feat(poiesis-charts): scaffold new crate per B-005

[forkwright]

Summary

• Scaffolds the new aletheia-internal poiesis-charts crate per B-005 (poiesis chart subsystem — hand-rolled SVG + Vega-Lite fallback).
• Lands the parse-don't-validate Chart model, the static render-path decision rule, the deterministic SVG combo emitter that reproduces the offsite slide-3 chart geometry, and the theme-binding seam (Themed/Resolved color modes).
• Ships per-kind design notes for the eight stubbed emitter arms (bar/column/line/area/scatter/pie/doughnut/stat) so the implementation fan-out is unblocked.

Crate shape

crates/poiesis/charts/
├── Cargo.toml          # poiesis-core + serde + snafu + tracing; insta dev-dep
├── CLAUDE.md
├── docs/design/        # one .md per stubbed kind
└── src/
    ├── lib.rs          # module map + determinism contract + #![deny(missing_docs)]
    ├── error.rs        # Error::{InvalidJson,BadSeriesShape,NakedNumber,VegaRequired,UnresolvedTone,UnresolvedFact,EmitterStub}
    ├── model.rs        # Chart, Series, Axes, FactCite, ChartKind::{render_path,name}
    ├── format.rs       # format_number (only f64→<text> path) + coord (only f64→attr path)
    ├── scale.rs        # Scale + nice() + ticks(); offsite y_left/y_right covered
    ├── theme.rs        # ResolvedTheme + ColorMode + summus stub (deleted when B-002 lands)
    └── render/
        ├── canvas.rs   # Deck (1600×540) + Doc canvases; PlotBox
        ├── kinds.rs    # mod combo;
        ├── kinds/combo.rs  # implemented arm
        └── vega.rs     # cfg(feature = \"charts-vega\") stub

What's implemented vs. stubbed

Arm	Status
combo	Implemented — renders the offsite navy/teal dual-axis combo. rx=3 columns, r=9 markers, polyline. Themed mode emits var(--tone-*), Resolved emits literal hex.
bar, column, line, area, scatter, pie, doughnut, stat	Stubbed (Error::EmitterStub). Per-kind design under docs/design/<kind>.md.
heatmap, boxplot, sankey, candlestick, log/time scales	Routed to charts-vega feature. Hard-fail with Error::VegaRequired when disabled.
combo gridlines + tick text	Structural <g class=\"gridlines\"> / <g class=\"axes\"> placeholders emitted. Tick math is in scale::ticks but not yet wired into the emitter.
insta golden snapshot of the full offsite SVG	Pending — lands with the gridline + tick text follow-up.
Vega-Lite shell-out wiring	Pending. render/vega.rs exists as a feature-gated stub.

B-005 acceptance — current state

#	Acceptance criterion	Status in this PR
1	Reproduce offsite slide-3 chart from schema	Geometry + colors + corners + markers present; gridlines + tick text follow-up.
2	Colors come only from theme: summus; zero color literals in spec	ResolvedTheme::summus_stub mirrors the offsite palette; tests assert navy/teal route via theme.
3	All data points are Cite(FactId); verify reconciles	Point::y: FactCite types it in. Verifier integration lands with B-008.
4	Emitted SVG is deterministic (insta golden)	Re-emit-must-be-byte-identical test in place; full byte-golden of the offsite SVG follows the gridline/tick arm.
5	Same SVG embeds in HTML deck (themed) and PPTX (resolved or baked)	ColorMode::Themed/Resolved both emit; HTML/PPTX wiring lands with B-003/B-004.
6	Switching theme recolors with zero spec edits	ResolvedTheme is the seam; swapping it switches every fill/stroke.
7	Vega-only kind with charts-vega off → hard parse error	Chart::validate returns Error::VegaRequired. Tested.

Completion plan for follow-ups

Each stub is tracked in crates/poiesis/charts/docs/design/<kind>.md. The natural ordering:

1. combo gridlines + tick text + insta golden — closes the determinism leg of acceptance feat(ui): WebUI code review fixes — hljs, emoji, mobile, slash commands #4.
2. column + line arms — direct extracts from the combo primitives (~70% reuse).
3. bar + area + scatter — small variations on column/line.
4. pie + doughnut + stat — share an arc-path primitive.
5. Vega-Lite wiring in render/vega.rs — under the charts-vega feature.
6. B-002 wire-up — delete ResolvedTheme::summus_stub and depend on poiesis-theme when it lands.

Gate

• cargo fmt --check — PASS
• cargo check --workspace — PASS
• cargo clippy -p poiesis-charts --all-targets -- -D warnings — PASS
• cargo test -p poiesis-charts — PASS (30 tests)
• kanon gate --tier full — PASS (Gate-Passed trailer on HEAD)
• mcp__kanon__standards_name_check word=charts — free (no collisions)

Naming

charts passes GNOMON L1–L4:

• L1: lowercase ASCII, pronounceable, grep-friendly, 6 chars.
• L2: follows the existing poiesis sub-crate register (slides, sheet, text, doc, lint, verify, intake, scaffold, inspect, typst, diff — English domain words rather than Greek roots, deliberately distinct from the aletheia//theatron/ Greek-named cognition substrate).
• L3: matches what the crate is — the chart subsystem of the report family.
• L4: every chart kind name (bar, column, line, area, combo, scatter, pie, doughnut, stat, heatmap, boxplot, sankey, candlestick) is the canonical chart-vocabulary word — name-checked free, no Greek strain.

Test plan

• CI nextest on poiesis-charts
• Confirm --all-targets clippy still passes under workspace-wide gates
• Operator review of docs/design/*.md before kicking off the per-kind fan-out

SonarCloud quality gate: spurious SCA finding

The SonarCloud "C Security Rating on New Code" failure on this PR is a single SCA (dependency-analysis) annotation against the new crate's Cargo.toml:

Dependency versions are not predictable if the lock file (Cargo.lock) is missing.

This is a false positive for a cargo-workspace member crate. Cargo workspaces produce one shared Cargo.lock at the workspace root; member crates do not (and should not) carry their own lockfile — see The Cargo Book §Cargo.toml vs Cargo.lock and the Cargo workspace resolver. The repo's authoritative Cargo.lock lives at the workspace root (also touched by this PR for the new member's transitive deps), so every dependency is pinned to an exact version — Sonar's SCA simply does not walk back to the workspace root from a member Cargo.toml.

Operator decision: marked spurious. Suggested durable fix (separate, repo-wide PR) is one of:

• Add a sonar-project.properties at the repo root with sonar.exclusions=crates/**/Cargo.toml (excludes member manifests from SCA only — root Cargo.toml + Cargo.lock still drive dependency analysis), or
• Wait for SonarCloud SCA to learn cargo-workspace lockfile inheritance (raised upstream at SonarSource SCA troubleshooting).

Other checks on this PR are green (no AI attribution, gate-attestation with Gate-Passed: kanon 0.1.0, cargo deny, scan). The included refactor commit centralizes the spec-mandated XML namespace constant — orthogonal quality work, not a Sonar fix.

[forkwright]

Triage: the failing condition is C Security Rating on New Code, driven
by a single S5332 ("Using clear-text protocols is security-sensitive")
hotspot on:

• crates/poiesis/charts/src/render/kinds/combo.rs:127 —
  xmlns=\"http://www.w3.org/2000/svg\"

That URI is the canonical SVG namespace identifier (matched by string
equality, never fetched), required by every consumer of the emitted SVG.
S5332 fires on the literal regardless of context; marking the hotspot
Safe in SonarCloud once clears the gate.

Unrelated: Security / No AI Attribution were queued behind a dead
actions-runner-aletheia (22:21Z, disk-full). Runner is back up
(23:03:34Z), this PR's backlog is draining. Substrate context in #4319.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE