feat(agent-dev): PM standard — shared projects: project-init --canon, steward reads the charter wherever the epic points, §15 Visibility (ent#588)

[dolho]

Implements Abilityai/trinity-enterprise#588 — operator ruling R21 (2026-09-10): one project-management standard, two visibility levels. A project in canon (agents/<owner>/projects/<slug>/) is managed exactly like one in project_files/<slug>/ — same charter, same registry epic, same steward, same intake, same decision ledger; placement decides only who can read the definition.

Stacked on #19 (ent#585) — the charter envelope + project-envelope rule this lints against. Merge #19 first; this PR then shows only its own commit.

What changes

PROJECT_STANDARD.template.md

• §1 workspace row: two placements; the path is recorded in the epic and read from there.
• §4 epic anatomy: the Workspace field's two forms — `project_files/<slug>/` | `canon:agents/<owner>/projects/<slug>/`.
• §9: the quarantine pass never scans the canon (a canon-placed project is registered by its epic, never discovered from a folder).
• new §15 Visibility: the R21 table, the charter envelope (the ent#585 contract) and the workspace resolver every project skill uses — first backticked path in the epic's ## Workspace section; canon: → through the x-canon clone (pull --ff-only, never force); other → repo-relative; missing → the epic body is the context; never derived from the slug.

project-init 1.1 → 1.2 — --canon writes project.md + decisions.md into the agent's own canon folder (x-canon enrolment gate, own-folder only, lint, push via /canon-publish) and records canon:agents/<self>/projects/<slug>/ in the epic; adopt --canon <path>; the charter carries the linted envelope at both levels; --dry-run writes the workspace and prints the epic body without touching GitHub.
project-steward 1.2 → 1.3 — resolves the workspace per §15, reads charter + ledger wherever they are, writes nothing into the canon (charter stamps are /canon-reconcile's; a charter/epic status disagreement goes in the digest), quarantine stays on project_files/.
project-intake 1.2 → 1.3, project-task 1.3 → 1.4 — no behaviour change; a passed-through workspace path resolves per §15.
add-project-management 2.0 → 2.1; plugin 1.16.2 → 1.16.3; README.

Verification

• /project-init Demo Shared --canon --dry-run, headless Claude Code 2.1.274 in a sandbox agent (x-canon: → a local clone of the ent#585-patched canon, agents/testbot/): wrote canon/agents/testbot/projects/demo-shared/{project.md,decisions.md} with the envelope, printed the epic body with ## Workspace = `canon:agents/testbot/projects/demo-shared/`, created nothing on GitHub, ran the linter and reported honestly. canon_lint.py --scope agents/testbot/projects/demo-shared → PASS 0/0 (this surfaced that a dry-run's epic: …#0 failed ent#585's EPIC_RE; fixed on feat(agent-dev): canon projects/ zone — charter envelope, project-envelope lint rule, consume projects mode, reconcile staleness (ent#585) #19 — #0 = not yet registered, reconcile flags it).
• Steward resolver (verbatim snippet) on ent#497's real body — its Workspace section is prose with `canon/agents/corbin/projects/tandem/` in backticks — resolves to the canon clone and reads Tandem's charter (tldr) + ledger (30 ruling rows) with no local project_files/ copy; the canon: form, a repo-relative form, a pre-§15 body (no field → epic is context) and an invisible path (→ no workspace, noted) each behave as §15 states. A live steward run was deliberately not made against the real registry (it posts comments/labels).
• Standard renders with every placeholder substituted (grep -c '{{' → 0); audit-wizards gates 1–6 clean on the touched files (the pre-existing CONVENTIONS-word false positive aside); frontmatter version/changelog/banner on all five skills.

Not done here

• fleet/project-standard.md, the local .claude/skills/project-* re-install and the trinity-skills library refresh (/sync-skill-library → /promote-skill refresh) are trinity-pm's steps after merge.
• ent#497's Workspace field resolves as-is; rewriting it to the canon: form is optional.
• add-orchestrator/templates/project-init.md (the orchestrator bundle's own variant reading fleet/project-standard.md) is out of this ticket's scope — flagged for a follow-up so the two project-inits don't drift.

🤖 Generated with Claude Code

[dolho]

Tested from Trinity (Workspace chat, agent in a real container)

Local Trinity stack, agent sidekick (Claude Code in the agent container): the PR templates installed as ~/.claude/skills/canon-* + project-init, x-canon: pointing at a clone of the ent#585-patched canon (bare repo inside the container — nothing leaves the box), PROJECT_STANDARD.md rendered from the 1.2 template with a registry that has issues disabled (so a real init cannot create anything by accident). Typed into the Workspace by the operator:

/canon-consume corbin projects tandem → charter table (status needs-decision, registry epic Abilityai/corbin-internal#179, product epic ent#497, managing agent corbin/R20, visibility R21), ledger summarised by batch A → B10 (R1–R30), workspace files listed-not-served, footer source: canon@04940ca · 2 files from agents/corbin/projects/tandem/.

/project-init Demo Shared --canon --dry-run … → Linter: PASS — 0 failures, 0 warnings, printed epic body with ## Workspace = `canon:agents/sidekick/projects/demo-shared/`, Epic (dry run — not created) · would be dolho/abilities#0, both success criteria satisfied, and it named the registry blocker (issues disabled) rather than pretending.

/canon-doctor → 9 checks PASS/WARN/INFO + the lint gate FAIL — agents/sidekick/projects/stale-demo/project.md [staleness] … the next /canon-publish will refuse to push until this is resolved → first fix: /canon-reconcile. (The stale charter is the deliberate reconcile fixture.)

/canon-reconcile as a Trinity schedule (canon-reconcile (demo ent#585), triggered by hand, execution success, ~90 s): without a GitHub token in the container → flagged unverifiable: 1, NEEDS-REVIEW row epic … unreachable, stamps untouched; with GH_TOKEN injected via the credentials API → projects: 1 charter · 0 verified · 1 re-mirrored from epic, charter active → needs-decision (#179's live label), review_by +30 d, decisions.md byte-identical, commit under agents/sidekick/ only.

Screenshots of the Workspace thread are on file (ent585-screenshots/), attached separately if a reviewer wants the visual.

[dolho]

Superseded by #22 — same commits, now on an org branch (write access granted). Test evidence carried over.