fix(visualization): gate the design canvas clause in plugin.json

[kyle-sexton]

Refs: #4054
Refs: #4055

Summary

The visualization plugin manifest description still carried an ungated presence claim, "where the bundled design skill is available", inside its form list. The visualize skill description dropped that phrasing in #4810, but plugin.json and the generated docs/catalog.md line kept it. The native-overlap self-check scans SKILL.md descriptions only, so CI never flagged it.

Fix

• plugins/visualization/.claude-plugin/plugin.json: removed the clause from the form list and added one sentence using the canonical gate token: "When the bundled design skill resolves in this session, it is preferred for a hand-editable design canvas; this skill chooses the form and medium."
• docs/catalog.md: regenerated with node scripts/generate-catalog.mjs (one line).
• Version 0.8.1 to 0.8.2 with a CHANGELOG entry.
• docs/native-surfaces/records.json and the regenerated docs/native-surfaces.md: the design to visualization:visualize row gains an evidence bullet quoting the gated description sentence, as the explore-directions row does (cross-group request from prototype, Refs prototype: sweep unit, gate the design canvas mention and bake the design row's integration into explore-directions #4055); the 0.8.2 CHANGELOG entry is extended, not bumped again.
• Finding 4054 (empty PR feat(visualization): gate design canvas mention in visualize (#4054) #4928) is a historical process fact with nothing to revert; no change made for it.

Verification

• node scripts/generate-catalog.mjs --check: catalog in sync with the manifests.
• scripts/check-changelog-parity.sh --check --check-order: pass.
• scripts/validate-plugins.sh: all plugin manifests and the catalog validated.
• scripts/check-purged-em-dashes.sh --check: no em dashes.
• The plugin has no test scripts.

Related

• Audit findings for visualization: sweep unit, gate the design canvas mention and bake the design row's integration into visualize #4054 and prototype: sweep unit, gate the design canvas mention and bake the design row's integration into explore-directions #4055 (.work/audit/REPORT.md); both issues are already closed and stay closed, hence Refs.
• Cross-group request to claude-ops (low priority): check_presence_mentions in plugins/claude-ops/skills/audit-native-overlap/scripts/overlap.py should also scan the plugin.json description so CI catches this class.
• Cross-group request from prototype (applied): cite the description phrase in the design registry row. The two-plugins-in-one-PR bundling note needed no action.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EugXnFddtpHcY5gTuyEirB

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T13:32:36.305906Z	28650f5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 24s —— View job

---

Claude finished the code review

• Gather context (PR body, changed files)
• Understand request: custom instructions direct running /review:code-review for PR fix(visualization): gate the design canvas clause in plugin.json #5253
• Invoke /review:code-review and follow its instructions
• Post findings

Summary

Reviewed the diff (git diff origin/main...HEAD, 5 files, +15/-3) against this repo's CLAUDE.md/AGENTS.md conventions and the CI code-review lane's correctness/maintainability bar.

No findings clear the high-signal bar. This is a tightly-scoped fix:

• plugins/visualization/.claude-plugin/plugin.json: removed the ungated "where the bundled design skill is available" clause from the FORM list and replaced it with a standalone gated sentence. Verified the JSON is well-formed and the new sentence conveys the same gate as the visualize skill's own frontmatter description (SKILL.md line 2), even though the two use slightly different phrasing ("prefer it for... this skill for choosing" vs. "it is preferred for... this skill chooses") — semantically equivalent, not a defect.
• docs/native-surfaces/records.json / docs/native-surfaces.md: the new evidence bullet quoting the gated SKILL.md description was checked character-for-character against plugins/visualization/skills/visualize/SKILL.md line 2 — it matches exactly. The bullet's shape also matches the sibling explore-directions row's evidence format (docs/native-surfaces.md#L192) as the PR body claims.
• docs/catalog.md: the updated blurb reads correctly and is internally consistent with the new plugin.json description.
• plugins/visualization/CHANGELOG.md: entry is well-formed, correctly versioned 0.8.2, links both issues, and the "Changed" sub-entry is folded into the same release rather than bumping again, as the PR body states.
• Searched the repo for the old ungated phrase ("where the bundled design skill is available"); the remaining hits are in CHANGELOG.md files (historical, describing the old wording) and files untouched by this PR (docs/specs/native-overlap-route-to-compose.md, plugins/claude-ops/skills/audit-native-overlap/scripts/test_overlap.py) — pre-existing and out of this PR's scope.
• plugins/visualization/README.md:25 still says "...via the bundled design skill when that presence-gated preview is available" — this already carries explicit gating language ("presence-gated", "when... available"), so it isn't the same defect class as the one this PR fixes, and it's untouched by the diff.

Verification note: I could not execute the author's cited verification commands (node scripts/generate-catalog.mjs --check, check-changelog-parity.sh, validate-plugins.sh, check-purged-em-dashes.sh) in this sandbox — all Bash invocations were denied by the environment's permission gate. I did not re-run them, so per this lane's rule I'm not claiming to have independently verified those results; treat the PR body's verification section as author-claimed only. Manual inspection (JSON well-formedness, exact-string comparison of the quoted evidence against the actual SKILL.md/plugin.json text, and format parity with the sibling registry row) covered what a lint/script run would otherwise catch here.

[claude]

Claude finished @kyle-sexton's task in 31s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Apply skip gate
• Review changed files for security-relevant surface
• Check for instruction-surface deletions
• Post final findings

No security issues found.

This PR only edits descriptive text and metadata:

• plugins/visualization/.claude-plugin/plugin.json: description string edit (gates the "design canvas" clause behind "When the bundled design skill resolves in this session").
• docs/catalog.md: regenerated catalog line matching the manifest description.
• docs/native-surfaces.md / docs/native-surfaces/records.json: an added evidence bullet quoting the new gated description sentence.
• plugins/visualization/CHANGELOG.md: changelog entry for 0.8.2.

None of this touches code execution, permissions, authentication, data handling, or trust boundaries — it's plugin-manifest/doc text only. The change tightens a presence claim (adds a conditional gate) rather than removing or weakening any guardrail, so the instruction-surface-deletion lens doesn't apply here either: no standing instruction (CLAUDE.md, AGENTS.md, a rules file, a skill/agent body, or a hook allow/deny list) is deleted, narrowed, or softened by this diff.

Skip gate applied: no security-relevant surface in this diff.