Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.dev/features/canonical-npm-name/PLAN.md:
- Around line 1-5: Reconcile the verification records with the current scoped
package identity: in .dev/features/canonical-npm-name/PLAN.md lines 1-5, replace
the unscoped pharn objective or mark the plan superseded; in
.dev/features/canonical-npm-name/GRILL.md lines 29-34, update tarball and
package assertions to `@pharn-dev/pharn`; in
.dev/features/canonical-npm-name/REVIEW.md lines 1-5, align the reviewed rename
direction with the scoped identity; and in
.dev/features/npm-publish-metadata/SHIP.md line 21, replace the pharn→pharn
statement with the actual `@pharn-dev/pharn` rename.

In @.dev/features/canonical-npm-name/SHIP.md:
- Around line 3-4: Correct the ship record’s package identity and release
direction: update the increment description to rename `pharn-cli` to
`@pharn-dev/pharn` while preserving the installed `pharn` binary, and remove the
unscoped-package/deprecation guidance. If this is stale historical output rather
than an active record, remove the artifact instead.

In @.dev/features/canonical-npm-name/verify-report.json:
- Around line 8-12: Update the verification artifact and its underlying
validation flow so the validate gate passes rather than leaving verdict as FAIL;
exclude generated test-*/ fixtures from validation as appropriate. Ensure the
resulting verify.verdict is PASS and failing_gates is empty, preserving the
.dev/floor/check-ship.mjs contract and requiring all CI gates to pass.

In @.dev/features/npm-publish-metadata/PLAN.md:
- Around line 10-13: The plan should use the scoped npm package name
`@pharn-dev/pharn` throughout package metadata and installation instructions,
while retaining pharn as the executable/bin name. Update the package.json,
README.md, CHANGELOG.md, and CLAUDE.md entries to replace unscoped package
references and change the npx command to target `@pharn-dev/pharn`.
- Around line 24-27: Align the repository metadata claim with the actual package
configuration: in .dev/features/npm-publish-metadata/PLAN.md lines 24-27, either
update the documented repository URL to pharn-dev/pharn-cli or change
package.json consistently to pharn-dev/pharn; in
.dev/features/npm-publish-metadata/GRILL.md line 51, remove the “EXACT”
assertion unless the package metadata is updated to match.

In @.github/workflows/publish.yml:
- Around line 3-8: Add a pre-publish validation step in the publish workflow
that compares the GitHub Release tag (removing the v prefix as needed) with the
version in package.json and fails on mismatch. Restrict workflow_dispatch
publishing to the intended release ref, while preserving the existing
release-triggered publishing behavior.
- Around line 21-24: Update the actions/setup-node configuration in the
privileged publish job to disable automatic package-manager caching by setting
package-manager-cache to false, and remove the cache: npm setting. Leave
dependency caching enabled only in the non-publishing CI jobs.

In `@CHANGELOG.md`:
- Around line 96-97: Update the initial release note to remove the duplicate bin
names, restoring the historical second binary name or clearly stating that only
the pharn binary is exposed.

In `@SECURITY.md`:
- Around line 3-9: The security documentation understates the installation write
surface. In SECURITY.md, update the description to cover .claude/, the mirrored
capability layout, root product surfaces, and pharn.config.json; in
THREAT-MODEL.md, expand Surface A beyond .claude/ to include every installed
location. Preserve the existing remote-input and safe-write security model while
ensuring both documents describe the current layout consistently.

---

Outside diff comments:
In `@CONSTITUTION.md`:
- Around line 20-24: The capability-document wording is inconsistent with
README.md: update CONSTITUTION.md lines 20-24 and LIMITS.md lines 21-31 to
describe capability frontmatter and install artifacts as the trust boundary,
removing references to manifests, module manifests, module catalogs, and
module-based installation while preserving the stated security principles and
limitations.

---

Nitpick comments:
In `@CLAUDE.md`:
- Around line 48-49: Update the remote-fetch invariant documentation in
CLAUDE.md to name both skills-version.ts and repo.ts, explicitly requiring
redirect rejection, an 8-second timeout, and a 256 KB response-body cap for
each. Preserve the existing validation and path-containment guidance.