@erclx/canon 5.34.0 → 5.35.0

package/src/sync/check.ts

@@ -3,9 +3,10 @@ import { basename, join, sep } from 'node:path'
 import { execa } from 'execa'
 import { gitEnv } from '@/git/env'
 import { createDesignAdapter, DESIGN_INSTALL_DIR } from '@/design/adapter'
-import { createGovAdapter, rulesSourceDir } from '@/gov/adapter'
+import { createGovAdapter } from '@/gov/adapter'
 import { successorResolver } from '@/gov/renames'
-import { loadGovStack, resolveMissingRules, resolveRules } from '@/gov/stacks'
+import { lookupRules } from '@/gov/install'
+import { resolveMissingRules, resolveRules } from '@/gov/stacks'
 import { planSync, type ScanEntry, type SyncAdapter } from '@/sync/engine'
 import {
   collectSuperseded,
@@ -576,7 +577,8 @@ export function readInstalledRules(
  * not already hold.
  *
  * The band test is the entitlement filter, and `bands` carries two sources: the
- * folders the target already holds, and the folders the base stack takes whole.
+ * folders the target already holds, and the folders holding a rule the base
+ * stack resolves to.
  * A rule authored under `lang/` or `ui/` is named by an individual stack, so it
  * belongs to some targets and not others, and listing every added file would
  * tell a base consumer about rules it was never entitled to. The test
@@ -615,27 +617,29 @@ export function selectNewRules(
 }
 
 /**
- * Band folders the base stack takes whole. Every governance stack extends base,
- * so a rule authored under one of these is entitled to every target.
+ * Band folders holding a rule the base stack resolves to. Every governance
+ * stack extends base, so a new rule authored beside one of base's rules is
+ * reported to every target the fallback below reads.
  *
  * This is what covers a band no target can carry yet. Entitlement is otherwise
- * read off folders the target already holds, and a folder added to base later
+ * read off folders the target already holds, and a band base reaches later
  * exists in no installed tree, so without this the rules inside it would reach
- * nobody. Read from the stack file rather than fixed, so that addition needs no
- * code change here.
+ * nobody. Read through `resolveRules` rather than off the stack's entries,
+ * since base names its rules one by one and an entry is a slug rather than a
+ * folder.
  *
- * A folder only a leaf stack names is deliberately absent. It is entitled to
+ * A folder only a leaf stack reaches is deliberately absent. It is entitled to
  * some targets and not others, which is the distinction the band test makes and
  * the installed tree is the only evidence of.
  */
 export function baseBands(root: string): Set<string> {
-  const stack = loadGovStack(root, 'base')
-  if (stack === undefined) return new Set()
+  const resolution = resolveRules(root, 'base')
+  if (!resolution.ok) return new Set()
 
   return new Set(
-    stack.rules.filter((entry) =>
-      isDirectory(join(rulesSourceDir(root), entry)),
-    ),
+    lookupRules(root, resolution.rules)
+      .found.map((source) => source.subdir.split(sep)[0] ?? '')
+      .filter((band) => band !== ''),
   )
 }
 

package/src/tooling/inject.ts

@@ -20,13 +20,7 @@ import {
   readPackage,
   serializePackage,
 } from '@/tooling/package'
-import {
-  hasSpellConfig,
-  isSubfolderTarget,
-  isWithheldInSubfolder,
-  SUBFOLDER_SPELL_CONFIG,
-  subfolderSpellConfig,
-} from '@/tooling/subfolder'
+import { isSubfolderTarget, isWithheldInSubfolder } from '@/tooling/subfolder'
 import { logAdd, logRemove, logStep, logWarn } from '@/cli/ui'
 
 export async function injectConfigs(
@@ -72,30 +66,13 @@ async function writeSeed(src: string, dest: string): Promise<void> {
 }
 
 /**
- * Copies a seed when the target lacks it. When the target already has one and
- * the seed is a `.txt` word list, missing lines are appended and the file is
- * re-sorted. Every other existing file is left untouched.
+ * Copies a seed when the target lacks it and leaves an existing file untouched.
  */
-async function mergeSeedFile(src: string, dest: string): Promise<void> {
+async function copySeedIfMissing(src: string, dest: string): Promise<void> {
   await mkdir(dirname(dest), { recursive: true })
+  if (existsSync(dest)) return
 
-  if (!existsSync(dest)) {
-    await writeSeed(src, dest)
-    return
-  }
-
-  if (!src.endsWith('.txt')) return
-
-  const existing = (await readFile(dest, 'utf8')).split('\n')
-  const incoming = (await readFile(src, 'utf8')).split('\n')
-  const missing = incoming.filter(
-    (word) => word !== '' && !existing.includes(word),
-  )
-
-  if (missing.length === 0) return
-
-  const merged = [...existing.filter((line) => line !== ''), ...missing].sort()
-  await writeFile(dest, `${merged.join('\n')}\n`)
+  await writeSeed(src, dest)
 }
 
 export async function injectSeeds(
@@ -116,20 +93,12 @@ export async function injectSeeds(
     logStep(`Applying ${manifest.name} seeds`)
     for (const rel of files) {
       const dest = resolveSurfacePath(target, rel)
-      await mergeSeedFile(join(manifest.seedsDir, rel), dest)
+      await copySeedIfMissing(join(manifest.seedsDir, rel), dest)
       logAdd(relative(target, dest))
       applied.push(rel)
     }
   }
 
-  const spellConfig = isSubfolder ? subfolderSpellConfig(chain) : undefined
-  if (spellConfig !== undefined && !hasSpellConfig(target)) {
-    logStep('Applying subfolder spell config')
-    await writeFile(join(target, SUBFOLDER_SPELL_CONFIG), spellConfig)
-    logAdd(SUBFOLDER_SPELL_CONFIG)
-    applied.push(SUBFOLDER_SPELL_CONFIG)
-  }
-
   return applied
 }
 

package/src/tooling/read.ts

@@ -28,9 +28,8 @@ function toolingSourceDir(root: string): string {
 }
 
 /**
- * The roots a stack reference resolves against, mirroring `standardRoots` in
- * `src/standards/read.ts`. No stack reference installs into a project any
- * more, so the package corpus is the only root that answers there. The
+ * The roots a stack reference resolves against. No stack reference installs
+ * into a project any more, so the package corpus is the only root that answers there. The
  * authoring root stays ahead of it for the toolkit's own repository, which
  * authors the corpus this reads, and for a project authoring stacks of its
  * own under the same layout.

package/src/tooling/scan.ts

@@ -16,13 +16,7 @@ import {
   readPackage,
   type ScriptState,
 } from '@/tooling/package'
-import {
-  hasSpellConfig,
-  isSubfolderTarget,
-  isWithheldInSubfolder,
-  SUBFOLDER_SPELL_CONFIG,
-  subfolderSpellConfig,
-} from '@/tooling/subfolder'
+import { isSubfolderTarget, isWithheldInSubfolder } from '@/tooling/subfolder'
 
 export interface ConfigState {
   readonly rel: string
@@ -73,9 +67,9 @@ function isIdentical(a: string, b: string): boolean {
  * so the path is reported once.
  *
  * A target below its git toplevel is scanned as a subfolder: a config or seed
- * GitHub reads only at the root moves to `withheld` and counts as no change,
- * and the nested spell config joins the seeds. The scope is read here so every
- * caller of `scan` agrees without passing a flag.
+ * GitHub reads only at the root moves to `withheld` and counts as no change.
+ * The scope is read here so every caller of `scan` agrees without passing a
+ * flag.
  */
 export function scan(chain: readonly Manifest[], target: string): ScanResult {
   const isSubfolder = isSubfolderTarget(target)
@@ -132,13 +126,6 @@ export function scan(chain: readonly Manifest[], target: string): ScanResult {
     }
   }
 
-  if (isSubfolder && subfolderSpellConfig(chain) !== undefined) {
-    seeds.push({
-      rel: SUBFOLDER_SPELL_CONFIG,
-      state: hasSpellConfig(target) ? 'present' : 'missing',
-    })
-  }
-
   const packagePath = join(target, 'package.json')
   const pkg = readPackage(packagePath)
   const scripts = pkg ? collectScripts(chain, pkg) : []

package/src/tooling/subfolder.ts

@@ -1,18 +1,9 @@
-import { existsSync, readdirSync, realpathSync } from 'node:fs'
-import { basename, join, relative } from 'node:path'
+import { realpathSync } from 'node:fs'
+import { relative } from 'node:path'
 import { gitEnv } from '@/git/env'
-import { isWholeStack, type Manifest, seedFiles } from '@/tooling/manifest'
-
-/**
- * The path the generated subfolder spell config is written to. Written
- * copy-once, since a project that already configured cspell here owns it.
- */
-export const SUBFOLDER_SPELL_CONFIG = 'cspell.json'
 
 const WITHHELD_PREFIX = '.github/'
 
-const SPELL_CONFIG_NAMES = ['cspell.json', '.cspell.json']
-
 /**
  * Whether the target sits below the root of the git repository holding it. A
  * target outside any repository, or one git cannot read, counts as a root, so
@@ -57,58 +48,3 @@ export function subfolderPath(target: string): string | undefined {
 export function isWithheldInSubfolder(rel: string): boolean {
   return rel.startsWith(WITHHELD_PREFIX)
 }
-
-/**
- * Whether the target already carries a cspell config of its own, in any of
- * the file names cspell searches for.
- */
-export function hasSpellConfig(target: string): boolean {
-  if (SPELL_CONFIG_NAMES.some((name) => existsSync(join(target, name)))) {
-    return true
-  }
-  if (!existsSync(target)) return false
-  return readdirSync(target).some((name) => name.startsWith('cspell.config.'))
-}
-
-/**
- * Builds the nested cspell config that registers a subfolder's seeded word
- * lists. A root `cspell '**'` merges it with the root config for files under
- * the subfolder. Each dictionary takes a `local-` name, since reusing a root
- * dictionary's name shadows it inside the subfolder and a root word then fails
- * there.
- *
- * Returns nothing when the chain carries `base`, whose own seed already writes
- * a config, or when no stack seeds a word list.
- */
-export function subfolderSpellConfig(
-  chain: readonly Manifest[],
-): string | undefined {
-  if (
-    chain.some((manifest) => manifest.name === 'base' && isWholeStack(manifest))
-  ) {
-    return undefined
-  }
-
-  const lists = new Set<string>()
-  for (const manifest of chain) {
-    for (const rel of seedFiles(manifest)) {
-      if (rel.startsWith('.cspell/') && rel.endsWith('.txt')) lists.add(rel)
-    }
-  }
-  if (lists.size === 0) return undefined
-
-  const definitions = [...lists].sort().map((path) => ({
-    name: `local-${basename(path, '.txt')}`,
-    path,
-    addWords: true,
-  }))
-
-  const config = {
-    version: '0.2',
-    dictionaryDefinitions: definitions,
-    dictionaries: definitions.map((definition) => definition.name),
-    ignorePaths: ['.cspell/**'],
-  }
-
-  return `${JSON.stringify(config, null, 2)}\n`
-}

package/tooling/base/configs/scripts/verify.json

@@ -1,3 +1,3 @@
 {
-  "require": ["format", "check:format", "check:spell", "check:shell"]
+  "require": ["format", "check:format", "check:shell"]
 }

package/tooling/base/configs/scripts/verify.ts

@@ -54,12 +54,6 @@ const PHASES: readonly Phase[] = [
     failed: 'Format check failed',
     passed: 'Format check passed',
   },
-  {
-    script: 'check:spell',
-    title: 'Spelling',
-    failed: 'Spell check failed',
-    passed: 'Spell check passed',
-  },
   {
     script: 'check:shell',
     title: 'Shell',
@@ -83,12 +77,7 @@ const PHASES: readonly Phase[] = [
 // A subfolder synced with --skip base declares none of these, since the
 // repository root owns them, so a list that does not require one runs it only
 // where the folder declares it.
-const BASE_PHASES = new Set([
-  'format',
-  'check:format',
-  'check:spell',
-  'check:shell',
-])
+const BASE_PHASES = new Set(['format', 'check:format', 'check:shell'])
 
 const PHASE_LIST = 'scripts/verify.json'
 const CARD_EXCLUSION = 'scripts/check-card-exclusion.sh'

package/tooling/base/manifest.toml

@@ -11,14 +11,12 @@ per_root = ["scripts/verify.sh", "scripts/verify.ts", "scripts/verify.json"]
 [dependencies.dev]
 packages = [
     "prettier",
-    "cspell",
     "husky",
     "@commitlint/cli",
     "@commitlint/config-conventional",
 ]
 
 [scripts]
-"check:spell" = "cspell '**' '.*/**' '.*' --no-progress --color --show-context"
 "check:format" = "prettier --check --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && find scripts -name '*.sh' -exec shfmt --diff --indent 2 {} +"
 "check:shell" = "find scripts -name '*.sh' -exec shellcheck --severity=warning {} +"
 "format" = "prettier --write --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && find scripts -name '*.sh' -exec shfmt --write --indent 2 {} +"
@@ -29,3 +27,4 @@ packages = [
 "# System" = [".DS_Store"]
 "# Dependencies" = ["node_modules/"]
 "# Secrets" = [".env", ".env.*", "*.local", "!.env.example"]
+"# VSCode" = [".vscode/"]

package/tooling/base/reference.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-The base layer covers every project the toolkit scaffolds, whatever language sits on top. It ships formatting, spelling, shell linting, conventional commits, git hooks, CI, and one maintenance script. Every other stack extends it, so a decision made here is one every stack inherits.
+The base layer covers every project the toolkit scaffolds, whatever language sits on top. It ships formatting, shell linting, conventional commits, git hooks, CI, and one maintenance script. Every other stack extends it, so a decision made here is one every stack inherits.
 
 A repository with several language roots layers this stack once at the root and skips it per subtree, since git honors only one `core.hooksPath` and a re-dropped husky silently breaks. `canon docs scenarios` carries the recipe.
 
@@ -15,17 +15,14 @@ Golden config files live in `tooling/base/configs/` and are copied into the targ
 - `.editorconfig`: `root = true`, with an `[*.sh]` block setting `indent_style = space` and `indent_size = 2`.
 - `commitlint.config.js`: ESM default export extending `@commitlint/config-conventional`. Rules are `header-max-length: 72`, `scope-case: lower-case`, `subject-full-stop: never`, `subject-case` disabled, and a local `no-claude-co-author` rule refusing a `Co-authored-by` trailer that names Claude or Anthropic.
 - `.husky/`: `pre-commit`, `commit-msg`, `pre-push`, `post-merge`, `post-rewrite`.
-- `.vscode/extensions.json` and `.vscode/settings.json`: editor wiring for Prettier, cspell, shfmt, and shellcheck.
 - `scripts/verify.sh`: the maintenance entry point behind `check`, a wrapper that hands off to `scripts/verify.ts`.
-- `scripts/verify.ts`: the one verify runner every stack shares. It runs typecheck, lint, format, format check, spelling, shell, unit tests, build, markdown bans, then card exclusion, always in that order, and skips any phase the folder's `scripts/verify.json` leaves out. Node modules only, since a target's own lint and typecheck read it.
-- `scripts/verify.json`: the phases a stack requires, plus any tools and preconditions it probes first. The nearest stack's copy wins. A required phase whose script `package.json` lacks fails the run. A base phase the list leaves out runs only where the folder declares its script. Base requires its four phases, so a base-only target still fails on a missing one. These three files are base's `[sync] per_root` set, which a `--skip base` subfolder still receives.
+- `scripts/verify.ts`: the one verify runner every stack shares. It runs typecheck, lint, format, format check, shell, unit tests, build, markdown bans, then card exclusion, always in that order, and skips any phase the folder's `scripts/verify.json` leaves out. Node modules only, since a target's own lint and typecheck read it.
+- `scripts/verify.json`: the phases a stack requires, plus any tools and preconditions it probes first. The nearest stack's copy wins. A required phase whose script `package.json` lacks fails the run. A base phase the list leaves out runs only where the folder declares its script. Base requires its three phases, so a base-only target still fails on a missing one. These three files are base's `[sync] per_root` set, which a `--skip base` subfolder still receives.
 
 ## What ships as user-owned seeds
 
 Seeds live in `tooling/base/seeds/`. Sync drops each once on first install and never overwrites it, so a project extends them freely.
 
-- `cspell.json`: `version: "0.2"`, `language: "en"`, `useGitignore: true`, `gitignoreRoot: ["."]`, dictionary definitions for `project-terms` and `tech-stack` with `addWords: true` on both, and `ignorePaths: [".cspell/**", ".git/**"]` to skip dictionary self-checks and git object files.
-- `.cspell/project-terms.txt` and `.cspell/tech-stack.txt`: one word per line, sorted alphabetically.
 - `.lintstagedrc`: the glob map below.
 - `.prettierignore`: created empty. Projects add their own entries.
 - `.github/workflows/verify.yml`: runs on pull requests targeting `main` and on `workflow_dispatch`. A project with more than one language root adds its own jobs here.
@@ -36,15 +33,14 @@ Seeds live in `tooling/base/seeds/`. Sync drops each once on first install and n
 
 - Runtime: `bun` as package manager and script runner, `bunx` over `npx` for a one-off executable.
 - Formatting: Prettier for what it parses, shfmt for shell. Two formatters because Prettier has no shell parser.
-- Spelling: cspell over the whole tree, with project vocabulary split into a project-terms dictionary and a tech-stack one.
 - Shell: shfmt formats and shellcheck lints at warning severity. Both take their files from `find scripts -name '*.sh'`, since `scripts/` can mix shell with TypeScript and shellcheck has no directory mode. A shell script with a shebang and no `.sh` extension is covered by neither, so give it the extension.
 - Commits: commitlint against conventional commits, wired through the husky `commit-msg` hook. Format is `<type>(<scope>): <subject>` in imperative mood with no trailing period.
-- Dev dependencies: `prettier`, `cspell`, `husky`, `@commitlint/cli`, `@commitlint/config-conventional`. Install via `bun add -D`.
+- Dev dependencies: `prettier`, `husky`, `@commitlint/cli`, `@commitlint/config-conventional`. Install via `bun add -D`.
 
 ## File layout
 
 - All shell scripts live in `scripts/`. Do not place a `.sh` file outside it.
-- Dictionaries live in `.cspell/`, hooks in `.husky/`, seeded context docs in `canon/context/`.
+- Hooks live in `.husky/`, seeded context docs in `canon/context/`.
 - The `canon/context/` location matches the three-tier context model: project-wide invariants in `CLAUDE.md` and `canon/REQUIREMENTS.md`, path-scoped rules in `.claude/rules/`, and on-demand domain narrative in `canon/context/`. Indexes stay opt-in.
 
 ## Hooks
@@ -59,13 +55,13 @@ Seeds live in `tooling/base/seeds/`. Sync drops each once on first install and n
 
 Seeded baseline globs:
 
-- `**/*.{json,md,mdc}` runs `prettier --write --ignore-path .gitignore --ignore-path .prettierignore` then `cspell --no-must-find-files`
+- `**/*.{json,md,mdc}` runs `prettier --write --ignore-path .gitignore --ignore-path .prettierignore`
 - `**/*.md` runs `canon indexes regen`
 - `**/*.sh` runs `shfmt --write --indent 2` then `shellcheck --severity=warning`
 
 ## CI
 
-- Steps: checkout, setup Bun at latest, `bun install --frozen-lockfile`, install `shfmt` and `shellcheck` via apt, then `check:format`, `check:spell`, and `check:shell`.
+- Steps: checkout, setup Bun at latest, `bun install --frozen-lockfile`, install `shfmt` and `shellcheck` via apt, then `check:format` and `check:shell`.
 - CI asserts and never writes. Format must be clean before push.
 
 ## Gitignore
@@ -73,13 +69,12 @@ Seeded baseline globs:
 - `# System`: `.DS_Store`
 - `# Dependencies`: `node_modules/`
 - `# Secrets`: `.env`, `.env.*`, `*.local`, `!.env.example`
+- `# VSCode`: `.vscode/`
 
 ## Anti-patterns
 
 Sticky negative knowledge. Do not relearn.
 
-- Do NOT drop `gitignoreRoot: ["."]` from `cspell.json`. Without it, cspell run from inside a linked worktree under `.claude/worktrees/` walks up into the parent repo's `.gitignore`, resolves every worktree file as living under the ignored worktree path, and checks zero files. New words then pass locally and fail in CI.
-- Do NOT rely on the default `**` glob for spelling. It skips dot-prefixed folders, leaving `.claude/`, `.github/`, and `.husky/` unchecked. Pass `'**' '.*/**' '.*'` explicitly.
 - Do NOT invoke prettier without both `--ignore-path .gitignore --ignore-path .prettierignore`. Passing one drops the other, since the flag replaces the default rather than adding to it.
 - Do NOT omit `--log-level warn` from a prettier invocation. The default prints a line per unchanged file.
 - Do NOT put logic in a husky hook and expect its shebang to hold. Husky runs hooks as `sh -e`, so a hook carrying logic is POSIX sh under errexit whatever the first line says.
@@ -92,11 +87,10 @@ Sticky negative knowledge. Do not relearn.
 | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
 | `bun run check`        | Repairs a checkout via `scripts/verify.ts`. Honors `VERIFY_NESTED=true` to suppress timeline boundaries when another script calls it. |
 | `bun run check:format` | Asserts prettier and shfmt formatting without writing                                                                                 |
-| `bun run check:spell`  | Runs cspell across every file, with context on failures                                                                               |
 | `bun run check:shell`  | Runs shellcheck at warning severity                                                                                                   |
 | `bun run format`       | Writes prettier and shfmt formatting in place                                                                                         |
 | `bun run prepare`      | Initializes husky hooks, run automatically on `bun install`                                                                           |
 
-`bun run check` repairs a checkout rather than gating one. It runs `format` first to auto-fix drifted code, then asserts only what the formatters could not fix. The pull request workflow calls `check:format`, `check:spell`, and `check:shell` directly, and those three are the gate.
+`bun run check` repairs a checkout rather than gating one. It runs `format` first to auto-fix drifted code, then asserts only what the formatters could not fix. The pull request workflow calls `check:format` and `check:shell` directly, and those two are the gate.
 
-`scripts/verify.ts`'s `Markdown bans` stage is the exception: it gates rather than repairs. It runs `canon markdown audit` over every tracked markdown file except `CHANGELOG.md`, since a generated changelog carries commit subjects nobody wrote against the ban set, and exits `2` on a finding or `3` on a shipped-empty ban set, failing `bun run check` and the `pre-push` hook that calls it. A refusal to measure exits `1` and is logged as a skip rather than a failure, as does a corpus with no file left to check once `CHANGELOG.md` is set aside. The stage needs `canon` on PATH. `canon docs projects` names the install command. Without it, the stage is skipped and logged, and coverage falls back to the three checks above.
+`scripts/verify.ts`'s `Markdown bans` stage is the exception: it gates rather than repairs. It runs `canon markdown audit` over every tracked markdown file except `CHANGELOG.md`, since a generated changelog carries commit subjects nobody wrote against the ban set, and exits `2` on a finding or `3` on a shipped-empty ban set, failing `bun run check` and the `pre-push` hook that calls it. A refusal to measure exits `1` and is logged as a skip rather than a failure, as does a corpus with no file left to check once `CHANGELOG.md` is set aside. The stage needs `canon` on PATH. `canon docs projects` names the install command. Without it, the stage is skipped and logged, and coverage falls back to the two checks above.

package/tooling/base/seeds/.github/workflows/verify.yml

@@ -28,8 +28,5 @@ jobs:
       - name: Check Formatting
         run: bun run check:format
 
-      - name: Check Spelling
-        run: bun run check:spell
-
       - name: Check Shell
         run: bun run check:shell

package/tooling/base/seeds/.lintstagedrc

@@ -1,7 +1,6 @@
 {
   "**/*.{json,md,mdc}": [
-    "prettier --write --ignore-path .gitignore --ignore-path .prettierignore",
-    "cspell --no-must-find-files"
+    "prettier --write --ignore-path .gitignore --ignore-path .prettierignore"
   ],
   "**/*.md": ["canon indexes regen"],
   "**/*.sh": ["shfmt --write --indent 2", "shellcheck --severity=warning"]

package/tooling/base/seeds/canon/context/ci.md

@@ -25,7 +25,6 @@ Defined in `.github/workflows/verify.yml`. All jobs must pass before merge.
 | Check  | Command                | What it asserts                    |
 | ------ | ---------------------- | ---------------------------------- |
 | Format | `bun run check:format` | prettier and shfmt are clean       |
-| Spell  | `bun run check:spell`  | cspell passes against dictionaries |
 | Shell  | `bun run check:shell`  | shellcheck passes at warning level |
 
 ## Running CI locally

package/tooling/base/seeds/canon/context/development.md

@@ -32,6 +32,6 @@ All `.sh` files live under `scripts/`. Do not place shell scripts outside `scrip
 
 ## Husky hooks
 
-- `pre-commit` runs `lint-staged` (prettier, cspell, shfmt, shellcheck on staged files).
+- `pre-commit` runs `lint-staged` (prettier, shfmt, shellcheck on staged files).
 - `commit-msg` runs `commitlint` against the conventional commit format.
 - `pre-push` runs `bun run check`. When a markdown-bans audit tool is on PATH, it also gates on banned characters across every tracked markdown file except `CHANGELOG.md`. After pushing, run `git status`. If files changed, commit the diff as `style(<scope>):` and push again.

package/tooling/claude/reference.md

@@ -42,7 +42,7 @@ A project installed before the board became a folder still holds `.claude/TASKS.
 
 Convert by hand, once per project:
 
-1. Split each `###` block into `.canon/tasks/vXX.Y-<slug>.md`, adding the `title` and `description` frontmatter the tasks standard requires, which `canon standards tasks` prints. Compare each new file against the block it came from rather than checking that every block landed somewhere.
+1. Split each `###` block into `.canon/tasks/vXX.Y-<slug>.md`, adding the `title` and `description` frontmatter the tasks reference in the `task-board` skill requires. Compare each new file against the block it came from rather than checking that every block landed somewhere.
 2. Run `canon indexes regen --no-stage --root . .canon/tasks/<any-task>.md` to build the catalog.
 3. Delete `.claude/TASKS.md`, and swap its `.gitignore` entry for `.canon/tasks/`.
 

package/tooling/claude/seeds/.claude/hooks/review-post-scan.sh

@@ -50,7 +50,19 @@ END {
       while (i <= n && substr(s, i, 1) != "\n") i++
       continue
     }
-    if (c == "<" && substr(s, i, 2) == "<<" && substr(s, i, 3) != "<<<") {
+    if (c == "(" && substr(s, i, 2) == "((") {
+      d = 0
+      while (i <= n) {
+        a = substr(s, i, 1)
+        if (a == "(") d++
+        else if (a == ")") { d--; if (d == 0) { seg = seg a; i++; break } }
+        seg = seg a; i++
+      }
+      continue
+    }
+    if (c == "<" && substr(s, i, 3) == "<<<") { seg = seg "<<<"; i += 3; continue }
+    if (c == "<" && substr(s, i, 2) == "<<" && seg ~ /^[ \t]*let[ \t]/) { seg = seg "<<"; i += 2; continue }
+    if (c == "<" && substr(s, i, 2) == "<<") {
       j = i + 2; dash = 0
       if (substr(s, j, 1) == "-") { dash = 1; j++ }
       while (substr(s, j, 1) ~ /[ \t]/) j++

package/tooling/go/reference.md

@@ -10,7 +10,7 @@ The go stack covers Go modules linted and formatted by `golangci-lint` v2, type-
 
 1. Scaffold with `go mod init <module-path>`. The module path is the project's own identity, so this stack never ships a `go.mod`.
 2. Keep `./...` out of `node_modules`: `go mod edit -ignore=./node_modules`. At a root sync the base layer installs `node_modules/` inside the module, and a package there can ship a `.go` file that `go vet`, `go test`, and `golangci-lint` would otherwise walk. The directive needs Go 1.25 or later.
-3. Seed `package.json` so the base layer's bun-side tools (husky, prettier, cspell, commitlint) have a target to install into: `bun init -y`.
+3. Seed `package.json` so the base layer's bun-side tools (husky, prettier, commitlint) have a target to install into: `bun init -y`.
 4. Install base tooling: `canon tooling sync base . --write`
 5. Install go tooling: `canon tooling sync go . --write`
 6. Install the linter: `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest`. The manifest declares no `[dependencies.dev]`, because manifest injection runs `bun add -D`, which cannot install a Go tool. This step stays manual.

package/tooling/php/reference.md

@@ -9,7 +9,7 @@ The php stack covers Composer projects on PHP 8.3 or later, formatted by PHP CS
 ## Scaffold checklist
 
 1. Scaffold with `composer init -n --name <vendor>/<name> --autoload src/`. The package name and namespace are the project's own identity, so this stack never ships a `composer.json`.
-2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, cspell, commitlint) have a target to install into: `bun init -y`.
+2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, commitlint) have a target to install into: `bun init -y`.
 3. Install base tooling: `canon tooling sync base . --write`
 4. Install php tooling: `canon tooling sync php . --write`
 5. Install the dev tools: `composer require --dev friendsofphp/php-cs-fixer phpstan/phpstan phpunit/phpunit`. The manifest declares no `[dependencies.dev]`, because manifest injection runs `bun add -D`, which cannot install a Composer package. This step stays manual.

package/tooling/python/reference.md

@@ -11,7 +11,7 @@ Configs ship as sidecar files (`ruff.toml`, `mypy.ini`, `pytest.ini`, `.coverage
 ## Scaffold checklist
 
 1. Scaffold with `uv init --package <name>`. This creates `pyproject.toml` with a `uv_build` backend, `.python-version` pinned to 3.14, and `src/<name with underscores>/__init__.py` holding an annotated `def main() -> None:`, so source lands under `src/` where `mypy.ini`, `pytest.ini`, and `.coveragerc` look for it. `uv init` defaults `requires-python` to `>=3.14`, which matches the `.python-version` pin this stack ships.
-2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, cspell, commitlint) have a target to install into: `bun init -y`. Without this the sync drops base configs but skips the dep install, since `resolve_missing_deps` short-circuits when `package.json` is absent.
+2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, commitlint) have a target to install into: `bun init -y`. Without this the sync drops base configs but skips the dep install, since `resolve_missing_deps` short-circuits when `package.json` is absent.
 3. Install base tooling: `canon tooling sync base . --write`
 4. Install python tooling: `canon tooling sync python . --write`
 5. Install Python tooling deps: `uv add --dev ruff mypy pytest pytest-cov`. v1 of this stack does not declare these in `[dependencies.dev]` because manifest injection hardcodes `bun add -D`, which can not install Python packages. Until the injector branches on `runtime`, this step is manual.
@@ -31,7 +31,7 @@ The python stack also ships `tests/test_smoke.py` as a copy-once seed. `pytest`
 
 ## Hybrid project shape
 
-A python project synced with this stack ends up with both `package.json` from base and `pyproject.toml` from `uv init`. The base layer brings prettier, cspell, commitlint, and husky for non-Python files. Both `node_modules/` and `.venv/` coexist at the project root. The hybrid shape gives Python projects access to the toolkit's cross-cutting tools without forking the base stack.
+A python project synced with this stack ends up with both `package.json` from base and `pyproject.toml` from `uv init`. The base layer brings prettier, commitlint, and husky for non-Python files. Both `node_modules/` and `.venv/` coexist at the project root. The hybrid shape gives Python projects access to the toolkit's cross-cutting tools without forking the base stack.
 
 ## Dependencies
 

package/tooling/web/configs/.github/workflows/verify.yml

@@ -42,9 +42,6 @@ jobs:
       - name: Check Formatting
         run: bun run check:format
 
-      - name: Check Spelling
-        run: bun run check:spell
-
       - name: Check Shell
         run: bun run check:shell
 

package/tooling/web/manifest.toml

@@ -59,4 +59,3 @@ packages = [
 "# Coverage" = ["coverage/"]
 "# Playwright" = ["test-results/", "playwright-report/", "blob-report/", "playwright/.cache/"]
 "# Screenshots" = ["screenshots/"]
-"# VSCode" = [".vscode/*", "!.vscode/extensions.json", "!.vscode/settings.json"]

package/tooling/web/reference.md

@@ -17,7 +17,6 @@ Golden config files live in `tooling/web/configs/` and are copied into the targe
 - `scripts/lib/preview-server.sh`: sourced, never executed. Builds, serves on `PREVIEW_PORT`, blocks until the port answers, and traps the whole process group on exit, including the detached grandchild `lsof` finds. Both capture scripts source it so the startup lives once.
 - `scripts/readme-screenshot.sh`: captures one case under `SCREENSHOT_FILTER` and copies its light and dark frames to `assets/evidence/readme/`. `README_FILTER` ships empty with `header/1280` as its example, and the script exits 1 until a project fills it, since a shipped default would capture the wrong part of the page in every project but one. Its copy reads from `screenshots/<hostname>/`, which is where the harness writes.
 - `.github/workflows/readme-screenshot.yml`: refreshes that frame on a pull request and commits it back to the branch. The path list ships as `REPLACE_WITH_PROJECT_PATHS`, and the job's first step after checkout exits 1 while it stays, since a job that never fires leaves no run and no diff to notice. The workflow's own path is in the list so the installing pull request reaches that step. When a commit-back is right and when a report is, `governance/rules/tooling/700-ci-workflow.md` states the test.
-- `.vscode/extensions.json` and `.vscode/settings.json`: editor wiring for ESLint, Tailwind, Playwright, Vitest.
 - `.github/workflows/verify.yml`: `static-checks`, `unit-tests`, `build-verify`, and `e2e-tests` jobs.
 - `scripts/verify.json`: the phases base's verify runner requires here, being typecheck, lint, unit tests, and build. `## Verify script` covers the order and the card exclusion stage.
 - `scripts/worktree-port.sh`: prints a base port plus this working directory's offset. Called with no argument it prints the offset alone. It refuses a folder left under the worktrees directory after its worktree was removed, rather than printing a port for it.
@@ -78,9 +77,8 @@ Sticky negative knowledge. Do not relearn.
 
 ## lint-staged (extend)
 
-- Add `**/*.{js,jsx,ts,tsx}` glob running `eslint --fix --max-warnings 0`, `prettier --write`, `cspell --no-must-find-files`.
+- Add `**/*.{js,jsx,ts,tsx}` glob running `eslint --fix --max-warnings 0`, and `prettier --write`.
 - Extend the prettier glob to include `css`: `**/*.{json,css,md,mdc}`.
-- Each file type runs cspell once via its own glob. No standalone cspell glob.
 
 ## CI docs (extend)
 
@@ -128,6 +126,6 @@ The sweep under `screenshots/` is ignored again, and only a flagged case's `evid
 
 ## Verify script
 
-The web layer's `scripts/verify.json` requires `typecheck`, `lint`, `test:run`, and `build`, and base's `scripts/verify.ts` runs them in its fixed order: typecheck, lint, format, spelling, shell, unit tests, build, markdown bans, then the card exclusion check where one is installed. astro, vite-react, and nextjs inherit the list, since the nearest stack's copy wins. An adapter whose phases differ ships its own `verify.json` rather than a script.
+The web layer's `scripts/verify.json` requires `typecheck`, `lint`, `test:run`, and `build`, and base's `scripts/verify.ts` runs them in its fixed order: typecheck, lint, format, shell, unit tests, build, markdown bans, then the card exclusion check where one is installed. astro, vite-react, and nextjs inherit the list, since the nearest stack's copy wins. An adapter whose phases differ ships its own `verify.json` rather than a script.
 
 The card stage runs `scripts/check-card-exclusion.sh` whenever that file is installed, which keeps the social card route's build exclusion on the default path rather than behind a flag. It tests for the script rather than the stack, so a project with no card route runs one less stage with no override, and the stack shipping a card route owns what the check reads, being the build the stage before it produced. The astro reference carries the route itself.

package/docs/agents/standards-audit.md

@@ -1,40 +0,0 @@
----
-title: Standard success criteria
-description: Reading the corpus against the success-criterion gate, the two headings it accepts, why the check scopes to arrival rather than the whole corpus, and the exit codes it sets
----
-
-# Standard success criteria
-
-`canon standards audit` reads the corpus at `standards/` and reports which files state a success criterion against which do not, per `standards/standard.md`. It fails only on a standard new to the current branch, never on one already short the section.
-
-Two headings count, at any casing. `## Success criterion` is the wording that standard states the rule under, and `## What a working <document type> looks like` is the wording its template prescribes for the section itself. Most of the corpus writes the templated form, so accepting the rule's wording alone would refuse a conforming standard.
-
-```bash
-canon standards audit
-canon standards audit --json
-canon standards audit --arrivals-only
-```
-
-| Option            | Behavior                                                     |
-| ----------------- | ------------------------------------------------------------ |
-| `[path]`          | Project root, defaulting to the current directory            |
-| `--json`          | Add a machine-readable record on stdout, keeping the frame   |
-| `--arrivals-only` | Run the gating check alone, printing nothing on a clean pass |
-
-## Why arrival rather than the corpus
-
-`standards/standard.md` states that a criterion is added to an existing standard when that standard is next exercised, not in a sweep: a criterion written with no failure to point at is the taste-based edit the rule exists to prevent. Gating the whole corpus would fail every push until every standard already short the section was closed at once, which is the sweep that rule forbids. The check reads the whole corpus and fails only on a file present in the working tree and absent at the branch's merge base, treating a rename into the corpus the same as a standard authored fresh.
-
-## Exit codes and refusals
-
-| Code | Meaning                                                                |
-| ---- | ---------------------------------------------------------------------- |
-| `0`  | every arriving standard carries the section                            |
-| `1`  | refused, with `reason` naming the cause                                |
-| `2`  | a standard new to this branch states no criterion under either heading |
-
-A project authoring no standards refuses with `no-corpus`, the ordinary state of most targets, the same absence `canon claude skills audit` reads as its own `no-corpus`.
-
-## What it does not measure
-
-Presence of the heading is the whole check. The section's content, the questions it must answer or the task it must let a reader complete, is a judgment `canon standards audit` cannot read, so a standard carrying an empty or token section still passes.