@erclx/canon 5.42.0 → 5.44.0

package/tooling/claude/seeds/.claude/hooks/board-validate.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+# Reports what `canon tasks validate` finds after an edit to the task board's
+# ordering file, so a hand edit that broke a table or drifted a derived cell is
+# named in the turn that made it.
+#
+# It reports and never blocks. The board verbs do not yet cover every move a
+# controller makes by hand, so a block here would stop work the verbs cannot
+# yet do. A `Bash` write fires no `PostToolUse` hook for a file, so a heredoc
+# write stays unchecked until the next validate run.
+
+# Claude Code sends a payload and closes stdin. A bare read with nothing feeding
+# it blocks forever and holds the session open, so the read is bounded. `read`
+# rather than `timeout cat`, which macOS does not ship.
+IFS= read -r -d '' -t 2 input
+[ -n "$input" ] || {
+  printf '%s reads a Claude Code hook payload on stdin and cannot be run by hand.\n' "${0##*/}" >&2
+  exit 1
+}
+
+tool=$(printf '%s' "$input" | jq -r '.tool_name // empty')
+case "$tool" in
+Write | Edit | MultiEdit) ;;
+*) exit 0 ;;
+esac
+
+file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // empty')
+
+# Both record roots, since a project the move has reached keeps its records
+# under `.canon/`. The root comes from the path rather than the session, since
+# the board resolves at the main worktree root and a linked worktree's session
+# edits it from outside its own project directory.
+case "$file_path" in
+*/.canon/tasks/priority.md) base=.canon ;;
+*/.claude/tasks/priority.md) base=.claude ;;
+*) exit 0 ;;
+esac
+root="${file_path%/"$base"/tasks/priority.md}"
+[ -n "$root" ] || exit 0
+
+report() {
+  jq -nc --arg msg "$1" \
+    '{hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:$msg}}'
+  exit 0
+}
+
+if ! command -v canon >/dev/null 2>&1; then
+  report "canon is not on PATH, so the board edit was not validated. Run canon tasks validate by hand."
+fi
+
+# Exit 2 carries findings, so the status is read off the record rather than
+# the exit code.
+record=$(canon tasks validate --json --root "$root" 2>/dev/null)
+ok=$(printf '%s' "$record" | jq -r '.ok // empty' 2>/dev/null)
+
+if [ "$ok" = false ]; then
+  report "canon tasks validate refused the board after this edit: $(printf '%s' "$record" | jq -r '.message // .reason')"
+fi
+[ "$ok" = true ] || report "canon tasks validate wrote no record after this edit, so the board was not validated."
+
+findings=$(printf '%s' "$record" | jq -r '.findings[] | "- \(.kind): \(.subject) \(.message)"' | head -10)
+[ -n "$findings" ] || exit 0
+
+report "The board edit left findings. Rewrite the rows through canon tasks place, promote, move, or block, which derive every cell but Waiting on.
+$findings"

package/tooling/claude/seeds/.claude/settings.json

@@ -1,4 +1,8 @@
 {
+  "autoMemoryEnabled": false,
+  "permissions": {
+    "deny": ["Agent", "Task"]
+  },
   "hooks": {
     "PreToolUse": [
       {
@@ -50,6 +54,10 @@
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/records-index.sh"
           },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/board-validate.sh"
+          },
           {
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/path-form.sh"

package/tooling/claude/user/settings.template.json

@@ -1,8 +1,4 @@
 {
-  "attribution": {
-    "commit": "",
-    "pr": ""
-  },
   "permissions": {
     "allow": ["Bash(bun run *)"],
     "deny": ["Read(**/.env)", "Read(**/.env.*)"]

package/tooling/cloudflare/configs/.github/workflows/deploy.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -50,7 +50,7 @@ jobs:
         run: bun run build
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist
@@ -84,7 +84,7 @@ jobs:
       # as dead weight breaks the deploy on every push.
       - name: Checkout
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         if: steps.secrets-check.outputs.skip == 'false'
@@ -94,7 +94,7 @@ jobs:
 
       - name: Download artifact
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist
@@ -104,7 +104,7 @@ jobs:
       - name: Publish
         id: publish
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/tooling/public/configs/.github/dependabot.yml

@@ -0,0 +1,12 @@
+# canon-no-seed: an add-on stack's config with no root counterpart by design.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+    groups:
+      actions:
+        update-types: [minor, patch]

package/tooling/public/configs/.github/workflows/release-please.yml

@@ -0,0 +1,30 @@
+name: Release
+# canon-no-seed: an add-on stack's workflow with no root counterpart by design, since the toolkit cuts its own releases through its own workflow.
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  release-please:
+    name: 🏷️ Release Please
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    # Queues rather than cancels, since a cancel can land after the release exists and before its outputs do
+    concurrency:
+      group: release-please
+      cancel-in-progress: false
+    steps:
+      - name: Release Please
+        uses: googleapis/release-please-action@v5
+        with:
+          # A personal token lets CI run on the release pull request, which the default token's bot author does not
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

package/tooling/public/manifest.toml

@@ -0,0 +1,8 @@
+[stack]
+name = "public"
+extends = ""
+runtime = "bun"
+scaffold = ""
+
+[sync]
+source = "configs"

package/tooling/public/reference.md

@@ -0,0 +1,53 @@
+# Tooling public reference
+
+## Overview
+
+The public stack is an add-on that ships the open-source files a public repository carries. It extends nothing and syncs beside any other stack at the same root with `canon tooling sync public . --write`.
+
+## Seeds
+
+A seed is copied only when its path is absent, so a project's filled `LICENSE`, `SECURITY.md`, or `CONTRIBUTING.md` is never overwritten. Fill each `<placeholder>` after the first sync.
+
+### Policy files
+
+These three name the project's owner and terms.
+
+- Use MIT for `LICENSE`, which needs a year and a holder. Swap the text by hand for a different license.
+- Point `SECURITY.md` and the issue chooser at GitHub private vulnerability reporting only, with no email.
+- Switch private reporting on under the repository's Settings, Code security.
+- Ship no `CODE_OF_CONDUCT.md`. Add one when outside contributors arrive.
+
+### Issue forms
+
+`bug.yml`, `feature.yml`, and `config.yml` turn blank issues off.
+
+- Add fields specific to the project, such as its CLI's version command, by hand.
+
+### Release files
+
+These two start release-please at version zero.
+
+- Start `release-please-config.json` on the `simple` release type, with `initial-version` `0.0.1` and `bump-minor-pre-major` on.
+- Switch the type and add `extra-files` for a package that carries its version in a manifest.
+- Start `.release-please-manifest.json` at `0.0.0`.
+
+## Release workflow
+
+`release-please.yml` is a config, so each sync overwrites it and a fix reaches every public repository.
+
+- Run it on every push to `main`. It keeps one release pull request open and tags the release when that pull request merges.
+- Publish nothing. A project that publishes a package adds its own workflow keyed on the release, and never edits this one.
+- Open the release pull request with `RELEASE_PLEASE_TOKEN` when the secret exists, and fall back to the default token otherwise.
+- Set the secret to a personal token so CI runs on the release pull request, since the default token's author does not start it.
+- Keep the token read-only at the top, with `contents: write` and `pull-requests: write` on the one job.
+
+## Dependabot
+
+`dependabot.yml` is how an existing repository keeps its seeded workflows' action majors current, since a seed never updates after install.
+
+- Update `github-actions` weekly with an `ci` commit prefix.
+- Group minor and patch updates into one pull request per run, and leave majors ungrouped so each arrives alone.
+
+## Beside another stack
+
+Run `canon tooling sync public . --write` on a repository that already carries a stack. The install stamp keeps the core chain and lists the add-on after it.

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Something does not work as expected
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Run `<command>`
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: The smallest input that shows the problem. Paste it, or link a repository or gist.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The release or commit you ran.
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and version
+      placeholder: Node 22.12.0, or Bun 1.3.0
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: macOS 26.1, Windows 11, Ubuntu 24.04
+    validations:
+      required: true

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/<owner>/<repo>/security/advisories/new
+    about: Report it privately rather than in a public issue.

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Suggest something this project should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: job
+    attributes:
+      label: The job
+      description: What you were trying to get done when the project fell short, and how you work around it today.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like
+      description: The behavior you have in mind, if you have one.

package/tooling/public/seeds/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

package/tooling/public/seeds/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to <project>
+
+This page covers getting a working checkout, how to test a change, and the commit and pull request rules the hooks enforce.
+
+## Setup
+
+<Prerequisites, such as the runtime and its minimum version.>
+
+```bash
+git clone https://github.com/<owner>/<repo>.git
+cd <repo>
+<install command>
+<check command>
+```
+
+<What the install step activates, such as git hooks, and what the check command runs.>
+
+## Layout
+
+| Path     | What it holds |
+| -------- | ------------- |
+| `<path>` | <role>        |
+
+## Tests
+
+<The commands that run the tests and what each one covers.>
+
+## Commit messages
+
+Commits follow [Conventional Commits](https://www.conventionalcommits.org), and release-please reads them to cut each release.
+
+- The header reads `<type>(<scope>): <subject>`, such as `fix(server): close the socket on shutdown`
+- The header is at most 72 characters
+- The first word of the subject is lowercase, and the subject ends with no period
+
+The types are `feat`, `fix`, `refactor`, `docs`, `chore`, `perf`, `test`, `style`, `build`, `ci`, and `revert`.
+
+## Pull requests
+
+Branch from `main` and open the pull request against it. Say what the change does and why, which files it touches, and how you tested it.
+
+CI runs on every pull request, and a pull request merges once it passes. Keep each one to a single concern. A refactor that a feature needs reads better as its own pull request ahead of the feature.
+
+## Releases
+
+release-please cuts every release from the conventional commits on `main`. Each push to `main` keeps one release pull request open, holding the next version and its `CHANGELOG.md` entry. Merging that pull request tags the release.
+
+## AI-assisted contributions
+
+Contributions written with a coding agent are welcome. You are the author of what you submit, so read every line before you open the pull request and be ready to explain it.

package/tooling/public/seeds/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) <year> <holder>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/tooling/public/seeds/SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+<One sentence on what in this project is security-sensitive.>
+
+## Reporting a vulnerability
+
+Report it privately through GitHub's [private vulnerability reporting](https://github.com/<owner>/<repo>/security/advisories/new). Do not open a public issue for it.
+
+Include the version, your OS, and the steps that reproduce the problem. You get a reply in the advisory thread.
+
+## Supported versions
+
+Only the latest release receives fixes.

package/tooling/public/seeds/release-please-config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "include-component-in-tag": false,
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "changelog-path": "CHANGELOG.md",
+      "initial-version": "0.0.1",
+      "bump-minor-pre-major": true
+    }
+  }
+}

package/tooling/shell/configs/.github/workflows/shell.yml

@@ -7,13 +7,16 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   shell-checks:
     name: 🐚 Shell Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/web/configs/.github/workflows/readme-screenshot.yml

@@ -20,6 +20,9 @@ concurrency:
   group: readme-screenshot-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   capture:
     name: 🖼️ Refresh README Screenshot
@@ -32,7 +35,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref }}
 
@@ -48,7 +51,7 @@ jobs:
           fi
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -62,7 +65,7 @@ jobs:
 
       - name: Cache Playwright Browser
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-chromium-${{ hashFiles('**/package.json') }}

package/tooling/web/configs/.github/workflows/verify.yml

@@ -9,16 +9,19 @@ concurrency:
   group: verify-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   static-checks:
     name: 🔍 Static Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -44,10 +47,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -67,10 +70,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -86,7 +89,7 @@ jobs:
         run: bun run build
 
       - name: Upload Build Output
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: build-output
           path: dist/
@@ -98,10 +101,10 @@ jobs:
     needs: [static-checks, unit-tests, build-verify]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -114,7 +117,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Download Build Output
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: build-output
           path: dist/
@@ -124,7 +127,7 @@ jobs:
 
       - name: Cache Playwright Browsers
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('**/package.json') }}
@@ -139,7 +142,7 @@ jobs:
         run: bun run test:e2e --project=chromium
 
       - name: Upload E2E Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report