CLAUDE.md is lying to agents: 4 phantom packages, omits config (8-consumer hub), invariant anchored on deleted package

[qmarcelle]

Finding

CLAUDE.md, the file the swarm reads as canon, materially misdescribes the repo. This is corrupted canon feeding the agents, a correctness bug, not a docs chore.

Specifics:

• Documents 4 nonexistent packages: edge-security, messages, utils, workspace-health.
• Anchors a live invariant ("all user-facing strings from @vreko/messages") on a deleted package.
• Omits 11 real packages including config, an 8-consumer dependency hub, plus quality, agents, brand, billing, build-audit, claims-ledger, sentry-privacy, workspacejson-spec, cli-packaging, eslint-plugin-vreko.
• Omits 2 real apps (agent-router, claude-code-plugin) and all of tooling/*.
• Claims local-service deploys to Fly.io. It does not (distributed with CLI/extension).

Evidence

CLAUDE.md structure diagram and Architecture Invariants section vs actual packages/, apps/, tooling/ trees (per 2026-07-10 audit, Theme 4).

Action

Reconcile CLAUDE.md to real repo state. Remove phantom packages, re-anchor or retire the @vreko/messages string invariant, add the omitted packages/apps/tooling, fix the local-service deploy claim. Route through canon reconciliation if any of this is mirrored in CANON.md.

Acceptance (perturb-the-referent)

• Every package named in CLAUDE.md resolves to a real dir: for p in $(parse packages from CLAUDE.md); do test -d packages/$p || echo "PHANTOM: $p"; done prints nothing
• Every real package under packages/ and app under apps/ is either documented or explicitly marked out-of-scope
• The string-source invariant names a package that exists, or is removed
• No live invariant references a deleted package

Note

This is the item most worth doing first among the non-security cluster: the swarm acts on this file every session.