A lockfile for facts
canon/1 — a lockfile for facts. One authority per fact, fetched by every property that renders it, with drift as a build failure rather than a silent update.
Ten properties render the same definitions, counts and paths, and each was typed in by hand — so changing one meant remembering every place it was written, and the places nobody remembered were wrong quietly for a year. This is `npm install` for prose: one authority, a revision, a lockfile, and a build that fails when they disagree.
A fact is a path — `directory.organizations.path` — an authority that serves it, and a locked value. `npx canon add` records all three; a build reads **only the lock**, so the same commit renders the same page on Tuesday as it did on Monday, offline, with no network in the path.
`npx canon check` is the half that reaches the network. It fetches each fact from its authority and exits 1 on any disagreement, naming the fact, both values and the authority that moved. `npx canon accept` takes the change into the lock as a reviewable diff.
The split is the design. Fetching at render time would be a synchronisation channel: one bad edit becomes a simultaneous ten-property incident with no review anywhere in the path, a network outage becomes a content outage, and nobody can say which page was live when a claim was cited.
Installing it puts this command on your path — read from the package’s own manifest, so this list cannot drift from what you actually get.
canonApache-2.0, read from the package’s own manifest. Embed it in anything, including closed software — that is what makes a spec adoptable and a verifier worth running. FlashyOS’s server side is AGPL-3.0-only instead, and a test in the monorepo asserts the direction between them: AGPL code may consume this, this may never consume AGPL code.