chore: install Arcanea editorial contract

[frankxai]

Installs the Arcanea editorial contract pinned to 50ae34c7ac06e6c083f277ca96c3bde8f0a39b43.

• preserves existing agent instructions through managed blocks
• autoloads the contract for Codex, Claude, Gemini, Cursor, and Copilot
• installs the repository-local brand editor skill
• blocks new public-copy hard failures through changed-line CI

Canonical source: frankxai/starlight-design-intelligence#14

---

Folded in: estate draft gate on every pull_request workflow (commit 2d8d5a2)

frankxai/arcanea is at 14 open PRs against a budget of 10, so this rides here instead of a 15th PR.

• Draft-gated (skip on draft, fire on ready_for_review): claude-code-review; deploy-apps test-and-build; mvp-deploy security/quality/build/database; packages-ci test; quality-gate quality/build; test cli-tests/typecheck/security.
• Kept running on drafts on purpose (no install, seconds): lore-canon, magic-validate, web-excellence, secret-literal-guard, packages-ci security grep, quality-gate release-integrity.
• ready_for_review added to every pull_request trigger so marking ready re-fires the gated checks.
• concurrency + cancel-in-progress and timeout-minutes on every reachable job.
• Branch also merged with main to pick up ci: never vercel --prod from public frankxai/arcanea #118 and Security: remove hard-coded Gemini credentials and add CI guard #120.

This PR is itself a draft, so its own checks now demonstrate the gate: heavy jobs should show as skipped, cheap linters as run.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Review: install Arcanea editorial contract

Reviewed the diff for #117. This is a docs/config change (no app code), so most standard categories (perf, test coverage) don't really apply — focused on correctness of the contract config and CI wiring.

Security — good. The reusable workflow (.github/workflows/starlight-editorial-contract.yml) is pinned to a commit SHA (50ae34c7ac06e6c083f277ca96c3bde8f0a39b43) rather than a mutable branch/tag, avoiding a supply-chain risk where the upstream frankxai/starlight-design-intelligence repo could later change what runs against this repo's PRs. permissions: contents: read is correctly minimal for the calling workflow.

Potential bug — content_roots don't match this repo's layout. .starlight/editorial-contract.json declares "content_roots": ["app", "components", "content", "data", "lib", "pages", "src"], all root-relative. But this repo is a monorepo — the actual product surfaces live under apps/web/{app,components,lib} and apps/premium-web/src; none of app/, components/, lib/, src/, or data/ exist at the repo root (verified locally). Root-level content/ and pages/ do exist, but pages/ there is a handful of legacy standalone .js files, not the live Next.js app. Net effect: as configured, the changed-line editorial CI gate this PR adds won't actually scan the real public-facing copy in apps/web or apps/premium-web — the two places most likely to contain the public/customer-facing copy this contract is meant to guard. It'll likely be a near-permanent no-op against the actual product, quietly undercutting the PR's stated goal ("blocks new public-copy hard failures through changed-line CI"). Worth fixing content_roots to point at apps/web/app, apps/web/components, apps/web/lib, apps/premium-web/src, etc. before relying on this gate.

Minor — five-way content duplication. The same editorial-contract block is duplicated verbatim across CREATOR.md, AGENTS.md, CLAUDE.md, GEMINI.md, and .github/copilot-instructions.md, each wrapped in STARLIGHT-EDITORIAL:START/END markers. Presumably intentional (per-tool autoload + a sync tool from the pinned Starlight repo), but any future contract update needs to touch all five in lockstep — worth confirming the sync tooling regenerates all five rather than relying on manual edits, since drift would be easy to miss.

Unverified. I wasn't able to reach the GitHub API for the external frankxai/starlight-design-intelligence repo from this sandbox, so I couldn't independently confirm that profile_sha256 in .starlight/editorial-contract.json matches the actual content of brand-packs/arcanea/COPY.md at the pinned commit, or that the reusable workflow path (.github/workflows/editorial-contract.yml) exists at that ref. Worth a quick manual check before merge.

Nitpick. The workflow triggers on pull_request with no path filter, so it runs on every PR regardless of whether it touches copy. Given the content_roots issue above, most runs will likely be cheap no-ops anyway, but once the roots are fixed, consider scoping the trigger with paths: to the actual content roots to avoid unnecessary CI runs on unrelated (e.g. backend-only) PRs.

Everything else (the managed-block pattern, the pinned SHA references being consistent across all seven files, the new SKILL.md and .cursor/rules/editorial.mdc) looks straightforward and correctly wired.