Review Hub Canonical Content Here, Before a Carrier Is the One to Read It

.claude-plugin/fleet-skills/.source-digest

@@ -1 +1 @@
-438bd561ef5f233b
+fdc184b741106834

.github/actions/validate/action.yml

@@ -42,6 +42,38 @@ runs:
       shell: bash
       run: python3 scripts/build_dist.py --check
 
+    # The carried-content half of the local-review rule, per GOVERNANCE.md "Verification Discipline".
+    # The .husky/pre-push hook runs the same check and is bypassable by construction, so this is where it actually binds.
+    # Pull requests only, since a canonical unit's change is measured against the branch it is proposed into and a push carrying no pull request has none.
+    # The base commit reaches the script through the environment rather than through an expression inside it, so a ref value can never be read as shell.
+    - name: Check carried canonical content review coverage step
+      if: github.event.pull_request != null
+      shell: bash
+      env:
+        BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      run: |
+        set -Eeuo pipefail
+        # This job checks out at the default depth, and the check measures each unit from the merge-base with the pull request's base, which a depth-1 clone holds neither side of.
+        # Deepening here rather than raising the job's own fetch-depth keeps the cost with the hub, whose hook this is, rather than on every repository that reuses this workflow.
+        # The engine reports an unresolvable base as a boundary rather than as a verdict, so without this the step fails loudly instead of passing blind, which is how the gap was found.
+        if [ "$(git rev-parse --is-shallow-repository)" = true ]; then
+          git fetch --no-tags --prune --unshallow origin
+        fi
+        # The base is an ancestor of the ref this event checks out, so unshallowing normally supplies it, and it is fetched by name where it does not.
+        if ! git rev-parse --verify --quiet "$BASE_SHA^{commit}"; then
+          git fetch --no-tags origin "$BASE_SHA"
+        fi
+        python3 scripts/canonical_review.py check --target "$BASE_SHA"
+
+    # Read-only: fails where the committed burn-down no longer describes the ledger and the tree.
+    # Runs on every event, unlike the step above, because staleness is a property of the commit rather than of a comparison against a base.
+    # `!cancelled()` so an earlier failing step does not skip it, since a run that names one reason and hides the next costs a whole round to discover the second, which is the reason .husky/pre-push runs both gates before reading either verdict.
+    # Not `always()`, which also runs after a cancellation, where nothing is waiting for the answer.
+    - name: Check the canonical review burn-down is current step
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: python3 scripts/canonical_review.py report --check
+
     # Warn-only, and visible rather than absent: an unrun check is one nobody acts on.
     # A finding here names a character no tier covers, and classifying it is a fleet-law edit rather than a prose fix.
     - name: Report unclassified characters step

.husky/pre-push

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Refuses a branch push that no recorded local review pass covers, per GOVERNANCE.md "Verification Discipline".
+# Refuses a branch push whose diff no recorded local review pass covers, and one carrying a canonical unit no full-content pass covers, per GOVERNANCE.md "Verification Discipline".
 # Enable it per clone with `git config core.hooksPath .husky`, and see the pre-commit hook for why `_/husky.sh` is not sourced.
 set -Eeuo pipefail
 
@@ -77,23 +77,29 @@ else
     exit 1
 fi
 
+# Two gates under one rule.
+# The first asks whether a recorded pass covers this branch's diff, and the second whether one covers each canonical unit the branch moved, which a repository carrying that content reads whole rather than as a diff.
+# Both run before either verdict is read, so one blocked push names every reason it was refused rather than only the first, which would otherwise cost a second push to discover the next.
 # No --target: a target read from the environment is set inline on the very command being gated.
-status=0
-run_py scripts/local_review.py check || status=$?
-if [ "$status" -eq 0 ]; then
+diff_status=0
+run_py scripts/local_review.py check || diff_status=$?
+unit_status=0
+run_py scripts/canonical_review.py check || unit_status=$?
+if [ "$diff_status" -eq 0 ] && [ "$unit_status" -eq 0 ]; then
     exit 0
 fi
-if [ "$status" -eq 1 ]; then
-    echo "" >&2
-    # The engine names its own case, and only some of them are a missing pass.
-    if [ "$py_name" != python3 ]; then
-        echo "pre-push: this host runs the engine as '$py_name', so read any 'python3' above as '$py_name'." >&2
-    fi
+echo "" >&2
+# The engines name their own cases, and only some of them are a missing pass.
+if [ "$py_name" != python3 ]; then
+    echo "pre-push: this host runs the engines as '$py_name', so read any 'python3' above as '$py_name'." >&2
+fi
+if [ "$diff_status" -eq 1 ] || [ "$unit_status" -eq 1 ]; then
     echo "pre-push: this push is blocked, which is the gate working. Read the engine message above for the case." >&2
-    echo "pre-push: the local-strict-review skill's refusal table says what clears each one." >&2
-    exit 1
+    echo "pre-push: the local-strict-review skill's refusal table says what each refusal means and what clears it," >&2
+    echo "pre-push: for both gates, and its carried-content section says how the canonical pass itself is run." >&2
+fi
+if [ "$diff_status" -gt 1 ] || [ "$unit_status" -gt 1 ]; then
+    echo "pre-push: a review gate could not run, which is not a verdict either way." >&2
+    echo "pre-push: fix what it reported above, most often by fetching the target branch." >&2
 fi
-echo "" >&2
-echo "pre-push: the local review gate could not run, which is not a verdict either way." >&2
-echo "pre-push: fix what it reported above, most often by fetching the target branch." >&2
 exit 1

AGENTS.md

@@ -92,6 +92,7 @@ Every rule below is a level-two section of [`GOVERNANCE.md`](./GOVERNANCE.md). R
 | Writing a commit message or pull request title | `Pull Request Title and Commit Message Conventions`, packaged as the `comment-and-doc-style` Skill |
 | Any prose, comment, doc, or line-ending change | `Documentation Style Conventions`, packaged as the `comment-and-doc-style` Skill |
 | Proving work actually happened | `Verification Discipline`, surfaced at its decision moment by the `agent-conduct` Skill, and the section keeps the full rules |
+| Editing rule text, a Skill, or any other content other repos carry | `Verification Discipline`'s carried-content rule, whose pass the `local-strict-review` Skill runs and whose record `scripts/canonical_review.py` keeps |
 | Opening a pull request, or requesting, monitoring, answering, or closing a review | `PR Review Etiquette`, packaged as the `pr-review-conduct` Skill |
 | Reviewing a pull request, patch, or change set | `code-review`, which routes to the applicable general, language, documentation, and workflow skills |
 | Reporting progress or asking the user something | `Communicating with the User`, surfaced at its decision moment by the `agent-conduct` Skill, and the section keeps the full rules |
@@ -110,4 +111,4 @@ Adding or changing a managed host tool is packaged as `add-host-tool`. It keeps
 
 Driving a pull request through its review loop, from a feature branch into `develop` and, when asked, on to a mergeable `develop -> main` promotion PR, disposing of every reviewer finding along the way per `pr-review-conduct`, is packaged as `drive-pr`, new content rather than a rule extracted from a section. Merging a ready promotion PR and dispatching the release it unblocks, refreshing this machine's installed Skills first when the repo is this hub, is `merge-and-release`, its own new-content package, invoked separately from `drive-pr` so the promotion merge and the release dispatch each keep their own explicit go-ahead.
 
-Running one read-only, adversarial review pass against a branch's current diff against its target branch, full file context included, on the strongest model tier the session can reach, before a unit of PR-bound work is pushed toward a pull request or claimed done, is packaged as `local-strict-review`, new content rather than a rule extracted from a section. `drive-pr`, `pr-review-conduct`, and `agent-conduct` each reference it at the moment they already govern, rather than restating what it does. The rule itself lives in [`GOVERNANCE.md`](./GOVERNANCE.md) "Verification Discipline", `scripts/local_review.py` is the engine that records a pass so a capture point can check one, and a repository carrying a `.husky/pre-push` hook enforces it at the push itself, the skill staying the primary and agent-agnostic layer with the hook a bypassable backstop under it.
+Running one read-only, adversarial review pass against a branch's current diff against its target branch, full file context included, on the strongest model tier the session can reach, before a unit of PR-bound work is pushed toward a pull request or claimed done, is packaged as `local-strict-review`, new content rather than a rule extracted from a section. `drive-pr`, `pr-review-conduct`, and `agent-conduct` each reference it at the moment they already govern, rather than restating what it does. The rule itself lives in [`GOVERNANCE.md`](./GOVERNANCE.md) "Verification Discipline", `scripts/local_review.py` is the engine that records a pass so a capture point can check one, and a repository carrying a `.husky/pre-push` hook enforces it at the push itself, the skill staying the primary and agent-agnostic layer with the hook a bypassable backstop under it. That skill carries a second pass under the same rule, over canonical content this repository authors and others carry, read one whole unit at a time rather than as a diff, because a diff-scoped read leaves the first real review of a rule to whichever repository carries it next, which is the one repository that cannot act on what it finds. `scripts/canonical_review.py` is that pass's engine, and the backlog it has yet to reach is `reports/canonical-review.md` in the hub, not a repo-relative link here since that path is hub-local like the Skills tree above.