@erclx/canon 5.34.0 → 5.36.0

package/tooling/claude/seeds/.claude/hooks/standards-audit.sh

@@ -62,13 +62,28 @@ fi
 hits=$(printf '%s' "$record" |
   jq -r '.entries[]?.bans[]? | ":\(.line):\(.column + 1)  \(.kind)  \(.term)"' 2>/dev/null)
 
+# Two advisory measures ride in the same record and never gate. A heading's
+# case is read for the whole file, since it is cheap to fix where it stands. A
+# colon is kept only where the word before it and the colon appear in the text
+# this write carried, since an edit often rewrites part of a line and a
+# whole-line match would drop exactly that case. The verb names that word as
+# `lead`, since slicing `text` at `column` miscounts after an emoji, and a
+# binary predating the field falls back to the slice. A file holds colons nobody is
+# asking this edit to answer for.
+new=$(printf '%s' "$input" |
+  jq -r '[.tool_input.new_string?, .tool_input.content?, (.tool_input.edits[]?.new_string?)] | map(select(. != null)) | join("\n")' 2>/dev/null)
+headings=$(printf '%s' "$record" |
+  jq -r '.entries[]?.headingCase[]? | ":\(.line)  \(.text)"' 2>/dev/null)
+colons=$(printf '%s' "$record" |
+  jq -r --arg new "$new" '.entries[]?.colons[]? | (.lead // (.text[:.column] | sub("^.*\\s"; ""))) as $lead | select($new | contains($lead + ":")) | ":\(.line):\(.column + 1)  \(.text)"' 2>/dev/null)
+
 # A set the verb shipped empty measures nothing and would report a clean file.
 # Reading the findings alone turns that narrowed check into a pass, so the field
 # is read beside them.
 empty=$(printf '%s' "$record" |
   jq -r '[.bans.emptySets[]?] | join(", ")' 2>/dev/null)
 
-[ -z "$hits" ] && [ -z "$unread" ] && [ -z "$empty" ] && exit 0
+[ -z "$hits" ] && [ -z "$headings" ] && [ -z "$colons" ] && [ -z "$unread" ] && [ -z "$empty" ] && exit 0
 
 nl=$'\n'
 msg=""
@@ -82,7 +97,17 @@ elif [ -n "$empty" ]; then
 fi
 
 if [ -n "$hits" ]; then
-  found=$(printf 'Standards-audit: markdown.md violations in %s. Rewrite the sentence (do not lazy-swap). A code span is the answer only where the token is genuinely an identifier under discussion.\n%s' "$file" "$hits")
+  found=$(printf 'Standards-audit: markdown.md violations in %s. Split the sentence or rewrite it. A colon or a comma standing where the em dash was is the same sentence. A code span is the answer only where the token is genuinely an identifier under discussion.\n%s' "$file" "$hits")
+  msg="${msg:+$msg$nl}$found"
+fi
+
+if [ -n "$headings" ]; then
+  found=$(printf 'Standards-audit: headings in %s are not sentence case. Lowercase every word after the first unless it is a proper noun, and leave a proper noun as it is.\n%s' "$file" "$headings")
+  msg="${msg:+$msg$nl}$found"
+fi
+
+if [ -n "$colons" ]; then
+  found=$(printf 'Standards-audit: this write added a colon in the middle of a sentence in %s. A colon belongs after a label or at the end of a line introducing a list. Split the sentence or rewrite it.\n%s' "$file" "$colons")
   msg="${msg:+$msg$nl}$found"
 fi
 

package/tooling/claude/seeds/CLAUDE.md

@@ -16,4 +16,4 @@
 ## Key paths
 
 - `src/`: [description]
-- `canon/DESIGN.md`: design tokens and the visual system
+- `canon/DESIGN.md`: visual intent, pointing at the stylesheet that holds the values

package/tooling/claude/seeds/canon/DESIGN.md

@@ -1,57 +1,44 @@
 # Design
 
-Authoring guidance: the design standard.
+Authoring guidance: the design standard. Values live in `<your stylesheet>`, such as `src/styles/tokens.css` or a Tailwind `@theme` block. A project with none writes them under `.claude/design/project/`, beside the installed base stylesheet.
 
-## Personality
+## Overview
 
 One paragraph. Voice, tone, and the feeling a user should have. The same content a design intake form asks for.
 
-## Color
+## Colors
 
-One row per role. Intent is a short phrase a human can picture. Value is a hex or a named system token.
+Up to three rules a developer could get wrong.
 
-| Role       | Intent                        | Value |
-| ---------- | ----------------------------- | ----- |
-| background | page canvas                   |       |
-| surface    | cards, panels, raised blocks  |       |
-| text       | primary body text             |       |
-| muted      | secondary text, captions      |       |
-| accent     | links, primary action         |       |
-| success    | confirmations, positive state |       |
-| warning    | cautions, pending state       |       |
-| error      | failures, destructive action  |       |
+One row per role, naming its custom property. Intent is a short phrase a human can picture.
 
-## Typography
+| Role       | Property             | Intent                        |
+| ---------- | -------------------- | ----------------------------- |
+| background | `--color-background` | page canvas                   |
+| surface    | `--color-surface`    | cards, panels, raised blocks  |
+| text       | `--color-text`       | primary body text             |
+| muted      | `--color-muted`      | secondary text, captions      |
+| accent     | `--color-accent`     | links, primary action         |
+| success    | `--color-success`    | confirmations, positive state |
+| warning    | `--color-warning`    | cautions, pending state       |
+| error      | `--color-error`      | failures, destructive action  |
 
-One row per role. Size and line height in pixels or rem. Family names use their product casing.
+## Typography
 
-| Role    | Family | Weight | Size | Line height |
-| ------- | ------ | ------ | ---- | ----------- |
-| display |        |        |      |             |
-| heading |        |        |      |             |
-| body    |        |        |      |             |
-| label   |        |        |      |             |
-| code    |        |        |      |             |
+Up to three rules. How the roles divide between families, and any role that breaks the pattern.
 
 ## Spacing
 
-Base unit and scale. The renderer draws a swatch per step.
+One line. The base unit and how the scale steps.
 
-| Step | Multiplier | Value |
-| ---- | ---------- | ----- |
-| xs   | 0.5        |       |
-| sm   | 1          |       |
-| md   | 2          |       |
-| lg   | 3          |       |
-| xl   | 5          |       |
+## Shapes
 
-## Borders
+One row per role, naming its radius property.
 
-| Role    | Radius | Width | When used             |
-| ------- | ------ | ----- | --------------------- |
-| default |        |       | cards, inputs         |
-| pill    |        |       | tags, status chips    |
-| none    | 0      | 0     | edge-to-edge surfaces |
+| Role    | Property           | When used          |
+| ------- | ------------------ | ------------------ |
+| default | `--radius-default` | cards, inputs      |
+| pill    | `--radius-pill`    | tags, status chips |
 
 ## Motion
 

package/tooling/go/reference.md

@@ -10,7 +10,7 @@ The go stack covers Go modules linted and formatted by `golangci-lint` v2, type-
 
 1. Scaffold with `go mod init <module-path>`. The module path is the project's own identity, so this stack never ships a `go.mod`.
 2. Keep `./...` out of `node_modules`: `go mod edit -ignore=./node_modules`. At a root sync the base layer installs `node_modules/` inside the module, and a package there can ship a `.go` file that `go vet`, `go test`, and `golangci-lint` would otherwise walk. The directive needs Go 1.25 or later.
-3. Seed `package.json` so the base layer's bun-side tools (husky, prettier, cspell, commitlint) have a target to install into: `bun init -y`.
+3. Seed `package.json` so the base layer's bun-side tools (husky, prettier, commitlint) have a target to install into: `bun init -y`.
 4. Install base tooling: `canon tooling sync base . --write`
 5. Install go tooling: `canon tooling sync go . --write`
 6. Install the linter: `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest`. The manifest declares no `[dependencies.dev]`, because manifest injection runs `bun add -D`, which cannot install a Go tool. This step stays manual.

package/tooling/php/reference.md

@@ -9,7 +9,7 @@ The php stack covers Composer projects on PHP 8.3 or later, formatted by PHP CS
 ## Scaffold checklist
 
 1. Scaffold with `composer init -n --name <vendor>/<name> --autoload src/`. The package name and namespace are the project's own identity, so this stack never ships a `composer.json`.
-2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, cspell, commitlint) have a target to install into: `bun init -y`.
+2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, commitlint) have a target to install into: `bun init -y`.
 3. Install base tooling: `canon tooling sync base . --write`
 4. Install php tooling: `canon tooling sync php . --write`
 5. Install the dev tools: `composer require --dev friendsofphp/php-cs-fixer phpstan/phpstan phpunit/phpunit`. The manifest declares no `[dependencies.dev]`, because manifest injection runs `bun add -D`, which cannot install a Composer package. This step stays manual.

package/tooling/python/reference.md

@@ -11,7 +11,7 @@ Configs ship as sidecar files (`ruff.toml`, `mypy.ini`, `pytest.ini`, `.coverage
 ## Scaffold checklist
 
 1. Scaffold with `uv init --package <name>`. This creates `pyproject.toml` with a `uv_build` backend, `.python-version` pinned to 3.14, and `src/<name with underscores>/__init__.py` holding an annotated `def main() -> None:`, so source lands under `src/` where `mypy.ini`, `pytest.ini`, and `.coveragerc` look for it. `uv init` defaults `requires-python` to `>=3.14`, which matches the `.python-version` pin this stack ships.
-2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, cspell, commitlint) have a target to install into: `bun init -y`. Without this the sync drops base configs but skips the dep install, since `resolve_missing_deps` short-circuits when `package.json` is absent.
+2. Seed `package.json` so the base layer's bun-side tools (husky, prettier, commitlint) have a target to install into: `bun init -y`. Without this the sync drops base configs but skips the dep install, since `resolve_missing_deps` short-circuits when `package.json` is absent.
 3. Install base tooling: `canon tooling sync base . --write`
 4. Install python tooling: `canon tooling sync python . --write`
 5. Install Python tooling deps: `uv add --dev ruff mypy pytest pytest-cov`. v1 of this stack does not declare these in `[dependencies.dev]` because manifest injection hardcodes `bun add -D`, which can not install Python packages. Until the injector branches on `runtime`, this step is manual.
@@ -31,7 +31,7 @@ The python stack also ships `tests/test_smoke.py` as a copy-once seed. `pytest`
 
 ## Hybrid project shape
 
-A python project synced with this stack ends up with both `package.json` from base and `pyproject.toml` from `uv init`. The base layer brings prettier, cspell, commitlint, and husky for non-Python files. Both `node_modules/` and `.venv/` coexist at the project root. The hybrid shape gives Python projects access to the toolkit's cross-cutting tools without forking the base stack.
+A python project synced with this stack ends up with both `package.json` from base and `pyproject.toml` from `uv init`. The base layer brings prettier, commitlint, and husky for non-Python files. Both `node_modules/` and `.venv/` coexist at the project root. The hybrid shape gives Python projects access to the toolkit's cross-cutting tools without forking the base stack.
 
 ## Dependencies
 

package/tooling/shell/configs/.github/workflows/shell.yml

@@ -0,0 +1,30 @@
+name: Shell
+# canon-no-seed: an add-on stack's workflow with no root counterpart by design, since the toolkit checks its own shell inside verify.yml.
+
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  shell-checks:
+    name: 🐚 Shell Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install Dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Install Shell Tools
+        run: sudo apt-get install -y shfmt shellcheck
+
+      - name: Check Shell
+        run: bun run check:shell

package/tooling/shell/manifest.toml

@@ -0,0 +1,12 @@
+[stack]
+name = "shell"
+extends = ""
+runtime = "bun"
+scaffold = ""
+
+[sync]
+source = "configs"
+
+[scripts]
+"check:shell" = "find scripts -name '*.sh' -exec shfmt --diff --indent 2 {} + && find scripts -name '*.sh' -exec shellcheck --severity=warning {} +"
+"format:shell" = "find scripts -name '*.sh' -exec shfmt --write --indent 2 {} +"

package/tooling/shell/reference.md

@@ -0,0 +1,46 @@
+# Tooling shell reference
+
+## Overview
+
+The shell stack is an add-on that formats and lints the shell scripts a project writes. It extends nothing and syncs beside any other stack at the same root with `canon tooling sync shell . --write`, so a project that writes no shell never installs shfmt or shellcheck.
+
+## Install
+
+- Install `shfmt` and `shellcheck` by hand, through `sudo apt-get install shfmt shellcheck` or `brew install shfmt shellcheck`. Injection runs only `bun add -D`, and neither tool ships through the registry.
+- `scripts/verify.ts` probes both before the `Shell` phase and names the install command when one is missing, rather than letting `find` report a missing executable.
+
+## shfmt
+
+- Indent with 2 spaces, set through `--indent 2` on every call.
+- `.editorconfig` carries an `[*.sh]` block with `indent_style = space` and `indent_size = 2`, so the editor and shfmt agree. Dropping the block because shfmt already sets indentation produces spurious diffs.
+
+## shellcheck
+
+- Run at warning severity.
+- `.shellcheckrc` sets `external-sources=true`, which shellcheck needs to follow `source` directives.
+
+## Coverage
+
+- Both tools take their files from `find scripts -name '*.sh'`, since `scripts/` can mix shell with TypeScript and shellcheck has no directory mode.
+- A shell script with a shebang and no `.sh` extension is covered by neither, so give it the extension.
+- Keep shell scripts in `scripts/`. A `.sh` file elsewhere, such as a seeded `.claude/hooks/` script, is left out on purpose.
+
+## Verify
+
+- `scripts/verify.ts` runs `check:shell` in its `Shell` phase wherever `package.json` declares it, between the format check and the unit tests. No stack's `scripts/verify.json` requires it, so a folder that never synced this stack skips the phase.
+
+## lint-staged
+
+- `.lintstagedrc` is a base seed this stack cannot reach once written. Add a `**/*.sh` entry by hand, running `shfmt --write --indent 2` then `shellcheck --severity=warning`, to run the checks on commit.
+- Do NOT copy that glob into a `package.json` script. lint-staged expands its own globs and passes matched files as arguments, which a bare shell script does not.
+
+## CI
+
+- `.github/workflows/shell.yml` runs on pull requests targeting `main` and on `workflow_dispatch`: checkout, setup Bun, `bun install --frozen-lockfile`, install both tools through apt, then `check:shell`.
+
+## CLI
+
+| Script                 | What it does                                                    |
+| ---------------------- | --------------------------------------------------------------- |
+| `bun run check:shell`  | Asserts shfmt formatting, then runs shellcheck at warning level |
+| `bun run format:shell` | Writes shfmt formatting in place                                |

package/tooling/vite-react/manifest.toml

@@ -15,7 +15,6 @@ packages = [
 "build" = "tsc --noEmit && vite build"
 "preview" = "WORKTREE_PORT_OFFSET=$(bash scripts/worktree-port.sh) && export WORKTREE_PORT_OFFSET && vite preview"
 "typecheck" = "tsc --noEmit"
-"setup" = "./scripts/setup.sh"
 
 [scripts.override]
 "build" = "tsc --noEmit && vite build"

package/tooling/vite-react/reference.md

@@ -33,14 +33,6 @@ When scaffolding a Chrome extension, override the installed golden configs:
 - `screenshot` script: `bun run build && bun e2e/screenshot.ts` (no preview server).
 - Additional gitignore entries: `*.crx`, `*.pem`, `release/`.
 
-## Setup script
-
-- File: `scripts/setup.sh`. Destructive: deletes `.git` and self-removes after running. Run once immediately after scaffolding.
-- Prompt for project name, normalize to kebab-case, derive title-cased display name.
-- Update `package.json` name and version, inject verify/clean/update scripts, remove setup.
-- Update `<title>` tags in HTML files.
-- Wipe `.git`, re-init, make scripts executable, commit as `chore(root): initialize <name>`.
-
 ## Development docs (extend)
 
 Append to the `## Scripts` table:

package/tooling/web/configs/.github/workflows/readme-screenshot.yml

@@ -95,11 +95,9 @@ jobs:
         # and stops here without pushing a second time.
         if: steps.diff.outputs.changed == 'true'
         # The hooks are off because this commit carries nothing they can read.
-        # `pre-push` runs the full verify, whose format step shells out to
-        # `shfmt`, which the runner does not install, so a push through them
-        # exits 127. The jobs in verify.yml already run those checks against
-        # the source, and what this step pushes is PNG bytes a capture
-        # produced.
+        # `pre-push` runs the full verify, which reruns every check the jobs
+        # in verify.yml already ran against the source, and what this step
+        # pushes is PNG bytes a capture produced.
         env:
           HUSKY: 0
         run: |

package/tooling/web/configs/.github/workflows/verify.yml

@@ -30,9 +30,6 @@ jobs:
       - name: Install Dependencies
         run: bun install --frozen-lockfile
 
-      - name: Install Shell Tools
-        run: sudo apt-get install -y shfmt shellcheck
-
       - name: Typecheck
         run: bun run typecheck
 
@@ -42,12 +39,6 @@ jobs:
       - name: Check Formatting
         run: bun run check:format
 
-      - name: Check Spelling
-        run: bun run check:spell
-
-      - name: Check Shell
-        run: bun run check:shell
-
   unit-tests:
     name: 🧪 Unit Tests
     runs-on: ubuntu-latest

package/tooling/web/manifest.toml

@@ -46,7 +46,7 @@ packages = [
 "test:e2e:changed" = "WORKTREE_PORT_OFFSET=$(bash scripts/worktree-port.sh) && export WORKTREE_PORT_OFFSET && playwright test --only-changed"
 "test:e2e:ui" = "WORKTREE_PORT_OFFSET=$(bash scripts/worktree-port.sh) && export WORKTREE_PORT_OFFSET && playwright test --ui"
 "test:e2e:report" = "playwright show-report"
-"check:full" = "./scripts/verify.sh && bun run test:e2e"
+"check:full" = "bun scripts/verify.ts && bun run test:e2e"
 "smoke:prod" = "bun e2e/screenshot.ts --check-console-clean --require-base-url"
 
 [scripts.override]
@@ -59,4 +59,3 @@ packages = [
 "# Coverage" = ["coverage/"]
 "# Playwright" = ["test-results/", "playwright-report/", "blob-report/", "playwright/.cache/"]
 "# Screenshots" = ["screenshots/"]
-"# VSCode" = [".vscode/*", "!.vscode/extensions.json", "!.vscode/settings.json"]

package/tooling/web/reference.md

@@ -16,8 +16,7 @@ Golden config files live in `tooling/web/configs/` and are copied into the targe
 - `scripts/screenshot.sh`: sources `scripts/lib/preview-server.sh`, then runs the capture against the served preview.
 - `scripts/lib/preview-server.sh`: sourced, never executed. Builds, serves on `PREVIEW_PORT`, blocks until the port answers, and traps the whole process group on exit, including the detached grandchild `lsof` finds. Both capture scripts source it so the startup lives once.
 - `scripts/readme-screenshot.sh`: captures one case under `SCREENSHOT_FILTER` and copies its light and dark frames to `assets/evidence/readme/`. `README_FILTER` ships empty with `header/1280` as its example, and the script exits 1 until a project fills it, since a shipped default would capture the wrong part of the page in every project but one. Its copy reads from `screenshots/<hostname>/`, which is where the harness writes.
-- `.github/workflows/readme-screenshot.yml`: refreshes that frame on a pull request and commits it back to the branch. The path list ships as `REPLACE_WITH_PROJECT_PATHS`, and the job's first step after checkout exits 1 while it stays, since a job that never fires leaves no run and no diff to notice. The workflow's own path is in the list so the installing pull request reaches that step. When a commit-back is right and when a report is, `governance/rules/tooling/700-ci-workflow.md` states the test.
-- `.vscode/extensions.json` and `.vscode/settings.json`: editor wiring for ESLint, Tailwind, Playwright, Vitest.
+- `.github/workflows/readme-screenshot.yml`: refreshes that frame on a pull request and commits it back to the branch. The path list ships as `REPLACE_WITH_PROJECT_PATHS`, and the job's first step after checkout exits 1 while it stays, since a job that never fires leaves no run and no diff to notice. The workflow's own path is in the list so the installing pull request reaches that step. When a commit-back is right and when a report is, `governance/rules/tooling/ci-workflow.md` states the test.
 - `.github/workflows/verify.yml`: `static-checks`, `unit-tests`, `build-verify`, and `e2e-tests` jobs.
 - `scripts/verify.json`: the phases base's verify runner requires here, being typecheck, lint, unit tests, and build. `## Verify script` covers the order and the card exclusion stage.
 - `scripts/worktree-port.sh`: prints a base port plus this working directory's offset. Called with no argument it prints the offset alone. It refuses a folder left under the worktrees directory after its worktree was removed, rather than printing a port for it.
@@ -78,9 +77,8 @@ Sticky negative knowledge. Do not relearn.
 
 ## lint-staged (extend)
 
-- Add `**/*.{js,jsx,ts,tsx}` glob running `eslint --fix --max-warnings 0`, `prettier --write`, `cspell --no-must-find-files`.
+- Add `**/*.{js,jsx,ts,tsx}` glob running `eslint --fix --max-warnings 0`, and `prettier --write`.
 - Extend the prettier glob to include `css`: `**/*.{json,css,md,mdc}`.
-- Each file type runs cspell once via its own glob. No standalone cspell glob.
 
 ## CI docs (extend)
 
@@ -115,7 +113,7 @@ Append rows:
 
 `canon tooling verify <stack>` is the only automated caller of `bun run screenshot`, running it for any stack whose `package.json` declares the script and asserting that PNG files land under `screenshots/`. It counts them with a recursive find carrying no depth limit, so the section folders the seed writes satisfy the assertion without a change to it. Do not flatten the layout to protect that check. No ship chain captures a screenshot, so the output path the seed writes is a contract that one verifier reads rather than a default a ship step depends on.
 
-`governance/rules/ui/440-surface-capture.md` is what asks a session to run the capture after a surface changes. It now fires on every component file too, reversing the route-and-page-only scope this reference once described, after a shipped batch of components carried no capture and a defect went unseen. The rule body states its own exemption for a component the production build strips out, so a reader chasing that case reads it there rather than here.
+`governance/rules/ui/surface-capture.md` is what asks a session to run the capture after a surface changes. It now fires on every component file too, reversing the route-and-page-only scope this reference once described, after a shipped batch of components carried no capture and a defect went unseen. The rule body states its own exemption for a component the production build strips out, so a reader chasing that case reads it there rather than here.
 
 The sweep under `screenshots/` is ignored again, and only a flagged case's `evidence/` output tracks in git, so the first capture a scaffolded target runs after this change is the baseline it commits there. A case naming sections commits a folder per section under that baseline rather than one file per theme, which is what lets a pull request comparison land on the part of the page that moved instead of on one image of the whole of it. The count is the section list times the themes, so a list is worth sizing against how many frames each later change has to regenerate and a reviewer has to read.
 
@@ -128,6 +126,6 @@ The sweep under `screenshots/` is ignored again, and only a flagged case's `evid
 
 ## Verify script
 
-The web layer's `scripts/verify.json` requires `typecheck`, `lint`, `test:run`, and `build`, and base's `scripts/verify.ts` runs them in its fixed order: typecheck, lint, format, spelling, shell, unit tests, build, markdown bans, then the card exclusion check where one is installed. astro, vite-react, and nextjs inherit the list, since the nearest stack's copy wins. An adapter whose phases differ ships its own `verify.json` rather than a script.
+The web layer's `scripts/verify.json` requires `typecheck`, `lint`, `test:run`, and `build`, and base's `scripts/verify.ts` runs them in its fixed order: typecheck, lint, format, shell where the `shell` stack declares it, unit tests, build, markdown bans, then the card exclusion check where one is installed. astro, vite-react, and nextjs inherit the list, since the nearest stack's copy wins. An adapter whose phases differ ships its own `verify.json` rather than a script.
 
 The card stage runs `scripts/check-card-exclusion.sh` whenever that file is installed, which keeps the social card route's build exclusion on the default path rather than behind a flag. It tests for the script rather than the stack, so a project with no card route runs one less stage with no override, and the stack shipping a card route owns what the check reads, being the build the stage before it produced. The astro reference carries the route itself.

package/docs/agents/standards-audit.md

@@ -1,40 +0,0 @@
----
-title: Standard success criteria
-description: Reading the corpus against the success-criterion gate, the two headings it accepts, why the check scopes to arrival rather than the whole corpus, and the exit codes it sets
----
-
-# Standard success criteria
-
-`canon standards audit` reads the corpus at `standards/` and reports which files state a success criterion against which do not, per `standards/standard.md`. It fails only on a standard new to the current branch, never on one already short the section.
-
-Two headings count, at any casing. `## Success criterion` is the wording that standard states the rule under, and `## What a working <document type> looks like` is the wording its template prescribes for the section itself. Most of the corpus writes the templated form, so accepting the rule's wording alone would refuse a conforming standard.
-
-```bash
-canon standards audit
-canon standards audit --json
-canon standards audit --arrivals-only
-```
-
-| Option            | Behavior                                                     |
-| ----------------- | ------------------------------------------------------------ |
-| `[path]`          | Project root, defaulting to the current directory            |
-| `--json`          | Add a machine-readable record on stdout, keeping the frame   |
-| `--arrivals-only` | Run the gating check alone, printing nothing on a clean pass |
-
-## Why arrival rather than the corpus
-
-`standards/standard.md` states that a criterion is added to an existing standard when that standard is next exercised, not in a sweep: a criterion written with no failure to point at is the taste-based edit the rule exists to prevent. Gating the whole corpus would fail every push until every standard already short the section was closed at once, which is the sweep that rule forbids. The check reads the whole corpus and fails only on a file present in the working tree and absent at the branch's merge base, treating a rename into the corpus the same as a standard authored fresh.
-
-## Exit codes and refusals
-
-| Code | Meaning                                                                |
-| ---- | ---------------------------------------------------------------------- |
-| `0`  | every arriving standard carries the section                            |
-| `1`  | refused, with `reason` naming the cause                                |
-| `2`  | a standard new to this branch states no criterion under either heading |
-
-A project authoring no standards refuses with `no-corpus`, the ordinary state of most targets, the same absence `canon claude skills audit` reads as its own `no-corpus`.
-
-## What it does not measure
-
-Presence of the heading is the whole check. The section's content, the questions it must answer or the task it must let a reader complete, is a judgment `canon standards audit` cannot read, so a standard carrying an empty or token section still passes.

package/governance/rules/tooling/765-spelling.md

@@ -1,19 +0,0 @@
----
-description: Route .cspell/ dictionary additions to the right seeded file and keep each sorted
-paths:
-  - '.cspell/**'
----
-
-# Spelling standards
-
-## Dictionary routing
-
-- Rewrite a typo rather than adding it. Add only a real term.
-- Add a term from a tool, library, or platform the project depends on to `.cspell/tech-stack.txt`, whether it is the dependency's own name or vocabulary from its config, API, or spec.
-- Add jargon, an acronym, a handle, or another project-specific term to `.cspell/project-terms.txt`.
-- Leave a dictionary declared `addWords: false` alone. It mirrors a closed set maintained elsewhere in the project rather than approved vocabulary, so route a word there through whatever maintains that set instead of editing the dictionary file.
-- Add a third dictionary only when cspell still flags a term neither file covers. Declare its path in `cspell.json` with `addWords: true` before adding words to it.
-
-## File shape
-
-- Keep every dictionary file sorted alphabetically.

package/governance/stacks/astro.toml

@@ -1,2 +0,0 @@
-extends = "node"
-rules = ["210-astro", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "465-interface-casing","470-motion"]

package/governance/stacks/nextjs.toml

@@ -1,2 +0,0 @@
-extends = "react"
-rules = ["230-nextjs"]

package/governance/stacks/node-server.toml

@@ -1,2 +0,0 @@
-extends = "node"
-rules = ["360-security-server", "370-database"]

package/governance/stacks/python-fastapi.toml

@@ -1,2 +0,0 @@
-extends = "python"
-rules = ["220-fastapi"]

package/governance/stacks/react.toml

@@ -1,2 +0,0 @@
-extends = "node"
-rules = ["200-react", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "465-interface-casing","470-motion"]