## ·01Prerequisites

You need three things installed before running the setup script:

Tool | Version | Install
--- | --- | ---
`node` | ≥ 18 | nodejs.org or `brew install node`
`npm` | bundled | comes with Node.js
`claude` | any current | `npm install -g @anthropic-ai/claude-code`

Check what you have:

    $ node -v
    v22.x.x
    $ npm -v
    10.x.x
    $ claude --version
    # whatever the current version is

## ·02Get the delivery zip

You need `memeroot-delivery.zip` from the most recent shipped delivery — the bundle that contains the canvas, both skill packs, the CLI, the builders, and the catalog. Drop it anywhere convenient (Downloads is fine).

## ·03Run the setup script

    $ chmod +x memeroot-claude-code-setup.sh
    $ ./memeroot-claude-code-setup.sh ~/Downloads/memeroot-delivery.zip

    Memeroot · Claude Code setup
    ────────────────────────────

    ✓ Node.js v22.22.2
    ✓ npm 10.x.x
    ✓ unzip available
    ✓ Claude Code 1.x

    ✓ Found delivery: ~/Downloads/memeroot-delivery.zip (835K)
    ✓ Extracted to /tmp/memeroot-setup.XXX

    ✓ Installed skill: regulated-document-author (314-line SKILL.md, 6 templates)
    ✓ Installed skill: memeroot-bridge (320-line SKILL.md, 6 templates)

    ✓ memeroot-cli installed globally — /usr/local/bin/memeroot

    ✓ Working directory: /Users/rob/memeroot-work
       ├── tools/         canvas, builders, bundles, catalog
       ├── packets/       audit packets you produce
       ├── snapshots/     captured-hash HTML evidence
       ├── identities/    keys for signing (you create these in the canvas)
       └── outputs/       general work outputs

    ✓ Wrote /Users/rob/memeroot-work/CLAUDE.md

    ────────────────────────────
    ✓ Setup complete.

The script is idempotent. Re-running overwrites the skills and refreshes the tools folder but leaves your `packets/`, `snapshots/`, and existing `CLAUDE.md` alone.

## ·04Start Claude Code in the working directory

    $ cd ~/memeroot-work
    $ claude

Claude Code reads `CLAUDE.md` at session start. It now knows:

- The two skill packs are available and when to invoke them
- Where to put produced files (`packets/<period>/<control-id>/`)
- That `memeroot validate` and `memeroot package` are available via bash
- Validation gates before declaring work ready
- Communication conventions (terse, no fake signatures, no fabricated values)

## ·05The end-to-end workflow

### Try it now

    ~/memeroot-work $ claude
    > Document the REV-002 expense approval control for SOX 404 as a Memeroot packet.
    > Control owner is Maria Hsu (VP Operations). Detective control, monthly,
    > reviews all expense reports over $25K for approval and documentation.

    [Claude Code activates regulated-document-author + memeroot-bridge skills]
    [Produces packets/2026-Q1/REV-002/control.xml]
    [Runs: memeroot validate packets/2026-Q1/REV-002/control.xml]
    ✓ control.xml  <control id="REV-002"> · 1842b
    [Runs: memeroot package packets/2026-Q1/REV-002/control.xml -o packets/2026-Q1/REV-002/audit-packet.html]
    ✓ wrote audit-packet.html (52k · canvas + 1 region + bootstrap)

    Audit packet ready at packets/2026-Q1/REV-002/audit-packet.html.
    Open it in a browser, sign as Maria Hsu in the Sign tab,
    then export the bundle from the Bundle tab.

## ·06Capturing snapshots for audit evidence

Claude Code can't reliably fetch external URLs (CORS, auth, JS-rendered content). For captured-hash snapshots, use the browser-based builder:

1. Open `tools/iframe-region-builder.html` in your browser
2. Fill the form (id, title, source URL, dimensions)
3. Paste the captured HTML OR click "Capture from URL" if it works
4. The SHA-256 hash auto-computes
5. Click "Download .xml" — saves `EMBED-DASHBOARD-Q1-2026.xml`
6. Move the file to `snapshots/<date>/` or `packets/<period>/<control>/`
7. Include in the next `memeroot package` call

Why captured-hash matters: the <snapshot> CDATA contains the bytes that were on screen at capture time. The <captured-hash> SHA-256 over those bytes means anyone can re-verify the snapshot hasn't been modified. Combined with the canvas signature on the whole iframe-region, you get cryptographic chain of custody from capture time to auditor inspection — no dependency on the source URL remaining live.

## ·07Signing

Important: Claude Code never signs. Signing is a wet-signature analog and must be performed by a real human at the canvas with their identity. Producing signed XML from a script is the structural equivalent of forging a signature.

The signing workflow:

1. Claude Code produces region XML (control, TOD, TOE, etc.)
2. `memeroot package` wraps them into a canvas-ready audit-packet.html
3. You open the audit-packet.html in your browser
4. Canvas boots with the regions in the Tree tab
5. In the Sign tab: select a region → select your identity → click SIGN
6. For separation of duties: sign control as control owner, then TOE as a different identity (the tester)
7. In the Bundle tab: click EXPORT BUNDLE HTML
8. Send the resulting bundle.html to your external auditor

The auditor opens the bundle in their own browser. WebCrypto verifies every signature locally. No service contacted at any point in the chain.

## ·08What's in `~/.claude/skills/` after setup

    $ ls ~/.claude/skills/
    memeroot-bridge/
    regulated-document-author/

    $ ls ~/.claude/skills/regulated-document-author/
    SKILL.md           # substantive instructions Claude Code reads
    INSTALL.md         # install notes
    skill-manifest.json # cryptographic manifest with signatures
    templates/         # 6 XML templates (sox-control, tod, toe, irb-protocol, audit-finding, management-letter)
    checklists/        # sox-control-checklist.md
    examples/          # example-rev-001-sox-control.xml (full worked example)

    $ ls ~/.claude/skills/memeroot-bridge/
    SKILL.md
    INSTALL.md
    skill-manifest.json
    templates/         # 6 region templates (note, section, decision, task, reference, iframe, workspace)
    examples/          # research workspace + iframe dashboard with embedded snapshot

You can verify the skill packs in any browser using `tools/regulated-document-author-bundle.html` and `tools/memeroot-bridge-bundle.html`. Each bundle has a "Verify all signatures" button that runs WebCrypto checks on every file in the pack.

## ·09Troubleshooting

### Skills don't show up in Claude Code

- Make sure the structure is `~/.claude/skills/<skill-name>/SKILL.md` — not nested deeper
- Restart Claude Code; skills load at session start
- Ask Claude Code directly: "What skills are available?"

### memeroot command not found

- Re-run the install: `cd ~/.local/share/memeroot-cli/memeroot-cli && npm install -g .`
- Or run directly: `node ~/.local/share/memeroot-cli/memeroot-cli/bin/memeroot ...`
- Check npm prefix: `npm config get prefix` — that's where globals install

### Validation fails on Claude Code's output

- Read the error message — common issues are unfilled `[NEEDS INPUT:...]` placeholders, missing id attribute, or fake signature elements
- Tell Claude Code: "validation failed: <paste the error>. Fix and re-validate."
- Don't ship work that didn't pass validation

### Canvas opens but content didn't auto-load

- The bootstrap script needs the canvas to fully initialize before injecting content — usually waits ~200ms. If your browser is slow, content may take longer to appear
- Check the browser console for `[memeroot-cli]` log messages
- Manual fallback: click Paste in the canvas, paste the workspace XML from the .xml file directly