@erclx/canon 5.44.0 → 5.45.0

package/README.md

@@ -165,7 +165,7 @@ git init
 canon init
 ```
 
-`canon init` installs base tooling configs, Claude seeds, and governance rules in one pass, and scaffolds a `.claude/wiki/` stub for your project's own reference pages.
+`canon init` installs base tooling configs, Claude seeds, and governance rules in one pass.
 
 - Governance defaults to the `base` stack, so a bare init lands the workflow and doc-authoring rules in `.claude/rules/`.
 - Each rule names the skill it loads, so no corpus is copied into your project.

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
-  "version": "5.44.0",
+  "version": "5.45.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/canon-cli/SKILL.md

@@ -33,7 +33,6 @@ Consult to pick the `canon` verb for a job, and before running a verb that write
 | Install or sync governance rules                                | `canon gov`     |
 | Sync a tooling stack's configs and seeds, or read its reference | `canon tooling` |
 | Set up or sync the Claude workflow                              | `canon claude`  |
-| Scaffold a wiki                                                 | `canon wiki`    |
 | Regenerate the `index.md` files                                 | `canon indexes` |
 | Read a toolkit reference doc                                    | `canon docs`    |
 

package/claude/skills/design-taste/REQUIREMENT.md

@@ -27,7 +27,7 @@ A session handed either one unfiltered adopts a stack the project does not use,
 - Enumerate the layers in settle order, so an instruction to name one has a catalog behind it
 - State that a round varies one layer, and that a complaint is worked at the lowest layer it reaches rather than the cheapest one to change
 - Carry grey-boxing as the operational form of the ordering rule, since removing the higher layers from view is what makes a lower one judgeable
-- Cite the correctness floor rather than restating it. `copy`, `a11y`, `forms` and `ux-completeness` already carry accessibility, keyboard, forms, states and rendered copy on the rendered paths, and a second copy here drifts with nothing comparing the two.
+- Cite the correctness floor rather than restating it. `copy`, `a11y`, `keyboard`, `forms` and `ux-completeness` already carry accessibility, keyboard, forms, states and rendered copy on the rendered paths, and a second copy here drifts with nothing comparing the two.
 - Hold in the body what every design moment pays for, being the read, the layers, the ordering, grey-boxing and the locks, and defer everything a single moment needs.
 - State what has to stay constant across a whole surface, since coherence is a property of the whole and each of those is broken one section at a time.
 - Detect the mode before reading anything when a surface already exists, and name what cannot change silently, since a slug, a field name or an analytics event breaks something outside the surface.
@@ -66,7 +66,7 @@ A rule failing any of the four is recorded as considered and declined rather tha
 
 ## Out of scope
 
-- Accessibility, keyboard interaction, ARIA and alt text, which `a11y` owns on every rendered path
+- Accessibility, ARIA and alt text, which `a11y` owns on every rendered path, and keyboard interaction, which `keyboard` owns
 - State coverage, empty and loading treatment, destructive confirmation and truncation, which `ux-completeness` owns
 - Validation timing, error placement and save blocking, which `forms` owns
 - Rendered copy casing, button labels and error wording, which `copy` owns

package/claude/skills/pick-by-eye/REQUIREMENT.md

@@ -7,80 +7,30 @@ description: Why a decision settled by looking needs its own surface, and where
 
 ## Gap
 
-Without this skill, a session facing a decision nobody can settle from a diff:
+Without this skill, a session facing a decision settled by looking describes the options in prose or ships one answer to a taste call. The operator never sees what they chose between. A drafted set varies several properties or the wrong layer, sits in the real surface, and mixes themes and widths, so no pick names what decided it.
 
-- Describes two options in prose and asks the operator to choose. The operator decides by looking, so a described option is not an option and the answer that comes back is arbitrary.
-- Produces one answer for a decision that was taste, so the operator never sees what they were choosing between and the call is taken silently by whoever wrote the code.
-- Reports that a candidate reads well without rendering it, so the claim rests on the markup having been written rather than on the page having been seen.
-- Hands over one image per arm, which asks the operator to hold the differences in memory rather than showing them. The comparison is the artifact and a set of separate files is not one.
-- Varies three properties at once across the arms, so the pick cannot say which difference decided it and the next iteration guesses.
-- Writes the candidates into the real surface, so the losing arms have to be unpicked out of a tree the operator has not judged yet, and a variant left behind a flag becomes a second design nobody maintains.
-- Stops the loop when the arms stop differing rather than when the operator says the pick is right, which ends the run on the session's own patience.
-- Reads a driver record as a verdict and drops an arm on it. `canon drive` reports findings and never gates, so a run filtering the arms on a probe reading has made a claim the probe catalog has not earned.
-- Reads a color without compositing its alpha, samples a round control at the corner of its bounding box, or confirms a panel's dimensions while it sits above the viewport. Each reads as a passing measurement about something no reader sees.
-- Meets a machine with no browser binary and reports on the arms anyway, since nothing in the default flow separates a render that failed from one that was never attempted.
-- Hand-writes a mockup of a surface a running app already serves, which drifts from what ships by a few pixels and a few words the moment the app's own markup or stylesheet moves on.
-- Varies a property the decision is not about, which satisfies the one-property rule and produces a set differing in the layer a reader notices least. Five palettes over one identical page read as five skins of one design, and the operator rejected the whole set on sight.
-- Renders each arm in whatever theme it happens to carry, so a set spanning both themes cannot be compared without the operator toggling every arm and holding the earlier ones in memory.
-- Looks at a render to confirm it came out rather than to judge whether it is worth showing, which satisfies the rule against reporting an unseen result and still hands over weak work.
-- Writes the run's renders to a scratch path outside the record that cites them, leaving the folder holding source markup and none of the images, so the judgment is unreachable to everyone except the session that made it.
-- Narrows the page onto the picked arm in place on each iteration, so every earlier round is overwritten and a later pass cannot see what was already rejected.
-- Names no layer at all, since the instruction to name one carries no catalog to name from and nothing reports the omission. Four consecutive rounds against one page each varied a property at the top layer while the defect sat two below it, and three of the four changed nothing the operator could see.
-- Judges a lower layer through a finished higher one, so an operator asked about composition looks at the palette instead and answers about that.
-- Hands over the combined page alone for a decision about layout, where every arm sits in a column while the media queries answer to the whole window, so no arm is ever seen at its own viewport and a fault that appears only narrower survives the pick.
-- Rebuilds a navigation harness by hand on a run with several rounds, since each round writes its own folder and nothing reaches all of them from one address. Two design tracks hand-wrote the same page picker and theme toggle.
-- Meets a session with no canvas server and drafts into a file instead, which leaves the operator a second surface to open and the run a second close to remember. The canvas is the one drafting surface, so a run without one starts it rather than falling back.
-- Puts the pick question with no address in its output, after capturing the page and reading the image back. The operator then has to ask for a served page before they can look, so the question goes unanswered or gets answered blind.
-- Sets the theme on an arm that persists its own and reads it back on load, so the control reports one theme while the arm renders the other and the set is compared across two.
+The evidence fails as well. Arms get reported without being rendered or judged, a driver finding reads as a verdict, and the pick question arrives with no address to look at. Renders land in scratch, each round overwrites the last, and the losing arms vanish with the run's pages.
 
 ## Must
 
-- Produce three to five arms with the shipping state among them, each carrying an id, a label, and what the arm costs.
-- Draft every arm of a round as one self-contained frame on one canvas page and capture that page once as a composite, so the comparison arrives as one image, except where the surface under decision is a running app: there each frame links a copy of the built stylesheet inside the page folder rather than inlining it, per `references/live-arms.md`.
-- Start the canvas when none is serving, and stop on a canvas that refuses to start or answers with a blank shell, rather than drafting into a file.
-- Emit the layer in the run's own output, drawn from the catalog `design-taste` fixes rather than from a word invented per run, and vary the arms at that layer alone. A layer held privately is one nothing can report missing, which is how the instruction went unfollowed while every round passed its own rules.
-- Grey-box the set when the declared layer sits below typography, and say the set is grey-boxed when handing it over, so the operator reads a flat page as the question rather than as unfinished work.
-- Theme every arm off the attribute the canvas toggle sets on each frame, so one control sets the whole set and the comparison holds still while the operator reads it, and give no arm a script that reads a stored preference back on load over the toggle.
-- Give each frame the width the arm is judged at, since a frame renders at its own layout width and answers how an arm behaves at a width where a column on a shared page could not.
-- Judge each render against a stated bar before handing it over, name the weakest thing on the page, and fix it where that sentence would embarrass the work.
-- Write each iteration to its own canvas page rather than narrowing the previous one in place, so every earlier round stays openable from the canvas page list.
-- Write the run's renders inside the record that cites them wherever one exists, and reserve the scratch path for inputs that are re-runnable and cited by nothing.
-- Render before reporting on any arm, and report a missing browser binary as a refusal naming the repair rather than describing an arm nobody has seen.
-- Take the pick through the structured question surface, with the recommendation ranked first and marked, and every option carrying its cost. Read the canvas selection only to resolve an answer that points at it, and treat an empty or stale selection as no answer.
-- Keep every write inside the run's own canvas pages until the pick is final.
-- Apply the winning arm in one change.
-- Capture every arm from the round the pick came from, whichever round that is, as an image named for its frame before deleting the run's pages, rather than discarding the losing arms with them.
-- Delete only the canvas pages the run itself added, recorded as it adds them, and stop only a canvas server the run itself started.
-- Resolve the archival capture's destination against the main worktree root, never against a linked worktree the run happens to be building in.
-- Put the candidates on the canvas on every run, whatever the decision's layer, and emit the canvas link ahead of the first pick question, so the operator can open the page the question is about and a still is never the only address.
+- Three to five arms, the shipping state among them, each carry an id, a label, and a cost, and vary only at a layer named from the `design-taste` catalog
+- Each round is one canvas page of frames at their judged widths, themed by the canvas toggle and captured once as a composite, with the link ahead of the first pick question
+- Every arm is rendered and judged against a stated bar before handover, and a missing browser or a canvas that will not start is reported as a refusal
+- The pick comes through the structured question surface with the recommendation first and every option's cost, and the winner lands in one change
+- Every round stays openable on its own page until the pick, and the picked round's arms are captured into the citing record at the main root before the run's pages go
 
 ## Must not
 
-- Take the pick where two arms are both defensible and the difference is taste. That call is the operator's, and taking it silently is the failure this skill exists to prevent.
-- Draft candidates for a decision the operator has not asked to make. Each arm costs a render, and a run offering options everywhere spends their attention rather than saving it.
-- Restate the mechanics of the canvas, the render, or the probes. `canon canvas` and `canon drive` own those and their help text is the source, so a second copy here hands one case two answers.
-- Read a `canon drive` finding as a gate over the arms.
-- Fire on a request that already names one answer.
-
-## Guards
-
-The refusal strings sit in the body, since the runtime loads that file and ignores this one. Two conditions stop a run: a request naming one answer and asking for it to be built, and a decision with no visible form for a render to show.
+- Take the pick where two arms are defensible and the difference is taste
+- Draft candidates for a decision the operator has not asked to make, or for a request that already names one answer
+- Write into the real surface before the pick is final
+- Restate the mechanics `canon canvas` and `canon drive` own, or read a drive finding as a gate over the arms
+- Delete a canvas page or stop a server the run did not start
 
 ## Out of scope
 
-- `plan-feature` plans the work once the answer is settled, and declares the pull request boundary its plan carries. This produces the answer to pick from and stops before the plan.
-- `ux-audit` reads source to find roughness and reports it. This takes its input from the operator and changes nothing until they pick.
-- `ux-measure` measures what a running interface costs to paint. This measures whatever a visual claim depends on, which is usually geometry or contrast rather than cost.
-- `ui-checklist` writes what to look at on a change already made. This runs before there is a change to look at.
-- `script-screencast` scripts a recording of something already built. This has nothing built yet.
-- `canon canvas` owns the page, the frames, the selection, the address, and the render, and `canon drive` owns the probes. Both are invoked rather than reimplemented.
-
-### What did not travel
-
-This descends from a project-local skill whose interactive half was written against one repository. Three of its capabilities do not travel, and the two verbs above are what stands in their place:
-
-- An arm switcher compiled into the project's own page, driven by a query parameter. A canvas page of frames replaces it, which puts the arms on the canvas rather than in the source and removes the call site a run had to remember to delete.
-- A copy cycle keyed to canonical page text held in a second repository. No toolkit surface has that shape, so a project holding one owns the second edit and this skill states nothing about it.
-- A walker that reads every control on every page and groups them by treatment. `canon drive` probes one page and reports findings, so a sweep across every surface of a site is out of reach here and a run needing one measures by hand.
-
-The capture mechanics traveled with a change of owner rather than being lost. They sat in a project-local path-scoped rule that fired whether or not the skill ran, and `canon canvas capture` owns them here, which is why this file bars restating them rather than naming a rule to defer to.
+- Planning the work once the answer is settled, which `plan-feature` owns
+- Finding roughness by reading source, which `ux-audit` owns
+- Measuring what a running interface costs to paint, which `ux-measure` owns
+- Listing what to look at on a change already made, which `ui-checklist` owns
+- Scripting a recording of something already built, which `script-screencast` owns

package/claude/skills/role-orchestrator/REQUIREMENT.md

@@ -7,113 +7,30 @@ description: What the one warm control session owns, why it plans and dispatches
 
 ## Gap
 
-Without this skill, the session holding the cross-feature picture starts building, and the picture goes with it. Two features land where one depends on the other or consumes a contract the other changes, because nobody read their plans against each other, and the second pull request rebases onto a tree it was never planned against. Findings from a merged pull request stay in a thread nobody re-reads, so the rule they should have changed never changes. Holding on one shared path costs as much, and ran six canvas rows one at a time on 2026-10-04 though no practitioner source serializes on a shared file.
+Without this skill, the control session builds or merges, and the cross-feature picture goes with it. Plans go out unread against each other and a moved tree, the queue empties or fills with whatever is oldest, a parked row's blocker is never re-tested, and a second orchestrator writes a board neither can read.
 
-The queue fails in both directions. It empties and a free worker waits, or it fills with whatever is oldest rather than with what establishes a mechanism. A plan handed over unverified is the quiet one, since it goes stale from whatever merged after it was written, and a worker that trusts its account of the tree builds against a shape that no longer exists. A second orchestrator makes all of this unrecoverable, because the board is gitignored and neither session can read the other's writes.
-
-Refilling on a merge and on a thinning ready list leaves the window between them unwatched. A wave mid-build has merged nothing and has moved no rows, so both conditions stay silent across the whole build and the wave finishes into an empty queue, which lands planning on the critical path directly after the stretch where it would have cost nothing.
-
-Every one of those triggers looks forward, so a row already parked is measured once and re-tested never. A blocker cell is a claim about the tree that was true the day it was written, and a merge changes the tree under every parked row at once rather than under the rows naming it. A row therefore sits on a condition that stopped holding weeks earlier with nothing reporting the gap.
-
-Re-measuring one goes wrong twice over, and both ways return a confident number rather than an error. A count read looser than its consumer defines the shape answers a question nobody asked, and a condition measured against the tree at hand reads as unreachable while it stays live in the corpus a shipped command runs against. Waiting is not evidence either, and a task conflicting with everything by construction gets re-measured every pass rather than split.
-
-Writing those plans against the tree alone is the second half, since several branches are already changing the shape a plan describes. A plan carrying a bare path list rather than a constraint per in-flight track leaves the worker guessing which act each path forbids, which is the dangling citation the rule against bare paths already exists to prevent.
-
-The session also writes surfaces it is told only how to read. With no stated method for rewriting the priority file, a session invents one that can exit clean on a non-match, carry prose where a plan pointer belongs, or keep a pointer to a plan a worker's branch archived, and each reads as correct until a dispatch spends on it.
-
-The ban on writing at all fails on a different axis, which is that nothing enforces it and a session weighs proportionality against it. A one-line prose correction found while orchestrating satisfies the root instruction to handle a small edit immediately and violates this rule, and a session given no statement of which one wins takes the smaller apparent cost and authors the change.
-
-That removes the independent pass the repository built to catch what a self-review misses, and the vantage does not come back, since no later session can review the change without re-deriving the context that produced it. A correction no open task owns has nowhere to go either, so the route matters as much as the ban.
-
-The contract also stops one state short of what the session holds. Its sections cover what the human launches and what they review, and a self-dispatching session adds a third that sits between them for ten to thirty minutes, which a session reports under no section while the launch section keeps recommending a plan a worker is already building.
-
-Output drifts everywhere the contract stops. The specified shape covers invocation alone, so a sweep report, a board report, and an analysis each end in a decision the human owns and each buries it under the evidence they would have skipped. A compaction is the same failure one step earlier, since the file that survives it has a stated reader and no stated writer, and the session improvises what to save and loses the reasoning the board never held.
-
-Naming that reader without naming the way in fails on the next axis, and it fails circularly. The command that routes a resume request lives in this body, which is the surface a long session is likeliest to have dropped, and dropping it is the condition the handoff exists to survive, so the session holding a complete handoff cannot reach the runbook that reads it back. The review poll is lost in the same moment and recovered by neither, since it is session-scoped and the resume performs no restart, which leaves a reader who follows the whole handoff with a board and no trigger.
-
-The runbooks the session cannot run from memory fail on a third axis, which is where they are kept. A runbook reached by an installed path is a dependency on a channel this skill does not travel on, so a project holding the plugin and running no install follows the citation to nothing, and nothing reports the break because a missing file produces no error until someone opens the path.
-
-Every one of them therefore has to ship inside the skill. The review trigger fails on an axis of its own when it names one client's command as the way to start the loop, since the file ships to every target holding the plugin and a client without that command reaches no path.
-
-The dispatch's return leg is unplaced for the same reason. A reply reaches this session as a message and settles a finding, corrects which session holds which branch, or names a gate a worker's edits pass through, and reading it is the whole of what happens to it. Both sessions then end, so the half that belonged on the pull request never reaches it and the half that belonged on the board is rediscovered by whoever needs it next.
-
-Both halves of that channel are written here and one of them is performed elsewhere, so a worker owes what nothing it loads states. The review trigger inherits the same asymmetry: firing on a dispatch spends an interval against a building worker that has no pull request, and a trigger matching pull requests alone stays silent through a worker that crashes, which only a roster read the poll script cannot make would catch.
-
-Cost never enters the decision to widen a wave. The rule weighing how many tracks to open measures conflict and review attention, and both describe what a worker writes rather than what the loop spends. Claude Code delivers a message from another session as a fresh turn carrying the whole accumulated context, and a recurring poll bills that same window on its own interval, so a wave's spend tracks this session's context rather than the work coming back. The one setting that bounds it reads as available to whoever finds it, and the two values that would bound it break the handback the loop runs on.
-
-Dispatch parts from what it checked in three ways. The gate and the worker each derive the branch from their own reading of one plan and reach different strings, a launched worker inherits its launcher's model rather than the configured default, and a declared file set does not hold, since a track crosses the set its plan named.
+The channel fails at every hand-off. A finding or a reply stays in a thread nobody re-reads, a dispatch launches a branch other than the one the check cleared, a wave's cost grows unweighed, a report buries the human's decision, and a compaction loses the way back in.
 
 ## Must
 
-- Read the priority file for execution order, since the index sorts by filename and states no order
-- Report the state of play so the human knows what to launch, what to review, and what to merge
-- Verify a plan against the tree before handing it over, counting the sites it claims and opening the files it describes
-- Hold a candidate only on a dependency, a contract, a relocation, a sweep, or a stated reason, since those predict a conflict a merge cannot settle and a shared file does not
-- State what a wave costs in inbound turns beside the conflict rule, and name the control that bounds it together with the reason it stays unset, since a lever recorded without its conclusion reads as available to set
-- Place every finding a merged pull request produced against the surface that owns it, and write the board so a row's readiness and hold claims stay checkable
-- Place what the return leg carries by what it changes, sending an answer that settles a finding onto the pull request and one that corrects this session's model of the world to the task owning that surface, since neither becomes a record by being read
-- Keep one planned, non-conflicting task in reserve beyond what is running
-- Refill the queue while a wave is still building, rather than on a merge and a thinning list alone, since neither of those fires across the window planning costs nothing
-- Carry a constraint naming each in-flight track's file set in every plan written from here, stating per set which of the two acts it forbids, since a bare path list leaves a broken citation in place
-- Carry a slot for this session's own workers mid-build, and withhold their plans from the launch slot, since the two other slots cover what a human launches and what they review and nothing between
-- Start the review poll on an open pull request rather than on a dispatch, and keep the dispatch as a fallback for an announcement that never arrives, since the script reads pull requests and a building worker has none
-- Point at the worker's own skill for the announcement, the block message, and the board ban, rather than holding the only written copy of obligations this session does not perform
-- Ship the roster-and-pull-request watch as a script beside the poll, since the loop that covered the gap lived in one session's temporary directory against a hardcoded path and died with that session
-- Lead a sweep report, a board report, and an analysis with the state, the open decisions, and the next action, keeping the evidence below them
-- Write the pre-compact handoff with what no other file carries, and name the runbook that reads it back
-- Carry the resume invocation and the owed poll restart in the handoff file itself, not in the runbook that writes it alone, since the file is what survives a compaction and the runbook is what a session has to already be holding to read
-- Distinguish this resume from the general-purpose `session-resume`, since the name an operator reaches for first reaches a skill that knows nothing about the board
-- Retire the sessions this wave delivered before the map is written and ahead of any reclaim run, reporting a hand-launched one rather than acting on it, since no verb decides a planner or an unmerged worker and a live session holding a worktree is what the reclaim reading refuses on
-- Carry every runbook the session cannot run from memory inside the skill, so each citation resolves for a project holding the plugin and nothing else
-- State which rule wins where the tracked-file ban collides with the root instruction on small edits, and where a correction no open task owns goes
-- State the review trigger as a recurring prompt rather than as one client's command, since the runbook ships to targets running whatever client they run
-- Read the handoff or the resume runbook when the human asks for that side of a compaction, since the request is the only signal available for a moment the loop cannot detect
-- Re-test every parked row's blocker against the current tree on request, since every refill trigger looks forward and none of them re-reads a row already waiting
-- Measure a condition the way the code consuming it defines the shape, and settle which tree the condition is about before counting, since both errors return a number rather than a failure
-- Write each re-test into the row and its measurement into that task's Findings, since a result reported in chat is gone at the next compaction and the next pass measures the same thing
-- Plan a row the re-test clears, since a cleared row carrying no plan is one the next pass looks at again
-- Split a task that conflicts with every other by construction, rather than re-measuring a scoping defect that reads as a blocker
-- Check a candidate branch is unclaimed by an existing worktree or a live session before dispatching a background worker for it, since the measured failure this closes is a worker colliding with someone else's work already sitting in the row
-- Dispatch a candidate sharing only files with a track in flight and name the shared paths, and have the branch merging second resolve after the first merges, since every source the gate cites tests at integration
-- Write a stated reason on the hold it makes, since two tracks interact in ways no plan reading shows
-- Name each self-dispatched worker explicitly with the `worker-` prefix, since that is the role the name marks and a client-derived name is a fragment of the session's identifier
-- Carry the dispatcher's `sessionId` in the launch prompt, since a worker owed two messages has no property on the roster that resolves a controller and a name goes stale inside the window it builds in
-- Report each self-dispatch and the row it fired against loudly enough to follow, since a person no longer watches the launch step happen
-- Stop dispatching once `## Up next` is empty or every row left in it is held, rather than waking again to fire on a board nobody is clearing
-- Launch a planner or worker the operator will talk with from the talk shape, with the `-talk` suffix and the brief sentence that tells it so, since a cold launch retires the session the moment its delivery lands while the operator still wants the conversation
-- Retire a talk session only on the operator's word and report it as held open until then, since its delivery says nothing about whether the conversation is over
-- Dispatch every non-release pull request's review to `role-reviewer`, leave each round's messages to it and the worker, and keep one cross-branch pass per wave here, since any pass or relay run here bills the context the wave shares
+- Every plan is verified against the current tree and names each in-flight track's file set, and a candidate holds only on a dependency, a contract, a relocation, a sweep, or a stated reason
+- One planned, non-conflicting task stays in reserve, refilled while a wave builds, and every parked row's blocker is re-tested against the current tree with the result written to the board
+- A finding or a reply lands on the surface that owns it, the pull request or the task, rather than in chat
+- A dispatch launches the branch the check cleared under a `worker-` name carrying this session's `sessionId`, hands review to `role-reviewer`, and states what the wave costs in inbound turns
+- A report and the pre-compact handoff lead with state, open decisions, and next action, the handoff carries its own resume invocation and poll restart, and every runbook ships inside the skill
 
 ## Must not
 
-- Implement a feature or edit any tracked file from this session, at any size, since the ban offers no proportionality exception
-- Merge. Recommend merge or changes and leave the gate to the human.
-- Spawn a worker with the Agent tool, since an in-process subagent shares this session's context and cannot be steered or reached independently. A dispatched `claude --bg` process is not this: it is a separate session with its own worktree and its own PR, gated by the branch check and the conflict check.
-- Hand a worker anything but a plan, because scope lives there
-- Name a count of the defect's extent or the mechanism behind it while filing a row, since this seat measures a defect from where it stands and the planner is the reader who commits to that scope. A blocker re-test, a branch check, and a conflict check decide whether a row can start rather than how big it is, and they stay.
+- Implement, edit any tracked file at any size, or merge
+- Spawn a worker with the Agent tool, or hand a worker anything but a plan
 - Run a second orchestrator against the same board
-- Promote a task to fill the queue when nothing qualifies. A thin queue is a real answer.
-- Promote a parked row on how long it has waited, since age is not a measurement of the blocker
-- Schedule the parked-row pass on a recurring loop, since the review poll owns the one recurring trigger this skill has and a second loop fires into a static board
-- Rewrite the board with a shell stream editor or an inline string replace, both of which exit clean when they match nothing
-- Restate the board, a task file, or a groundwork folder in the pre-compact handoff, which is the padding that makes a handoff stop being read
-- Specify a shape for a correction, since a format for admitting error invites ceremony where plainness is the whole value
-
-## Guards
-
-- Priority file absent: report the queue and say the order is unrecorded rather than inferring it from the index
-- Cross-version sequencing asked for: say no surface carries it, rather than asserting an active version the tree does not state
-- This body dropped from a long session approaching a compaction: name the re-invocation and the runbook paths, since the routing lives in the body and a user-invoked skill routes nothing once it is gone
-- Blocker only an operator can clear: record the row as untestable this pass and name the action owed, rather than re-measuring what no session can move
-- Branch check refuses, with no session registry or no repository resolved: treat the candidate as unverified and fall back to the human-launch line, rather than reading a check that could not run as a clear one
-- Candidate holds under the conflict check: leave the row ready and name the hold, rather than dispatching onto a contract still moving
-- Talk session the client renamed after launch: find it by the `sessionId` recorded in the map, since the `-talk` suffix is display only and a rename can drop it
-- Operator states a cap for the session: honor it for that session alone, rather than treating it as a standing rule or writing the number into a file
+- Promote a row to fill the queue when nothing qualifies, or on how long it has waited
+- Rewrite the board with a stream editor or a string replace that exits clean on no match
 
 ## Out of scope
 
-- Writing the plan itself, which `plan-feature` owns and this session runs rather than reimplements
-- Reviewing a worker's pull request, which `review-pr` owns, and the bounds of a reviewer dispatched to run it, which `role-reviewer` owns
-- Entering the worktree a build runs in, which the worker opens for itself whether a human launched it or this session dispatched it
-- The worker's half of the channel and the boundaries a building session holds, which `role-worker` states where that session reads them
-- The operating model this enacts, which the toolkit's own docs hold
+- Writing the plan itself, which `plan-feature` owns
+- Reviewing a worker's pull request, which `review-pr` and `role-reviewer` own
+- Entering the worktree a build runs in, which `session-worktree` owns
+- The worker's half of the channel and its boundaries, which `role-worker` owns
+- Resuming a session with no board behind it, which `session-resume` owns

package/claude/skills/role-planner/REQUIREMENT.md

@@ -7,87 +7,29 @@ description: What a thinking session is across planning, groundwork, and intake,
 
 ## Gap
 
-Without this skill, a planning session is told what to plan and never what it
-is. `role-worker` states the building role and `auto-ship` Step 0 reaches
-it on every build, so a builder takes a role whether a person launched it or a
-dispatcher did. Planning has no equivalent, and two trials on 2026-08-31 ran
-entirely on prose the controller retyped into each launch. That is the shape
-`role-orchestrator` already bans on the building side, where one half held the
-only written copy of obligations the other half performs.
+Without this skill, a planning, groundwork, or intake session is told what to plan and never what it is. Every launch retypes the role's rules, and the forgotten one fails. The session counts worktrees and branches as in flight though a squash merge leaves both behind, and it quotes a row's stale count instead of opening the source.
 
-Six rules went into each of those launches by hand: no worktree, no branch, no
-tracked file, no board write, report the path alone, and re-measure rather than
-trusting the task file. A seventh was added only after a trial got it wrong.
-Every one of them is a property of the role rather than of the row, so each
-dispatch reproduced them from memory and the one nobody remembered was the one
-that failed.
-
-The in-flight read is that failure. The first trial counted worktrees and local
-branches and named four branches as in flight, all four of which had merged,
-because this repository squash-merges and leaves both behind. A corrected brief
-naming `gh pr list` as the source closed it and no constraint in the second
-batch was wrong, which puts the fix in a launch string that the next dispatch
-has to remember to carry.
-
-Measuring rather than trusting the row is the other half and it is what the
-trials were strongest on. Across four plans the planner reported ten things the
-task files got wrong, and one plan overturned its own row's closing conclusion.
-Nothing in any skill body tells a planner to open the source rather than quote
-the row, so a session that skips that read produces a plan built on the same
-stale count the row already carried.
-
-A planner reading the board sees blockers and file sets and can write a
-confident merge order off a partial picture. Which rows collide, what merges
-before what, and whether a row should run at all stay with the controlling
-session, and no body states that boundary for the planning side.
-
-Nothing scans a plan for ban hits either. `.gitignore` ignores
-`.canon/plans/`, and the audit's default path set is what git lists, so no gate
-ever opens one. Six ban hits landed across the four trial plans and three of the
-four carried at least one, caught only because the planner ran
-`canon markdown audit` unprompted.
+It also reaches past its seat. A planner reading blockers and file sets writes a merge order off a partial picture. Its plans land in a gitignored folder no gate audits, and the controller learns nothing of what the row got wrong unless the planner says so.
 
 ## Must
 
-- Assert what a thinking session is, what it may not write, and how long the role lasts, since `plan-feature`, `plan-groundwork`, and `plan-intake` each carry their own procedure and no body carries the role the three share
-- Cover all three of those skills rather than `plan-feature` alone, since a groundwork or intake session took no role at all while the body was written for one plan under one task
-- State the writes-records-never-source boundary once, and name the three folders in one line while deferring each scope's exceptions to the skill that owns it, so a change to one scope edits one body
-- Carry `plan-groundwork`'s close-time task file as an exception to the board ban, since widening the role without it makes the role forbid what that skill requires
-- State the in-flight read as a command composing the session roster with open pull requests, and say that a branch and a worktree are not evidence, since a count of either reported merged work as live
-- Run that read once per task rather than once per batch, since a reused session ages its picture of the tree while it works
-- Name every read a plan needed and a launch string did not carry, the task file's findings and the source files among them, since a count quoted from a row was wrong or stale in ten places across four plans
-- Name the validate and audit calls the written plan passes through, since nothing else opens a plan and the audit caught ban hits in three of four trial plans
-- State the shared board as read-only and name the cross-feature call as the controller's, since a planner reading blockers and file sets can write a merge order off a partial picture and will not notice that it has
-- Owe an announcement when the record lands, carrying the path and what the row got wrong, since the controller cannot watch the read happen
-- Owe a message before a block becomes an interactive prompt, since a session already waiting on input never reaches the tool round an inbound message drains at
-- Keep correcting the dispatcher a first-class move carrying its evidence, since a trial corrected a brief's premise, planned every row anyway, and carried the consequence into a plan question
-- Carry a talk clause for a launch whose operator is in the session, putting each open question to them, recording a settled pick in place, sending an ask about a row now building to the controller rather than the worker, and owing a close message when they end the conversation, since a cold planner's halting rules contradict a brief that asks it to talk
-- Point at each of the three skills for its record's shape and the steps that write it
-- Defer the addressee resolution to `session-relay` and keep only the last-rung inference, which discriminates differently here than it does for a worker because a session in this role holds no feature branch either
+- One role covers `plan-feature`, `plan-groundwork`, and `plan-intake`, writing records and never source, with each scope's exceptions left to its own skill
+- The in-flight read composes the session roster with open pull requests once per task, and never counts a branch or a worktree as evidence
+- A plan rests on the task file's findings and the source files rather than on counts quoted from the row
+- Every record passes the validate and audit calls before it is announced, and the announcement carries the path and what the row got wrong
+- A block goes out as a message before it becomes a prompt, a correction to the dispatcher carries its evidence, and a talk launch puts each open question to the operator
 
 ## Must not
 
-- Restate a record's sections, its suggested-and-answer contract, or the steps the running skill carries, since thinness is what keeps one body correct for a dispatched session reading it as its whole contract
-- Restate the write-scope exceptions each of the three skills states about its own folder
-- Restate a boundary `role-orchestrator` or `role-worker` states about itself
-- Tell a planner to halt on a plan question, which the suggested line already answers, rather than on what blocks writing the plan at all. A talk launch is the exception, since putting the question to the operator in the session is its job.
-- Tell a planner to report the path with no account of what the row got wrong. That instruction came from a trial condition holding a blind comparison intact, and it is not a durable obligation.
-- Report progress through the channel, which rebuilds on the sender's side the poll the announcement exists to retire
-- Write the priority board or the backlog, at any size, or the task file outside `plan-groundwork`'s close-time exception
-- Be a skill nothing invokes but its author typing the name. `orchestrator-launch.md` names it on the planning launch the way it names `role-worker` on a build, so a stretch where only a typed invocation reaches it is the signal that the role never took.
-
-## Guards
-
-- Task file does not resolve from where the session stands: report it unreadable and name the main-root path, rather than reporting the row as absent
-- A read of what is in flight returns nothing: report that no pull request is open and no live session holds another branch, rather than falling back to a raw branch or worktree count
-- Launch named no controlling session and an operator is present: ask which row to address rather than inferring
-- Launch named no controlling session and nobody is present: infer from the sessions holding no feature branch, never from a name prefix, and say the addressee was inferred
+- Write the priority board or the backlog, or a task file outside the close-time exception `plan-groundwork` states
+- Decide which rows run or in what order
+- Restate a record's sections, its answer contract, or the steps the running skill carries
+- Halt on a plan question the suggested line already answers, outside a talk launch
+- Report progress through the channel
 
 ## Out of scope
 
-- Each record's sections and its answer contract, which the standard behind it fixes, and the steps that write the file, which `plan-feature`, `plan-groundwork`, and `plan-intake` each own for their own
-- The write-scope exceptions, which stay in the three skills: groundwork's close-time task file, its fixture and evidence paths, and intake's statement that it has none
-- The mechanical addressee resolution, which `session-relay` owns for every session with or without a role
+- Each record's sections, answer contract, write-scope exceptions, and writing steps, which `plan-feature`, `plan-groundwork`, and `plan-intake` own
+- Resolving an addressee, which `session-relay` owns
 - The branch, the build, and the pull request, which `role-worker` and `auto-ship` own
-- Deciding which rows run and in what order, which is the controlling session's call and stated in `role-orchestrator`
-- The dispatch itself, its collision check, and its conflict check, which `orchestrator-dispatch.md` holds
+- Choosing which rows run, their order, and the dispatch with its collision and conflict checks, which `role-orchestrator` owns

package/claude/skills/role-worker/REQUIREMENT.md

@@ -7,58 +7,30 @@ description: What a building session is, the shared surfaces it may not write, a
 
 ## Gap
 
-Without this skill, a building session is told what to do and never what it is. One shipped body asserts a session role and it is the orchestrator, so worker behavior spreads across three skills that each own a step and none of them names the role or the channel it runs on. The handback works because a session reading plain text tends to follow it rather than because anything says it should, which held while a person launched every worker and stopped holding the first time one ran with nobody watching.
+Without this skill, a building session is told what to do and never what it is. It writes shared surfaces, hand-writing the board from a stale copy, filing a task with no row, or re-drafting a readied pull request. From a linked worktree it finds no plan folder and reports the task has no plan.
 
-The session then writes surfaces nothing told it were shared. One worker split a concern its own run could not reach, hand-wrote the priority board from a copy taken minutes earlier, and reverted a promotion with nothing reporting it, on a board that still validated afterwards because a reverted row is a well-formed board. A second added a row and labelled it with an identifier another row already held. The rule against both sits inside the controlling session's own body, which no worker loads.
-
-Standing in a linked worktree fails one step earlier and reports confidently while it does. The plan folder is gitignored, so `git worktree add` never creates it, and a worker reading it from the build tree reports that the task has no plan. That is true from where the session stands and wrong about the world, and a reader holding no second tree cannot tell those apart. Three workers hit it in one day and an absolute path unblocked all three.
-
-A blocked worker reaches nobody at all. Two dispatched sessions opened an interactive prompt inside a background session no operator was attached to, and the roster read both as alive throughout. An answer relayed afterwards arrives and does not land, since a queued message drains at the next tool round and a session waiting on input never reaches one, so the channel closes the gap only when it is used before the prompt opens. One of the two held uncommitted work across three files, which made stopping and relaunching a destructive recovery rather than a free one.
-
-Finishing is invisible from the other side. A worker that opens a pull request goes idle rather than exiting, so the one push signal available fired for a worker that was stopped and never fired for the one that finished, which then sat unnoticed for eighteen minutes. Polling covers that interval by spending a fixed cost against a worker with no pull request to report, measured as five consecutive runs reporting no movement across roughly fifteen minutes while one worker built.
-
-Nothing tells the session that refusing is allowed either. Four occasions across two days had a worker halt correctly with the cost falling on the dispatcher, and the correction that mattered most reached the right place because a worker argued back with evidence rather than complying. A role written only as report-upward suppresses exactly that.
-
-The draft mark fails from both ends. On 2026-08-31 four sessions re-drafted a pull request someone had readied, acting on a belief no surface in the tree stated. On 2026-09-07 a controlling session told a worker to lift the mark rather than lifting it itself, and the worker complied and reported against the surface rather than the outcome. From 2026-10-12 `canon pr lift` reads the gates itself, so the reviewers run it on a close and the controlling session runs it as the fallback. A worker leaves the verb to them and readies a pull request directly for nobody, since a direct ready skips every gate the verb reads.
+The channel fails on the worker's side. Blocks open prompts nobody is attached to, and a finished pull request goes idle unannounced or stalls silently on its reviews. Painted ones ship with no address for the UI reviewer. Late asks widen the reviewed scope, and a worker told only to report upward never argues back.
 
 ## Must
 
-- Assert what a building session is, what it may not do, and how long the role lasts, since the three step-owning skills each carry a procedure and none carries a role
-- State that session scratch resolves at the main worktree root, since a linked worktree holds none of those folders and their absence reads as a missing artifact rather than as a wrong vantage
-- State the shared board as read-only for a building session and name what it does instead when a row is owed, since a task file with no row is a dropped task and placing the row is the controlling session's call
-- Owe an announcement the moment the pull request opens, carrying the number, the branch, and the task, since that transition is the one interval only the worker can observe
-- Carry a row the build turned up in the pull request announcement, and send it alone only when the session ends before a pull request opens, since the worker files no task file of its own and the channel is the row's only route
-- Carry a fan-in member's branch and head commit in its done message in place of a pull request number, and end its role at the push, since a member opens no pull request and its integrator fixes what the merge surfaces
-- Send the controller the `canon pr review-state` record when a wait for the reviews times out, rather than waiting on, since a worker improvising that read stalled silently with both reviewers idle behind it
-- Owe a message before a block becomes an interactive prompt, since a session already waiting on input never reaches the tool round an inbound message drains at
-- Defer the addressee resolution to `session-relay` and keep only the operator ask and the last-rung inference, which discriminates here because a worker holds a feature branch and a controller does not, and which falls back to the roster and says so, since an operator's own launch names nobody
-- Keep refusing a dispatcher a first-class move carrying its evidence, since the halts measured so far were correct and the cost of each fell where it belonged
-- State that a held body may be older than the branch under it, since a plugin skill loads from the marketplace cache rather than from the working tree
-- Carry a talk clause for a launch whose operator is in the session, asking them at a judgment call and sending a close message when they end the conversation, since a cold worker's halt-toward-the-controller and merge-ends-the-role rules contradict a brief that asks it to talk
-- Freeze the plan's scope at dispatch, sorting a late ask into a defect to fix, a follow-up row to report, or an addition the operator's word admits with its re-review cost stated, since intake 155 measured about four UI review rounds on one pull request from late asks, each re-running both reviews
-- Own the local preview server for a painted diff, started as a tracked background command before the pull request opens, since a `no-server` read leaves the evidence comment and the UI reviewer without an address on the one path nobody watched being built (erclx/frameboard#1 and erclx/frameboard#4)
-- Point at `session-worktree`, `auto-ship`, and `review-address` for the steps each already owns
+- Session scratch resolves at the main worktree root, and a plan that fails to resolve is reported unreadable from there rather than absent
+- The pull request announcement carries the number, the branch, the task, the reach, and any row the build turned up, and a painted diff has its preview server running before the pull request opens
+- A block goes out as a message before it becomes a prompt, a fan-in member's done message carries its branch and head commit, and a review wait that times out reaches the controller
+- The plan's scope freezes at dispatch, and a late ask is sorted into a defect, a follow-up row, or an addition on the operator's word
+- A refusal of an instruction the tree contradicts carries its evidence, and a talk launch puts its judgment calls to the operator in the session
 
 ## Must not
 
-- Restate a procedure any of the three step-owning skills carries, since thinness is what keeps one body correct for a dispatched worker reading it as its whole contract and for a hand-launched one reading it beside a person
-- Restate a boundary the orchestrator already states about itself
-- Report progress through the channel, which rebuilds on the sender's side the poll the announcement exists to retire
 - Write the priority board or the backlog, at any size
-- Create a task file for work the build turns up, through `task-board` or by hand, since the file lands with no row and the placement is not the worker's to make
-- Be a skill nothing invokes but its author typing the name. `auto-ship` Step 0 invokes it on every build, dispatched or hand-launched, so a stretch where only a typed invocation reaches it is the signal that the role never took.
-
-## Guards
-
-- Plan path does not resolve from inside the worktree: report it unreadable from here and name the main-root path, rather than reporting the task as having no plan
-- Plan carries a suggestion written as needing the operator's call: halt and message, rather than answering it
-- Launch named no controlling session: resolve from the roster, address the match, and say the addressee was inferred
-- No live session holds the other end: report what would have been sent and stop, rather than retrying or waiting
+- Create a task file for work the build turns up
+- Ready the pull request directly, or re-draft one someone readied
+- Report progress through the channel
+- Restate a procedure `session-worktree`, `auto-ship`, or `review-address` carries
 
 ## Out of scope
 
 - Entering the worktree, which `session-worktree` owns
 - The chain from implement through pull request, which `auto-ship` owns
-- How the build moves through the plan, slice by slice with a commit each, which `build-in-slices` owns
+- Moving through the plan slice by slice, which `build-in-slices` owns
 - Answering a posted review, which `review-address` owns
-- The controlling session's half of the channel, the review poll, and the watch beside it, which `role-orchestrator` and its runbooks hold
+- The controlling session's half of the channel and the review poll, which `role-orchestrator` owns

package/claude/skills/target-setup/SKILL.md

@@ -88,7 +88,7 @@ preview proposed, per the detect reference. Run from the
 target project's current directory. Do not cd into the toolkit source tree. The
 `canon` CLI is global.
 
-Step 1: `canon init` installs base tooling, claude seeds, governance rules, and wiki.
+Step 1: `canon init` installs base tooling, claude seeds, and governance rules.
 
 ```bash
 CANON_NON_INTERACTIVE=1 canon init \
@@ -121,7 +121,7 @@ CANON_NON_INTERACTIVE=1 canon tooling sync python ./backend --skip base --write
 - Without `--skip base`, each subtree re-drops husky, and git honors only one `core.hooksPath`, so the extra hook dirs silently break
 - Each subtree keeps its own framework configs, and its stack reference reads through `canon tooling reference <stack>`
 - A subtree sync withholds `.github/`, since GitHub reads workflows only at the root, and names each withheld file with the `working-directory` a root CI job needs
-- A subtree needs its own `bun init` before its scripts and dependencies land, and the sync warns and skips them until then
+- A subtree with no `package.json` gets a minimal one from the sync, so its scripts and dependencies land in the same pass
 
 ### Post-sync fixups
 

package/claude/skills/target-setup/references/detect.md

@@ -93,7 +93,6 @@ A language root below the repository root whose language the stack does not carr
 A language root below the repository root takes its own `canon tooling sync <stack> <path> --skip base`, since `canon init` already lands `base` once at the root.
 
 - Leave a root whose stack resolves to `base` out of the commands, since that sync lands nothing. A root `package.json` hosting only formatters and hooks is that case and adds no row.
-- `wiki` installs by default. Add `--skip wiki` only when the user explicitly wants it left out.
 
 ## Gap handling
 

package/claude/skills/target-setup/references/verify.md

@@ -32,7 +32,7 @@ canon targets list --sweep <root> --json
 
 - The root is a folder to verify when it carries a `package.json`.
 - Each path in the record's `targets` that sits under the root and carries its own `package.json` is a folder to verify.
-- A path under the root with no `package.json` is not verified. Name it as skipped with its fix, `run 'bun init' in <path>, then sync the stack again`, and carry on with the rest.
+- A path under the root with no `package.json` is not verified. Name it as skipped with its fix, `sync the stack in <path> to write one`, and carry on with the rest.
 - If neither the root nor any stamped subfolder carries a `package.json`, stop: `❌ No package.json at the root or in any synced subfolder. Cannot verify.`
 - In each folder to verify, if `node_modules/` does not exist, run `bun install` there first, then proceed.
 
@@ -103,7 +103,7 @@ port to poll across stacks, so port-probing is out of reach here.
 ## Step 3: report
 
 Report per folder, under a heading naming its path relative to the root, and
-list each skipped folder with its `bun init` fix. For each script run, report
+list each skipped folder with its sync fix. For each script run, report
 one of:
 
 - `✅ <script>`

package/claude/skills/teach-workspace/REQUIREMENT.md

@@ -55,7 +55,7 @@ Two failures land specifically on where the folder sits. A workspace resolved ag
 ## Guards
 
 - No subject named and no existing workspace matching, stop rather than opening a workspace with nothing to learn
-- No wiki folder in the project and a page routing there, refuse and name the command that creates one rather than scaffolding a surface the project never chose
+- No wiki folder in the project and a page routing there, refuse and name the folder to create rather than scaffolding a surface the project never chose
 
 ## Out of scope