@erclx/canon 5.35.0 → 5.36.0

package/claude/skills/plan-feature/SKILL.md

@@ -24,7 +24,7 @@ Read these in parallel from the project root, skipping any that do not exist:
 
 Also read these when the feature touches code or UI. Skip them for prose, docs, catalog, or config-only changes:
 
-- `canon/DESIGN.md`: tokens, typography, spacing, and component rules
+- `canon/DESIGN.md`: visual intent and component rules, with values read from the stylesheet its lead names
 
 Coding standards live in `.claude/rules/`. Claude Code loads them automatically. Path-scoped rules apply to the files they match.
 

package/claude/skills/review-craft/references/ui.md

@@ -59,7 +59,7 @@ A second theme earns a read only when the diff touches a color token. Name the s
 
 ## Comparing
 
-Check each opened image against the layout its checklist box claims, and check `canon/DESIGN.md` for the tokens the image makes visible: color, type scale, spacing, and component rules.
+Check each opened image against the layout its checklist box claims, and check the tokens the image makes visible, being color, type scale, and spacing, against the stylesheet `canon/DESIGN.md`'s lead names, and its component rules against the record itself.
 
 Read the width and theme from whatever the image path carries, and fix no width list, since which widths matter belongs to the project. Skip the design file comparison silently when the project has none.
 

package/claude/skills/test-craft/SKILL.md

@@ -105,5 +105,5 @@ Run the final filter over every test written this session, checking each line. A
 
 - The red, green, refactor procedure and its order: `test-first`, which loads this skill at its first step
 - Reproducing a failure with no known cause: `systematic-debugging`
-- Runner, file suffix, placement, and query conventions per language: `300-testing-ts`, `330-testing-py`, `335-testing-go`, and `336-testing-php`
-- Settle, guard, and run-scope rules inside an end to end file: `305-e2e-reliability` and `306-test-scope`
+- Runner, file suffix, placement, and query conventions per language: `testing-ts`, `testing-py`, `testing-go`, and `testing-php`
+- Settle, guard, and run-scope rules inside an end to end file: `e2e-reliability` and `test-scope`

package/claude/skills/ux-audit/REQUIREMENT.md

@@ -37,4 +37,4 @@ The pass slides into fixing what it finds, and then the audit and the change lan
 - Feature planning, which `plan-feature` owns
 - Verifying one specific change, which `ui-checklist` owns
 - Defining the intent it audits against, which the design document owns
-- Measuring what a running interface costs to paint, block, or shift, which `ux-measure` owns. Contrast stays here rather than going with it, being computable from two color values this skill already reads off the token table.
+- Measuring what a running interface costs to paint, block, or shift, which `ux-measure` owns. Contrast stays here rather than going with it, being computable from two color values this skill already reads off the stylesheet's custom properties.

package/claude/skills/ux-audit/SKILL.md

@@ -10,14 +10,14 @@ metadata:
 ## Guards
 
 - If no UI files exist in the project (no JSX, TSX, Vue, Svelte, or HTML under `src/`), stop: `❌ No UI surfaces found to audit.`
-- If the request asks what the interface costs to paint, block, or shift at runtime, run nothing and name `ux-measure`. This skill reads source and reaches no number a browser produces. Contrast is the exception and stays here, since it is computable from the two color values already in the token table.
+- If the request asks what the interface costs to paint, block, or shift at runtime, run nothing and name `ux-measure`. This skill reads source and reaches no number a browser produces. Contrast is the exception and stays here, since it is computable from two color values in the stylesheet's custom properties, which the design document's lead names.
 
 ## Step 1: read context
 
 Read these in parallel from the project root, skipping any that do not exist:
 
 - `CLAUDE.md`: project type and conventions
-- `canon/DESIGN.md`: visual intent, tokens, typography, spacing rules
+- `canon/DESIGN.md`: visual intent, typography, and spacing rules, plus the stylesheet its lead names for the values
 - `canon/REQUIREMENTS.md`: feature scope and non-goals
 - A committed capture beside the surface's own source, when the project has one. A rendered surface reads differently composed than it reads written, and a capture is the only artifact here that shows the composed result rather than the markup. Absent one, note that this audit reads source only, and keep going. This is a stated fallback, not a stop: a project with no capture yet, or a capture mid-rebuild, still gets a source-only audit rather than losing the skill entirely.
 

package/claude/skills/ux-measure/REQUIREMENT.md

@@ -43,7 +43,7 @@ A session that does start one picks a runner on the spot. The reading then comes
 ## Out of scope
 
 - Judging the interface against stated intent, which `ux-audit` owns
-- Contrast, which is computable from two color values in the token table `ux-audit` already reads. A contrast failure from a color computed at runtime stays invisible to that reader, and the cost is accepted rather than overlooked.
+- Contrast, which is computable from two color values in the stylesheet `ux-audit` already reads. A contrast failure from a color computed at runtime stays invisible to that reader, and the cost is accepted rather than overlooked.
 - Network waterfall, bundle size, and accessibility, which no version of this measures
 - Writing behavioral tests against the interface, which `test-first` and `test-craft` own
 - Fixing what the reading found

package/claude/skills/write-human/references/machine-tells.md

@@ -21,6 +21,7 @@ Work top down. The first three account for most of what a reader calls machine-w
 - [Question as transition](#question-as-transition)
 - [Escalating parallel clauses](#escalating-parallel-clauses)
 - [Empty superlative frames](#empty-superlative-frames)
+- [A colon or comma where the dash was](#a-colon-or-comma-where-the-dash-was)
 
 ## Rule of three
 
@@ -118,3 +119,14 @@ Fix by writing the two claims as two sentences, or by cutting the one that repea
 `one of the most important`, `a critical piece of`, `at the heart of`. The frame ranks a thing against a set the sentence never names.
 
 Fix by stating what the thing does. A ranking survives only where the set is named and the position is measured.
+
+## A colon or comma where the dash was
+
+An agent told to remove an em dash swaps in a colon or a comma and leaves the sentence as it was. The join is the same and so is the pause the dash made, which is the habit the ban was written against.
+
+```markdown
+Bad: The hook fires on every edit: it reads the record the verb wrote.
+Good: The hook fires on every edit and reads the record the verb wrote.
+```
+
+Fix by splitting the sentence in two, or by cutting the clause that only restates the first. A colon after a label or before a list is not this tell.

package/docs/agents/commands.md

@@ -5,7 +5,9 @@ description: Every top-level command with its purpose, each domain's subcommands
 
 # Command catalog
 
-Full help: `canon <command> --help`. Bare `canon --help` lists every top-level command under five headings, Project, Domains, Author and render, Session and ship, and Repo reports, with descriptions cut at 80 columns. Piped into another command, the block prints without its frame glyphs and carries the same text. Behavior notes for the install and sync verbs live in `install-and-sync.md`.
+Bare `canon --help` lists every top-level command under five headings, Project, Domains, Author and render, Session and ship, and Repo reports, with descriptions cut at 80 columns. A pipe gets the same text without the frame glyphs. Behavior notes for the install and sync verbs live in `install-and-sync.md`.
+
+`canon <command> --help` lists subcommands, and `canon <command> <subcommand> --help` a leaf's flags, exit codes, and examples. `canon <command> --help --all` prints both. An unknown subcommand exits 1 under a group taking no operand.
 
 ## Project-level
 
@@ -78,11 +80,11 @@ query = "button, a[href], input, select, textarea, [tabindex]"
 
 ## Domain commands
 
-Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help` lists the flags of any subcommand.
+Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help --all` prints every subcommand's flags.
 
 - `migrate`, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
 - `targets`, in `targets.md`: `list`, `pulls`
-- `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `test-order`, `counts`, `superseded`, `citations`, `restated`
+- `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `detect` (in `gov-detect.md`), `test-order`, `counts`, `superseded`, `citations`, `restated`
 - `tooling`, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
 - `claude`, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
 - `wiki`, in `scripting.md`: `init`
@@ -92,16 +94,17 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 - `slides`, described below: `render`, `list`
 - `demo`, in `demo.md`: `compile`, `run`, `frames`
 - `inventory`, described above: `run`
-- `teach`, in `teach.md`: `list`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
-- `canvas`, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `selection`, `edit`, `editing`, `capture`
-- `sandbox`, in `sandbox.md`: `reset`, `clean`, `check`, `coverage`
+- `teach`, in `teach.md`: `list`, `up`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
+- `canvas`, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `fit`, `arrange`, `selection`, `edit`, `editing`, `capture`
+- `sandbox`, in `sandbox.md`: `run`, `equivalence`, `reset`, `clean`, `check`, `coverage`
 - `tasks`, in `tasks.md`: `next-label`, `archive`, `decline`, `plan-citations`, `plan-answers`, `plan-branch`, `plan-reach`, `plan-link`, `pull-request`, `outcome`, `list`, `validate`
 - `intake`, in `intake.md`: `list`, `answer`
-- `records`, in `records.md`: `validate`, `migrate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
+- `records`, in `records.md`: `validate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
 - `sessions`, in `sessions.md`: `list`, `export`, `import`
-- `worktrees`, in `worktrees.md`: `list`, `reclaim`
+- `worktrees`, in `worktrees.md`: `list`, `reclaim`, `repair-bare-flag` (hidden)
 - `hooks`, in `hooks.md`: `post-merge`
-- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`)
+- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`), `tick` (in `pr-tick.md`)
+- `upstream`, in `upstream.md`: `fetch`, `catalog`, `due`, `advance`
 - `audits`, in `audits.md`: `run`, `list`
 - `gate`, in `gate.md`: `run`
 - `secrets`, in `state-scoped-risk.md`: `scan`

package/docs/agents/comments.md

@@ -29,6 +29,6 @@ This works only because density is a pure function of a tree. Which author or se
 
 ## Degradation sweep
 
-The degradation sweep reads its vocabulary from whichever rule publishes a `## Degradation vocabulary` heading, preferring `.claude/rules/` over `governance/rules/`, so one definition serves the toolkit and every target. Discovery anchors on the heading rather than a filename, because a renumbered rule would otherwise empty the vocabulary while the sweep still reported clean. With no such rule the sweep reports **skipped** rather than zero hits, since finding nothing and looking for nothing mean opposite things.
+The degradation sweep reads its vocabulary from whichever rule publishes a `## Degradation vocabulary` heading, preferring `.claude/rules/` over `governance/rules/`, so one definition serves the toolkit and every target. Discovery anchors on the heading rather than a filename, because a renamed rule would otherwise empty the vocabulary while the sweep still reported clean. With no such rule the sweep reports **skipped** rather than zero hits, since finding nothing and looking for nothing mean opposite things.
 
 `090-code-comments` is the rule that publishes the list, and it ships on the `base` stack. A project that installs or syncs governance for the first time after that rule landed gets a sweep that previously reported skipped, so hits appear where the command used to stay quiet. Edit the backticked terms in the installed copy to change what that project sweeps for. The sweep matches comment text, so a comment naming a term as an example is a hit, and a hit is a prompt to read the line rather than a verdict on it.

package/docs/agents/gov-detect.md

@@ -31,7 +31,7 @@ Both reads stop at depth two, which reaches a service folder and a workspace pac
   "stack": "node",
   "proposals": [
     {
-      "rule": "200-react",
+      "rule": "react",
       "evidence": [{ "kind": "dep", "match": "react", "path": "package.json" }]
     }
   ]

package/docs/agents/index.md

@@ -49,7 +49,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Records](records.md): The two roots a record folder resolves at, claiming the ordinal intake and groundwork share, reading each folder's size and growth, pruning stale scratch, and where validation, the canonical review count, and the private-remote backup are described
 - [Restated instructions](restated.md): Counting the instructions the always-loaded file and every path-scoped rule share with the seed, the skill bodies, and each other, how a match is decided, the three classes, which surface a later edit starts from, and why the sweep reports rather than gates
 - [Routing report](routing.md): Reading per CLAUDE.md section how many bullets name a path, what counts as naming one, when a rule counts as covering it, the two refusals, and why the verb reports rather than gates
-- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the two forms a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
+- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the one form a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
 - [Sandbox](sandbox.md): Scenario routing, the expectation scoring surface, and the coverage census over scenarios and skills
 - [Scripting](scripting.md): The runtime catalogs that replace hardcoded names, what each carries, and a headless invocation per domain
 - [Sessions transfer](sessions-transfer.md): Moving a session to another machine, the export bundle and its manifest, placing it with import, the refusal reasons, and what a resume on the target depends on

package/docs/agents/install-and-sync.md

@@ -19,7 +19,7 @@ removes a stale `.claude/GOV.md` from the retired build. Use
 
 Everything under `.claude/rules/canon/` belongs to the toolkit, so a rule
 there that the toolkit no longer ships is deleted on sync, edited or not. That
-is how a retired rule stops loading in a target. A renamed or renumbered rule
+is how a retired rule stops loading in a target. A renamed rule
 the toolkit declares in `governance/renames.toml` moves instead: the sync
 installs the rule under its new name and deletes the old file, whether or not
 the target's stamp records a stack. Local edits to the old file are not
@@ -34,9 +34,9 @@ groundwork, intake, session, design, readme, and rule copies are deleted as
 retired. The markdown rule is hand-written at `writing/markdown.md` and names
 the `markdown-craft` skill, and `800-prose` retires.
 
-A project's own rules belong under `.claude/rules/project/`, where
-the `create-rule` skill's reference reserves `900-999` for them, and a rule placed under
-`canon/` instead is lost on the next sync.
+A project's own rules belong under `.claude/rules/project/`, where a slug
+the toolkit also ships collides with nothing, and a rule placed under `canon/`
+instead is lost on the next sync.
 
 A sync never deletes a rule that a newer canon release installed. The stamp
 records the newest release that synced governance, and an older binary holds

package/docs/agents/markdown-audit.md

@@ -55,6 +55,16 @@ A relative link's destination resolves against the filesystem, over the same cor
 
 The placeholder exemption is the one live case the corpus needs. Every current instance is a genuine illustration rather than a literal path, and a marker-based override is available for the day a real one needs an exception instead.
 
+### Colons and heading case
+
+Two advisory measures report beside the bans and never fail a run.
+
+The colon measure reports a colon followed by more text in a prose line, outside the label position. A list item's first colon, a bold or code span label, a line-final colon, a time, a URL, and anything inside a code span or a link are left alone. A heading, a table row, and a fenced line are skipped. Each finding carries the line, the column, the line's text, and the word before the colon as `lead` under `colons` in the `--json` entry.
+
+The heading-case measure reports a heading or a frontmatter `title` with a capitalized word after its first, outside code spans and all-caps tokens, under `headingCase`. A proper noun reports as well and is left as it is.
+
+`CHANGELOG.md` is exempt from both, since the release tool writes its headings.
+
 ### Weight, cadence, and length
 
 Bullet and paragraph weight, run depth, the two cadence numbers, and the document length ceiling are each a judgment a reader settles rather than a fact a scan settles. What each measures, the samples behind its checkpoint, and why none of them gates are in `markdown-audit-weight.md`.
@@ -95,6 +105,8 @@ The target push stage excludes `CHANGELOG.md`, unlike every other surface here.
 
 The hook prefers a checkout's own `src/cli.ts` over a globally installed binary, so it and the push stage read one build. A published binary lags a branch by whatever has not been released, which would put a ban kind added on the branch into the push and not into the edit. It reads its findings out of the `--json` record rather than off the exit code, so an older binary still reports where the fallback applies. It reads `bans.emptySets` out of the same record, so a set the verb shipped empty reaches the author as a check narrowed to what it could measure rather than as a clean pass.
 
+It also relays the two advisory measures from the same record. A heading finding reports for the whole file, and a colon finding reports only where the word before the colon and the colon appear in the text the write carried, so an edit is never asked to answer for a colon it left untouched.
+
 That field replaced `bans.missingStandards`, which answered a standard resolving under none of three roots. The set ships with the package now, so the state it named cannot occur and the narrowed check has one cause left, a defect in the build. The hook keeps reading a field either way, since a reader cannot tell a narrowed check from a clean one without it.
 
 Both hooks answer an absent record as well. A completed run always writes the record and a refusal writes none, so an empty one means the verb declined to measure rather than measured and found nothing. The verb needs a git repository to build its corpus and refuses without one, which is a project the seeded hook can be installed into, and reading the findings alone reported that as a clean file.

package/docs/agents/output-shape.md

@@ -40,7 +40,7 @@ Rules:
 └
 ```
 
-Help skips the banner. The `Usage:` line sits directly on `├`. Help writes to stdout because `--help` is documentation, not runtime UI.
+Help skips the banner. The `Usage:` line sits directly on `├`. Help writes to stdout because `--help` is documentation, not runtime UI. `--help --all` on a command prints each block unframed, one after another, and a help request naming an unknown subcommand, under a group that takes no operand of its own, writes its refusal to stderr and exits 1.
 
 ## JSON and `--names` modes
 

package/docs/agents/overview.md

@@ -11,7 +11,7 @@ This folder is an index of what an agent can run and how to run it cleanly from
 
 ## Invocation rules
 
-See `CLAUDE.md` design principles. They apply to every command in this folder.
+`output-shape.md` holds the stream and exit contract. It applies to every command in this folder.
 
 ## Where to start
 
@@ -21,6 +21,6 @@ See `CLAUDE.md` design principles. They apply to every command in this folder.
 
 ## Related
 
-- `CLAUDE.md`: project behaviors and design principles
+- `CLAUDE.md`: project behaviors
 - `.claude/skills/internal-*`: domain-scoped guidance for editing work, in the toolkit checkout only
 - `docs/index.md`: full docs directory

package/docs/agents/rule-citations.md

@@ -1,6 +1,6 @@
 ---
 title: Rule citations
-description: Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the two forms a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
+description: Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the one form a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
 ---
 
 # Rule citations
@@ -28,14 +28,9 @@ Under `--json` the record holds stdout alone and the frame still renders on stde
 
 Two files agreeing is what a drift check measures. Whether either one is right about the tree is a different question, and this is the stage that asks it.
 
-## The two forms
+## The one form
 
-A citation reaches a reader in one of two shapes, and each resolves against a different root.
-
-| Form      | Shape                    | Resolves against                   |
-| --------- | ------------------------ | ---------------------------------- |
-| `path`    | a backticked path        | the root                           |
-| `sibling` | a bare `<nnn>-<slug>.md` | the folder the citing rule sits in |
+A citation reaches a reader as a backticked path, reported under the form `path`, and it resolves against the root. A bare filename is never a citation, since with no folder around it nothing tells a rule from a convention such as `index.md`. A rule pointing at another rule writes its repository path.
 
 A call to the retired standards verb is no form here. A rule holding one fails the shipped-references stage of `canon gate run`, which reads every shipped file for it.
 
@@ -46,7 +41,7 @@ A `path` is anchored on the whole backticked span rather than on a trailing patt
 A rule body is full of backticked spans carrying a slash, and almost none of them names a file in this tree. The stage declines four shapes outright.
 
 - A placeholder or glob segment describes a shape rather than naming a file: `canon/context/<domain>.md`, `app/**/route.ts`, `${CLAUDE_SKILL_DIR}/../references/<name>.md`.
-- A bare filename names a convention: `route.ts`, `manifest.toml`, `components.json`, `playwright.config.ts`. A bare name is read as a citation only when it matches a rule filename, which is how one authored rule would point at a sibling such as `605-worktrees.md`.
+- A bare filename names a convention: `route.ts`, `manifest.toml`, `components.json`, `playwright.config.ts`.
 - A span carrying no file extension is a folder or a module specifier: `src/pages/`, `next/font`, `try/except`, `react-hooks/set-state-in-effect`, `oven-sh/setup-bun@v2`, `@/lib/utils`.
 - A fenced block displays a path rather than pointing at one.
 
@@ -70,7 +65,7 @@ A rule under `governance/rules/` installs into a target, and its `paths:` entrie
 
 `internal/rules/` ships nowhere. The tree it governs is the tree present, which makes the question answerable, and all 14 of its globs across 7 rules match at the commit this shipped on.
 
-What that leaves unreached is a glob that matches real files and still reaches none of the work it was scoped at. `governance/rules/lib/305-e2e-reliability.md` scoped itself at `e2e/*.ts` and `e2e/**/*.ts` and now reads `**/e2e/**/*.ts`. No probe in this repository is written under `e2e/`, so the rule asking a session to watch a new guard fail never fired for the session writing guards. Resolution is mechanical and reach is a judgment about where the work happens, so only the first is here.
+What that leaves unreached is a glob that matches real files and still reaches none of the work it was scoped at. `governance/rules/lib/e2e-reliability.md` scoped itself at `e2e/*.ts` and `e2e/**/*.ts` and now reads `**/e2e/**/*.ts`. No probe in this repository is written under `e2e/`, so the rule asking a session to watch a new guard fail never fired for the session writing guards. Resolution is mechanical and reach is a judgment about where the work happens, so only the first is here.
 
 ## The exemption marker
 

package/docs/agents/scripting.md

@@ -79,7 +79,7 @@ CANON_NON_INTERACTIVE=1 canon tooling diff astro /path/to/project
 CANON_NON_INTERACTIVE=1 canon tooling sync astro /path/to/project --write
 
 # Install a governance stack (the stack argument is required headlessly)
-CANON_NON_INTERACTIVE=1 canon gov install node --add 210-astro,260-shadcn /path/to/project
+CANON_NON_INTERACTIVE=1 canon gov install node --add astro,shadcn /path/to/project
 
 # Update installed governance rules, dropping a retired .claude/GOV.md
 CANON_NON_INTERACTIVE=1 canon gov sync /path/to/project

package/docs/target/projects.md

@@ -72,7 +72,7 @@ Keep the `## Scripts` table in `canon/context/development.md` current as scripts
 Scaffold installs tooling and seeds. It does not fill the planning docs or the design system. Complete those before the first feature session:
 
 1. Fill `canon/REQUIREMENTS.md`. The seed asks for the problem in one line, then goals and non-goals, and the scope is yours to write. The seed states its own cap of 600 words, and `canon context audit` gates on it. Edit the number in the record to loosen it. A decision about how the project is built goes in the `canon/context/` entry of the domain it constrains.
-2. For a UI project, write `canon/DESIGN.md` from the seed template, or work the direction out with `canon:canvas-board` and carry the pick in. Skip for non-UI projects.
+2. For a UI project, write `canon/DESIGN.md` from the seed template and name the project's stylesheet in its lead, or work the direction out with `canon:canvas-board` and carry the pick in. Skip for non-UI projects.
 3. Optionally invoke `canon:draft-figure` naming an architecture view, such as system context or components, and the document it belongs in. It draws the view from the context index, the folder layout, and the requirements and renders it to verify the layout, which downloads the Mermaid CLI on first use and takes about 15 seconds.
 4. Start the feature loop. See [AI workflow](../workflow/ai-workflow.md) for the per-feature sequence.
 
@@ -88,7 +88,7 @@ Escalate for a project writing code. The `target-setup` skill reads `package.jso
 
 In a monorepo the skill reads each folder holding a `package.json`, `pyproject.toml`, `go.mod`, `composer.json`, or `Cargo.toml` to depth two, skipping what git ignores. Each of those folders gets its own tooling stack and a `canon tooling sync <stack> <folder> --skip base` in the preview. Governance still installs once at the root, since a rule's `paths:` globs reach every subfolder, so a subfolder's language rules join the root install through `--add`.
 
-The server-side security and persistence rules belong to no stack. `canon gov detect` proposes both from a server framework or database client in the manifest, which you confirm in the preview, or add them by hand with `--add 360-security-server,370-database`.
+The server-side security and persistence rules belong to no stack. `canon gov detect` proposes both from a server framework or database client in the manifest, which you confirm in the preview, or add them by hand with `--add security-server,database`.
 
 Markdown-heavy projects, CLI tools, docs sites, research notebooks, and scripting repos stay on `base`. Escalation is a ceiling move, not a default.
 

package/docs/target/scenarios.md

@@ -26,7 +26,7 @@ bun create vite my-app && cd my-app
 claude
 ```
 
-Invoke `canon:target-setup`. The skill reads `package.json` and the Vite config, resolves tooling to `vite-react` and governance to `node`, proposes `200-react` and the other rules its manifest matches as extras, and runs `canon init` with the resolved flags.
+Invoke `canon:target-setup`. The skill reads `package.json` and the Vite config, resolves tooling to `vite-react` and governance to `node`, proposes `react` and the other rules its manifest matches as extras, and runs `canon init` with the resolved flags.
 
 Ongoing maintenance:
 
@@ -34,22 +34,22 @@ Ongoing maintenance:
 - Seed drift: merge by hand against the toolkit copy
 - Catch-all sync: `canon sync .`
 - Governance rule refresh only: `canon gov sync .`
-- Layer a new rule on top, for example `260-shadcn` after adopting shadcn: `canon gov install node --add 260-shadcn .`
+- Layer a new rule on top, for example `shadcn` after adopting shadcn: `canon gov install node --add shadcn .`
 
 ## Monorepo with multiple language roots
 
 The repo root owns the shared `base` layer, and each language lives in its own subfolder.
 
 ```bash
-canon init --stack node --add 200-react .
+canon init --stack node --add react .
 canon tooling sync vite-react ./frontend --skip base --write
 canon tooling sync python ./backend --skip base --write
 ```
 
-`--skip base` drops the `base` layer from each subtree sync, so husky, prettier, commitlint, and CI stay single at the repo root. The one exception is base's verify runner, `scripts/verify.sh`, `scripts/verify.ts`, and `scripts/verify.json`, which every subtree still receives so it can verify on its own. Without it, every subtree re-drops husky, and since git honors only one `core.hooksPath` the extra hook dirs silently break. Each subtree still gets its own framework configs (eslint, vitest, tsconfig, vite), and its own stack reference reads through `canon tooling reference <stack>`.
+`--skip base` drops the `base` layer from each subtree sync, so husky, prettier, commitlint, and CI stay single at the repo root. The one exception is base's verify runner, `scripts/verify.ts` and `scripts/verify.json`, which every subtree still receives so it can verify on its own. Without it, every subtree re-drops husky, and since git honors only one `core.hooksPath` the extra hook dirs silently break. Each subtree still gets its own framework configs (eslint, vitest, tsconfig, vite), and its own stack reference reads through `canon tooling reference <stack>`.
 
 A sync whose target sits below the git root knows it is writing into a subfolder:
 
 - It withholds `.github/`, since GitHub reads workflows only at the repository root, and names each withheld file. Run the subtree from a job in the root workflow instead, with `working-directory` set to the subtree path the sync prints, such as `working-directory: frontend`.
 - It installs no dependencies and adds no scripts to a subtree without a `package.json`. It names what it skipped and ends on `run 'bun init' in <path>, then sync again`.
-- The subtree carries no `check` script, since that lives in the root's base layer, so run `./scripts/verify.sh` there. It skips the format and shell phases a subtree does not declare, since the root runs them, and still fails on a missing lint, typecheck, or test script, the phases its stack's `scripts/verify.json` requires.
+- The subtree carries no `check` script, since that lives in the root's base layer, so run `bun scripts/verify.ts` there. It skips the format phases a subtree does not declare, since the root runs them, and still fails on a missing lint, typecheck, or test script, the phases its stack's `scripts/verify.json` requires.

package/docs/workflow/ai-workflow.md

@@ -17,7 +17,7 @@ Project docs split across three roots at the project root. What the project auth
 ```plaintext
 canon/
 ├── REQUIREMENTS.md  ← problem, goals, non-goals
-├── DESIGN.md        ← visual intent and token decisions (UI projects)
+├── DESIGN.md        ← visual intent, pointing at the stylesheet (UI projects)
 └── context/         ← per-domain narrative loaded on demand via index.md
 
 .claude/

package/docs/workflow/visual-design-workflow.md

@@ -14,19 +14,19 @@ The tier framework sits alongside [Claude Design](../../wiki/claude/design.md),
 
 ## Tier 0: prose only
 
-The default. `canon/DESIGN.md` holds visual intent as token tables for color, typography, spacing, and borders, with one Personality paragraph and at most three one-line rules a section, motion and iconography included.
+The default. `canon/DESIGN.md` holds visual intent, being one Overview paragraph, at most three one-line rules a section, and a table naming what each color and shape role is for. Its lead names the stylesheet the values live in, since a hand-typed copy of them drifts from the CSS.
 
 Claude Code reads it and writes the implementation. Works for CLI tools, internal dashboards, admin panels, and backend-focused projects.
 
 ### Seed shape
 
-The toolkit seed in `tooling/claude/seeds/canon/DESIGN.md` ships a token-table template with a starting set of roles, and `claude/skills/canvas-board/references/design.md` carries the same tables under `## Template` with placeholder rows. The column headers are what the renderer parses, so they stay verbatim in either, while the rows and values are the project's own.
+The toolkit seed in `tooling/claude/seeds/canon/DESIGN.md` ships an intent template with a starting set of roles, each naming its custom property, and `claude/skills/canvas-board/references/design.md` carries the same tables under `## Template` with placeholder rows. The column headers are what the parser reads, so they stay verbatim in either, while the rows are the project's own. The seed's lead asks for the project's own stylesheet, such as `src/styles/tokens.css` or a Tailwind `@theme` block, and falls back to `.claude/design/project/` only when the project has none.
 
 `canon design render` writes an HTML plus CSS preview to `.canon/tmp/render/design/` for eyeballing the current system without leaving Claude Code. See `canon/context/design/index.md`.
 
 A project wanting a neutral starting point to override runs `canon design install`, which copies one stylesheet to `.claude/design/base.css` carrying an achromatic token set as custom properties and two components built on them. Greys run from near-black to near-white and the accent is monochrome, so the only palette the project renders is one it writes itself. That file is toolkit-owned and `canon design sync` refreshes it, so a project overrides a value in `.claude/design/project/` instead, which sync never touches. Nothing arrives without that install, and the two channels are independent: a record the project wrote is its own, and the installed stylesheet is the toolkit's.
 
-A cell no source anchors ends in `? verify`, and the preview shows that marker beside the value rather than folding it in, so a swatch and a font sample stay built from the value alone. A confidence line above the sections names how many cells are anchored against how many are tagged, which is what tells a reader whether they are looking at a record of the code or a proposal about it. It reads the columns a source could anchor and leaves out the row names, so the ratio is not diluted by cells no tag could ever reach. The proposal path tags nearly all of them, so that count reads low on day one by design.
+A record generated from a token source carries the values in tables instead, which is the shape this toolkit's own record takes. There a cell no source anchors ends in `? verify`, and the preview shows that marker beside the value rather than folding it in, so a swatch and a font sample stay built from the value alone. A confidence line above the sections names how many cells are anchored against how many are tagged, which is what tells a reader whether they are looking at a record of the code or a proposal about it. It reads the columns a source could anchor and leaves out the row names, so the ratio is not diluted by cells no tag could ever reach. The proposal path tags nearly all of them, so that count reads low on day one by design.
 
 ### Tools
 

package/governance/detect.toml

@@ -21,67 +21,67 @@
 deps = []
 files = [".claude/skills", "claude/skills"]
 
-["700-ci-workflow"]
+["ci-workflow"]
 deps = []
 files = [".github/workflows"]
 
-["775-dependencies"]
+["dependencies"]
 deps = []
 files = ["**/package.json", "**/pyproject.toml", "**/go.mod", "**/composer.json"]
 
-["780-config-comments"]
+["config-comments"]
 deps = []
 files = [".editorconfig", "**/Dockerfile*", "**/*.config.*", "**/.env.example"]
 
-["790-code-comments"]
+["code-comments"]
 deps = []
 files = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "**/*.sh", "**/*.py"]
 
-["130-go"]
+["go"]
 deps = []
 files = ["**/go.mod"]
 
-["140-php"]
+["php"]
 deps = []
 files = ["**/composer.json"]
 
-["200-react"]
+["react"]
 deps = ["react"]
 files = []
 
-["210-astro"]
+["astro"]
 deps = ["astro"]
 files = ["**/astro.config.*"]
 
-["220-fastapi"]
+["fastapi"]
 deps = ["fastapi"]
 files = []
 
-["230-nextjs"]
+["nextjs"]
 deps = ["next"]
 files = ["**/next.config.*"]
 
-["250-tailwind"]
+["tailwind"]
 deps = ["tailwindcss", "@tailwindcss/vite", "@tailwindcss/postcss"]
 files = ["**/tailwind.config.*"]
 
-["260-shadcn"]
+["shadcn"]
 deps = []
 files = ["**/components.json"]
 
-["305-e2e-reliability"]
+["e2e-reliability"]
 deps = ["@playwright/test", "playwright", "cypress"]
 files = ["**/e2e"]
 
-["306-test-scope"]
+["test-scope"]
 deps = ["@playwright/test", "playwright", "cypress"]
 files = ["**/e2e"]
 
-["310-zod"]
+["zod"]
 deps = ["zod"]
 files = []
 
-["320-tanstack-query"]
+["tanstack-query"]
 deps = [
   "@tanstack/react-query",
   "@tanstack/vue-query",
@@ -91,23 +91,23 @@ deps = [
 ]
 files = []
 
-["335-testing-go"]
+["testing-go"]
 deps = []
 files = ["**/go.mod"]
 
-["336-testing-php"]
+["testing-php"]
 deps = ["phpunit/phpunit", "pestphp/pest"]
 files = ["**/phpunit.xml", "**/phpunit.xml.dist"]
 
-["340-pydantic"]
+["pydantic"]
 deps = ["pydantic"]
 files = []
 
-["350-security-web"]
+["security-web"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["360-security-server"]
+["security-server"]
 deps = [
   "express",
   "fastify",
@@ -129,7 +129,7 @@ deps = [
 ]
 files = []
 
-["370-database"]
+["database"]
 deps = [
   "prisma",
   "@prisma/client",
@@ -156,42 +156,42 @@ deps = [
 ]
 files = ["**/migrations", "**/schema.prisma", "**/*.sql"]
 
-["400-ui"]
+["copy"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["410-a11y"]
+["a11y"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["420-forms"]
+["forms"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["430-ux-completeness"]
+["ux-completeness"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["440-surface-capture"]
+["surface-capture"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["450-link-behavior"]
+["link-behavior"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["460-design-taste"]
+["design-taste"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["canon/DESIGN.md", "index.html", "*/index.html"]
 
-["465-interface-casing"]
+["interface-casing"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["470-motion"]
+["motion"]
 deps = ["react", "vue", "svelte", "astro", "next", "solid-js", "preact"]
 files = ["index.html", "*/index.html"]
 
-["480-canvas"]
+["canvas"]
 deps = []
 files = [".canon/canvas"]