@haabe/canvas-sync
ASynchronize canvas state across team sessions via git. Ensures all team members see the same product knowledge.
Install
agr install @haabe/canvas-sync --target claudeWrites 1 file into .claude/skills/, pinned to git-8627804b.
- .claude/skills/canvas-sync/SKILL.md
Document
name: canvas-sync description: "Synchronize canvas state across team sessions via git. Ensures all team members see the same product knowledge." metadata: instruction_budget: "8" framework_dependency: "mycelium" framework_dependency_note: "This skill is designed to run within the Mycelium framework (https://github.com/haabe/mycelium). Standalone use will skip the canvas state, theory gates, and harness behavior the skill assumes. Install: /plugin install mycelium@haabe-mycelium."
Canvas Sync
When to Use
- Starting a new session (pull latest canvas)
- Ending a session (commit canvas changes)
- After team discussion that changes product direction
- When canvas conflicts arise from parallel work
Workflow
Pull Latest
git pull origin main
Then run /mycelium:diamond-assess to see what changed.
Commit Changes
git add .claude/canvas/ .claude/harness/decision-log.md .claude/memory/
git commit -m "canvas: [brief description of what changed and why]"
Conflict Resolution
- Different canvas files: auto-merges (no conflict)
- Same file, different sections: usually auto-merges
- Same field conflicting: the person with more evidence wins — a manual resolution heuristic for the team, not an automated merge. No tooling evaluates evidence weight;
Gated by:a/canvas-mergeprocedure (read both versions, compare provenance depth on overlapping entries, recommend) — not yet built. - When uncertain: discuss as team, log decision
GitOps Principle
The canvas system IS GitOps for product knowledge — git is the single source of truth, changes are declarative (YAML), and updates flow through version control with review. For infrastructure GitOps (ArgoCD, Flux), see JiT tooling detection for Kubernetes/infrastructure-as-code projects.
Trustgrade A
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- passType matchnot applicable to this artifact type
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- passLicense
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-8627804b33602026-07-31