Add the catalog index, and package a real prompt collection

CANP-WP-0004. The operator asked canned-prompts to build a database of
versioned prompts recording where each came from and when — the first step
toward a platform for collaborative prompting.

The format had nowhere to put that. `provenance` records who wrote a prompt and
where the idea came from; nothing recorded how a copy arrived in a particular
store. Section 20.3 now specifies an `index.yaml` as store metadata rather than
package data: how a copy arrived differs for every consumer, and recording an
arrival must never rewrite the package that arrived.

`add`, `install` and `publish` record registry, id, version, name, source,
method, first-inclusion date, and the package's declared author, source and
licence — the last three copied so a listing is readable without opening every
package. A new `index` verb lists it. `included_at` is never overwritten; a
re-run updates `last_seen_at`, because when a package first entered a
collection is a fact about history rather than about the last command run.

Tests 84 -> 90.

Also records two findings from actually using the format:

CANP-WP-0004-T03 — inclusion has no deduplication, so a diamond dependency
renders shared content once per path. Found by composing a real collection.
Not fixed here: deduplicating means choosing which occurrence survives and
deciding what happens when two paths resolve different versions, which is
resolver behaviour that section 10.4 deliberately avoids. Handed to
CANP-WP-0005 with a leaning: document it, warn at validation time, do not
deduplicate.

The add_ons workaround in practice/pqrst-estimate is evidence about section
23's deferred "richer template syntax" — an optional appendix has to be an
input with an empty default, because CPF has no conditionals.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

workplans/CANP-WP-0004-prompt-index.md

@@ -0,0 +1,105 @@
+---
+id: CANP-WP-0004
+type: workplan
+title: "Catalog index: where a package came from and when"
+domain: agents
+repo: canned-prompts
+status: finished
+owner: codex
+topic_slug: practice
+created: "2026-09-06"
+updated: "2026-09-06"
+---
+
+# Catalog index: where a package came from and when
+
+Driven by packaging a real collection (`helix-forge` `HF-WP-0005`). The operator
+asked for canned-prompts to "build a database of versioned prompts", recording
+the source a prompt came from and the date it was included — the first step
+toward a platform for collaborative prompting.
+
+The format had no place for this. `provenance` (§ 13) records who wrote a prompt
+and where the idea came from, but nothing recorded how a *copy* arrived in a
+*particular* store.
+
+## Fix practice/pqrst-estimate to be the canonical prompt
+
+```task
+id: CANP-WP-0004-T01
+status: done
+priority: high
+```
+
+**Found while researching helix-forge.** `examples/pqrst-estimate` was not the
+canonical PQRST prompt. The canonical one is `~/pqrst-practice/PqrstPrompt.md`,
+normatively specified in `spec/PqrstEstimationPractice.md`, and
+`hall-of-helix/CLOSING.md` requires pasting it unmodified. Ours was a paraphrase
+with a different output shape — no `Confidence`, no `Signature`, no `Dominant
+factors` — and `CANP-WP-0002-T03` had made it worse by prepending a
+`house_style` inclusion to a prompt whose governing document says do not modify
+it.
+
+A copied prompt that silently forked its source, sitting in the examples
+directory of the repo whose `INTENT.md` opens by naming that exact failure.
+
+Fixed: the template is the canonical block extracted programmatically rather
+than retyped, and the default render is byte-identical at 2886 bytes.
+`evals/canonical-fidelity.yaml` guards it with sixteen render checks, including
+`not_contains` checks naming the paraphrase it used to be. Version 0.2.1 →
+1.0.0, the § 17 MAJOR case.
+
+The source documents two optional add-ons appended after the block. CPF has no
+conditionals, so `add_ons` is an input defaulting to the empty string and each
+add-on is an example fixture. Adequate, but a workaround — recorded as evidence
+about § 23's deferred "richer template syntax".
+
+## Add the index
+
+```task
+id: CANP-WP-0004-T02
+status: done
+priority: high
+```
+
+A store may keep an `index.yaml` recording which package versions entered it,
+from where, and when. Specified in § 20.3, deliberately as **store** metadata
+rather than package data: how a copy arrived differs for every consumer, and
+recording an arrival must never rewrite the package that arrived (§ 17).
+
+`add`, `install` and `publish` record an entry carrying registry, id, version,
+name, source, method, `included_at`, the package's declared author and source,
+and its licence — the last two copied so a listing is readable without opening
+every package. A new `index` verb lists it.
+
+`included_at` is first arrival and is never overwritten; a re-run updates
+`last_seen_at` instead. When a package first entered a collection is a fact
+about history, not about the last time someone ran a command.
+
+`reference/canned_prompts.py`: `read_index`, `record_inclusion`,
+`index_entry_key`, `cmd_index`. Tests 84 → 90.
+
+## Record the inclusion-deduplication gap
+
+```task
+id: CANP-WP-0004-T03
+status: done
+priority: medium
+```
+
+**Found by using the format.** `helix/repo-advance` composed
+`helix/commit-sync`, which composes `helix/custodian-conventions`, while also
+composing the conventions itself. The rendered prompt contained the conventions
+block twice: CPF inclusion has no deduplication, so a diamond dependency renders
+shared content once per path.
+
+Not fixed in the format. Deduplicating would mean deciding *which* occurrence
+survives and what happens when the two paths resolve different versions — that
+is resolver behaviour, and § 10.4 keeps composition declarative on purpose.
+Nothing in § 10.4 currently warns an author, which is the actual defect.
+
+Downstream this was fixed by factoring (`HF-WP-0005-T03`), which is the right
+answer for a collection and may be the right general advice.
+
+**Handed to `CANP-WP-0005`:** document the diamond behaviour in § 10.4 and
+decide whether a validator should warn when one package reaches the same
+dependency by two paths.

workplans/CANP-WP-0005-inclusion-diamond.md

@@ -0,0 +1,47 @@
+---
+id: CANP-WP-0005
+type: workplan
+title: "Document and detect inclusion diamonds"
+domain: agents
+repo: canned-prompts
+status: proposed
+owner: codex
+topic_slug: practice
+created: "2026-09-06"
+updated: "2026-09-06"
+---
+
+# Document and detect inclusion diamonds
+
+Residual from `CANP-WP-0004` (`origin: residual`, `origin_ref: CANP-WP-0004`).
+
+## Warn about repeated inclusion
+
+```task
+id: CANP-WP-0005-T01
+status: todo
+priority: medium
+```
+
+CPF inclusion (§ 10.4) does not deduplicate: when one package reaches the same
+dependency by two paths, the included text renders once per path. This was found
+by building a real collection — `helix/repo-advance` rendered its conventions
+block twice — and worked around downstream by factoring the shared routine into
+its own fragment.
+
+§ 10.4 says nothing about it, so an author meets the behaviour only by reading
+the output carefully. That silence is the defect.
+
+Two questions, and the second depends on the first:
+
+1. **Document it.** State in § 10.4 that inclusion is textual and repeated,
+   not deduplicated, and give the factoring pattern that avoids a diamond.
+2. **Detect it.** Decide whether validation should warn when a package reaches
+   the same dependency by more than one path. A warning is cheap and catches the
+   mistake at `add` time. Silently deduplicating is a different proposition
+   entirely — it would mean choosing which occurrence survives, and deciding what
+   happens when two paths resolve *different versions* of the same dependency.
+   That is resolver behaviour, and § 10.4 keeps composition declarative on
+   purpose.
+
+Leaning: document it now, warn at validation time, and do not deduplicate.