@warpgogol/forge 5.1.1 → 5.1.3

package/os/core/handlers/pinned-validate.ts

@@ -33,6 +33,7 @@ import type {
 import {
   loadPinnedManifest,
   isPinned,
+  isIntraDirMove,
   PINNED_MANIFEST_PATH,
   PinnedManifestMalformedError,
 } from "./pinned-check.ts";
@@ -51,11 +52,18 @@ const AUDIT_LOG_PATH = path.join(".forge", "pinned-audit.log");
  * Git status codes:
  *   D = deleted, R = renamed (move), M = modified, A = added, C = copied
  * Format: "R100\tdocs/old.md\tdocs/new.md" or "D\tdocs/file.md"
+ *
+ * R/C entries keep their destination in `destPath` so the violation check can
+ * apply the isIntraDirMove exemption (same rule the archive handlers use).
  */
 function parseGitNameStatus(
   output: string,
-): Array<{ relPath: string; operation: PinnedViolation["operation"] }> {
-  const entries: Array<{ relPath: string; operation: PinnedViolation["operation"] }> = [];
+): Array<{ relPath: string; operation: PinnedViolation["operation"]; destPath?: string }> {
+  const entries: Array<{
+    relPath: string;
+    operation: PinnedViolation["operation"];
+    destPath?: string;
+  }> = [];
   const lines = output.trim().split("\n").filter(Boolean);
 
   for (const line of lines) {
@@ -69,10 +77,7 @@ function parseGitNameStatus(
     if (statusCode.startsWith("D")) {
       entries.push({ relPath: oldPath, operation: "delete" });
     } else if (statusCode.startsWith("R") || statusCode.startsWith("C")) {
-      entries.push({ relPath: oldPath, operation: "move" });
-      if (newPath !== oldPath) {
-        entries.push({ relPath: newPath, operation: "move" });
-      }
+      entries.push({ relPath: oldPath, operation: "move", destPath: newPath });
     } else if (statusCode.startsWith("M")) {
       entries.push({ relPath: oldPath, operation: "modify" });
     }
@@ -228,7 +233,28 @@ export async function runPinnedValidate(
 
   // Check each changed file against the manifest
   const allViolations: PinnedViolation[] = [];
-  for (const { relPath, operation } of changedFiles) {
+  for (const { relPath, operation, destPath } of changedFiles) {
+    if (operation === "move" && destPath) {
+      // Exempt intra-directory moves — the file stays inside the same pinned
+      // dir (e.g. docs.archive moves docs/rfcs/x.md → docs/rfcs/archive/…/x.md).
+      // Same exemption the archive handlers apply via isIntraDirMove.
+      if (isIntraDirMove(manifest, relPath, destPath)) {
+        continue;
+      }
+      for (const movePath of new Set([relPath, destPath])) {
+        const moveEntry = isPinned(manifest, movePath);
+        if (moveEntry) {
+          allViolations.push({
+            path: movePath,
+            mode: moveEntry.mode,
+            operation,
+            reason: moveEntry.reason,
+          });
+        }
+      }
+      continue;
+    }
+
     const entry = isPinned(manifest, relPath);
     if (entry) {
       // For protect mode, only delete and move are violations — modify is allowed

package/os/naming/naming-convention.ts

@@ -69,6 +69,8 @@ const NAMING_CONVENTION_IGNORED_TOP_LEVEL = new Set([
   ".forge",
   "patches",
   "storage",
+  ".check-warpgogol",
+  ".coverage-report-html",
 ]);
 
 // Tool-mandated filenames exempt from kebab-case (Docker, Caddy use these exact names).

package/os/rfc/frontmatter-io.ts

@@ -56,6 +56,7 @@ export async function listRfcFiles(rfcDirPath: string): Promise<string[]> {
           entry.isFile() &&
           entry.name.endsWith(".md") &&
           !entry.name.startsWith("rfc-0000") &&
+          !entry.name.endsWith(".generated.md") &&
           entry.name !== "README.md"
         ) {
           results.push(relativePath);

package/os/rfc/handlers/validate-rules.ts

@@ -404,7 +404,14 @@ async function checkImplementationCommitDrift(
   createdAt: string,
   currentStatus: string,
 ): Promise<{ found: boolean; commitCount: number }> {
-  if (currentStatus === "implemented") {
+  // Terminal statuses are exempt: implemented is the target state, and
+  // superseded/rejected RFCs may legitimately carry implement: commits from
+  // work that landed before the status transition (RFC-0769 lifecycle).
+  if (
+    currentStatus === "implemented" ||
+    currentStatus === "superseded" ||
+    currentStatus === "rejected"
+  ) {
     return { found: false, commitCount: 0 };
   }
 

package/os/werkstatt/handlers/workspace-deps.ts

@@ -1,6 +1,6 @@
 /*
 <MODULE_CONTRACT>
-<purpose>Lazy dynamic-import bridge for @warpgogol/werkstatt-engine/fingerprint and @warpgogol/werkstatt-shared/node/fs. These workspace packages are not published to npm — when forge is installed standalone from npm, they are unavailable and handlers that depend on them must degrade gracefully.</purpose>
+<purpose>Lazy dynamic-import bridge for @warpgogol/werkstatt-shared/node/fs and @warpgogol/werkstatt-shared/fingerprint. These workspace packages are not published to npm — when forge is installed standalone from npm, they are unavailable and handlers that depend on them must degrade gracefully.</purpose>
 <non-goals>
   <item>Do not re-export types from @warpgogol/* — only runtime functions.</item>
   <item>Do not use static imports — that would break npm installs without workspace deps.</item>
@@ -9,6 +9,7 @@
 <CHANGE_SUMMARY>
   <item>RFC-0682: extract dynamic-import helper so forge publishes without workspace:* deps.</item>
   <item>RFC-0940: moved from os/core/handlers/ to os/werkstatt/handlers/ — this module imports @warpgogol/werkstatt-engine and belongs in the adapter directory.</item>
+  <item>2026-09-22: fingerprint import switched from @warpgogol/werkstatt-engine/fingerprint to @warpgogol/werkstatt-shared/fingerprint (canonical home since RFC-1104) — breaks the forge↔engine package cycle reported by turbo.</item>
 </CHANGE_SUMMARY>
 */
 
@@ -40,7 +41,7 @@ export async function loadWorkspaceDeps(): Promise<WorkspaceDeps> {
     const shareMod = await import("@warpgogol/werkstatt-shared/node/fs");
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore — workspace dep, may not be installed when forge is used standalone from npm
-    const fpMod = await import("@warpgogol/werkstatt-engine/fingerprint");
+    const fpMod = await import("@warpgogol/werkstatt-shared/fingerprint");
     cached = {
       collectFiles: shareMod.collectFiles as CollectFilesFn,
       byteHashFile: fpMod.byteHashFile as ByteHashFileFn,
@@ -48,7 +49,7 @@ export async function loadWorkspaceDeps(): Promise<WorkspaceDeps> {
     return cached;
   } catch (err) {
     loadError =
-      `@warpgogol/werkstatt-engine/fingerprint and @warpgogol/werkstatt-shared are required for this command but not installed. ` +
+      `@warpgogol/werkstatt-shared/fingerprint and @warpgogol/werkstatt-shared/node/fs are required for this command but not installed. ` +
       `When using forge standalone from npm, install them separately or use forge within the warpgogol workspace. ` +
       `Error: ${(err as Error).message}`;
     throw new Error(loadError);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warpgogol/forge",
-  "version": "5.1.1",
+  "version": "5.1.3",
   "private": false,
   "type": "module",
   "license": "Apache-2.0",