canonlisted

# Canon — priming **Canonical spec:** `docs/domains/canon.md` — read it for the damper matrix, all invariants, key files, and gotchas. Terms of record: `UBIQUITOUS_LANGUAGE.md` § Canon (and *Approve vs Promote*, *Canon draft vs Loose End*). A draft is **not** a memory until an Operator approves it. Only Term pages ship today, from two deterministic zero-LLM sources (entity aggregation, `UBIQUITOUS_LANGUAGE.md` seed). REST/Web UI only — no MCP surface. ## Core invariants (get these right) - **Approve is the only write path into `canon:*`**, always via `ICanonMintPort` → `StoreAsync`. That's the enforcement point for the zero-LLM write path once syntheses come from a model. - **Secret-scan draft prose at creation *and* gate again at approve** — source prose can echo a member's secret. - **The draft id (`canondrafts/{repo}/{kind}/{slug}`) is the damper anchor** — one doc per slug, refreshed in place; identical fingerprint ⇒ regeneration does nothing. - **Reopening a rejected draft needs both an elapsed cooldown and a changed fingerprint.** Never disturb a draft in `Approving`. - **Claim before mint** (`Pending → Approving`), release to a *clean* `Pending` on failure (on `CancellationToken.None`), and stay idempotent — the loose-end resolve pattern. - **Dedup and consolidation must never touch a `canon:*` page** — both filter on `CanonTags.IsCanonPage`. - **Strip `canon:*` from inherited member tags** so a page never re-tags itself by another page's tag. - **Provena