canvas-execute

# Canvas Execute Execute is the action half of the scan/execute boundary. It reads an existing student-reviewed plan; it never scans, invents, expands, or silently repairs a missing plan. Plan approval authorizes local assignment work for the selected items only. It does **not** authorize a Canvas upload/submission or a quiz start/answer/complete action. Those mutations require a separate scoped authorization receipt validated and consumed by the shared runtime. ## Hard rules - Do not run `canvas-scan` inline or regenerate `plan.json` from Canvas. - Do not execute unapproved items. - Do not execute an item whose final `user_decision` is not `approve` or a valid `swap:canvas-*`. - Do not expand a vague approval. Ambiguity stops before any plan write, marker, dispatch, or mutation. - Do not do course work inside this dispatcher. Use sequential native Codex skill handoffs. - Do not invent a route alias, draft path, verification result, result status, submission, score, or quiz diagnostic. - A TODO, sentinel, skeleton, empty template, outline-only file, or placeholder is never `draft_ready`. - Every assignment snapshot item must have one valid canonical `result.json` before finalization. - Keep `.claude/` read-only. Do not use the frozen Claude Skill tool or Claude session variables as active runtime mechanisms. - Do not submit to Canvas from plan approval. ## Phase 0: Preconditions and integrity Before parsing approval, require: 1. `runs/<today>/plan.json` e...