@erclx/canon 5.77.0 → 5.79.0

package/docs/workflow/visual-design-workflow.md

@@ -45,6 +45,7 @@ Two reviews run beside each other and finish on their own clocks.
 - `canon:review-pr` reads the code and the stills in the evidence comment, and posts under `## Review`.
 - `canon:review-ui` never reads the diff. It drives each checklist box in the running app through `canon browser`, which runs the pinned `@playwright/cli`, and posts under `## UI review`.
 - Every box gets one verdict, being pass, fail, needs eyes, or not driven.
+- A page that shows its start state only behind a token or a signed-in route names that path as `access` in `canon/config/app-drive.toml`, and the pass opens its address behind it.
 - The pass refuses rather than download a browser. Install it once per machine with `canon browser install-browser chromium`.
 
 After the boxes, `review-ui` sweeps every route they reached:
@@ -63,7 +64,7 @@ A UI review stays open while the branch owes a fix. Three things owe one:
 
 Two kinds of result report without holding the review open.
 
-- A taste box needs eyes, so the pass captures both themes and leaves the call to you.
+- A taste box needs eyes, so the pass captures both themes and leaves the call to you. A checklist holding only taste boxes gets no UI reviewer at all, and the lift does not wait for one.
 - Every other probe result, and every axe `incomplete`, is a reading to confirm, since each probe carries a known class of false finding.
 
 At the time of writing, the gated axe classes are contrast, target size, accessible names, labels, alt text, document title and language, valid ARIA, and nested interactive controls. A rule leaves the list on its first false finding, so `canon drive --help` and the `review-ui` skill carry the current one.

package/governance/ledger/skills/code-craft/SKILL.md

@@ -42,6 +42,15 @@ Parnas's paper refused a read at its ACM DOI, `10.1145/361598.361623`, so the ro
 | Rules free of transport and storage       | [Cockburn, Hexagonal Architecture](https://alistair.cockburn.us/hexagonal-architecture/): an application "developed and tested in isolation from its eventual run-time devices and databases"                                                                           | 2026-10-24 |
 | No ports and adapters for record CRUD     | [Microsoft, Design a DDD-oriented microservice](https://learn.microsoft.com/en-us/dotnet/architecture/microservices/microservice-ddd-cqrs-patterns/ddd-oriented-microservice): "Simpler responsibilities, like a CRUD service, can be managed with simpler approaches." | 2026-10-24 |
 
+## Give another language its own file
+
+| Bullet                                  | Source                                                                                                                                                                                        | Read       |
+| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| A long page, stylesheet, or script out  | [Meszaros, Inline Resource](http://xunitpatterns.com/Inline%20Resource.html): "If the contents of the resource are large, chances are high that you are also suffering from Eager Test"       | 2026-11-03 |
+| A branching script out at any length    | House choice: the `ci-workflow` skill already moves a `run:` step past one guard to a script, and a fake that branches is shared by many tests, so no test reads it as its own input          | 2026-11-03 |
+| An interpolating template stays in code | House choice: a template built from data is code generating output, and a file holding it would carry placeholders no linter for its language reads either                                    | 2026-11-03 |
+| Short input under test stays inline     | [Meszaros, Obscure Test](http://xunitpatterns.com/Obscure%20Test.html): with a Mystery Guest "the test reader is not able to see the cause and effect between fixture and verification logic" | 2026-11-03 |
+
 ## Check your own diff
 
 | Bullet                                  | Source                                                                                                                                                                                                                                                        | Read       |

package/governance/ledger/skills/test-craft/SKILL.md

@@ -44,6 +44,7 @@ The field is software testing practice. Software Engineering at Google carries t
 | Test data through a factory or builder  | [Pryce, Test Data Builders](http://www.natpryce.com/articles/000714.html): "For each class you want to use in a test, create a Builder for that class", one that "Initialises its instance variables to commonly used or safe values"                | 2026-10-24 |
 | Assert through the public surface       | [Software Engineering at Google, ch. 12](https://abseil.io/resources/swe-book/html/ch12.html): tests should "make calls against its public API rather than its implementation details"                                                               | 2026-10-24 |
 | Real, then fake, then stub, mock last   | [addyosmani/agent-skills, Test-Driven Development](https://github.com/addyosmani/agent-skills/blob/c004a74/skills/test-driven-development/SKILL.md): "Preference order (most to least preferred): 1. Real implementation", then fake, stub, and mock | 2026-10-24 |
+| A long fixture in its own file          | [Meszaros, Inline Resource](http://xunitpatterns.com/Inline%20Resource.html): "If the contents of the resource are large, chances are high that you are also suffering from Eager Test"                                                              | 2026-11-03 |
 
 ## Hold the structure floors
 

package/governance/ledger/skills/ui-craft/capture.md

@@ -16,11 +16,24 @@ The rule states canon's own evidence procedure for a rendered change, so most ro
 
 ## When to capture
 
-| Bullet                                   | Source                                                                                                                                                                                                                                                                                                                           | Read       |
-| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
-| Preview, not dev server                  | House choice: a dev server injects overlays and skips the production build's transforms, so its frame differs from what ships                                                                                                                                                                                                    | 2026-10-18 |
-| Every theme, and again                   | House choice: a defect in the dark theme passes a light-only capture, and a repair inside a shared stylesheet can cancel a rule written earlier in the same file                                                                                                                                                                 | 2026-10-18 |
-| Read the capture before the pull request | House choice: a defect visible in the worker's own capture, such as a 20px target under the 24px bullet in `pointer.md`, reached review because nobody read the frame against the checklist first, and each review round re-runs both reviews. The skill ships with the plugin, so the bullet carries a report-if-missing clause | 2026-10-23 |
+| Bullet                                    | Source                                                                                                                                                                                                                                                                                                                           | Read       |
+| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Preview, not dev server                   | House choice: a dev server injects overlays and skips the production build's transforms, so its frame differs from what ships                                                                                                                                                                                                    | 2026-10-18 |
+| Every theme, and again                    | House choice: a defect in the dark theme passes a light-only capture, and a repair inside a shared stylesheet can cancel a rule written earlier in the same file                                                                                                                                                                 | 2026-10-18 |
+| Read the capture before the pull request  | House choice: a defect visible in the worker's own capture, such as a 20px target under the 24px bullet in `pointer.md`, reached review because nobody read the frame against the checklist first, and each review round re-runs both reviews. The skill ships with the plugin, so the bullet carries a report-if-missing clause | 2026-10-23 |
+| A case per added or altered state         | House choice: workers read the old rule as covering new surfaces only, so new states of captured surfaces shipped with no case and the next pull request met the same thin fixture. Proof is owed by default.                                                                                                                    | 2026-11-03 |
+| States that count as visible              | House choice: a focus ring, an outline, a toast, a tooltip, a size change from server-written markup, and a state reachable only by interaction each show on a page, and workers filed them as behavior with nothing to capture                                                                                                  | 2026-11-03 |
+| Exemption stated in the pull request body | House choice: the reviewer needs the path and the reason in front of them to accept it, and a line in the body is the one place both reviewers read                                                                                                                                                                              | 2026-11-03 |
+| Reviewer accepts through the waiver line  | House choice: the lift reads waivers from the newest review pass alone, so only that line holds the draft mark open to a painted path with no case                                                                                                                                                                               | 2026-11-03 |
+| Uncovered painted path stays in draft     | House choice: a painted path with neither a case nor a waiver is the gap the lift refuses, so the rule names the outcome a worker meets                                                                                                                                                                                          | 2026-11-03 |
+
+## When the fixture cannot reach a state
+
+| Bullet                                      | Source                                                                                                                                                                            | Read       |
+| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Extend the fixture in the same branch       | House choice: a drive fixture lacking a state made a box or reel skip and close, and only the building session can add the state before the pull request opens                    | 2026-11-03 |
+| Never record the state as a skip            | House choice: a skip leaves the fixture as thin as it was, so the next pull request meets the same gap and skips again                                                            | 2026-11-03 |
+| State the setup inline with no fixture file | House choice: a project with no `canon/config/app-drive.toml` drives the served root, so a fixture file is not owed and the setup goes on the box, as `(local only)` already does | 2026-11-03 |
 
 ## What a capture covers
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.77.0",
+  "version": "5.79.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {
@@ -18,6 +18,7 @@
     "tsconfig.json",
     "assets/brand/mark.svg",
     "!scripts/eval",
+    "!src/**/fixtures/**",
     "!**/*.test.ts",
     "!**/*.test.tsx"
   ],
@@ -74,8 +75,8 @@
     "astro": "^6.1.9",
     "husky": "^9.1.7",
     "micromatch": "^4.0.8",
-    "oxfmt": "0.74.0",
-    "oxlint": "1.89.0",
+    "oxfmt": "0.75.0",
+    "oxlint": "1.90.0",
     "prettier": "^3.8.1",
     "prettier-plugin-astro": "^0.14.1",
     "prettier-plugin-tailwindcss": "^0.8.1",