@bleedingdev/modern-js-create 3.2.0-ultramodern.2 → 3.2.0-ultramodern.21

package/template-workspace/scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -4,52 +4,99 @@ import path from 'node:path';
 const root = process.cwd();
 const packageScope = '{{packageScope}}';
 const tanstackVersion = '1.170.1';
+const rstackAgentSkillsCommit = '61c948b42512e223bad44b83af4080eba48b2677';
 const modernPackages = [
   '@modern-js/app-tools',
   '@modern-js/plugin-bff',
+  '@modern-js/plugin-i18n',
   '@modern-js/plugin-tanstack',
   '@modern-js/runtime',
 ];
+const baselineAgentSkills = [
+  'rsbuild-best-practices',
+  'rspack-best-practices',
+  'rspack-tracing',
+  'rsdoctor-analysis',
+  'rslib-best-practices',
+  'rslib-modern-package',
+  'rstest-best-practices',
+];
+const privateAgentSkills = ['plan-graph', 'dag', 'subagent-graph', 'helm', 'debugger-mode'];
 
-function readText(relativePath) {
-  return fs.readFileSync(path.join(root, relativePath), 'utf-8');
-}
-
-function readJson(relativePath) {
-  return JSON.parse(readText(relativePath));
-}
-
-function assert(condition, message) {
+const readText = (relativePath) => fs.readFileSync(path.join(root, relativePath), 'utf-8');
+const readJson = (relativePath) => JSON.parse(readText(relativePath));
+const assert = (condition, message) => {
   if (!condition) {
     throw new Error(message);
   }
-}
-
-function assertExists(relativePath) {
+};
+const assertExists = (relativePath) => {
   assert(fs.existsSync(path.join(root, relativePath)), `Missing ${relativePath}`);
-}
+};
 
 const requiredPaths = [
+  'AGENTS.md',
+  '.gitignore',
   'package.json',
   'pnpm-workspace.yaml',
   'tsconfig.base.json',
+  'oxlint.config.ts',
+  'oxfmt.config.ts',
+  '.github/renovate.json',
+  '.github/workflows/ultramodern-workspace-gates.yml',
+  '.agents/skills-lock.json',
+  '.agents/agent-reference-repos.json',
+  '.agents/rstackjs-agent-skills-LICENSE',
+  '.agents/skills/rsbuild-best-practices/SKILL.md',
+  '.agents/skills/rspack-best-practices/SKILL.md',
+  '.agents/skills/rspack-tracing/SKILL.md',
+  '.agents/skills/rspack-tracing/references/tracing-guide.md',
+  '.agents/skills/rspack-tracing/scripts/analyze_trace.js',
+  '.agents/skills/rsdoctor-analysis/SKILL.md',
+  '.agents/skills/rsdoctor-analysis/references/rsdoctor-data-types.md',
+  '.agents/skills/rslib-best-practices/SKILL.md',
+  '.agents/skills/rslib-modern-package/SKILL.md',
+  '.agents/skills/rstest-best-practices/SKILL.md',
   'topology/reference-topology.json',
   'topology/ownership.json',
   'topology/local-overlays/development.json',
   '.modernjs/ultramodern-workspace-template-manifest.json',
   '.modernjs/ultramodern-package-source.json',
+  'scripts/bootstrap-agent-skills.mjs',
+  'scripts/setup-agent-reference-repos.mjs',
+  'scripts/check-i18n-strings.mjs',
   'apps/shell-super-app/package.json',
+  'apps/shell-super-app/config/public/locales/en/translation.json',
+  'apps/shell-super-app/config/public/locales/cs/translation.json',
   'apps/shell-super-app/modern.config.ts',
   'apps/shell-super-app/module-federation.config.ts',
+  'apps/shell-super-app/src/modern-app-env.d.ts',
+  'apps/shell-super-app/src/modern.runtime.ts',
+  'apps/shell-super-app/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-commerce/package.json',
+  'apps/remotes/remote-commerce/config/public/locales/en/translation.json',
+  'apps/remotes/remote-commerce/config/public/locales/cs/translation.json',
   'apps/remotes/remote-commerce/modern.config.ts',
   'apps/remotes/remote-commerce/module-federation.config.ts',
+  'apps/remotes/remote-commerce/src/modern-app-env.d.ts',
+  'apps/remotes/remote-commerce/src/modern.runtime.ts',
+  'apps/remotes/remote-commerce/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-identity/package.json',
+  'apps/remotes/remote-identity/config/public/locales/en/translation.json',
+  'apps/remotes/remote-identity/config/public/locales/cs/translation.json',
   'apps/remotes/remote-identity/modern.config.ts',
   'apps/remotes/remote-identity/module-federation.config.ts',
+  'apps/remotes/remote-identity/src/modern-app-env.d.ts',
+  'apps/remotes/remote-identity/src/modern.runtime.ts',
+  'apps/remotes/remote-identity/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-design-system/package.json',
+  'apps/remotes/remote-design-system/config/public/locales/en/translation.json',
+  'apps/remotes/remote-design-system/config/public/locales/cs/translation.json',
   'apps/remotes/remote-design-system/modern.config.ts',
   'apps/remotes/remote-design-system/module-federation.config.ts',
+  'apps/remotes/remote-design-system/src/modern-app-env.d.ts',
+  'apps/remotes/remote-design-system/src/modern.runtime.ts',
+  'apps/remotes/remote-design-system/src/routes/[lang]/page.tsx',
   'services/service-recommendations-effect/package.json',
   'services/service-recommendations-effect/modern.config.ts',
   'services/service-recommendations-effect/api/effect/index.ts',
@@ -63,14 +110,30 @@ for (const requiredPath of requiredPaths) {
   assertExists(requiredPath);
 }
 
+for (const appDirectory of [
+  'apps/shell-super-app',
+  'apps/remotes/remote-commerce',
+  'apps/remotes/remote-identity',
+  'apps/remotes/remote-design-system',
+]) {
+  assert(
+    !fs.existsSync(path.join(root, appDirectory, 'src/routes/page.tsx')),
+    `${appDirectory} must use src/routes/[lang]/page.tsx`,
+  );
+}
+
 const rootPackage = readJson('package.json');
 const packageSource = readJson('.modernjs/ultramodern-package-source.json');
+const skillsLock = readJson('.agents/skills-lock.json');
+const agentReferenceRepos = readJson('.agents/agent-reference-repos.json');
+const pnpmWorkspace = readText('pnpm-workspace.yaml');
+const workflowContent = readText('.github/workflows/ultramodern-workspace-gates.yml');
+const renovateConfig = readJson('.github/renovate.json');
+const deprecatedTanstackRuntime = '@modern-js/runtime/' + 'tanstack-router';
 const expectedModernSpecifier =
-  packageSource.strategy === 'install'
-    ? packageSource.modernPackages?.specifier
-    : 'workspace:*';
+  packageSource.strategy === 'install' ? packageSource.modernPackages?.specifier : 'workspace:*';
 
-function expectedModernDependency(packageName) {
+const expectedModernDependency = (packageName) => {
   if (packageSource.strategy !== 'install') {
     return 'workspace:*';
   }
@@ -79,13 +142,74 @@ function expectedModernDependency(packageName) {
   return aliasPackageName
     ? `npm:${aliasPackageName}@${expectedModernSpecifier}`
     : expectedModernSpecifier;
-}
+};
 
 assert(rootPackage.private === true, 'Root package must be private');
 assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare presetUltramodern');
+assert(rootPackage.packageManager === 'pnpm@11.1.2', 'Root must pin pnpm 11.1.2');
+assert(rootPackage.engines?.pnpm === '>=11.0.0', 'Root must require pnpm >=11');
+for (const requiredSnippet of [
+  'packages:\n  - apps/*\n  - apps/remotes/*\n  - services/*\n  - packages/*',
+  'minimumReleaseAge: 1440',
+  'minimumReleaseAgeStrict: true',
+  'minimumReleaseAgeIgnoreMissingTime: false',
+  "minimumReleaseAgeExclude:\n  - '@modern-js/*'\n  - '@bleedingdev/*'\n  - '@effect/tsgo'\n  - '@effect/tsgo-*'\n  - '@typescript/native-preview'\n  - '@typescript/native-preview-*'",
+  'trustPolicy: no-downgrade',
+  'trustPolicyIgnoreAfter: 1440',
+  'blockExoticSubdeps: true',
+  'engineStrict: true',
+  'pmOnFail: error',
+  'verifyDepsBeforeRun: error',
+  'strictDepBuilds: true',
+  "allowBuilds:\n  '@swc/core': true\n  core-js: true\n  esbuild: true\n  msgpackr-extract: true\n  simple-git-hooks: true",
+]) {
+  assert(
+    pnpmWorkspace.includes(requiredSnippet),
+    `pnpm-workspace.yaml must retain ${requiredSnippet.split('\n')[0]}`,
+  );
+}
+assert(
+  !pnpmWorkspace.includes('onlyBuiltDependencies'),
+  'pnpm-workspace.yaml must use pnpm 11 allowBuilds instead of onlyBuiltDependencies',
+);
+for (const requiredSnippet of [
+  'permissions:\n  contents: read',
+  'pull_request:',
+  'persist-credentials: false',
+  'pnpm install --frozen-lockfile',
+  'pnpm -r --filter "./apps/**" run build',
+  'MODERN_PUBLIC_SITE_URL: http://localhost:8080',
+  'timeout-minutes:',
+  'egress-policy: audit',
+]) {
+  assert(
+    workflowContent.includes(requiredSnippet),
+    `Generated workspace workflow must retain ${requiredSnippet.split('\n')[0]}`,
+  );
+}
 assert(
-  rootPackage.modernjs?.packageSource?.config ===
-    './.modernjs/ultramodern-package-source.json',
+  !workflowContent.includes('pull_request_target'),
+  'Generated workspace workflow must not use pull_request_target',
+);
+for (const match of workflowContent.matchAll(/^\s*uses:\s*([^@\s]+)@([^\s#]+)/gmu)) {
+  const [, actionName, actionRef] = match;
+  assert(
+    /^[a-f0-9]{40}$/u.test(actionRef),
+    `Generated workspace workflow must pin ${actionName}@${actionRef} to a commit SHA`,
+  );
+}
+assert(
+  renovateConfig.dependencyDashboard === true &&
+    renovateConfig.minimumReleaseAge === '1 day' &&
+    renovateConfig.extends?.includes('helpers:pinGitHubActionDigests') &&
+    renovateConfig.packageRules?.some(
+      (rule) =>
+        rule.dependencyDashboardApproval === true && rule.matchUpdateTypes?.includes('major'),
+    ),
+  'Generated workspace Renovate config must retain dashboard, release-age, action pinning, and major-approval policy',
+);
+assert(
+  rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json',
   'Root must point to the UltraModern package source metadata',
 );
 assert(
@@ -101,21 +225,122 @@ assert(
   'Generated shared packages must keep workspace:* links',
 );
 assert(
-  modernPackages.every(packageName =>
+  modernPackages.every((packageName) =>
     packageSource.modernPackages?.packages?.includes(packageName),
   ),
   'Package source metadata must list all Modern runtime/tooling packages',
 );
 assert(
-  expectedModernSpecifier &&
-    packageSource.modernPackages?.specifier === expectedModernSpecifier,
+  expectedModernSpecifier && packageSource.modernPackages?.specifier === expectedModernSpecifier,
   'Package source metadata must provide a Modern package specifier',
 );
+
+const requiredRootScripts = {
+  format: 'oxfmt .',
+  'format:check': 'oxfmt --check .',
+  'i18n:check': 'node ./scripts/check-i18n-strings.mjs',
+  lint: 'oxlint .',
+  'lint:fix': 'oxlint . --fix',
+  'agents:refs:check': 'node ./scripts/setup-agent-reference-repos.mjs --check',
+  'agents:refs:install': 'node ./scripts/setup-agent-reference-repos.mjs',
+  postinstall: 'node ./scripts/setup-agent-reference-repos.mjs',
+  'skills:check': 'node ./scripts/bootstrap-agent-skills.mjs --check',
+  'skills:install': 'node ./scripts/bootstrap-agent-skills.mjs',
+  typecheck: `pnpm -r --filter "@${packageScope}/*" typecheck`,
+  'ultramodern:check': 'node ./scripts/validate-ultramodern-workspace.mjs',
+};
+for (const [scriptName, scriptCommand] of Object.entries(requiredRootScripts)) {
+  assert(rootPackage.scripts?.[scriptName] === scriptCommand, `Root must expose ${scriptName}`);
+}
+
+for (const dependency of [
+  '@effect/tsgo',
+  '@typescript/native-preview',
+  'oxfmt',
+  'oxlint',
+  'ultracite',
+]) {
+  assert(rootPackage.devDependencies?.[dependency], `Root must depend on ${dependency}`);
+}
+
+const agentsInstructions = readText('AGENTS.md');
+assert(
+  agentsInstructions.includes('UltraModern Agent Contract') &&
+    agentsInstructions.includes('Required Skill Baseline'),
+  'Root AGENTS.md must document the UltraModern agent contract',
+);
+assert(
+  skillsLock.source?.repository === 'https://github.com/rstackjs/agent-skills',
+  'Agent skills lock must retain the Rstack skill source repository',
+);
+assert(
+  skillsLock.source?.commit === rstackAgentSkillsCommit,
+  'Agent skills lock must pin the expected Rstack skill commit',
+);
+assert(
+  skillsLock.installDir === '.agents/skills',
+  'Agent skills lock must use .agents/skills as installDir',
+);
+assert(
+  agentReferenceRepos.defaultEnabled === true,
+  'Agent reference repositories must be enabled by default',
+);
+assert(
+  agentReferenceRepos.strategy === 'git-subtree-squash',
+  'Agent reference repositories must use git subtree squash strategy',
+);
+assert(
+  agentReferenceRepos.repositories?.some(
+    (repo) =>
+      repo.id === 'effect' &&
+      repo.url === 'https://github.com/Effect-TS/effect.git' &&
+      repo.path === 'repos/effect',
+  ),
+  'Agent reference repositories must include Effect',
+);
+assert(
+  agentReferenceRepos.repositories?.some(
+    (repo) =>
+      repo.id === 'ultramodern-js' &&
+      repo.url === 'https://github.com/BleedingDev/ultramodern.js.git' &&
+      repo.path === 'repos/ultramodern.js',
+  ),
+  'Agent reference repositories must include UltraModern.js',
+);
+assert(
+  readText('scripts/setup-agent-reference-repos.mjs').includes(
+    'ULTRAMODERN_SKIP_AGENT_REPOS',
+  ),
+  'Agent reference repository setup must expose an opt-out environment variable',
+);
 assert(
-  rootPackage.scripts?.['ultramodern:check'] ===
-    'node ./scripts/validate-ultramodern-workspace.mjs',
-  'Root must expose the ultramodern:check script',
+  readText('scripts/setup-agent-reference-repos.mjs').includes('git-subtree-dir'),
+  'Agent reference repository setup must validate git subtree evidence',
 );
+for (const skillName of baselineAgentSkills) {
+  assert(
+    skillsLock.baseline?.some((skill) => skill.name === skillName),
+    `Agent skills lock must include ${skillName}`,
+  );
+  assert(
+    readText(`.agents/skills/${skillName}/SKILL.md`).includes(`name: ${skillName}`),
+    `${skillName} must contain matching skill metadata`,
+  );
+}
+
+const privateSource = skillsLock.sources?.find(
+  (source) => source.repository === 'https://github.com/TechsioCZ/skills',
+);
+assert(
+  privateSource?.install === 'clone-if-authorized',
+  'Agent skills lock must configure TechsioCZ skills as clone-if-authorized',
+);
+for (const skillName of privateAgentSkills) {
+  assert(
+    privateSource.baseline?.some((skill) => skill.name === skillName),
+    `Agent skills lock must allowlist private skill ${skillName}`,
+  );
+}
 
 const appPackagePaths = [
   'apps/shell-super-app/package.json',
@@ -126,31 +351,47 @@ const appPackagePaths = [
 
 for (const packagePath of appPackagePaths) {
   const packageJson = readJson(packagePath);
+  assert(
+    packageJson.dependencies?.['@modern-js/plugin-i18n'] ===
+      expectedModernDependency('@modern-js/plugin-i18n'),
+    `${packagePath} must use @modern-js/plugin-i18n through ${expectedModernDependency(
+      '@modern-js/plugin-i18n',
+    )}`,
+  );
   assert(
     packageJson.dependencies?.['@modern-js/plugin-tanstack'] ===
       expectedModernDependency('@modern-js/plugin-tanstack'),
-    `${packagePath} must depend on @modern-js/plugin-tanstack through ${expectedModernDependency('@modern-js/plugin-tanstack')}`,
+    `${packagePath} must use @modern-js/plugin-tanstack through ${expectedModernDependency(
+      '@modern-js/plugin-tanstack',
+    )}`,
   );
   assert(
     packageJson.dependencies?.['@modern-js/runtime'] ===
       expectedModernDependency('@modern-js/runtime'),
-    `${packagePath} must depend on @modern-js/runtime through ${expectedModernDependency('@modern-js/runtime')}`,
+    `${packagePath} must use @modern-js/runtime through ${expectedModernDependency(
+      '@modern-js/runtime',
+    )}`,
   );
   assert(
     packageJson.devDependencies?.['@modern-js/app-tools'] ===
       expectedModernDependency('@modern-js/app-tools'),
-    `${packagePath} must depend on @modern-js/app-tools through ${expectedModernDependency('@modern-js/app-tools')}`,
+    `${packagePath} must use @modern-js/app-tools through ${expectedModernDependency(
+      '@modern-js/app-tools',
+    )}`,
   );
   assert(
-    packageJson.dependencies?.[`@${packageScope}/shared-contracts`] ===
-      'workspace:*',
+    packageJson.dependencies?.[`@${packageScope}/shared-contracts`] === 'workspace:*',
     `${packagePath} must link generated shared contracts through workspace:*`,
   );
   assert(
-    packageJson.dependencies?.[`@${packageScope}/shared-design-tokens`] ===
-      'workspace:*',
+    packageJson.dependencies?.[`@${packageScope}/shared-design-tokens`] === 'workspace:*',
     `${packagePath} must link generated shared design tokens through workspace:*`,
   );
+  assert(packageJson.dependencies?.i18next === '26.2.0', `${packagePath} must include i18next`);
+  assert(
+    packageJson.dependencies?.['react-i18next'] === '17.0.8',
+    `${packagePath} must include react-i18next`,
+  );
   assert(
     packageJson.dependencies?.['@tanstack/react-router'] === tanstackVersion,
     `${packagePath} must use @tanstack/react-router ${tanstackVersion}`,
@@ -159,6 +400,10 @@ for (const packagePath of appPackagePaths) {
     packageJson.dependencies?.['@module-federation/modern-js-v3'] === '2.4.0',
     `${packagePath} must include the Module Federation plugin`,
   );
+  assert(
+    packageJson.dependencies?.['zephyr-modernjs-plugin'] === '1.1.1',
+    `${packagePath} must include the official Zephyr Modern.js plugin`,
+  );
   assert(
     packageJson.modernjs?.preset === 'presetUltramodern',
     `${packagePath} must keep presetUltramodern metadata`,
@@ -173,57 +418,133 @@ for (const configPath of [
 ]) {
   const config = readText(configPath);
   assert(config.includes('presetUltramodern('), `${configPath} must use presetUltramodern`);
+  assert(config.includes('i18nPlugin('), `${configPath} must enable plugin-i18n`);
+  assert(config.includes('localePathRedirect: true'), `${configPath} must prefix localized URLs`);
+  assert(config.includes('ULTRAMODERN_SITE_URL'), `${configPath} must expose site URL metadata`);
+  assert(
+    config.includes('MODERN_PUBLIC_SITE_URL must be set for production builds'),
+    `${configPath} must require MODERN_PUBLIC_SITE_URL for production builds`,
+  );
   assert(config.includes('tanstackRouterPlugin()'), `${configPath} must enable plugin-tanstack`);
-  assert(config.includes('moduleFederationPlugin()'), `${configPath} must enable Module Federation`);
+  assert(
+    config.includes('moduleFederationPlugin()'),
+    `${configPath} must enable Module Federation`,
+  );
+  assert(
+    config.includes("from 'zephyr-modernjs-plugin'"),
+    `${configPath} must import the official Zephyr Modern.js plugin`,
+  );
+  assert(config.includes('withZephyr()'), `${configPath} must enable Zephyr through plugins`);
+  assert(
+    config.includes("bundler: 'rspack'"),
+    `${configPath} must keep appTools on the rspack bundler for Zephyr`,
+  );
+  assert(
+    config.includes("html: './'"),
+    `${configPath} must keep Modern.js output.distPath.html compatible with Zephyr`,
+  );
+  assert(
+    config.includes("outputStructure: 'flat'"),
+    `${configPath} must keep Modern.js HTML output flat for Zephyr`,
+  );
+  assert(
+    config.includes("mainEntryName: 'index'"),
+    `${configPath} must keep Modern.js source.mainEntryName compatible with Zephyr`,
+  );
+}
+
+for (const routePath of [
+  'apps/shell-super-app/src/routes/[lang]/page.tsx',
+  'apps/remotes/remote-commerce/src/routes/[lang]/page.tsx',
+  'apps/remotes/remote-identity/src/routes/[lang]/page.tsx',
+  'apps/remotes/remote-design-system/src/routes/[lang]/page.tsx',
+]) {
+  const route = readText(routePath);
+  assert(route.includes('rel="canonical"'), `${routePath} must emit canonical metadata`);
+  assert(route.includes('rel="alternate"'), `${routePath} must emit alternate locale metadata`);
+  assert(route.includes('hrefLang="x-default"'), `${routePath} must emit x-default metadata`);
+  assert(route.includes('localizedPath('), `${routePath} must build localized URLs`);
+  assert(
+    route.includes('@modern-js/plugin-tanstack/runtime'),
+    `${routePath} must import TanStack runtime from @modern-js/plugin-tanstack/runtime`,
+  );
+  assert(
+    !route.includes(deprecatedTanstackRuntime),
+    `${routePath} must not import deprecated TanStack runtime path`,
+  );
 }
 
 const shellMf = readText('apps/shell-super-app/module-federation.config.ts');
 assert(shellMf.includes("name: 'shellSuperApp'"), 'Shell MF config must name the shell');
-assert(shellMf.includes('remoteCommerce@http://localhost:3021/mf-manifest.json'), 'Shell must reference commerce remote');
-assert(shellMf.includes('remoteIdentity@http://localhost:3022/mf-manifest.json'), 'Shell must reference identity remote');
-assert(shellMf.includes('remoteDesignSystem@http://localhost:3023/mf-manifest.json'), 'Shell must reference design-system remote');
+assert(
+  shellMf.includes('remoteCommerce@http://localhost:3021/mf-manifest.json'),
+  'Shell must reference commerce remote',
+);
+assert(
+  shellMf.includes('remoteIdentity@http://localhost:3022/mf-manifest.json'),
+  'Shell must reference identity remote',
+);
+assert(
+  shellMf.includes('remoteDesignSystem@http://localhost:3023/mf-manifest.json'),
+  'Shell must reference design-system remote',
+);
 
 const commerceMf = readText('apps/remotes/remote-commerce/module-federation.config.ts');
 assert(commerceMf.includes("name: 'remoteCommerce'"), 'Commerce remote MF name is missing');
-assert(commerceMf.includes('"./Widget"'), 'Commerce remote must expose a widget');
+assert(commerceMf.includes("'./Widget'"), 'Commerce remote must expose a widget');
 
 const designMf = readText('apps/remotes/remote-design-system/module-federation.config.ts');
 assert(designMf.includes("name: 'remoteDesignSystem'"), 'Design-system remote MF name is missing');
-assert(designMf.includes('"./Button"'), 'Design-system remote must expose Button');
-assert(designMf.includes('"./tokens"'), 'Design-system remote must expose tokens');
+assert(designMf.includes("'./Button'"), 'Design-system remote must expose Button');
+assert(designMf.includes("'./tokens'"), 'Design-system remote must expose tokens');
 
 const servicePackage = readJson('services/service-recommendations-effect/package.json');
 assert(
   servicePackage.dependencies?.['@modern-js/runtime'] ===
     expectedModernDependency('@modern-js/runtime'),
-  `Effect service must use @modern-js/runtime through ${expectedModernDependency('@modern-js/runtime')}`,
+  `Effect service must use @modern-js/runtime through ${expectedModernDependency(
+    '@modern-js/runtime',
+  )}`,
 );
 assert(
   servicePackage.devDependencies?.['@modern-js/app-tools'] ===
     expectedModernDependency('@modern-js/app-tools'),
-  `Effect service must use @modern-js/app-tools through ${expectedModernDependency('@modern-js/app-tools')}`,
+  `Effect service must use @modern-js/app-tools through ${expectedModernDependency(
+    '@modern-js/app-tools',
+  )}`,
 );
 assert(
   servicePackage.devDependencies?.['@modern-js/plugin-bff'] ===
     expectedModernDependency('@modern-js/plugin-bff'),
-  `Effect service must use @modern-js/plugin-bff through ${expectedModernDependency('@modern-js/plugin-bff')}`,
+  `Effect service must use @modern-js/plugin-bff through ${expectedModernDependency(
+    '@modern-js/plugin-bff',
+  )}`,
 );
 assert(
-  servicePackage.dependencies?.[`@${packageScope}/shared-effect-api`] ===
-    'workspace:*',
+  servicePackage.dependencies?.[`@${packageScope}/shared-effect-api`] === 'workspace:*',
   'Effect service must link generated shared Effect API through workspace:*',
 );
 
 const serviceConfig = readText('services/service-recommendations-effect/modern.config.ts');
-assert(serviceConfig.includes("runtimeFramework: 'effect'"), 'Effect service must use Effect runtime');
+assert(
+  serviceConfig.includes("runtimeFramework: 'effect'"),
+  'Effect service must use Effect runtime',
+);
 assert(serviceConfig.includes('bffPlugin()'), 'Effect service must enable bffPlugin');
 
 const serviceEntry = readText('services/service-recommendations-effect/api/effect/index.ts');
-assert(serviceEntry.includes('defineEffectBff'), 'Effect service must expose defineEffectBff placeholder');
-assert(serviceEntry.includes('recommendationsEffectApi'), 'Effect service must use shared recommendations API');
-
-const serviceApi = readText('services/service-recommendations-effect/shared/effect/api.ts');
-assert(serviceApi.includes('HttpApi.make'), 'Effect shared API placeholder must define HttpApi');
+assert(
+  serviceEntry.includes('defineEffectBff'),
+  'Effect service must expose defineEffectBff placeholder',
+);
+assert(
+  serviceEntry.includes('recommendationsEffectApi'),
+  'Effect service must use shared recommendations API',
+);
+assert(
+  readText('services/service-recommendations-effect/shared/effect/api.ts').includes('HttpApi.make'),
+  'Effect shared API placeholder must define HttpApi',
+);
 
 const topology = readJson('topology/reference-topology.json');
 assert(topology.preset === 'presetUltramodern', 'Topology must reference presetUltramodern');
@@ -232,27 +553,26 @@ assert(topology.shell?.remoteRefs?.length === 3, 'Topology shell must reference
 assert(topology.remotes?.length === 3, 'Topology must contain three remotes');
 assert(
   topology.remotes.some(
-    remote =>
-      remote.id === 'remote-design-system' &&
-      remote.kind === 'horizontal-design-system',
+    (remote) => remote.id === 'remote-design-system' && remote.kind === 'horizontal-design-system',
   ),
   'Topology must contain the horizontal design-system remote',
 );
-assert(topology.effectServices?.[0]?.runtime === 'effect', 'Topology must contain an Effect service');
+assert(
+  topology.effectServices?.[0]?.runtime === 'effect',
+  'Topology must contain an Effect service',
+);
 assert(topology.sharedPackages?.length === 3, 'Topology must contain shared package placeholders');
 
 const ownership = readJson('topology/ownership.json');
 assert(
   ownership.owners?.some(
-    owner =>
-      owner.id === 'remote-commerce' &&
-      owner.ownership?.team === 'commerce-experience',
+    (owner) => owner.id === 'remote-commerce' && owner.ownership?.team === 'commerce-experience',
   ),
   'Ownership metadata must retain commerce owner',
 );
 assert(
   ownership.owners?.some(
-    owner =>
+    (owner) =>
       owner.id === 'service-recommendations-effect' &&
       owner.package === `@${packageScope}/service-recommendations-effect`,
   ),
@@ -268,9 +588,35 @@ assert(
   manifest.packageSource?.strategy === packageSource.strategy,
   'Template manifest must retain the generated package source strategy',
 );
+assert(
+  manifest.agentSkills?.source?.commit === rstackAgentSkillsCommit,
+  'Template manifest must retain the Rstack agent skills commit',
+);
+assert(
+  baselineAgentSkills.every((skillName) => manifest.agentSkills?.baseline?.includes(skillName)),
+  'Template manifest must list every baseline agent skill',
+);
+assert(
+  manifest.agentSkills?.privateSource?.repository === 'https://github.com/TechsioCZ/skills',
+  'Template manifest must retain the private TechsioCZ skill source',
+);
+assert(
+  privateAgentSkills.every((skillName) =>
+    manifest.agentSkills?.privateSource?.baseline?.includes(skillName),
+  ),
+  'Template manifest must list every private agent skill allowlist entry',
+);
 assert(
   manifest.validation?.expectedCommands?.includes('pnpm run ultramodern:check'),
   'Template manifest must document the validation command',
 );
+assert(
+  manifest.validation?.postMaterializationValidation?.includes('pnpm-11-policy-enforced'),
+  'Template manifest must document pnpm 11 policy validation',
+);
+assert(
+  manifest.validation?.postMaterializationValidation?.includes('github-workflow-security-enforced'),
+  'Template manifest must document generated workflow security validation',
+);
 
 console.log('UltraModern workspace scaffold validated');