@erclx/canon 5.65.0 → 5.66.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [5.66.0](https://github.com/erclx/canon/compare/v5.65.0...v5.66.0) (2026-10-25)
+
+
+### Features
+
+* **labels:** seed a starter label map and create its labels ([#2715](https://github.com/erclx/canon/issues/2715)) ([82a11b1](https://github.com/erclx/canon/commit/82a11b13870960926f0844519a76e039afd0ed5c))
+* **pr:** close a pull request with a required reason ([#2718](https://github.com/erclx/canon/issues/2718)) ([963f784](https://github.com/erclx/canon/commit/963f784e46e25e3c42ea1f6027a7b04860ec544e))
+* **pr:** probe declared health paths before linking the local preview ([#2712](https://github.com/erclx/canon/issues/2712)) ([a16c3f9](https://github.com/erclx/canon/commit/a16c3f966211f5bd9b8af9f82720d42251ac41b9))
+
+
+### Bug Fixes
+
+* **sandbox:** retry the replay checkout copy on a vanished file ([#2720](https://github.com/erclx/canon/issues/2720)) ([64d964b](https://github.com/erclx/canon/commit/64d964bdae0e26f79ab5c0ddc0c1f0e80bc20e6b))
+* **tooling:** install Go for the go stack verify job ([#2717](https://github.com/erclx/canon/issues/2717)) ([e87d433](https://github.com/erclx/canon/commit/e87d433bdbf64945165923d1b6f7294e2d873b7b))
+
 ## [5.65.0](https://github.com/erclx/canon/compare/v5.64.0...v5.65.0) (2026-10-25)
 
 

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
-  "version": "5.65.0",
+  "version": "5.66.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/git-pr/references/labels.md

@@ -109,10 +109,14 @@ Labelling runs whenever this skill runs and at no other time, recomputing over t
 Warn and continue rather than creating it, naming the command in the warning:
 
 ```bash
-gh label create <name> --description "<text>"
+canon labels sync
 ```
 
-Creating a label writes to the repository settings from a run invoked to open a pull request, and a label created from a map typo is harder to notice than a warning.
+It creates every label the map names that the remote lacks, and never edits or deletes one.
+
+- An installed `canon` predating the verb takes `gh label create <name>` per label instead
+- Creating a label writes to the repository settings, and a label created from a map typo is harder to notice than a warning
+- So the operator runs the sync on purpose after reading the map, and a run invoked to open a pull request never does
 
 The refusal names the label it rejected and applies none of the set, so an unseen warning leaves the run reading like one that labelled. Surface it beside the result line rather than letting the pull request URL stand alone.
 

package/claude/skills/git-pr-close/REQUIREMENT.md

@@ -0,0 +1,29 @@
+---
+name: git-pr-close
+description: What closing a pull request unmerged is for, the gap it closes, and how it splits from merging and from the verb it calls
+---
+
+# Git PR close requirement
+
+## Gap
+
+Without this skill, a session asked to close a pull request improvises a bare close. Most hand-closed pull requests then carry no reason, so a reader who finds one later cannot tell a rejected idea from a superseded one or a pause. No `git-*` skill covered the act, so the request had nowhere to route.
+
+## Must
+
+- Every close goes through `canon pr close`, which refuses without a reason and posts it before the close
+- The reason follows the shape `references/close.md` fixes, opening on what happened and ending on what replaces it or how to reopen
+- A close of another branch's pull request names that branch through `--head`, so a wrong number refuses rather than closing someone else's work
+
+## Must not
+
+- Merge, mark ready, or reopen a pull request
+- Guess a number from the newest pull request in view
+- Close with no reason, or post the reason any way other than through the verb
+- Exist only to be typed by name. It earns its place when a session routes "close this PR" or a superseded batch here unprompted.
+
+## Out of scope
+
+- Writing the gate on the reason, which the verb owns
+- Merging, which the operator runs through `canon pr merge`
+- Closing an issue, which `git-issue` covers

package/claude/skills/git-pr-close/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: git-pr-close
+description: Closes an open pull request without merging it, posting a short reason first and deleting its head branch, through `canon pr close`. Use when asked to "close this PR", "close #N", "supersede #N with #M", "abandon this pull request", or "drop this PR". Do NOT use to merge, which the operator does, or to close an issue, which `git-issue` covers.
+metadata:
+  family: after-pr
+---
+
+# Git PR close
+
+Close one pull request unmerged with its reason on the thread, so a later reader finds why without asking.
+
+Read `${CLAUDE_SKILL_DIR}/references/close.md` before writing the reason, for its shape and the two forms it takes.
+
+## Guards
+
+- Take the number the caller named. With none named, "this pull request" means the current branch's, read from the `number` of `canon pr head --json`.
+- Never guess a number from the newest pull request in view, since a wrong number closes another branch's work
+- If the caller gave no reason and none follows from the conversation, stop: `❌ No reason to post. Say why this pull request is closing.`
+
+## Step 1: write the reason
+
+Write the reason to `.canon/tmp/pr/close/close-<number>.md` in its own call, in the shape `close.md` fixes.
+
+## Step 2: close
+
+Run the verb. It refuses unless the pull request's head is the branch `--head` names, defaulting to the current branch, so a wrong number writes nothing.
+
+```bash
+canon pr close <number> --reason-file .canon/tmp/pr/close/close-<number>.md --json
+```
+
+- Pass `--head <branch>` only when closing a branch this checkout is not on, taking the branch from the caller, such as a dispatch naming it or the batch a replacement merged
+- Never read `--head` off the pull request being closed, since a branch read from the same number agrees with any number and the check proves nothing
+- Pass `--keep-branch` only when the caller says the branch stays
+- The verb posts the reason, closes, then deletes the branch, and refuses before any write on a reason it cannot publish
+
+## Step 3: read the record
+
+Branch on `reason` rather than the exit, since a shell function wrapping `canon` can flatten it.
+
+| `reason`               | Route                                                                        |
+| ---------------------- | ---------------------------------------------------------------------------- |
+| `closed`               | Report the comment URL, and name the branch when `branch` is `delete-failed` |
+| `reason-unpublishable` | Rewrite the sentence each finding names, then run Step 2 again               |
+| `head-mismatch`        | Stop and report it, since the number names another branch's pull request     |
+| `close-failed`         | Report that the comment posted and the pull request is still open            |
+| Any other refusal      | Report the `message` and stop                                                |
+
+## Output
+
+One line on a close:
+
+```plaintext
+✅ Closed #<number>: <comment url>
+```

package/claude/skills/git-pr-close/references/close.md

@@ -0,0 +1,54 @@
+---
+title: Closing comment reference
+description: The shape of the comment a pull request carries when it closes unmerged, its two forms, and the limits the verb checks
+---
+
+# Closing comment reference
+
+## Scope
+
+Governs the comment posted when a pull request closes without merging.
+
+Does not govern:
+
+- A pull request body or title: `${CLAUDE_SKILL_DIR}/../git-pr/references/pr.md`
+- A review reply, which `review-address` writes
+
+## Shape
+
+A reader who finds the closed pull request later learns why it closed and where the work went, in two sentences at most.
+
+- Open on what happened: `Superseded by #<number>` when another pull request carries the work, or `Closing unmerged.` otherwise
+- Say why in one sentence, naming the decision rather than retelling the discussion that reached it
+- End on what replaces it, or how to reopen when the close is a pause
+- Keep each paragraph under 350 characters, and two paragraphs at most
+
+### Superseded
+
+Another pull request carries the work, so the comment links it and says nothing is left behind.
+
+```markdown
+Superseded by #<replacement>, which combines this batch with the five other context rebuilds and carries every reviewed change from this branch. Nothing here is left to carry over.
+```
+
+### Closed for a decision
+
+Nothing replaces the work, so the comment names the decision that ended it.
+
+```markdown
+Closing unmerged. Base's starter label map should stay stack-neutral rather than list every stack's configs, so each project adds rows for its own stack.
+```
+
+## What the verb refuses
+
+`canon pr close` checks the reason before it reads the pull request, and refuses `reason-unpublishable` with the findings in its record.
+
+- A banned character, a phase label, a board reference, or a session link, the checks `canon labels scan` runs on a body
+- A paragraph or a run of paragraphs past the density limits, measured on the reason itself
+- The scan measures density only on a post opening on a known heading, so the verb measures it here
+
+## Sources
+
+- [Zephyr pull request lifecycle policy](https://docs.zephyrproject.org/latest/contribute/pr_lifecycle_policy.html)
+  - "Close with explicit rationale and a reopen path."
+  - For a superseded one: "Link the replacement pull request." and "Add a short summary comment preserving context."

package/claude/skills/pr-evidence/SKILL.md

@@ -43,11 +43,11 @@ Collect only the lines below whose condition holds, and nothing when none does.
 | A checklist posted alone                                  | `📋 Posted the UI checklist to <number>, on its own.`              |
 | The preview step returned an address                      | `🔗 Preview: <url>`                                                |
 | The evidence step posted the local link                   | `🖥️ Local preview: <url>`                                          |
-| The local step refused and evidence or a checklist posted | `🖥️ No local preview: <reason>`                                    |
+| The local step refused and evidence or a checklist posted | `🖥️ No local preview: <reason>: <message>`                         |
 | A git refusal or a preview refusal the reference reports  | `⚠️ <reason>: <message>`                                           |
 
 ### The no-local-preview line
 
-It fires when the local step refused as `no-server` or `no-listener-reader`, since that pull request changes a rendered surface and a reviewer could have used the link. A later run only carries a link forward, so it cannot add one the comment never had.
+It fires when the local step refused under any reason the reference holds, `unhealthy` included, since that pull request changes a rendered surface and a reviewer could have used the link. The `message` names what to fix, such as the failing health path. A later run only carries a link forward, so it cannot add one the comment never had.
 
 To add the link later, start the server and run this skill again, adding `--checklist` to the evidence call when one is still owed.

package/claude/skills/pr-evidence/references/evidence.md

@@ -35,7 +35,9 @@ canon pr local --json
 The verb reports the lowest port serving an HTML page whose process runs inside this worktree, never one in another worktree or the main checkout, which shows a different branch. `canon pr local --help` states the contract. Read `reason` on the record rather than the exit code.
 
 - `ok`: hold the record's `url` for the evidence step below.
-- `no-server` or `no-listener-reader`: hold the reason for the closing report and pass no link. Never start a server here, since the ship chain cannot own one. A worker starts one under `role-worker`.
+- `no-server`, `no-listener-reader`, `unhealthy`, or `invalid-config`: hold the reason and the record's `message` for the closing report, and pass no link.
+- `unhealthy` means a page answered but a health path declared in `canon/config/local.toml` failed. `invalid-config` means that file cannot be read, so nothing was checked.
+- Never start a server here, since the ship chain cannot own one. A worker starts one under `role-worker`.
 - Anything else, including no record or an older binary's unknown-subcommand error: move on silently, as a skip rather than a stop.
 
 ### Where the link lands

package/claude/skills/role-worker/SKILL.md

@@ -46,8 +46,8 @@ Open the task's `## Findings` line for an override with the bold source-and-date
 
 A painted pull request needs a server in this worktree for `canon pr local` to find, and this session is the one with a lifetime to own it. `auto-ship` Step 5 decides whether the diff is painted, so this body restates no file test.
 
-- Run `canon pr local --json` first and start nothing when `reason` reads `ok`
-- Otherwise start the stack's `dev` script as a background command from the worktree root before the pull request step. `dev` follows the worktree, so a `review-address` fix shows on the same link.
+- Run `canon pr local --json` first. Start nothing on `ok`, `unhealthy`, or `invalid-config`, and carry a refusal's `message` in the announcement
+- Otherwise start the stack's `dev` in the background from the worktree root before the pull request step, so a `review-address` fix shows on the same link.
 - Wait up to 60 seconds for the verb to read `ok`, then ship either way. A stack with no `dev` script gets no start, and `pr-evidence` reports `no-server`.
 - Never detach it with `nohup`, `setsid`, or `disown`, since the owning session is the stop. `canon worktrees reclaim` ends any listener left in a worktree it removes.
 

package/docs/workflow/skill-map.md

@@ -80,6 +80,7 @@ Groups run in the order a project meets them. Every name `canon claude skills li
 | `canon:git-followup`   | A small edit on a branch with an open PR      |
 | `canon:pr-evidence`    | A new head needs its screenshots re-posted    |
 | `canon:git-split`      | A branch carries unrelated commits            |
+| `canon:git-pr-close`   | A pull request closes without merging         |
 | `canon:git-issue`      | Something belongs on the tracker              |
 | `canon:git-worktree`   | After a merge, to reclaim worktrees           |
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.65.0",
+  "version": "5.66.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {

package/src/claude/cases/git.ts

@@ -22,6 +22,10 @@ export const GIT_CASES: readonly SkillCase[] = [
     prompt: 'Turn this bug into a GitHub issue and file it.',
     expect: 'git-issue',
   },
+  {
+    prompt: 'Close #42 without merging, #57 supersedes it.',
+    expect: 'git-pr-close',
+  },
   {
     prompt: 'Write the title and body for this pull request.',
     expect: 'git-pr',

package/src/commands/labels.ts

@@ -14,9 +14,10 @@ import {
 } from '@/labels/density'
 import { resolveScanInput } from '@/labels/event'
 import { checkTitleFormat, type TitleFormatIssue } from '@/labels/format'
-import { MAP_REL } from '@/labels/map'
+import { MAP_REL, readLabelMap } from '@/labels/map'
 import { isReleasePullRequest, scanPhaseLabels } from '@/labels/phase'
 import { checkSections } from '@/labels/sections'
+import { missingLabels } from '@/labels/sync'
 import { BAN_SETS } from '@/markdown/bans'
 import { bodyLines, scanBans } from '@/markdown/scan'
 import { intro, logInfo, logStep, logWarn, outro, plural } from '@/cli/ui'
@@ -33,6 +34,12 @@ interface ApplyOptions extends AuditOptions {
 
 type ApplyRefusal = 'bad-number' | 'no-branch' | 'gh-failed' | 'head-mismatch'
 
+interface SyncOptions {
+  readonly root?: string
+  readonly check?: boolean
+  readonly json?: boolean
+}
+
 const GH_TIMEOUT_MS = 30_000
 
 interface ScanOptions {
@@ -187,6 +194,48 @@ export function register(program: Command): void {
       process.exitCode = await runApply(number, opts)
     })
 
+  labels
+    .command('sync')
+    .description(
+      'Create on the remote each label the map names that it lacks, never editing or deleting one',
+    )
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--root <path>', 'Repository to read, defaulting to the cwd')
+    .option('--check', 'Report the labels missing and write nothing')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        '',
+        `Reads the label names under [domains] in ${MAP_REL}, reads the remote's`,
+        'labels over REST, and creates each one the remote lacks. A label already',
+        'on the remote is left as it is, and one the map does not name is never',
+        'touched. A project declaring no map creates nothing and exits 0.',
+        '',
+        'Run it once after installing a map and again after adding a row, so',
+        '`canon labels apply` finds every label it earns.',
+        '',
+        'Record: labels, present, created, missing, failed',
+        '',
+        'Exit codes:',
+        '  0  the remote carries every label the map names after the run',
+        '  1  refused, with the reason on stderr or in the JSON record',
+        '  2  labels are still missing, being any under --check, or a failed',
+        '     create otherwise',
+        '',
+        'Reasons:',
+        '  gh-failed  the remote labels could not be read, so nothing was written',
+        '',
+        'Examples:',
+        '  canon labels sync',
+        '  canon labels sync --check --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (opts: SyncOptions) => {
+      process.exitCode = await runSync(opts)
+    })
+
   labels
     .command('scan')
     .description(
@@ -544,9 +593,7 @@ async function runApply(number: string, opts: ApplyOptions): Promise<number> {
   }
 
   for (const label of diff.missingOnRemote) {
-    logWarn(
-      `${label} is not on the remote. Create it with: gh label create ${label}`,
-    )
+    logWarn(`${label} is not on the remote. Create it with: canon labels sync`)
   }
   for (const label of failed) logWarn(`Label apply failed: ${label}`)
 
@@ -577,6 +624,107 @@ async function runApply(number: string, opts: ApplyOptions): Promise<number> {
   return owed.length === 0 ? 0 : 2
 }
 
+async function runSync(opts: SyncOptions): Promise<number> {
+  const root = resolve(opts.root ?? process.cwd())
+  const emitJson = opts.json ?? false
+  const isCheck = opts.check ?? false
+
+  intro('canon labels sync')
+
+  const map = readLabelMap(root)
+
+  if (map.kind === 'refused' && map.reason === 'no-map') {
+    logStep('Labels')
+    logInfo(REFUSALS['no-map'])
+    outro()
+    if (emitJson) {
+      process.stdout.write(
+        `${JSON.stringify({
+          reason: 'no-map',
+          labels: [],
+          present: [],
+          created: [],
+          missing: [],
+          failed: [],
+        })}\n`,
+      )
+    }
+    return 0
+  }
+
+  const refuse = (reason: LabelAuditRefusal | 'gh-failed'): number => {
+    const message =
+      reason === 'gh-failed'
+        ? 'gh could not read the remote labels, so nothing was written.'
+        : REFUSALS[reason]
+    logStep('Refused')
+    logWarn(message)
+    outro()
+    if (emitJson) {
+      process.stdout.write(`${JSON.stringify({ root, reason, message })}\n`)
+    }
+    return 1
+  }
+
+  if (map.kind === 'refused') return refuse(map.reason)
+
+  const remoteRaw = await gh(root, [
+    'api',
+    '--paginate',
+    'repos/{owner}/{repo}/labels',
+    '--jq',
+    '.[].name',
+  ])
+  if (remoteRaw === null) return refuse('gh-failed')
+
+  const labels = map.domains.map((row) => row.label)
+  const present = nonEmptyLines(remoteRaw)
+  const toCreate = missingLabels(labels, present)
+
+  const created: string[] = []
+  const failed: string[] = []
+
+  if (!isCheck) {
+    for (const label of toCreate) {
+      const wrote = await gh(root, [
+        'api',
+        '-X',
+        'POST',
+        'repos/{owner}/{repo}/labels',
+        '-f',
+        `name=${label}`,
+        '--silent',
+      ])
+      if (wrote === null) failed.push(label)
+      else created.push(label)
+    }
+  }
+
+  const missing = toCreate.filter((label) => !created.includes(label))
+
+  logStep('Labels')
+  logInfo(labels.join(', '))
+
+  if (isCheck) {
+    logStep(missing.length === 0 ? 'Nothing missing' : 'Missing')
+    for (const label of missing) logWarn(label)
+  } else {
+    logStep('Created')
+    logInfo(created.length === 0 ? 'no label was created' : created.join(', '))
+  }
+  for (const label of failed) logWarn(`Label create failed: ${label}`)
+
+  outro()
+
+  if (emitJson) {
+    process.stdout.write(
+      `${JSON.stringify({ labels, present, created, missing, failed })}\n`,
+    )
+  }
+
+  return missing.length === 0 ? 0 : 2
+}
+
 /**
  * Reads `--closes` as the issues the body must close. Undefined when the flag
  * is absent, which skips the check, and a message when the value is neither

package/src/commands/pr.ts

@@ -74,6 +74,7 @@ import {
   readBaseStanding,
   readChangedPaths,
 } from '@/pr/lift'
+import { close, type CloseApi, type CloseRefusal } from '@/pr/close'
 import {
   merge,
   type MergeApi,
@@ -92,6 +93,7 @@ import {
 } from '@/pr/drive-copy'
 import { machineListenerReader } from '@/listeners/machine'
 import { loadPaintedPatterns } from '@/pr/painted'
+import { LOCAL_CONFIG_REL, readHealthPaths } from '@/pr/health'
 import {
   dropAddressLine,
   maskLocalAddress,
@@ -174,6 +176,12 @@ interface MergeCommandOptions extends ReadOptions {
   readonly dryRun?: boolean
 }
 
+interface CloseCommandOptions extends ReadOptions {
+  readonly reasonFile?: string
+  readonly head?: string
+  readonly keepBranch?: boolean
+}
+
 interface ReviewStateOptions extends ReadOptions {
   readonly wait?: string
 }
@@ -244,9 +252,15 @@ const AMBIGUOUS_PULL =
 /** How long the probe waits on a listener before reading it as not a server. */
 const LOCAL_PROBE_TIMEOUT_MS = 2_000
 
-const LOCAL_REFUSALS: Record<LocalRefusal | 'gh-failed', string> = {
+const LOCAL_REFUSALS: Record<
+  LocalRefusal | 'invalid-config' | 'gh-failed',
+  string
+> = {
   'no-server':
     'Nothing listening inside this worktree served an HTML page. Start the dev server here and re-run to get a link.',
+  unhealthy:
+    'A page answered inside this worktree, but a health path it declares failed. Start what the page reaches and re-run to get a link.',
+  'invalid-config': `${LOCAL_CONFIG_REL} cannot be read, so no health path was checked and no link is given. Fix or delete it and re-run.`,
   'no-listener-reader':
     'This machine offers neither lsof nor /proc, so no listening socket could be read. Nothing is posted.',
   'gh-failed':
@@ -991,6 +1005,60 @@ export function register(program: Command): void {
       process.exitCode = await runMerge(number, opts)
     })
 
+  pr.command('close')
+    .description(
+      'Close a pull request unmerged, posting the reason first and deleting its head branch',
+    )
+    .argument('<number>', 'Pull request to close')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--reason-file <path>', 'Closing comment to post, required')
+    .option(
+      '--head <branch>',
+      'Head branch the pull request must carry, defaulting to the current branch',
+    )
+    .option('--keep-branch', 'Leave the head branch in place')
+    .option('--root <path>', 'Repository to read, defaulting to the cwd')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'The reason is required, so a pull request this verb closes always says',
+        'why. It is checked before anything is read: banned characters, phase',
+        'labels, board references, session links, and density measured on the',
+        'reason itself. A finding refuses reason-unpublishable with the findings',
+        'in the record.',
+        '',
+        'Then the pull request is read and must be open with the head --head',
+        'names. The comment posts first, then the close, then the branch',
+        'delete, so a failure part way leaves a comment on an open pull request',
+        'rather than a close with no reason. A failed delete never fails the',
+        'close, and a head in another repository is never deleted.',
+        '',
+        'Record: number, commentUrl, branch (deleted, kept, fork, delete-failed),',
+        'findings on a reason-unpublishable refusal',
+        '',
+        'Reasons:',
+        '  closed',
+        '  no-reason, reason-unreadable, reason-unpublishable, no-head,',
+        '  gh-failed, pull-closed, head-mismatch, comment-failed, close-failed',
+        '',
+        'Every call is REST, never `gh pr close`, which runs on GraphQL.',
+        '',
+        'Exit codes:',
+        '  0  closed',
+        '  1  refused, with the reason in the JSON record',
+        '',
+        'Examples:',
+        '  canon pr close 1341 --reason-file reason.md --json',
+        '  canon pr close 1341 --reason-file reason.md --head feat/old --keep-branch',
+        '',
+      ].join('\n'),
+    )
+    .action(async (number: string, opts: CloseCommandOptions) => {
+      process.exitCode = await runClose(number, opts)
+    })
+
   pr.command('preview')
     .description(
       "Deploy the pull request's branch to a Cloudflare Pages preview and report its address",
@@ -1090,6 +1158,13 @@ export function register(program: Command): void {
         'port serving an HTML page is reported, which skips a test runner or a',
         'reload socket answering in the same tree.',
         '',
+        'A project can declare paths the page must also serve, in',
+        'canon/config/local.toml as health = ["/api/health"]. Each is requested',
+        "on the page's own port, redirects followed, and only a final 2xx",
+        'passes. A page failing one is skipped for the next page port, and the',
+        "refusal names the lowest page port's first failing path. An absent",
+        'file or an empty list checks the page alone.',
+        '',
         'A process in a sibling worktree, in the main checkout seen from a',
         'linked worktree, or in a linked worktree seen from the main checkout',
         'is never reported, since its server shows another branch. Sockets are',
@@ -1112,6 +1187,11 @@ export function register(program: Command): void {
         '  ok                  a page answered, with its address in `url`',
         '  no-server           nothing inside this worktree served a page',
         '  no-listener-reader  neither lsof nor /proc is available',
+        '  unhealthy           a page answered but a declared health path did',
+        '                      not, with `port`, `path`, and `status`, which',
+        '                      is null on a timeout',
+        '  invalid-config      canon/config/local.toml is not valid TOML, or',
+        '                      health is not a list of paths starting with /',
         '  removed             --remove dropped the line',
         '  no-comment          --remove found no marked comment, a no-op',
         '  no-line             --remove found no address line, a no-op',
@@ -3005,6 +3085,19 @@ function machineLocalRunner(): LocalRunner {
         return false
       }
     },
+    // The final status after redirects, so a login bounce ending on a 3xx or
+    // a 4xx fails rather than reading as the backend answering.
+    async check(port, path) {
+      try {
+        const response = await fetch(`http://localhost:${port}${path}`, {
+          signal: AbortSignal.timeout(LOCAL_PROBE_TIMEOUT_MS),
+        })
+        await response.body?.cancel()
+        return response.status
+      } catch {
+        return null
+      }
+    },
   }
 }
 
@@ -3025,7 +3118,35 @@ async function runLocal(opts: LocalOptions): Promise<number> {
   intro('canon pr local')
 
   const worktree = await resolveWorktreeRoot(root)
-  const result = await findLocalServer(worktree, machineLocalRunner())
+  const declaration = readHealthPaths(worktree)
+  if (declaration.kind === 'invalid') {
+    return refuseWith(
+      'invalid-config',
+      `${declaration.reason}. ${LOCAL_REFUSALS['invalid-config']}`,
+      emitJson,
+      root,
+    )
+  }
+
+  const result = await findLocalServer(
+    worktree,
+    machineLocalRunner(),
+    declaration.kind === 'paths' ? declaration.paths : [],
+  )
+  if (result.kind === 'refused' && result.reason === 'unhealthy') {
+    const { port, path, status } = result
+    const answer =
+      status === null
+        ? `gave no answer within ${LOCAL_PROBE_TIMEOUT_MS / 1000} seconds`
+        : `answered ${status}`
+    return refuseWith(
+      'unhealthy',
+      `${LOCAL_REFUSALS.unhealthy} ${path} on http://localhost:${port} ${answer}.`,
+      emitJson,
+      root,
+      { port, path, status },
+    )
+  }
   if (result.kind === 'refused') {
     return refuseWith(
       result.reason,
@@ -4394,6 +4515,146 @@ async function runDriveCopy(
   return 0
 }
 
+type CloseCommandRefusal = 'reason-unreadable' | 'no-head'
+
+const CLOSE_REFUSALS: Record<CloseRefusal | CloseCommandRefusal, string> = {
+  'no-reason':
+    'No closing reason was given. Write it to a file and pass --reason-file.',
+  'reason-unreadable': 'The --reason-file could not be read.',
+  'reason-unpublishable':
+    'The reason carries text a reader on the remote cannot use or that breaks the density limits. The findings are in the record.',
+  'no-head':
+    'This checkout is on no branch, so pass --head with the branch the pull request carries.',
+  'gh-failed': 'gh could not read the pull request, so nothing was written.',
+  'pull-closed': 'The pull request is already closed.',
+  'head-mismatch':
+    'The pull request carries another head branch than the one expected. Nothing was written to it.',
+  'comment-failed':
+    'The closing comment did not post, so the pull request was left open.',
+  'close-failed':
+    'The comment posted but the close was refused, so the pull request is still open. Close it by hand or re-run.',
+}
+
+function closeApi(root: string, number: string): CloseApi {
+  return {
+    readPull: async () => {
+      const stdout = await gh(root, [
+        'api',
+        `repos/{owner}/{repo}/pulls/${number}`,
+      ])
+      if (stdout === null) return undefined
+      try {
+        const row = JSON.parse(stdout) as RestPull
+        if (typeof row.head?.ref !== 'string') return undefined
+        const headRepo = row.head.repo?.full_name
+        return {
+          isOpen: row.state === 'open',
+          branch: row.head.ref,
+          isFork:
+            headRepo === undefined || headRepo !== row.base?.repo?.full_name,
+        }
+      } catch {
+        return undefined
+      }
+    },
+    postComment: async (body) => {
+      const url = await gh(root, [
+        'api',
+        '-X',
+        'POST',
+        `repos/{owner}/{repo}/issues/${number}/comments`,
+        '-f',
+        `body=${body}`,
+        '--jq',
+        '.html_url',
+      ])
+      return url === null || url.trim() === '' ? undefined : url.trim()
+    },
+    patchClosed: async () =>
+      (await gh(root, [
+        'api',
+        '-X',
+        'PATCH',
+        `repos/{owner}/{repo}/pulls/${number}`,
+        '-f',
+        'state=closed',
+        '--silent',
+      ])) !== null,
+    deleteBranch: async (branch) =>
+      (await gh(root, [
+        'api',
+        '-X',
+        'DELETE',
+        `repos/{owner}/{repo}/git/refs/heads/${encodeURIComponent(branch)}`,
+        '--silent',
+      ])) !== null,
+  }
+}
+
+async function runClose(
+  number: string,
+  opts: CloseCommandOptions,
+): Promise<number> {
+  const root = resolve(opts.root ?? process.cwd())
+  const emitJson = opts.json ?? false
+
+  intro('canon pr close')
+
+  const refuseClose = (
+    reason: CloseRefusal | CloseCommandRefusal,
+    extra: Record<string, unknown> = {},
+  ): number =>
+    refuseWith(reason, CLOSE_REFUSALS[reason], emitJson, root, {
+      number: Number(number),
+      ...extra,
+    })
+
+  if (opts.reasonFile === undefined) return refuseClose('no-reason')
+  let reason: string
+  try {
+    reason = await readFile(resolve(root, opts.reasonFile), 'utf8')
+  } catch {
+    logWarn(`Could not read ${opts.reasonFile}`)
+    return refuseClose('reason-unreadable')
+  }
+
+  let head = opts.head
+  if (head === undefined) {
+    const branch = await $`git -C ${root} symbolic-ref --short -q HEAD`
+      .env(gitEnv())
+      .quiet()
+      .nothrow()
+    head = branch.exitCode === 0 ? branch.text().trim() : ''
+    if (head === '') return refuseClose('no-head')
+  }
+
+  const record = await close(closeApi(root, number), {
+    number: Number(number),
+    reason,
+    head,
+    isKeepBranch: opts.keepBranch ?? false,
+  })
+
+  if (!record.isOk) {
+    return refuseClose(record.reason as CloseRefusal, {
+      ...(record.commentUrl !== undefined && { commentUrl: record.commentUrl }),
+      ...(record.findings !== undefined && { findings: record.findings }),
+    })
+  }
+
+  logStep('Closed')
+  logInfo(`#${record.number} closed, branch ${record.branch}`)
+  if (record.branch === 'delete-failed') {
+    logWarn(`The branch ${head} could not be deleted. Delete it by hand.`)
+  }
+  outro()
+
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify({ root, ...record })}\n`)
+  }
+  return 0
+}
+
 function refuseWith(
   reason: string,
   message: string,

package/src/labels/apply.ts

@@ -20,20 +20,25 @@ export interface LabelDiff {
  * A label the remote lacks is separated from the addable set rather than
  * dropped, because the REST add endpoint creates any label it is handed and
  * that write to the repository settings is not the map's call.
+ *
+ * Names match regardless of case, as GitHub holds them, so this agrees with
+ * `missingLabels` on which labels the remote carries.
  */
 export function diffLabels(
   earned: readonly string[],
   present: readonly string[],
   remote: readonly string[],
 ): LabelDiff {
-  const has = new Set(present)
-  const carried = new Set(remote)
+  const fold = (labels: readonly string[]): Set<string> =>
+    new Set(labels.map((label) => label.toLowerCase()))
+  const has = fold(present)
+  const carried = fold(remote)
 
-  const owed = earned.filter((label) => !has.has(label))
+  const owed = earned.filter((label) => !has.has(label.toLowerCase()))
 
   return {
     owed,
-    toAdd: owed.filter((label) => carried.has(label)),
-    missingOnRemote: owed.filter((label) => !carried.has(label)),
+    toAdd: owed.filter((label) => carried.has(label.toLowerCase())),
+    missingOnRemote: owed.filter((label) => !carried.has(label.toLowerCase())),
   }
 }

package/src/labels/sync.ts

@@ -0,0 +1,17 @@
+/**
+ * The labels a map names that the remote does not carry yet, in map order.
+ *
+ * Only ever a subset of the map, so a label a person made by hand never
+ * appears and nothing here can become an edit or a deletion on the remote.
+ *
+ * GitHub holds label names unique regardless of case, so a remote `Docs`
+ * counts as carrying `docs`. Creating it would be refused, and every later
+ * run would report the same failure.
+ */
+export function missingLabels(
+  mapLabels: readonly string[],
+  remote: readonly string[],
+): string[] {
+  const carried = new Set(remote.map((label) => label.toLowerCase()))
+  return mapLabels.filter((label) => !carried.has(label.toLowerCase()))
+}

package/src/pr/close.ts

@@ -0,0 +1,152 @@
+import { scanPhaseLabels } from '@/labels/phase'
+import { BAN_SETS } from '@/markdown/bans'
+import { type DensityFinding, densityFindings } from '@/markdown/density'
+import { bodyLines, scanBans } from '@/markdown/scan'
+
+/** Why the verb did not close, in the order the refusals are read. */
+export type CloseRefusal =
+  | 'no-reason'
+  | 'reason-unpublishable'
+  | 'gh-failed'
+  | 'pull-closed'
+  | 'head-mismatch'
+  | 'comment-failed'
+  | 'close-failed'
+
+export interface ClosePull {
+  readonly isOpen: boolean
+  /** The head branch name, which the caller's expected head is checked against. */
+  readonly branch: string
+  /** Whether the head lives in another repository, whose branch this one cannot delete. */
+  readonly isFork: boolean
+}
+
+/**
+ * Everything the verb reads or writes, injected so every refusal runs without
+ * a network. A read or write that failed returns undefined or false, never a
+ * guess.
+ */
+export interface CloseApi {
+  readPull(): Promise<ClosePull | undefined>
+  /** Posts the reason and answers the comment's URL. */
+  postComment(body: string): Promise<string | undefined>
+  patchClosed(): Promise<boolean>
+  deleteBranch(branch: string): Promise<boolean>
+}
+
+export interface CloseOptions {
+  readonly number: number
+  readonly reason: string
+  /** The head branch the caller means, so a mistyped number closes nothing. */
+  readonly head: string
+  readonly isKeepBranch: boolean
+}
+
+/** What the reason carries that a reader on the remote cannot use. */
+export interface ReasonFindings {
+  readonly isClean: boolean
+  readonly bannedCharacters: readonly string[]
+  readonly phaseLabels: readonly string[]
+  readonly boardReferences: readonly string[]
+  readonly sessionLinks: readonly string[]
+  readonly density: readonly DensityFinding[]
+}
+
+/** What happened to the head branch once the pull request closed. */
+export type BranchOutcome = 'deleted' | 'kept' | 'fork' | 'delete-failed'
+
+export interface CloseRecord {
+  readonly reason: 'closed' | CloseRefusal
+  readonly isOk: boolean
+  readonly number: number
+  readonly commentUrl?: string
+  readonly branch?: BranchOutcome
+  readonly findings?: ReasonFindings
+}
+
+/**
+ * Runs the checks `canon labels scan` runs on a pull request body, plus
+ * density measured on the reason itself.
+ *
+ * The scan's own post density reads a body only when it opens on a known
+ * post heading, and a closing comment carries none, so an overloaded reason
+ * would pass it unmeasured.
+ */
+export function checkReason(reason: string): ReasonFindings {
+  const lines = bodyLines(reason)
+  const bannedCharacters = scanBans(lines, BAN_SETS).map(
+    (finding) => finding.term,
+  )
+  const { phaseLabels, boardReferences, sessionLinks } = scanPhaseLabels({
+    title: '',
+    body: reason,
+    headRefName: '',
+  })
+  const density = densityFindings(lines)
+
+  return {
+    isClean:
+      bannedCharacters.length === 0 &&
+      phaseLabels.length === 0 &&
+      boardReferences.length === 0 &&
+      sessionLinks.length === 0 &&
+      density.length === 0,
+    bannedCharacters,
+    phaseLabels,
+    boardReferences,
+    sessionLinks,
+    density,
+  }
+}
+
+function refused(
+  reason: CloseRefusal,
+  number: number,
+  extra: Partial<CloseRecord> = {},
+): CloseRecord {
+  return { reason, isOk: false, number, ...extra }
+}
+
+/**
+ * Closes one pull request unmerged with its reason posted first.
+ *
+ * The comment lands before the close, so a failure between the two leaves a
+ * comment on an open pull request rather than a closed one carrying no
+ * reason, which is the defect this verb exists to remove. The branch delete
+ * runs last and never fails the close, since the pull request is already
+ * closed with its reason by then.
+ */
+export async function close(
+  api: CloseApi,
+  opts: CloseOptions,
+): Promise<CloseRecord> {
+  const { number } = opts
+  const reason = opts.reason.trim()
+
+  if (reason === '') return refused('no-reason', number)
+  const findings = checkReason(reason)
+  if (!findings.isClean) {
+    return refused('reason-unpublishable', number, { findings })
+  }
+
+  const pull = await api.readPull()
+  if (pull === undefined) return refused('gh-failed', number)
+  if (!pull.isOpen) return refused('pull-closed', number)
+  if (pull.branch !== opts.head) return refused('head-mismatch', number)
+
+  const commentUrl = await api.postComment(reason)
+  if (commentUrl === undefined) return refused('comment-failed', number)
+
+  if (!(await api.patchClosed())) {
+    return refused('close-failed', number, { commentUrl })
+  }
+
+  let branch: BranchOutcome
+  if (opts.isKeepBranch) branch = 'kept'
+  else if (pull.isFork) branch = 'fork'
+  else {
+    branch = (await api.deleteBranch(pull.branch)) ? 'deleted' : 'delete-failed'
+  }
+
+  return { reason: 'closed', isOk: true, number, commentUrl, branch }
+}

package/src/pr/health.ts

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** Where a project declares what `canon pr local` checks beyond the page. */
+export const LOCAL_CONFIG_REL = join('canon', 'config', 'local.toml')
+
+/**
+ * The health paths a project declared. `none` is an absent file or an empty
+ * `health = []`. `invalid` is a declaration that exists and cannot be used,
+ * which refuses rather than falling back to the page-only probe, since that
+ * fallback is the failure the declaration exists to catch.
+ */
+export type HealthDeclaration =
+  | { readonly kind: 'paths'; readonly paths: readonly string[] }
+  | { readonly kind: 'none' }
+  | { readonly kind: 'invalid'; readonly reason: string }
+
+/**
+ * A path on the page's own host. A second leading slash would read as a
+ * protocol-relative host, so it is refused to keep the probe on localhost.
+ */
+function isLocalPath(entry: unknown): entry is string {
+  return (
+    typeof entry === 'string' &&
+    entry.startsWith('/') &&
+    !entry.startsWith('//') &&
+    !entry.startsWith('/\\')
+  )
+}
+
+export function readHealthPaths(root: string): HealthDeclaration {
+  const path = join(root, LOCAL_CONFIG_REL)
+  if (!existsSync(path)) return { kind: 'none' }
+
+  let parsed: Record<string, unknown>
+  try {
+    parsed = Bun.TOML.parse(readFileSync(path, 'utf8')) as Record<
+      string,
+      unknown
+    >
+  } catch {
+    return { kind: 'invalid', reason: `${LOCAL_CONFIG_REL} is not valid TOML` }
+  }
+
+  const declared = parsed.health
+  if (!Array.isArray(declared) || !declared.every(isLocalPath)) {
+    return {
+      kind: 'invalid',
+      reason: `${LOCAL_CONFIG_REL} needs health as a list of paths, each starting with a single /`,
+    }
+  }
+
+  return declared.length === 0
+    ? { kind: 'none' }
+    : { kind: 'paths', paths: declared }
+}

package/src/pr/local.ts

@@ -2,27 +2,62 @@ import { belongsTo } from '@/listeners/belongs'
 import type { ListenerReader } from '@/listeners/machine'
 import { readAddresses } from '@/pr/evidence'
 
-export type LocalRefusal = 'no-server' | 'no-listener-reader'
+export type LocalRefusal = 'no-server' | 'no-listener-reader' | 'unhealthy'
 
-/** The listener reads a detection makes plus an HTML probe, injected so it can be driven without binding a socket. */
+/** The listener reads a detection makes plus two HTTP probes, injected so it can be driven without binding a socket. */
 export interface LocalRunner extends ListenerReader {
   /** Whether the port serves an HTML page at its root inside the runner's timeout. */
   probe(port: number): Promise<boolean>
+  /** The final status a path on the port answers after redirects, or null when nothing answers inside the timeout. */
+  check(port: number, path: string): Promise<number | null>
 }
 
 export type LocalResult =
   | { readonly kind: 'found'; readonly port: number; readonly url: string }
-  | { readonly kind: 'refused'; readonly reason: LocalRefusal }
+  | {
+      readonly kind: 'refused'
+      readonly reason: Exclude<LocalRefusal, 'unhealthy'>
+    }
+  | {
+      readonly kind: 'refused'
+      readonly reason: 'unhealthy'
+      readonly port: number
+      readonly path: string
+      readonly status: number | null
+    }
+
+interface HealthFailure {
+  readonly path: string
+  readonly status: number | null
+}
+
+async function firstFailingPath(
+  port: number,
+  healthPaths: readonly string[],
+  runner: LocalRunner,
+): Promise<HealthFailure | undefined> {
+  for (const path of healthPaths) {
+    const status = await runner.check(port, path)
+    if (status === null || status < 200 || status >= 300) {
+      return { path, status }
+    }
+  }
+  return undefined
+}
 
 /**
  * Finds the server this worktree is running: the lowest port whose listening
- * process runs inside the worktree and answers an HTTP probe. A port rather
- * than a process is the unit, since one dev server often holds a second
- * socket for its reload channel, and the lower one is the page by convention.
+ * process runs inside the worktree, answers an HTTP probe, and passes every
+ * declared health path. A port rather than a process is the unit, since one
+ * dev server often holds a second socket for its reload channel, and the
+ * lower one is the page by convention. Health is read on the page's own port,
+ * since that is the address a reviewer drives, and a page whose backend fails
+ * refuses as `unhealthy` naming the lowest page port's first failing path.
  */
 export async function findLocalServer(
   worktreeRoot: string,
   runner: LocalRunner,
+  healthPaths: readonly string[] = [],
 ): Promise<LocalResult> {
   const listeners = await runner.listListeners()
   if (listeners === undefined) {
@@ -37,12 +72,18 @@ export async function findLocalServer(
     if (cwd !== undefined && belongsTo(cwd, worktreeRoot)) ports.add(port)
   }
 
+  let unhealthy: (HealthFailure & { readonly port: number }) | undefined
   for (const port of [...ports].sort((a, b) => a - b)) {
-    if (await runner.probe(port)) {
+    if (!(await runner.probe(port))) continue
+    const failure = await firstFailingPath(port, healthPaths, runner)
+    if (failure === undefined) {
       return { kind: 'found', port, url: `http://localhost:${port}` }
     }
+    unhealthy ??= { port, ...failure }
   }
-  return { kind: 'refused', reason: 'no-server' }
+  return unhealthy === undefined
+    ? { kind: 'refused', reason: 'no-server' }
+    : { kind: 'refused', reason: 'unhealthy', ...unhealthy }
 }
 
 /**

package/src/pr/rest.ts

@@ -15,8 +15,16 @@ export interface RestPull {
   readonly number?: number
   readonly title?: string
   readonly body?: string | null
-  readonly head?: { readonly ref?: string; readonly sha?: string }
-  readonly base?: { readonly ref?: string }
+  readonly head?: {
+    readonly ref?: string
+    readonly sha?: string
+    /** Null when the fork the head lived in was deleted. */
+    readonly repo?: { readonly full_name?: string } | null
+  }
+  readonly base?: {
+    readonly ref?: string
+    readonly repo?: { readonly full_name?: string }
+  }
   readonly mergeable_state?: string
   readonly state?: string
   readonly draft?: boolean

package/src/sandbox/replay/run.ts

@@ -81,6 +81,35 @@ function isCopied(rel: string): boolean {
   return rel.split('/').at(-1) !== 'node_modules' && rel !== '.claude/worktrees'
 }
 
+/**
+ * Git's background maintenance creates and removes files such as
+ * `.git/objects/maintenance.lock` while a copy walks the checkout, and a file
+ * listed then gone throws ENOENT. A short bound covers every transient name
+ * git uses, where a filter on `*.lock` would cover one.
+ */
+const COPY_ATTEMPTS = 3
+
+export function copyCheckout(
+  source: ReplaySource,
+  tree: string,
+  copy: typeof cpSync = cpSync,
+): void {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      copy(source.path, tree, {
+        recursive: true,
+        verbatimSymlinks: true,
+        filter: (from) => isCopied(relative(source.path, from)),
+      })
+      return
+    } catch (error) {
+      const vanished = (error as NodeJS.ErrnoException).code === 'ENOENT'
+      if (!vanished || attempt === COPY_ATTEMPTS) throw error
+      rmSync(tree, { recursive: true, force: true })
+    }
+  }
+}
+
 /**
  * Copies a source into `tree`. A snapshot's files lose their `.fixture`
  * suffix and its recorded expectation stays behind, and a checkout copies whole rather than cloning, since a clone
@@ -88,11 +117,7 @@ function isCopied(rel: string): boolean {
  */
 export function copySource(source: ReplaySource, tree: string): void {
   if (source.kind === 'checkout') {
-    cpSync(source.path, tree, {
-      recursive: true,
-      verbatimSymlinks: true,
-      filter: (from) => isCopied(relative(source.path, from)),
-    })
+    copyCheckout(source, tree)
     return
   }
 

package/src/tooling/verify-stack.ts

@@ -95,19 +95,18 @@ async function run({
   logStep(`Scaffolding ${stack}`)
   // Manifests carry shell syntax (`&&`, `cd`, quoted globs), so the command
   // runs under a shell rather than as a split argv.
-  const scaffold = await shell(
-    manifest.scaffold.replaceAll('{{name}}', name),
-    runsDir,
-  )
+  const scaffoldCommand = manifest.scaffold.replaceAll('{{name}}', name)
+  const scaffold = await shell(scaffoldCommand, runsDir)
   if (scaffold.failed) {
     logWarn('Scaffold failed')
+    process.stderr.write(`$ ${scaffoldCommand}\n`)
     writeTail(scaffold.all)
-    state.isFailed = true
   }
 
   if (!existsSync(state.dir)) {
     return refuse(`Scaffold did not produce ${state.dir}`)
   }
+  record(state, 'Scaffold', !scaffold.failed)
 
   await shell(
     'git init -q && git add . && git commit -m "chore: verify scaffold" -q --no-verify --allow-empty',

package/tooling/base/reference.md

@@ -39,6 +39,7 @@ Seeds live in `tooling/base/seeds/`. Sync drops each once on first install and n
 - `.github/workflows/verify.yml` runs on pull requests targeting `main` and on `workflow_dispatch`. A multi-root project adds its own jobs here.
 - `.github/pull_request_template.md` has `## Summary`, `## Key changes`, `## Technical context`, and `## Testing`. A project adds its own checklist lines.
 - `canon/context/development/` holds the `setup` and `ci` entries under a folder index. Extend them with project-specific commands and workflows, and keep canonical rationale here.
+- `canon/config/pr-labels.toml` is the starter pull request label map, covering what the toolkit installs. A project adds a row per surface of its own.
 
 ## Tool pairing
 

package/tooling/base/seeds/canon/config/pr-labels.toml

@@ -0,0 +1,41 @@
+# Pull request domain labels.
+#
+# `git-pr` matches the paths a branch changed against the prefixes below and
+# applies every label that matches. The rows here cover what the toolkit
+# installs. Add a row per surface of your own, such as `app = ["src/"]`, and
+# `canon labels audit` names any changed path no row reaches.
+#
+# Each label has to exist on the remote before a pull request can carry it.
+# Run `canon labels sync` once to create the ones the remote lacks, and again
+# after adding a row.
+#
+# The matching rule and the `[declined]` table are described in the `git-pr`
+# skill's labels reference.
+
+[domains]
+tooling = [
+  ".github/",
+  ".husky/",
+  "scripts/",
+  ".gitignore",
+  ".lintstagedrc",
+  ".oxfmtrc.json",
+  ".prettierignore",
+  "commitlint.config.js",
+  "package.json",
+  "bun.lock",
+  "canon/config/",
+]
+claude = [".claude/", "CLAUDE.md"]
+docs = [
+  "README.md",
+  "docs/",
+  "canon/REQUIREMENTS.md",
+  "canon/DESIGN.md",
+  "canon/context/",
+]
+
+# Paths deliberately left unlabelled, keyed by the reason.
+[declined]
+# Release automation opens its own pull request and applies its own label.
+release-managed = ["CHANGELOG.md", ".release-please-manifest.json"]