@mindrian_os/install 1.13.0-beta.11

package/lib/memory/validators/README.md

@@ -0,0 +1,157 @@
+# Feynman-MINTO Guardian Validators
+
+Phase 88-13 ships the guardian at `scripts/feynman-minto-guardian.cjs` with a
+plugin registry that loads every `.cjs` file dropped into this directory.
+Adding a new validator means dropping a file here. The guardian does not
+need to change.
+
+## Contract
+
+Every validator must export the following shape:
+
+```cjs
+module.exports = {
+  id:           'my-validator',             // unique, sortable, snake or kebab
+  severity_map: { critical: 3, error: 2, warning: 1, info: 0 },
+  scope:        'section',                  // 'section' | 'room' (default: 'section')
+  validate:     function (path, ctx) {      // path is sectionDir OR roomDir
+    // ctx = { roomDir, kind, now, validators } -- optional but guardian provides
+    return {
+      severity:   'warning' | 'error' | 'critical' | 'info' | null,
+      violations: [                         // zero or more
+        {
+          validator:   'my-validator',
+          category:    'string key',
+          severity:    'warning',
+          message:     'human-readable explanation',
+          action_hint: 'optional_slug_like_this',  // optional
+          section:     'market-analysis',          // optional
+          field:       'governing_thought',        // optional
+        },
+      ],
+    };
+  },
+};
+```
+
+### Scope modes
+
+- `'section'` (default): guardian invokes `validate(sectionDir, ctx)` once per
+  section directory that holds ROOM.md. Use this for per-section content
+  invariants (MINTO content checks, cross-ref presence, local graph edges).
+- `'room'`: guardian invokes `validate(roomDir, ctx)` once per room. Use this
+  for room-wide invariants that do not partition cleanly by section. The
+  three lifecycle validators shipped in Phase 88 (snapshot-integrity,
+  queue-health, stale-lifecycle) are all room-scoped because the file they
+  inspect lives at `.mindrian/*.json`, not per-section.
+
+### Severity semantics
+
+The guardian aggregates violations into `.mindrian/invariant-report.json`
+during `on-stop` mode and writes them as `systemMessage` during
+`session-start`. Severity has two distinct enforcement points:
+
+- **Runtime (session-start + on-stop):** advisory only. No exit code
+  indicates blocking. The user sees a TRIPLE_CONTEXT footer that surfaces
+  violations, but the session continues.
+- **pre-commit:** blocking. Any violation whose severity is `critical` or
+  `error` causes the guardian to exit 2 and the commit to fail. Warnings
+  and info are visible but never block.
+
+### Fail-open
+
+If your validator's `validate` function throws, the guardian catches it,
+logs to stderr, and continues with the remaining validators. If the module
+itself throws at require time (syntax error, missing import), the guardian
+skips the file with a stderr warning and keeps loading the rest. One
+broken validator never breaks the whole registry.
+
+### Id collision
+
+If two validators declare the same `id`, the first one loaded wins
+(alphabetical by filename). The second is logged as a collision and
+skipped. This lets downstream phases override a shipped validator simply
+by ordering their file before it (e.g. `00-custom-minto-invariants.cjs`
+shadows `01-minto-invariants.cjs`).
+
+### Testing registration
+
+Your validator is automatically loaded the next time
+`scripts/feynman-minto-guardian.cjs` runs in any mode. To test the loader
+without spawning the hook, set `GUARDIAN_VALIDATORS_DIR=/abs/path/to/my/validators`
+in the environment and point at a fresh directory containing only the
+file under test.
+
+## Seed validators (reference implementations)
+
+### 1. `minto-invariants.cjs` (core)
+
+Wraps `lib/core/feynman-minto-invariants.cjs` (88-00-B). Flags schema,
+freshness, coherence, and atomicity violations in the section's MINTO.md.
+This is the first-in validator that proves the registry pattern; the
+guardian does not require the invariants module directly, it goes through
+this adapter.
+
+### 2. `snapshot-integrity.cjs` (MEM-GUARDIAN-SNAPSHOT-01)
+
+Reads `.mindrian/session-snapshot.json` and cross-checks its `sections[]`
+array against the sections discovered on disk (via ROOM.md presence).
+
+- Partial snapshot (disk section missing from snapshot) -> `warning`
+  `partial_snapshot_detected` per missing section.
+- Empty snapshot with non-empty room -> `error` `snapshot_empty` with
+  `action_hint: rerun_on_stop`.
+- Missing snapshot file -> silent (healthy first-session state).
+- Unparseable snapshot -> `error` `snapshot_unparseable`.
+
+Converts "on-stop crashed mid-walk, nobody notices for 20 sessions" into
+"visible at the very next session-start footer."
+
+### 3. `queue-health.cjs` (MEM-GUARDIAN-QUEUE-01)
+
+Reads `.mindrian/minto-queue.json` (written by 88-02 debouncer). Enforces
+size ceilings:
+
+- `< 500 entries` -> healthy (no violation).
+- `500-999 entries` -> `warning` `queue_approaching_ceiling`.
+- `>= 1000 entries` -> `error` `queue_ceiling_exceeded` with
+  `action_hint: halt_enqueue_until_drained`.
+
+Emits at most ONE aggregate violation per invocation, not N per entry.
+Converts "debouncer drain never fires, queue grows unbounded" into a
+visible health signal.
+
+### 4. `stale-lifecycle.cjs` (MEM-GUARDIAN-STALE-01)
+
+Re-validates `.mindrian/minto-stale.json` entries against the current
+MINTO state. A stale entry whose section now has an invariant-clean
+MINTO is a GHOST: the ledger lies. Emits `warning` `stale_ghost` with
+`action_hint: prune_stale_entry` and `section: <name>`. The guardian
+`on-stop` mode consumes these signals and atomically rewrites
+`minto-stale.json` with ghost sections removed (tmp + rename).
+
+Converts "stale entries never clear, footer shows phantom staleness
+forever" into self-pruning behavior.
+
+## Downstream extension points
+
+Phase 88.3 (Brain cognitive-loop contract) will drop
+`cognitive-loop-contract.cjs` here. Phase 90 (Navigation Engine) will drop
+`navigation-invariants.cjs`. Neither modifies the guardian. The registry
+is the integration point.
+
+## Authoring checklist
+
+- [ ] `id` is unique and stable (shipped IDs appear in telemetry and
+      reports; renaming breaks downstream consumers)
+- [ ] `severity_map` is present even if unused (guardian validates the
+      shape at load time)
+- [ ] `validate` returns the documented shape in all paths, including
+      error paths
+- [ ] Your validator is fail-safe: throwing is acceptable (guardian
+      catches), but infinite loops are not (cap every loop)
+- [ ] Every violation carries `{validator: '<your id>'}` even though the
+      guardian also tags them (belt + suspenders for report traceability)
+- [ ] README entry above (add yours after a shipping commit)
+
+_Three-surface by construction: CJS, Node built-ins, zero new deps._

package/lib/memory/validators/brain-md-invariants.cjs

@@ -0,0 +1,475 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ * Phase 90-05 -- BRAIN.md invariants validator.
+ *
+ * Registry-compatible drop-in for the Phase 88-13 guardian. Auto-
+ * discovered by scripts/feynman-minto-guardian.cjs's validator loader.
+ * Zero guardian.cjs edits required; the guardian's loadValidators()
+ * walks lib/memory/validators/*.cjs on every invocation.
+ *
+ * Contract (see lib/memory/validators/README.md):
+ *   module.exports = {
+ *     id:           'brain-md-invariants',
+ *     severity_map: { critical, error, warning, info },
+ *     scope:        'section',
+ *     validate(sectionDir, ctx) -> { severity, violations[] },
+ *   }
+ *
+ * This is the THIRD independent Canon Part 8 enforcement layer:
+ *   1. Plan 90-00 validateSchema (documents + scans frontmatter leaks).
+ *   2. Plan 90-01 prompt-builder allow-list (hard block at emission).
+ *   3. THIS validator (body-text scan at read-time / commit-time).
+ *
+ * Defense-in-depth by design: a bug in any ONE detector still produces
+ * detection via the other two.
+ *
+ * Three checks beyond the wrapped 90-00 schema validation:
+ *   A) Staleness vs triple. Compare BRAIN.md governing_thought_hash
+ *      against sha256 of the current triple.reasoning.governing_thought.
+ *      Mismatch -> staleness/warning with action_hint 'enqueue_regen'.
+ *   B) brain_graph_version drift. Compare BRAIN.md brain_graph_version
+ *      against .mindrian/brain-schema-cache.json.current_graph_version.
+ *      Drift -> staleness/warning.
+ *   C) Cross-file Canon Part 8 body scan. Run a frozen regex set over
+ *      the BRAIN.md body text. Each distinct hit -> canon_boundary/
+ *      warning with action_hint 'canon_part8_review'. Capped at 5 per
+ *      BRAIN.md to avoid spam.
+ *
+ * Fail-open: any unexpected throw is caught by the guardian's
+ * validator runner (Phase 88-13 Test 12). This validator does NOT
+ * swallow its own exceptions; the guardian owns that contract. Internal
+ * best-effort reads (cache file, triple field access) are guarded
+ * individually so a missing cache never produces a violation.
+ *
+ * BRAIN.md absent -> {violations:[]}. Absence is a valid default
+ * state (mirrors Phase 88-13 stale-lifecycle.cjs behavior for missing
+ * ledger files).
+ *
+ * Pure CJS, node built-ins only (fs, path, crypto). Zero npm deps.
+ */
+
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const schema = require('../../core/brain-md-schema.cjs');
+
+// folder-memory is loaded lazily so the validator's top-level require
+// graph stays minimal and a hypothetical unavailability never crashes
+// require-time. When the guardian runs in on-stop / session-start mode
+// it does NOT pre-populate ctx.triple for section-scoped validators, so
+// we read the triple ourselves via readTriple. Every I/O path stays
+// fail-open: a missing MINTO.md simply skips Check A silently.
+let _folderMemory = null;
+function lazyFolderMemory() {
+  if (_folderMemory !== null) return _folderMemory;
+  try {
+    _folderMemory = require('../../core/folder-memory.cjs');
+  } catch (_e) {
+    _folderMemory = false;
+  }
+  return _folderMemory;
+}
+
+// ---------- Constants ----------
+
+const SEVERITY_MAP = Object.freeze({
+  critical: 3,
+  error: 2,
+  warning: 1,
+  info: 0,
+});
+
+// Violation categories this validator emits. Kept in sync with the
+// schema module's CATEGORIES. Declared here so `severity_map` (required
+// by the guardian registry loader) is stable and auditable.
+const SEVERITY_BY_CATEGORY = Object.freeze({
+  existence: 'critical',
+  schema: 'error',
+  staleness: 'warning',
+  attribution: 'error',
+  canon_boundary: 'warning',
+  coherence: 'warning',
+});
+
+// Hard cap on canon_boundary violations per BRAIN.md to prevent one
+// noisy file from drowning the invariant report.
+const CANON_BOUNDARY_CAP = 5;
+
+// Frozen regex set -- MUST mirror the spirit of the Plan 90-00 scanner
+// but applies to BRAIN.md BODY text (not just frontmatter scalars). The
+// canon_boundary message carries the human-readable `hint` so downstream
+// reviewers know which pattern matched.
+const FORBIDDEN_PATTERNS = Object.freeze([
+  { re: /@[a-zA-Z0-9._-]+\.[a-zA-Z]{2,}/, hint: 'email-like pattern' },
+  { re: /\$[0-9][\d,.]*[KMB]?\b/, hint: 'currency magnitude' },
+  {
+    re: /\b(Lawrence|Jonathan|Nimrod|Oren|Dror)\s+said\b/i,
+    hint: 'quoted-person attribution',
+  },
+  { re: /\bmeeting with\b/i, hint: 'meeting fragment' },
+  { re: /\b\d{3}-\d{2}-\d{4}\b/, hint: 'SSN-like pattern' },
+  {
+    re: /\b\+?1?[\s.\-]?\(?\d{3}\)?[\s.\-]?\d{3}[\s.\-]?\d{4}\b/,
+    hint: 'phone-like pattern',
+  },
+]);
+
+// Categories that REQUIRE a parsed frontmatter (cannot run if we never
+// got a usable fm object). If the schema wrapping short-circuits on a
+// parse error, the validator skips these checks.
+const STALENESS_CATEGORY = 'staleness';
+const CANON_BOUNDARY_CATEGORY = 'canon_boundary';
+const SCHEMA_CATEGORY = 'schema';
+
+// ---------- Helpers ----------
+
+function safeReadText(p) {
+  try {
+    return fs.readFileSync(p, 'utf8');
+  } catch (_e) {
+    return null;
+  }
+}
+
+function safeReadJson(p) {
+  const raw = safeReadText(p);
+  if (raw === null) return null;
+  try {
+    return JSON.parse(raw);
+  } catch (_e) {
+    return null;
+  }
+}
+
+// Best-effort frontmatter extractor. Returns { fm, body } on success;
+// { fm: null, body: '' } if the file is malformed. We do NOT emit a
+// schema violation from here (the wrapped validateSchema already
+// reports that with a precise message); we just bail out of the checks
+// that depend on parsed frontmatter.
+function splitFrontmatterAndBody(raw) {
+  if (typeof raw !== 'string' || raw.length === 0) {
+    return { fm: null, body: '' };
+  }
+  const re = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+  const m = raw.match(re);
+  if (!m) return { fm: null, body: '' };
+
+  const fm = {};
+  const fmText = m[1];
+  const body = m[2] || '';
+  const lines = fmText.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length === 0 || /^\s*$/.test(line) || /^\s*#/.test(line)) continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_-]*):(.*)$/);
+    if (!match) {
+      return { fm: null, body: body };
+    }
+    const key = match[1];
+    const rest = match[2].trim();
+    fm[key] = unquoteOrCast(rest);
+  }
+  return { fm: fm, body: body };
+}
+
+function unquoteOrCast(raw) {
+  if (raw.length === 0) return '';
+  if (raw[0] === '"') {
+    if (raw.length < 2 || raw[raw.length - 1] !== '"') return raw;
+    return raw.slice(1, -1);
+  }
+  if (raw[0] === "'") {
+    if (raw.length < 2 || raw[raw.length - 1] !== "'") return raw;
+    return raw.slice(1, -1);
+  }
+  if (raw === 'null' || raw === '~') return null;
+  if (raw === 'true') return true;
+  if (raw === 'false') return false;
+  if (/^-?\d+$/.test(raw)) {
+    const n = parseInt(raw, 10);
+    if (Number.isSafeInteger(n)) return n;
+  }
+  if (/^-?\d+\.\d+$/.test(raw)) {
+    const f = parseFloat(raw);
+    if (Number.isFinite(f)) return f;
+  }
+  return raw;
+}
+
+function gthHashOf(text) {
+  const s = typeof text === 'string' ? text : '';
+  return 'sha256:' + crypto.createHash('sha256').update(s).digest('hex');
+}
+
+function pushViolation(list, category, severity, message, extras) {
+  const v = { category: category, severity: severity, message: message };
+  if (extras && typeof extras === 'object') {
+    for (const k of Object.keys(extras)) {
+      if (extras[k] !== undefined) v[k] = extras[k];
+    }
+  }
+  list.push(v);
+}
+
+function aggregateSeverity(violations) {
+  const order = ['info', 'warning', 'error', 'critical'];
+  let max = -1;
+  for (const v of violations) {
+    const i = order.indexOf(v.severity);
+    if (i > max) max = i;
+  }
+  return max === -1 ? null : order[max];
+}
+
+// ---------- Schema wrapping (Plan 90-00) ----------
+//
+// Wraps validateSchema and copies its violation records through. The
+// schema module already normalizes severity + category; we just
+// forward. The field + action_hint properties are preserved.
+
+function runSchemaCheck(brainMdPath, violations) {
+  let res;
+  try {
+    res = schema.validateSchema(brainMdPath);
+  } catch (_e) {
+    // Defensive: if the schema validator itself throws, surface a
+    // single schema/error so the downstream audit is visible. The
+    // guardian's fail-open still protects session-start and
+    // pre-commit.
+    pushViolation(
+      violations,
+      SCHEMA_CATEGORY,
+      'error',
+      'brain-md-schema.validateSchema threw unexpectedly'
+    );
+    return { shortCircuit: true };
+  }
+  if (!res || !Array.isArray(res.violations)) {
+    return { shortCircuit: false };
+  }
+  // Copy violations into our list byte-identically (preserving field +
+  // action_hint). The guardian auto-stamps validator id later.
+  for (const v of res.violations) {
+    if (!v || typeof v !== 'object') continue;
+    const extras = {};
+    if (v.field !== undefined) extras.field = v.field;
+    if (v.action_hint !== undefined) extras.action_hint = v.action_hint;
+    pushViolation(violations, v.category, v.severity, v.message, extras);
+  }
+  // If the schema validator returned CRITICAL (existence) or a parse-
+  // delimiter error, we short-circuit the staleness + canon_boundary
+  // checks: without a parsed frontmatter we can't compare hashes, and
+  // without a parsed frontmatter+body we risk double-reporting the
+  // same shape break. The short-circuit also prevents cascading noise
+  // in Test 13 (parse-failure case).
+  const isFatal = res.violations.some(function (v) {
+    if (!v || typeof v !== 'object') return false;
+    if (v.category === 'existence') return true;
+    if (v.category === 'schema' && v.severity === 'error') {
+      // Only delimiter / parse-failure messages warrant short-circuit;
+      // missing-field errors are still informative alongside runtime
+      // checks. We treat messages that mention "delimiter" or "parse"
+      // as fatal-for-runtime-checks.
+      return /delimiter|parse/i.test(v.message || '');
+    }
+    return false;
+  });
+  return { shortCircuit: isFatal };
+}
+
+// ---------- Check A: staleness vs triple ----------
+
+function runStalenessCheck(fm, triple, violations) {
+  if (!fm || !triple || !triple.reasoning) return;
+  const fileHash = fm.governing_thought_hash;
+  if (typeof fileHash !== 'string' || fileHash.length === 0) return;
+  const currentGt = triple.reasoning.governing_thought;
+  // If there's no current governing_thought (e.g. MINTO absent), we
+  // cannot meaningfully compare. Skip silently; the 90-00 schema layer
+  // already flags missing fields.
+  if (typeof currentGt !== 'string' || currentGt.length === 0) return;
+  const expected = gthHashOf(currentGt);
+  if (expected === fileHash) return;
+  pushViolation(
+    violations,
+    STALENESS_CATEGORY,
+    'warning',
+    'BRAIN.md governing_thought_hash does not match current triple (derivation stale, enqueue regen)',
+    {
+      field: 'governing_thought_hash',
+      action_hint: 'enqueue_regen',
+    }
+  );
+}
+
+// ---------- Check B: brain_graph_version drift ----------
+
+function runGraphVersionDriftCheck(fm, roomDir, violations) {
+  if (!fm || !roomDir) return;
+  const fileVersion = fm.brain_graph_version;
+  if (typeof fileVersion !== 'number' || !Number.isSafeInteger(fileVersion)) {
+    return;
+  }
+  const cachePath = path.join(roomDir, '.mindrian', 'brain-schema-cache.json');
+  const cache = safeReadJson(cachePath);
+  if (!cache || typeof cache !== 'object') return;
+  const currentVersion = cache.current_graph_version;
+  if (
+    typeof currentVersion !== 'number' ||
+    !Number.isSafeInteger(currentVersion)
+  ) {
+    return;
+  }
+  if (currentVersion === fileVersion) return;
+  pushViolation(
+    violations,
+    STALENESS_CATEGORY,
+    'warning',
+    'BRAIN.md brain_graph_version ' +
+      fileVersion +
+      ' does not match current Brain graph version ' +
+      currentVersion +
+      ' (graph_version drift)',
+    {
+      field: 'brain_graph_version',
+      action_hint: 'enqueue_regen',
+    }
+  );
+}
+
+// ---------- Check C: cross-file canon boundary scan ----------
+
+function runCanonBoundaryScan(body, violations) {
+  if (typeof body !== 'string' || body.length === 0) return;
+  let count = 0;
+  for (const p of FORBIDDEN_PATTERNS) {
+    if (count >= CANON_BOUNDARY_CAP) break;
+    if (p.re.test(body)) {
+      pushViolation(
+        violations,
+        CANON_BOUNDARY_CATEGORY,
+        'warning',
+        'Possible Canon Part 8 leak in BRAIN.md body: ' +
+          p.hint +
+          ' matched. Review for user-content seepage.',
+        {
+          field: 'body',
+          action_hint: 'canon_part8_review',
+        }
+      );
+      count += 1;
+    }
+  }
+}
+
+// ---------- validate ----------
+
+function validate(sectionDir, ctx) {
+  const violations = [];
+  // Guardian always passes a string sectionDir. Be defensive anyway.
+  if (typeof sectionDir !== 'string' || sectionDir.length === 0) {
+    return { severity: null, violations: violations };
+  }
+
+  const brainMdPath = path.join(sectionDir, 'BRAIN.md');
+  // Absence is valid (mirrors stale-lifecycle.cjs behavior on missing
+  // ledger files). Return zero violations.
+  let stat;
+  try {
+    stat = fs.statSync(brainMdPath);
+  } catch (_e) {
+    return { severity: null, violations: violations };
+  }
+  if (!stat || !stat.isFile()) {
+    return { severity: null, violations: violations };
+  }
+
+  // --- Schema wrapping (Plan 90-00 validateSchema) ---
+  const schemaOutcome = runSchemaCheck(brainMdPath, violations);
+  if (schemaOutcome.shortCircuit) {
+    // Existence-critical or delimiter/parse-error. The staleness and
+    // canon_boundary checks need a parsed frontmatter; running them
+    // against a malformed file produces noise, not signal.
+    return {
+      severity: aggregateSeverity(violations),
+      violations: violations,
+    };
+  }
+
+  // --- Local parse for runtime checks ---
+  const raw = safeReadText(brainMdPath);
+  if (raw === null) {
+    return {
+      severity: aggregateSeverity(violations),
+      violations: violations,
+    };
+  }
+  const parsed = splitFrontmatterAndBody(raw);
+  const fm = parsed.fm;
+  const body = parsed.body;
+
+  // If fm is null here, the wrapped schema already emitted an error;
+  // runtime checks would double-report. Bail.
+  if (!fm) {
+    return {
+      severity: aggregateSeverity(violations),
+      violations: violations,
+    };
+  }
+
+  // --- Check A: staleness vs live triple ---
+  //
+  // When called by the Phase 88-13 guardian in session-start / on-stop
+  // / pre-commit mode, ctx does NOT carry a pre-computed triple (the
+  // guardian passes {roomDir, kind, now}). We fall back to reading the
+  // section's MINTO.md via folder-memory.readTriple. If folder-memory
+  // is unavailable or readTriple throws unexpectedly, we skip the
+  // check rather than synthesize a false violation -- fail-open.
+  let triple = ctx && ctx.triple ? ctx.triple : null;
+  if (!triple) {
+    const fm2 = lazyFolderMemory();
+    if (fm2 && typeof fm2.readTriple === 'function') {
+      try {
+        triple = fm2.readTriple(sectionDir);
+      } catch (_e) {
+        triple = null;
+      }
+    }
+  }
+  runStalenessCheck(fm, triple, violations);
+
+  // --- Check B: brain_graph_version drift ---
+  // Prefer ctx.roomDir (set by the guardian); fall back to the
+  // section's parent directory as a sensible default when called
+  // outside the guardian (e.g. direct unit tests with only a roomDir
+  // in context).
+  const roomDir =
+    (ctx && typeof ctx.roomDir === 'string' && ctx.roomDir.length > 0)
+      ? ctx.roomDir
+      : path.dirname(sectionDir);
+  runGraphVersionDriftCheck(fm, roomDir, violations);
+
+  // --- Check C: canon_boundary body scan ---
+  runCanonBoundaryScan(body, violations);
+
+  return {
+    severity: aggregateSeverity(violations),
+    violations: violations,
+  };
+}
+
+module.exports = {
+  id: 'brain-md-invariants',
+  severity_map: SEVERITY_MAP,
+  scope: 'section',
+  validate: validate,
+  // Exported for downstream introspection + traceability. Not required
+  // by the registry loader, but useful to Phase 91 and the 90-08
+  // graceful-degradation suite.
+  SEVERITY_BY_CATEGORY: SEVERITY_BY_CATEGORY,
+  FORBIDDEN_PATTERNS: FORBIDDEN_PATTERNS,
+  CANON_BOUNDARY_CAP: CANON_BOUNDARY_CAP,
+};