@warpgogol/forge 2.9.13 → 2.9.25

package/src/registry.ts

@@ -17,6 +17,7 @@
   <item>RFC-0524: added optional knowledge?: string[] field for cumulative knowledge system. Added knowledge arrays to fo-site-scan and grilling.</item>
   <item>RFC-0538: added fo-compass-annotate skill (22nd fo skill) — full-lifecycle Compass header management replacing removed compass.annotate, compass.clear, compass.markup.migrate, compass.invariant.add kernel commands.</item>
   <item>RFC-0539: added discoverPackSkills helper and PackSkillEntry interface for project-declared skill packs. Removed mission-complete and fo-site-scan entries (relocated to warpgogol-skills as wg- pack skills).</item>
+  <item>RFC-0941: discoverPackSkills now requires forge.plugin.yaml manifest at each pack root — throws on missing or invalid manifest (fail-fast).</item>
 </CHANGE_SUMMARY>
 */
 
@@ -24,6 +25,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import type { ForgeConfig } from "./config/forge-config.ts";
+import { forgePluginManifestSchema } from "./plugin/ForgePluginManifest.ts";
 
 /**
  * Every entry MUST be portable — it runs in any forge-bootstrapped project
@@ -69,6 +71,40 @@ export function discoverPackSkills(workspaceRoot: string, config: ForgeConfig):
     const packDir = path.resolve(workspaceRoot, pack.dir);
     if (!fs.existsSync(packDir)) continue;
 
+    const manifestPath = path.join(packDir, "forge.plugin.yaml");
+    if (!fs.existsSync(manifestPath)) {
+      throw new Error(
+        `forge.plugin.yaml not found at ${packDir} for pack prefix "${pack.prefix}". ` +
+          "Run `forge init` to create manifests for declared skill packs (RFC-0941).",
+      );
+    }
+
+    let manifestRaw: string;
+    try {
+      manifestRaw = fs.readFileSync(manifestPath, "utf-8");
+    } catch (err) {
+      throw new Error(
+        `Failed to read forge.plugin.yaml at ${manifestPath}: ${(err as Error).message}`,
+      );
+    }
+
+    let manifestParsed: unknown;
+    try {
+      manifestParsed = parseYaml(manifestRaw);
+    } catch (err) {
+      throw new Error(
+        `forge.plugin.yaml at ${manifestPath} is not valid YAML: ${(err as Error).message}`,
+      );
+    }
+
+    const manifestResult = forgePluginManifestSchema.safeParse(manifestParsed);
+    if (!manifestResult.success) {
+      const issues = manifestResult.error.issues
+        .map((i) => `${i.path.join(".")}: ${i.message}`)
+        .join("; ");
+      throw new Error(`forge.plugin.yaml at ${manifestPath} failed schema validation: ${issues}`);
+    }
+
     const entries = fs.readdirSync(packDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;

package/src/tests/contract-registry.test.ts

@@ -0,0 +1,248 @@
+import { test, expect, describe } from "vitest";
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  getBuiltInSpecs,
+  loadContractRegistry,
+  findApplicablePackSpecs,
+  fileMatchesGlobs,
+} from "../compass/contract-registry.ts";
+import type { ForgeConfig } from "../config/forge-config.ts";
+
+function makeTmpWorkspace(): string {
+  return mkdtempSync(join(tmpdir(), "forge-contract-registry-"));
+}
+
+function writeManifest(packDir: string, content: string): void {
+  mkdirSync(packDir, { recursive: true });
+  writeFileSync(join(packDir, "forge.plugin.yaml"), content);
+}
+
+describe("contract-registry (RFC-0943)", () => {
+  describe("getBuiltInSpecs", () => {
+    test("returns MODULE_CONTRACT and CHANGE_SUMMARY as built-in specs", () => {
+      const specs = getBuiltInSpecs();
+      expect(specs).toHaveLength(2);
+      expect(specs[0]!.blockId).toBe("module-contract");
+      expect(specs[1]!.blockId).toBe("change-summary");
+    });
+
+    test("module-contract has purpose tag with minWords 10", () => {
+      const specs = getBuiltInSpecs();
+      const moduleContract = specs.find((s) => s.blockId === "module-contract");
+      expect(moduleContract).toBeDefined();
+      expect(moduleContract!.requiredTags).toBeDefined();
+      const purposeTag = moduleContract!.requiredTags!.find((t) => t.name === "purpose");
+      expect(purposeTag).toBeDefined();
+      expect(purposeTag!.minWords).toBe(10);
+    });
+  });
+
+  describe("fileMatchesGlobs", () => {
+    test("matches a simple glob pattern", () => {
+      expect(fileMatchesGlobs("packages/my-pack/src/index.ts", ["packages/my-pack/**/*.ts"])).toBe(true);
+    });
+
+    test("does not match when glob does not match", () => {
+      expect(fileMatchesGlobs("packages/other-pack/src/index.ts", ["packages/my-pack/**/*.ts"])).toBe(false);
+    });
+
+    test("matches any of multiple globs", () => {
+      expect(
+        fileMatchesGlobs("services/my-service/src/index.ts", [
+          "packages/**/*.ts",
+          "services/**/*.ts",
+        ]),
+      ).toBe(true);
+    });
+
+    test("handles dot files with dot option", () => {
+      expect(fileMatchesGlobs("packages/my-pack/.env.example", ["packages/**/*.example"])).toBe(true);
+    });
+  });
+
+  describe("loadContractRegistry", () => {
+    test("returns only built-in specs when no skillPacks declared", () => {
+      const registry = loadContractRegistry("/nonexistent", undefined);
+      expect(registry.builtIn).toHaveLength(2);
+      expect(registry.pack).toHaveLength(0);
+    });
+
+    test("returns only built-in specs when skillPacks is empty", () => {
+      const config: ForgeConfig = {
+        schema: "forge/bindings@1",
+        project: { name: "test", root: "." },
+        bindings: undefined,
+        skillPacks: [],
+      } as unknown as ForgeConfig;
+      const registry = loadContractRegistry("/nonexistent", config);
+      expect(registry.pack).toHaveLength(0);
+    });
+
+    test("loads pack-declared blocks from forge.plugin.yaml", () => {
+      const ws = makeTmpWorkspace();
+      try {
+        const packDir = join(ws, "my-pack");
+        writeManifest(
+          packDir,
+          "id: my-pack\nversion: 1.0.0\nextensionPoints:\n  compass:\n    contract:\n      blocks:\n        - blockId: api-contract\n          requiredFor:\n            - \"packages/my-pack/**/*.ts\"\n          requiredTags:\n            - name: endpoints\n              minWords: 5\n",
+        );
+
+        const config: ForgeConfig = {
+          schema: "forge/bindings@1",
+          project: { name: "test", root: "." },
+          bindings: undefined,
+          skillPacks: [{ prefix: "my", dir: "my-pack" }],
+        } as unknown as ForgeConfig;
+
+        const registry = loadContractRegistry(ws, config);
+        expect(registry.pack).toHaveLength(1);
+        expect(registry.pack[0]!.blockId).toBe("api-contract");
+        expect(registry.pack[0]!.packId).toBe("my-pack");
+        expect(registry.pack[0]!.requiredTags).toEqual([{ name: "endpoints", minWords: 5 }]);
+      } finally {
+        rmSync(ws, { recursive: true, force: true });
+      }
+    });
+
+    test("throws on duplicate blockId across packs", () => {
+      const ws = makeTmpWorkspace();
+      try {
+        writeManifest(
+          join(ws, "pack-a"),
+          "id: pack-a\nversion: 1.0.0\nextensionPoints:\n  compass:\n    contract:\n      blocks:\n        - blockId: shared-block\n          requiredFor:\n            - \"packages/**/*.ts\"\n",
+        );
+        writeManifest(
+          join(ws, "pack-b"),
+          "id: pack-b\nversion: 1.0.0\nextensionPoints:\n  compass:\n    contract:\n      blocks:\n        - blockId: shared-block\n          requiredFor:\n            - \"services/**/*.ts\"\n",
+        );
+
+        const config: ForgeConfig = {
+          schema: "forge/bindings@1",
+          project: { name: "test", root: "." },
+          bindings: undefined,
+          skillPacks: [
+            { prefix: "a", dir: "pack-a" },
+            { prefix: "b", dir: "pack-b" },
+          ],
+        } as unknown as ForgeConfig;
+
+        expect(() => loadContractRegistry(ws, config)).toThrow(/COMPASS-PLUGIN-DUP-01/);
+      } finally {
+        rmSync(ws, { recursive: true, force: true });
+      }
+    });
+
+    test("skips packs with no extensionPoints", () => {
+      const ws = makeTmpWorkspace();
+      try {
+        writeManifest(join(ws, "my-pack"), "id: my-pack\nversion: 1.0.0\n");
+
+        const config: ForgeConfig = {
+          schema: "forge/bindings@1",
+          project: { name: "test", root: "." },
+          bindings: undefined,
+          skillPacks: [{ prefix: "my", dir: "my-pack" }],
+        } as unknown as ForgeConfig;
+
+        const registry = loadContractRegistry(ws, config);
+        expect(registry.pack).toHaveLength(0);
+      } finally {
+        rmSync(ws, { recursive: true, force: true });
+      }
+    });
+
+    test("skips packs with empty blocks array", () => {
+      const ws = makeTmpWorkspace();
+      try {
+        writeManifest(
+          join(ws, "my-pack"),
+          "id: my-pack\nversion: 1.0.0\nextensionPoints:\n  compass:\n    contract:\n      blocks: []\n",
+        );
+
+        const config: ForgeConfig = {
+          schema: "forge/bindings@1",
+          project: { name: "test", root: "." },
+          bindings: undefined,
+          skillPacks: [{ prefix: "my", dir: "my-pack" }],
+        } as unknown as ForgeConfig;
+
+        const registry = loadContractRegistry(ws, config);
+        expect(registry.pack).toHaveLength(0);
+      } finally {
+        rmSync(ws, { recursive: true, force: true });
+      }
+    });
+
+    test("skips packs with missing manifest file", () => {
+      const ws = makeTmpWorkspace();
+      try {
+        const config: ForgeConfig = {
+          schema: "forge/bindings@1",
+          project: { name: "test", root: "." },
+          bindings: undefined,
+          skillPacks: [{ prefix: "my", dir: "nonexistent-pack" }],
+        } as unknown as ForgeConfig;
+
+        const registry = loadContractRegistry(ws, config);
+        expect(registry.pack).toHaveLength(0);
+      } finally {
+        rmSync(ws, { recursive: true, force: true });
+      }
+    });
+  });
+
+  describe("findApplicablePackSpecs", () => {
+    test("returns specs whose requiredFor globs match the file path", () => {
+      const registry = {
+        builtIn: getBuiltInSpecs(),
+        pack: [
+          {
+            blockId: "api-contract",
+            requiredFor: ["packages/my-pack/**/*.ts"],
+            requiredTags: [],
+            packId: "my-pack",
+          },
+          {
+            blockId: "service-contract",
+            requiredFor: ["services/**/*.ts"],
+            requiredTags: [],
+            packId: "other-pack",
+          },
+        ],
+      };
+
+      const applicable = findApplicablePackSpecs(registry, "packages/my-pack/src/index.ts");
+      expect(applicable).toHaveLength(1);
+      expect(applicable[0]!.blockId).toBe("api-contract");
+    });
+
+    test("returns empty array when no specs match", () => {
+      const registry = {
+        builtIn: getBuiltInSpecs(),
+        pack: [
+          {
+            blockId: "api-contract",
+            requiredFor: ["packages/my-pack/**/*.ts"],
+            requiredTags: [],
+            packId: "my-pack",
+          },
+        ],
+      };
+
+      const applicable = findApplicablePackSpecs(registry, "packages/other-pack/src/index.ts");
+      expect(applicable).toHaveLength(0);
+    });
+
+    test("returns empty array when registry has no pack specs", () => {
+      const registry = {
+        builtIn: getBuiltInSpecs(),
+        pack: [],
+      };
+
+      const applicable = findApplicablePackSpecs(registry, "packages/my-pack/src/index.ts");
+      expect(applicable).toHaveLength(0);
+    });
+  });
+});

package/src/tests/discover-pack-skills.test.ts

@@ -0,0 +1,112 @@
+import { test, expect, describe, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { discoverPackSkills } from "../registry.ts";
+import { loadForgeConfig } from "../config/forge-config.ts";
+import { stringify as stringifyYaml } from "yaml";
+
+describe("discoverPackSkills fail-fast (RFC-0941)", () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "forge-plugin-test-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function writeForgeYaml(skillPacks: Array<{ prefix: string; dir: string }>) {
+    const config = {
+      schema: "forge/config@1",
+      project: {
+        name: "test-project",
+        stack: [],
+        packageManager: "pnpm",
+      },
+      paths: {
+        rfcsDir: "docs/rfcs",
+        adrsDir: "docs/adrs",
+        plansDir: "docs/plans",
+        auditsDir: "docs/audits",
+        skillsDir: ".agents/skills",
+      },
+      skillPacks,
+    };
+    fs.writeFileSync(path.join(tmpDir, "forge.yaml"), stringifyYaml(config), "utf8");
+  }
+
+  function createPackDir(prefix: string, dir: string) {
+    const packDir = path.resolve(tmpDir, dir);
+    fs.mkdirSync(packDir, { recursive: true });
+    return packDir;
+  }
+
+  function writeManifest(packDir: string, id: string, version: string) {
+    fs.writeFileSync(
+      path.join(packDir, "forge.plugin.yaml"),
+      stringifyYaml({ id, version }),
+      "utf8",
+    );
+  }
+
+  function writeSkill(packDir: string, prefix: string, skillName: string) {
+    const skillDir = path.join(packDir, `${prefix}-${skillName}`);
+    fs.mkdirSync(skillDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(skillDir, "SKILL.md"),
+      `---\nname: ${prefix}-${skillName}\ndescription: Test skill\nconcerns: read-only\n---\n`,
+      "utf8",
+    );
+  }
+
+  test("throws on missing forge.plugin.yaml manifest", () => {
+    const packDir = createPackDir("wg", "skills/wg");
+    writeSkill(packDir, "wg", "test");
+    writeForgeYaml([{ prefix: "wg", dir: "skills/wg" }]);
+
+    const config = loadForgeConfig(tmpDir);
+    expect(() => discoverPackSkills(tmpDir, config)).toThrow(/forge\.plugin\.yaml not found/);
+  });
+
+  test("throws on invalid manifest (bad id)", () => {
+    const packDir = createPackDir("wg", "skills/wg");
+    writeManifest(packDir, "Wg", "1.0.0");
+    writeSkill(packDir, "wg", "test");
+    writeForgeYaml([{ prefix: "wg", dir: "skills/wg" }]);
+
+    const config = loadForgeConfig(tmpDir);
+    expect(() => discoverPackSkills(tmpDir, config)).toThrow(/failed schema validation/);
+  });
+
+  test("throws on invalid manifest (bad version)", () => {
+    const packDir = createPackDir("wg", "skills/wg");
+    writeManifest(packDir, "wg", "not-semver");
+    writeSkill(packDir, "wg", "test");
+    writeForgeYaml([{ prefix: "wg", dir: "skills/wg" }]);
+
+    const config = loadForgeConfig(tmpDir);
+    expect(() => discoverPackSkills(tmpDir, config)).toThrow(/failed schema validation/);
+  });
+
+  test("discovers skills when manifest is valid", () => {
+    const packDir = createPackDir("wg", "skills/wg");
+    writeManifest(packDir, "wg", "1.0.0");
+    writeSkill(packDir, "wg", "test");
+    writeForgeYaml([{ prefix: "wg", dir: "skills/wg" }]);
+
+    const config = loadForgeConfig(tmpDir);
+    const skills = discoverPackSkills(tmpDir, config);
+    expect(skills.length).toBe(1);
+    expect(skills[0].name).toBe("wg-test");
+    expect(skills[0].pack).toBe("wg");
+  });
+
+  test("returns empty array when no skillPacks declared", () => {
+    writeForgeYaml([]);
+    const config = loadForgeConfig(tmpDir);
+    const skills = discoverPackSkills(tmpDir, config);
+    expect(skills).toEqual([]);
+  });
+});

package/src/tests/doctor-autonomy.test.ts

@@ -67,7 +67,7 @@ test("doctor detects @warpgogol/* import specifiers", async () => {
   );
   await writeFile(
     join(tempDir, "packages", "forge", "src", "bad.ts"),
-    'import { foo } from "@warpgogol/werkstatt/kernel";\nexport const x = foo;',
+    'import { foo } from "@warpgogol/werkstatt-engine/kernel";\nexport const x = foo;',
     "utf8",
   );
 
@@ -75,7 +75,7 @@ test("doctor detects @warpgogol/* import specifiers", async () => {
   const autonomyCheck = result.data?.checks.find((c) => c.name === "autonomy-guard");
   expect(autonomyCheck?.status).toBe("fail");
   expect(result.data?.forbiddenImports.length).toBe(1);
-  expect(result.data?.forbiddenImports[0]?.specifier).toBe("@warpgogol/werkstatt/kernel");
+  expect(result.data?.forbiddenImports[0]?.specifier).toBe("@warpgogol/werkstatt-engine/kernel");
 });
 
 test("doctor ignores @warpgogol/* in comments", async () => {
@@ -87,7 +87,7 @@ test("doctor ignores @warpgogol/* in comments", async () => {
   );
   await writeFile(
     join(tempDir, "packages", "forge", "src", "clean.ts"),
-    "/* Do not import from @warpgogol/werkstatt/kernel */\nexport const x = 1;",
+    "/* Do not import from @warpgogol/werkstatt-engine/kernel */\nexport const x = 1;",
     "utf8",
   );
 

package/src/tests/fixtures/agents-generate-business-before.txt

@@ -129,6 +129,15 @@ Session save mechanism:
 
 The agent SHOULD auto-run `fo-review` after implementing a significant change. Review results are presented in creator language — only actionable issues are highlighted.
 
+### Auto-testing
+
+The agent SHOULD write tests for new code it produces. Tests are written for **agents**, not humans — when a test fails, the error message should tell an agent reading the console output what to fix and where, but only when the fix is not obvious from the assertion itself.
+
+- **Significant changes** (new features, new functions, bug fixes) → write tests.
+- **Minor edits** (typo fix, small CSS change, renaming a variable) → no new tests required.
+- Use `fo-add-tests` for the full process and decision tree (example-based vs PBT).
+- Do not weaken or delete existing tests without explicit operator direction.
+
 ### Context awareness
 
 Before starting significant work, the agent SHOULD read recent ADRs, RFCs, and session transcripts (last 5-10 documents) to understand prior decisions and avoid conflicts. Minor edits do not require context reading.

package/src/tests/forge-autonomy-validate.test.ts

@@ -0,0 +1,157 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for forge.autonomy.validate handler (RFC-0940, FORGE-AUTONOMY-01).</purpose>
+<non-goals>
+  <item>Does not test the pipeline wiring — that is covered by integration tests.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0940: initial unit tests for forge.autonomy.validate handler.</item>
+</CHANGE_SUMMARY>
+*/
+
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runForgeAutonomyValidate } from "../../os/core/handlers/forge-autonomy-validate.ts";
+import type { ForgeRuntimeContext } from "../types.ts";
+
+function makeTmpWorkspace(): string {
+  const dir = mkdtempSync(join(tmpdir(), "forge-autonomy-"));
+  mkdirSync(join(dir, "packages", "forge", "os", "core", "handlers"), { recursive: true });
+  mkdirSync(join(dir, "packages", "forge", "os", "werkstatt", "handlers"), { recursive: true });
+  mkdirSync(join(dir, "packages", "forge", "os", "rfc"), { recursive: true });
+  return dir;
+}
+
+function makeContext(workspaceRoot: string): ForgeRuntimeContext {
+  return {
+    workspaceRoot,
+    logger: {
+      section: () => {},
+      info: () => {},
+      warn: () => {},
+      error: () => {},
+      success: () => {},
+    },
+    dryRun: false,
+    outputFormat: "pretty",
+  };
+}
+
+describe("forge.autonomy.validate", () => {
+  let workspace: string;
+
+  beforeEach(() => {
+    workspace = makeTmpWorkspace();
+  });
+
+  afterEach(() => {
+    rmSync(workspace, { recursive: true, force: true });
+  });
+
+  test("passes when no @warpgogol/werkstatt-engine imports exist", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "clean.ts"),
+      `import { join } from "node:path";\nexport function foo() { return join("a", "b"); }\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.violations).toHaveLength(0);
+    expect(result.exitCode).toBe(0);
+  });
+
+  test("fails when @warpgogol/werkstatt-engine is imported outside os/werkstatt/", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "bad.ts"),
+      `import { foo } from "@warpgogol/werkstatt-engine/kernel";\nexport function bar() { return foo(); }\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("fail");
+    expect(result.data?.violations).toHaveLength(1);
+    expect(result.data?.violations[0]!.ruleId).toBe("FORGE-AUTONOMY-01");
+    expect(result.data?.violations[0]!.specifier).toBe("@warpgogol/werkstatt-engine/kernel");
+    expect(result.exitCode).toBe(1);
+  });
+
+  test("passes when @warpgogol/werkstatt-engine is imported inside os/werkstatt/", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "werkstatt", "handlers", "adapter.ts"),
+      `import { foo } from "@warpgogol/werkstatt-engine/kernel";\nexport function bar() { return foo(); }\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.violations).toHaveLength(0);
+  });
+
+  test("passes when @warpgogol/werkstatt-shared is imported (exempt)", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "shared.ts"),
+      `import { scanDirectoryForImports } from "@warpgogol/werkstatt-shared/share/import-scan";\nexport function bar() { return scanDirectoryForImports; }\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.violations).toHaveLength(0);
+  });
+
+  test("passes for type-only imports (import type)", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "type-only.ts"),
+      `import type { KernelModule } from "@warpgogol/werkstatt-engine/kernel";\nexport const x: KernelModule | null = null;\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.violations).toHaveLength(0);
+  });
+
+  test("passes for multi-line import type with specifier on different line", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "multiline-type.ts"),
+      `import type {\n  KernelModule,\n  KernelPipelineStep,\n} from "@warpgogol/werkstatt-engine/kernel";\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.violations).toHaveLength(0);
+  });
+
+  test("does not scan test files", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "bad.test.ts"),
+      `import { foo } from "@warpgogol/werkstatt-engine/kernel";\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.violations).toHaveLength(0);
+  });
+
+  test("reports multiple violations from different files", async () => {
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "core", "handlers", "bad1.ts"),
+      `import { foo } from "@warpgogol/werkstatt-engine";\n`,
+    );
+    writeFileSync(
+      join(workspace, "packages", "forge", "os", "rfc", "bad2.ts"),
+      `import { bar } from "@warpgogol/werkstatt-engine/release";\n`,
+    );
+
+    const result = await runForgeAutonomyValidate({ argv: [], flags: {} }, makeContext(workspace));
+
+    expect(result.data?.status).toBe("fail");
+    expect(result.data?.violations).toHaveLength(2);
+  });
+});