, `handleSubmit`.

package/governance/rules/code/010-testing.md

@@ -1,37 +1,9 @@
 ---
-description: Enforce universal testing standards and best practices
+description: Routes a test edit to the skill that carries the testing floors
 ---
 
 # Testing standards
 
 ## Before writing a test
 
-- Load the `canon:test-craft` skill before choosing the layer for a new test, and report it rather than proceeding silently when the skill does not resolve.
-
-## Test structure
-
-- Structure tests using the Arrange, Act, Assert (AAA) pattern.
-- Each test should verify a single behavior.
-- Do not use conditional logic or loops within test bodies.
-
-## Test focus
-
-- Do not test private functions or internal state directly.
-- Do not target arbitrary coverage percentages.
-
-## Organization and isolation
-
-- Group related tests using the framework's nesting mechanism.
-- Keep nesting shallow (max 2 levels).
-- Ensure tests are independent with no shared side effects.
-- Clean up side effects and restore state after each test.
-
-## Test data and async
-
-- Use factory functions or builders for test data over inline object literals.
-- Always await async operations.
-- Do not fire-and-forget promises in tests.
-
-## Verification
-
-- Do not use snapshot testing for verification.
+- Load the `canon:test-craft` skill before writing or changing a test, and report it rather than proceeding silently when the skill does not resolve.

package/governance/rules/ui/400-ui.md

@@ -11,7 +11,7 @@ paths:
 
 ## Punctuation
 
-- Do not use em dashes (`—`). Use a comma or period, or restructure the sentence.
+- Do not use em dashes (`—`) or semicolons (`;`). Use a comma or period, or restructure the sentence.
 - Do not add punctuation to button labels or short action strings.
 
 ## Button copy

package/governance/rules/ui/480-canvas.md

@@ -0,0 +1,13 @@
+---
+description: Route edits to canvas frames under .canon/canvas/ to the canvas-board skill for the house style, and keep frame text and box height readable
+paths:
+  - '.canon/canvas/**'
+---
+
+# Canvas standards
+
+## Frames
+
+- Load the `canon:canvas-board` skill before drawing or editing a frame. It carries the house style for an explanation frame and the content format. Report it rather than proceeding silently when the skill does not resolve.
+- Write explanation frame text in sentence case. A mockup of the project's interface follows its design document instead.
+- Size each explanation frame's box to show all its content with no scrollbar.

package/governance/stacks/base.toml

@@ -5,7 +5,5 @@ extends = ""
 # session conduct and `.claude/` authoring rules, `tooling` the dev setup and
 # CI workflow rules, and `writing` the prose and document-shape rules. The
 # `code` group is left to the stacks that write code, so a docs or writing
-# project loads no rule it can never apply. `standards` holds one rule per
-# standard routing its paths to it, generated by `canon gov regen` from each
-# standard's frontmatter rather than authored.
-rules = ["canon", "claude", "standards", "tooling", "writing"]
+# project loads no rule it can never apply.
+rules = ["canon", "claude", "tooling", "writing"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.32.0",
+  "version": "5.34.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {
@@ -26,9 +26,9 @@
   },
   "scripts": {
     "check:spell": "cspell '**' '.*/**' '.*' --no-progress --color --show-context",
-    "format": "prettier --write --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --write --indent 2 scripts/ sandbox/ tooling/ claude/",
-    "check:format": "prettier --check --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --diff --indent 2 scripts/ sandbox/ tooling/ claude/",
-    "check:shell": "find scripts sandbox tooling claude .claude/hooks -name '*.sh' -exec shellcheck --severity=warning {} + && find .husky -maxdepth 1 -type f -exec shellcheck --severity=warning --shell=sh {} +",
+    "format": "prettier --write --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --write --indent 2 scripts/ tooling/ claude/",
+    "check:format": "prettier --check --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --diff --indent 2 scripts/ tooling/ claude/",
+    "check:shell": "find scripts tooling claude .claude/hooks -name '*.sh' -exec shellcheck --severity=warning {} + && find .husky -maxdepth 1 -type f -exec shellcheck --severity=warning --shell=sh {} +",
     "check:types": "tsc --noEmit",
     "check:install": "./scripts/core/install-check.sh",
     "test": "bun --bun vitest run",

package/scripts/core/install-check.sh

@@ -55,10 +55,10 @@ open_timeline "Install verification"
 # nothing, so the excluded tree has to exist here before its absence below can
 # mean the publish left it out.
 log_step "Assert excluded path exists in source"
-if [ ! -f "$PROJECT_ROOT/sandbox/run.sh" ]; then
-  log_error "sandbox/run.sh is missing from the source tree, so the absence check below would pass on nothing"
+if [ ! -f "$PROJECT_ROOT/sandbox/exempt.toml" ]; then
+  log_error "sandbox/exempt.toml is missing from the source tree, so the absence check below would pass on nothing"
 fi
-log_info "Present: sandbox/run.sh"
+log_info "Present: sandbox/exempt.toml"
 
 log_step "Pack"
 TARBALL_PATH="$(cd "$PROJECT_ROOT" && bun pm pack --quiet --ignore-scripts --destination "$PACK_DIR" | tail -n 1)"

package/scripts/core/regen-hero.ts

@@ -50,7 +50,6 @@ import { listSkills } from '../../src/claude/skills-list'
 import { countCommands } from '../../src/counts/catalogs'
 import { buildDesignCss } from '../../src/design/css'
 import { buildGovCatalog } from '../../src/gov/list'
-import { listStandardEntries } from '../../src/standards/list'
 import { buildStackSummaries } from '../../src/tooling/list'
 
 const root = new URL('../..', import.meta.url).pathname
@@ -87,11 +86,6 @@ function run(): void {
   const { values, frames } = buildFrameValues({
     skills: listSkills(root).map((entry) => entry.name),
     gov: buildGovCatalog(root),
-    // The toolkit root only: a project-local standard would put a row in the
-    // hero the toolkit does not ship.
-    standards: listStandardEntries(root).filter((entry) =>
-      entry.source.startsWith('standards/'),
-    ),
     toolingStacks: buildStackSummaries(root),
     commandCount: countCommands(root) ?? 0,
     tokenCss,

package/scripts/lib/ui.sh

@@ -6,12 +6,6 @@ if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
   exit 1
 fi
 
-# Resolved from this file's own location rather than `$PROJECT_ROOT`, because
-# `require_project_root` is what several scripts call before anything has
-# established a root.
-# shellcheck source=/dev/null
-source "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/sandbox-path.sh"
-
 # `NO_COLOR` follows the published convention, where any non-empty value turns
 # color off whatever the value says.
 supports_color() {
@@ -102,165 +96,3 @@ close_timeline() {
   set_palette 2
   echo -e "${GREY}└${NC}" >&2
 }
-
-guard_root() {
-  local target="$1"
-  local target_abs
-  target_abs=$(cd "$target" && pwd)
-  if [ "$target_abs" = "$PROJECT_ROOT" ]; then
-    log_error "Cannot run against toolkit root. Files here are the source of truth."
-  fi
-}
-
-require_project_root() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local sandbox in_sandbox=0
-  if [ -n "${CANON_SANDBOX_DIR:-}" ]; then
-    sandbox="$CANON_SANDBOX_DIR"
-    [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* ]] && in_sandbox=1
-  else
-    sandbox="$(sandbox_dir_prefix)"
-    [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* || "$PWD" == "$sandbox"-* ]] && in_sandbox=1
-  fi
-  if [ "$in_sandbox" -eq 1 ]; then
-    echo -e "${GREY}┌${NC}" >&2
-    log_error "Execution restricted: Command cannot be run from inside the sandbox environment."
-  fi
-  if [[ "$PWD" != "$PROJECT_ROOT"* ]]; then
-    echo -e "${GREY}┌${NC}" >&2
-    log_error "Context Error: You must run this command from inside the repository."
-  fi
-}
-
-# The retired spelling stays honored, and permanently. This variable is the
-# documented way to drive any command headlessly, so every skill body, CI job,
-# and operator script already written sets the old name, and those callers live
-# in repositories and plugin caches this release cannot reach. Dropping it
-# leaves them waiting on a TTY nobody is watching.
-is_non_interactive() {
-  # canon-keep-retired
-  [[ "${CANON_NON_INTERACTIVE:-}" == "1" || "${AITK_NON_INTERACTIVE:-}" == "1" ]]
-}
-
-ask() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local prompt_text=$1
-  local var_name=$2
-  local default_val=$3
-  local input=""
-  local char
-  local display_default=""
-  if [ -n "$default_val" ]; then
-    display_default=" (${default_val})"
-  fi
-  if is_non_interactive; then
-    echo -e "${GREY}│${NC}" >&2
-    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${default_val}${NC}" >&2
-    export "$var_name"="$default_val"
-    return
-  fi
-  echo -e "${GREY}│${NC}" >&2
-  echo -ne "${GREEN}◆${NC} ${prompt_text}${display_default} " >&2
-  while IFS= read -r -s -n1 char; do
-    if [[ $char == $'\x1b' ]]; then
-      read -rsn2 -t 0.001 _ || true
-      echo -ne "\r\033[K" >&2
-      echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
-      exit 1
-    elif [[ $char == $'\x7f' || $char == $'\x08' ]]; then
-      if [ -n "$input" ]; then
-        input="${input%?}"
-        echo -ne "\b \b" >&2
-      fi
-    elif [[ -z "$char" ]]; then
-      break
-    else
-      input+="$char"
-      echo -n "$char" >&2
-    fi
-  done
-  [ -z "$input" ] && input="$default_val"
-  echo -ne "\r\033[K" >&2
-  echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${input}${NC}" >&2
-  export "$var_name"="$input"
-}
-
-select_or_route_scenario() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local prompt_text=$1
-  shift
-  local options=("$@")
-
-  if [ -n "${SANDBOX_SCENARIO:-}" ]; then
-    echo -e "${GREY}│${NC}" >&2
-    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${SANDBOX_SCENARIO}${NC}" >&2
-    export SELECTED_OPTION="$SANDBOX_SCENARIO"
-    return
-  fi
-
-  select_option "$prompt_text" "${options[@]}"
-}
-
-select_option() {
-  local GREEN RED YELLOW WHITE GREY NC
-  set_palette 2
-  local prompt_text=$1
-  shift
-  local options=("$@")
-  local cur=0
-  local count=${#options[@]}
-
-  if is_non_interactive; then
-    echo -e "${GREY}│${NC}" >&2
-    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${options[0]}${NC}" >&2
-    export SELECTED_OPTION="${options[0]}"
-    return
-  fi
-
-  if [ ! -t 0 ]; then
-    log_error "${prompt_text} requires a TTY. Pass an argument or set CANON_NON_INTERACTIVE=1."
-  fi
-
-  echo -e "${GREY}│${NC}" >&2
-  echo -ne "${GREEN}◆${NC} ${prompt_text}\n" >&2
-
-  while true; do
-    for i in "${!options[@]}"; do
-      if [ "$i" -eq "$cur" ]; then
-        echo -e "${GREY}│${NC}  ${GREEN}❯ ${options[$i]}${NC}" >&2
-      else
-        echo -e "${GREY}│${NC}    ${GREY}${options[$i]}${NC}" >&2
-      fi
-    done
-
-    read -rsn1 key
-    case "$key" in
-    $'\x1b')
-      if read -rsn2 -t 0.001 key_seq; then
-        if [[ "$key_seq" == "[A" ]]; then cur=$(((cur - 1 + count) % count)); fi
-        if [[ "$key_seq" == "[B" ]]; then cur=$(((cur + 1) % count)); fi
-      else
-        echo -ne "\033[$((count + 1))A\033[J" >&2
-        echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
-        exit 1
-      fi
-      ;;
-    "k") cur=$(((cur - 1 + count) % count)) ;;
-    "j") cur=$(((cur + 1) % count)) ;;
-    "q")
-      echo -ne "\033[$((count + 1))A\033[J" >&2
-      echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
-      exit 1
-      ;;
-    "") break ;;
-    esac
-    echo -ne "\033[${count}A" >&2
-  done
-
-  echo -ne "\033[$((count + 1))A\033[J" >&2
-  echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${options[$cur]}${NC}" >&2
-  export SELECTED_OPTION="${options[$cur]}"
-}

package/src/audits/catalog.ts

@@ -468,7 +468,6 @@ const RECORD_KINDS: readonly (readonly [string, Corpus])[] = [
   ['plans', 'per-machine'],
   ['groundwork', 'per-machine'],
   ['intake', 'per-machine'],
-  ['memory', 'per-machine'],
   ['standards', 'tracked'],
   ['teach', 'per-machine'],
 ]