@warpgogol/forge 5.1.1 → 5.1.3

package/src/onboarding/site-workshop-profile.test.ts

@@ -0,0 +1,84 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for the site-workshop stack profile (RFC-1125) — verifies the profile parses, scaffolds the workshop contract, and never scaffolds systems-cache inside the workshop root.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial site-workshop profile tests (AC-1 evidence).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { test, expect } from "vitest";
+import { join } from "node:path";
+import { listStackProfiles } from "../profiles/stack-profile.ts";
+
+// Resolve forge root from this test file's location
+const FORGE_ROOT = join(import.meta.dirname, "..", "..");
+
+function loadSiteWorkshop() {
+  const profiles = listStackProfiles(FORGE_ROOT);
+  const profile = profiles.find((p) => p.id === "site-workshop");
+  expect(profile, "site-workshop profile must exist in packages/forge/profiles/").toBeDefined();
+  return profile!;
+}
+
+test("site-workshop profile parses and is discoverable", () => {
+  const profile = loadSiteWorkshop();
+  expect(profile.schema).toBe("forge/stack-profile@1");
+  expect(profile.displayName).toBeTruthy();
+});
+
+test("scaffolds kernel wiring, missions/, and governance dirs — but never systems-cache", () => {
+  const profile = loadSiteWorkshop();
+  const dirs = profile.workspace.dirs;
+  const filePaths = profile.workspace.files.map((f) => f.path);
+
+  // AC-1: kernel wiring + missions + governance dirs present
+  expect(dirs).toContain("missions");
+  expect(dirs).toContain("docs");
+  expect(dirs).toContain("tools");
+  expect(filePaths).toContain("tools/kernel.config.ts");
+  expect(filePaths).toContain("missions/.gitkeep");
+
+  // AC-1: systems-cache is a sibling (../systems-cache), never scaffolded inside root
+  expect(
+    dirs,
+    "systems-cache must not be a scaffolded dir — sibling convention per RFC-1125",
+  ).not.toContain("systems-cache");
+  expect(
+    filePaths.some((p) => p.startsWith("systems-cache")),
+    "no systems-cache files may be scaffolded — created by sternsystem.register on demand",
+  ).toBe(false);
+});
+
+test("scaffolded kernel.config.ts consumes the single-sourced WorkshopModuleMap", () => {
+  const profile = loadSiteWorkshop();
+  const kernelConfig = profile.workspace.files.find((f) => f.path === "tools/kernel.config.ts");
+  expect(kernelConfig, "profile must scaffold tools/kernel.config.ts").toBeDefined();
+  // AC-5: the scaffolded config spreads workshopModuleLoaders() — no hand-copied loader list
+  expect(kernelConfig!.content).toContain("workshopModuleLoaders");
+  expect(kernelConfig!.content).toContain("@warpgogol/werkstatt-engine/kernel/module-map");
+  expect(
+    kernelConfig!.content,
+    "kernel.config.ts must not embed per-module loader thunks — they live in WORKSHOP_MODULE_MAP",
+  ).not.toContain("createMissionModule");
+});
+
+test("install set includes engine, site plugin, and forge", () => {
+  const profile = loadSiteWorkshop();
+  const install = profile.install.join(" ");
+  expect(install).toContain("@warpgogol/werkstatt-engine");
+  expect(install).toContain("@warpgogol/werkstatt-site");
+  expect(install).toContain("@warpgogol/forge");
+});
+
+test("ships .npmrc token template and site-workshop nextSteps guidance", () => {
+  const profile = loadSiteWorkshop();
+  const npmrc = profile.workspace.files.find((f) => f.path === ".npmrc");
+  expect(npmrc, "profile must scaffold .npmrc for the private @warpgogol scope").toBeDefined();
+  expect(npmrc!.content).toContain("@warpgogol:registry");
+
+  // RFC-1125: token lifecycle + identity.bootstrap guidance lives in NEXT_STEPS.md
+  expect(profile.nextSteps, "profile must provide nextSteps for token/identity onboarding").toBeTruthy();
+  expect(profile.nextSteps).toContain("NPM_TOKEN");
+  expect(profile.nextSteps).toContain("identity.bootstrap");
+});

package/src/onboarding/upgrade.ts

@@ -32,6 +32,7 @@ import {
   FORGE_CLI_BINDING_DEFAULTS,
   resolveForgeRoot,
   loadForgeConfig,
+  serializeForgeConfig,
   resolvePmRunner,
   resolvePmInstall,
   type ForgeConfig,
@@ -311,8 +312,10 @@ function updateSyncedVersion(
   config.forge = { syncedVersion: version };
 
   // Write the full config back to forge.yaml
+  // RFC-1118: serializeForgeConfig writes the declared profile id verbatim —
+  // never the resolved StackProfile object, never drops an unresolvable id.
   const forgeYamlPath = path.join(workspaceRoot, "forge.yaml");
-  fs.writeFileSync(forgeYamlPath, stringifyYaml(config), "utf8");
+  fs.writeFileSync(forgeYamlPath, stringifyYaml(serializeForgeConfig(config)), "utf8");
 }
 
 export async function runUpgrade(

package/src/profiles/profile-schema.ts

@@ -363,6 +363,7 @@ export const stackProfileDomainFieldsSchema = z.object({
   templates: z.array(profileTemplateSchema).optional(),
   scriptDir: z.string().min(1).optional(),
   rootAgentsMdTemplate: z.string().optional(),
+  nextSteps: z.string().optional(),
   compass: compassPolicyOverridesSchema.optional(),
 });
 
@@ -380,5 +381,6 @@ export interface StackProfileDomainFields {
   templates?: ProfileTemplate[];
   scriptDir?: string;
   rootAgentsMdTemplate?: string;
+  nextSteps?: string;
   compass?: CompassPolicyOverrides;
 }

package/src/profiles/stack-profile.ts

@@ -80,6 +80,8 @@ export const stackProfileSchema = z.object({
   scriptDir: stackProfileDomainFieldsSchema.shape.scriptDir,
   // Profile-driven root AGENTS.md template
   rootAgentsMdTemplate: stackProfileDomainFieldsSchema.shape.rootAgentsMdTemplate,
+  // RFC-1125: profile-driven NEXT_STEPS.md content override
+  nextSteps: stackProfileDomainFieldsSchema.shape.nextSteps,
   // Profile-driven Compass file extensions
   compass: stackProfileDomainFieldsSchema.shape.compass,
 });

package/src/tests/adr-implement-stamp.test.ts

@@ -70,6 +70,48 @@ Test consequences.
 Test evolution.
 `;
 
+const ADR_BODY_WITH_AC = (
+  id: string,
+  status: string,
+  createdAt: string,
+  acBlock: string,
+): string => `---
+id: ${id}
+title: "Test ADR"
+status: ${status}
+scope: workspace
+decider: human:test
+createdAt: ${createdAt}
+updatedAt: ${createdAt}
+---
+
+# ${id}: Test ADR
+
+## Context
+
+Test context.
+
+## Decision
+
+Test decision.
+
+## Justification
+
+Test justification.
+
+## Consequences
+
+Test consequences.
+
+## Evolution
+
+Test evolution.
+
+## Acceptance criteria
+
+${acBlock}
+`;
+
 async function makeGitRepo(dir: string): Promise<void> {
   execFileSync("git", ["init"], { cwd: dir, timeout: 5000 });
   execFileSync("git", ["config", "user.email", "test@test.com"], { cwd: dir, timeout: 5000 });
@@ -295,6 +337,114 @@ describe("adr.implement.stamp", () => {
     expect(result.data?.violations.some((v) => v.rule === "ADR-IMP-05")).toBe(true);
   });
 
+  // ── ADR-IMP-02: acceptance criteria completeness (post-cutoff, mirrors AV-17) ──
+
+  it("rejects post-cutoff ADR with unchecked acceptance criteria", async () => {
+    await writeFile(
+      join(workspaceRoot, "docs", "adrs", "adr-0001-test.md"),
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-09-10",
+        "- [ ] AC-1: THE artifact SHALL exist (evidence: file: x.ts:1)\n- [x] AC-2: THE other SHALL pass (evidence: file: y.ts:2)",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("fail");
+    expect(result.data?.violations.some((v) => v.rule === "ADR-IMP-02")).toBe(true);
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("rejects post-cutoff ADR with checked criteria lacking evidence annotation", async () => {
+    await writeFile(
+      join(workspaceRoot, "docs", "adrs", "adr-0001-test.md"),
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-09-10",
+        "- [x] AC-1: THE artifact SHALL exist",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("fail");
+    expect(result.data?.violations.some((v) => v.rule === "ADR-IMP-02")).toBe(true);
+  });
+
+  it("stamps post-cutoff ADR when all criteria are checked with evidence", async () => {
+    const adrPath = join(workspaceRoot, "docs", "adrs", "adr-0001-test.md");
+    await writeFile(
+      adrPath,
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-09-10",
+        "- [x] AC-1: THE artifact SHALL exist (evidence: file: x.ts:1)\n- [x] AC-2: THE other SHALL pass (evidence: file: y.ts:2)",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.data?.criteriaChecked).toBe(2);
+
+    const afterContent = await readFile(adrPath, "utf-8");
+    expect(afterContent).toContain("status: implemented");
+  });
+
+  it("stamps pre-cutoff ADR with unchecked criteria (AV-17 exempt)", async () => {
+    await writeFile(
+      join(workspaceRoot, "docs", "adrs", "adr-0001-test.md"),
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-08-01",
+        "- [ ] AC-1: THE artifact SHALL exist (evidence: file: x.ts:1)",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.data?.criteriaChecked).toBeUndefined();
+  });
+
+  it("stamps post-cutoff ADR without an acceptance criteria section", async () => {
+    const adrPath = join(workspaceRoot, "docs", "adrs", "adr-0001-test.md");
+    const body = ADR_BODY("ADR-0001", "accepted").replace(
+      "createdAt: 2026-08-01",
+      "createdAt: 2026-09-10",
+    );
+    await writeFile(adrPath, body);
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("pass");
+  });
+
   // ── Dry-run ──────────────────────────────────────────────────────────────────
 
   it("dry-run checks preconditions without mutating file", async () => {

package/src/tests/doctor-profile-id-known.test.ts

@@ -0,0 +1,237 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for RFC-1118 fail-closed handling of unresolvable forge.yaml profile id — profile-id-known doctor check, declared-id preservation, serializeForgeConfig, init re-detect guard.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1118: initial tests — AC-1..AC-8 plus corrupted-object recovery.</item>
+</CHANGE_SUMMARY>
+*/
+
+import { test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, rm, mkdir, writeFile, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { runDoctor } from "../onboarding/doctor.ts";
+import { runUpgrade } from "../onboarding/upgrade.ts";
+import { runInit } from "../onboarding/init.ts";
+import { loadForgeConfig, serializeForgeConfig } from "../config/forge-config.ts";
+import type { ForgeCommandInput, ForgeRuntimeContext } from "../types.ts";
+
+let tempDir: string;
+
+beforeEach(async () => {
+  tempDir = await mkdtemp(join(tmpdir(), "doctor-profile-id-known-"));
+});
+
+afterEach(async () => {
+  await rm(tempDir, { recursive: true, force: true });
+});
+
+function makeContext(): ForgeRuntimeContext {
+  return {
+    workspaceRoot: tempDir,
+    logger: {
+      section: () => {},
+      success: () => {},
+      warn: () => {},
+      error: () => {},
+      info: () => {},
+    },
+    dryRun: false,
+    outputFormat: "json",
+  };
+}
+
+const FORGE_YAML_BASE = `schema: "forge/config@1"
+project:
+  name: test-project
+  stack: []
+  packageManager: pnpm
+paths:
+  rfcsDir: docs/rfcs
+  adrsDir: docs/adrs
+  plansDir: docs/plans
+  auditsDir: docs/audits
+  specsDir: docs/specs
+  skillsDir: .agents/skills
+  sessionsDir: docs/sessions
+`;
+
+async function writeForgeYaml(extra = ""): Promise<void> {
+  await writeFile(join(tempDir, "forge.yaml"), FORGE_YAML_BASE + extra, "utf8");
+}
+
+function minimalProfile(id: string, marker: string): string {
+  return `schema: forge/stack-profile@1
+id: ${id}
+displayName: ${id} profile
+detect:
+  anyOf:
+    - ${marker}
+workspace:
+  dirs:
+    - docs
+  files: []
+`;
+}
+
+// A fake installed forge: packages/forge/package.json + profiles/<id>.yaml.
+// resolveForgeRoot(workspaceRoot) picks it up via the monorepo path.
+async function writeFakeForgeRoot(
+  version: string,
+  profiles: Array<{ id: string; marker: string }>,
+): Promise<string> {
+  const forgeRoot = join(tempDir, "packages", "forge");
+  await mkdir(join(forgeRoot, "profiles"), { recursive: true });
+  await writeFile(
+    join(forgeRoot, "package.json"),
+    JSON.stringify({ name: "@warpgogol/forge", version }) + "\n",
+    "utf8",
+  );
+  for (const p of profiles) {
+    await writeFile(
+      join(forgeRoot, "profiles", `${p.id}.yaml`),
+      minimalProfile(p.id, p.marker),
+      "utf8",
+    );
+  }
+  return forgeRoot;
+}
+
+function findCheck(result: Awaited<ReturnType<typeof runDoctor>>, name: string) {
+  return result.data?.checks.find((c) => c.name === name);
+}
+
+// AC-1: unresolvable declared id → profile-id-known fails, names id + version
+test("doctor fails profile-id-known when declared profile id is absent from installed catalog", async () => {
+  await writeFakeForgeRoot("9.9.9", [{ id: "known-profile", marker: "marker-known.txt" }]);
+  await writeForgeYaml(`profile: bogus-id\n`);
+
+  const input: ForgeCommandInput = { argv: [], flags: {} };
+  const result = await runDoctor(input, makeContext());
+
+  const check = findCheck(result, "profile-id-known");
+  expect(check, "profile-id-known check must exist in doctor output").toBeDefined();
+  expect(check!.status).toBe("fail");
+  expect(check!.message).toContain("bogus-id");
+  expect(check!.message).toContain("9.9.9");
+  expect(result.exitCode).toBe(1);
+});
+
+// AC-2: ForgeConfig exposes profileDeclaredId + profileResolution
+test("loadForgeConfig exposes profileDeclaredId and profileResolution", async () => {
+  await writeFakeForgeRoot("9.9.9", [{ id: "known-profile", marker: "marker-known.txt" }]);
+  await writeForgeYaml(`profile: bogus-id\n`);
+
+  const config = loadForgeConfig(tempDir);
+  expect(config.profileDeclaredId).toBe("bogus-id");
+  expect(config.profileResolution).toBe("unknown");
+  expect(config.profile).toBeUndefined();
+});
+
+// AC-3: no profile field → pass
+test("doctor passes profile-id-known when no profile is declared", async () => {
+  await writeFakeForgeRoot("9.9.9", [{ id: "known-profile", marker: "marker-known.txt" }]);
+  await writeForgeYaml();
+
+  const input: ForgeCommandInput = { argv: [], flags: {} };
+  const result = await runDoctor(input, makeContext());
+
+  const check = findCheck(result, "profile-id-known");
+  expect(check!.status).toBe("pass");
+});
+
+// AC-4: unresolvable id survives re-serialization verbatim
+test("forge upgrade preserves an unresolvable declared profile id verbatim", async () => {
+  const forgeRoot = await writeFakeForgeRoot("9.9.9", [
+    { id: "known-profile", marker: "marker-known.txt" },
+  ]);
+  await writeForgeYaml(`profile: bogus-id\nforge:\n  syncedVersion: "0.0.0"\n`);
+
+  const input: ForgeCommandInput = { argv: [], flags: {} };
+  const ctx = { ...makeContext(), forgeRoot };
+  const result = await runUpgrade(input, ctx);
+  expect(result.exitCode).toBe(0);
+
+  const written = parseYaml(await readFile(join(tempDir, "forge.yaml"), "utf8")) as Record<
+    string,
+    unknown
+  >;
+  expect(
+    written["profile"],
+    "re-serialized forge.yaml must retain the declared id string, not drop it",
+  ).toBe("bogus-id");
+});
+
+// AC-6: resolvable id serializes as the id string, not the StackProfile object
+test("forge upgrade writes the profile id string, not the resolved object", async () => {
+  const forgeRoot = await writeFakeForgeRoot("9.9.9", [
+    { id: "known-profile", marker: "marker-known.txt" },
+  ]);
+  await writeForgeYaml(`profile: known-profile\nforge:\n  syncedVersion: "0.0.0"\n`);
+
+  const input: ForgeCommandInput = { argv: [], flags: {} };
+  const ctx = { ...makeContext(), forgeRoot };
+  const result = await runUpgrade(input, ctx);
+  expect(result.exitCode).toBe(0);
+
+  const written = parseYaml(await readFile(join(tempDir, "forge.yaml"), "utf8")) as Record<
+    string,
+    unknown
+  >;
+  expect(
+    typeof written["profile"],
+    "profile must serialize as the declared id string, not the StackProfile object",
+  ).toBe("string");
+  expect(written["profile"]).toBe("known-profile");
+});
+
+// AC-7: unreadable catalog → warn, not fail
+test("doctor warns (not fails) when the profile catalog cannot be read", async () => {
+  // No fake forge root — resolveForgeRoot falls back to a nonexistent path.
+  await writeForgeYaml(`profile: bogus-id\n`);
+
+  const input: ForgeCommandInput = { argv: [], flags: {} };
+  const result = await runDoctor(input, makeContext());
+
+  const check = findCheck(result, "profile-id-known");
+  expect(check!.status).toBe("warn");
+  expect(check!.message).toContain("bogus-id");
+});
+
+// AC-8: init --from never overwrites a declared profile id
+test("forge init preserves a declared profile id against conflicting detection", async () => {
+  const forgeRoot = await writeFakeForgeRoot("9.9.9", [
+    { id: "detected-y", marker: "marker-y.txt" },
+  ]);
+  await writeForgeYaml(`profile: declared-x\n`);
+
+  // --from directory that detects as "detected-y"
+  const fromDir = join(tempDir, "from-src");
+  await mkdir(fromDir, { recursive: true });
+  await writeFile(join(fromDir, "marker-y.txt"), "x", "utf8");
+
+  const result = runInit({ flags: { from: fromDir } }, { workspaceRoot: tempDir, forgeRoot });
+
+  const written = await readFile(join(tempDir, "forge.yaml"), "utf8");
+  expect(written).toContain("profile: declared-x");
+  expect(
+    result.skipped.some((s) => s.includes("declared-x") && s.includes("detected-y")),
+    "init must surface a warning that the declared id was preserved over the detection result",
+  ).toBe(true);
+});
+
+// Corrupted state recovery: object-form profile (written by the old bug) heals to the declared id
+test("loadForgeConfig recovers profileDeclaredId from a corrupted object-form profile", async () => {
+  await writeFakeForgeRoot("9.9.9", [{ id: "known-profile", marker: "marker-known.txt" }]);
+  await writeForgeYaml(`profile:\n  id: known-profile\n  displayName: known-profile profile\n`);
+
+  const config = loadForgeConfig(tempDir);
+  expect(config.profileDeclaredId).toBe("known-profile");
+  expect(config.profileResolution).toBe("resolved");
+
+  // Re-serialization heals the field back to the id string
+  const serialized = serializeForgeConfig(config);
+  expect(serialized["profile"]).toBe("known-profile");
+});

package/src/tests/pinned-validate.test.ts

@@ -0,0 +1,134 @@
+import { test, expect, describe } from "vitest";
+import { mkdtemp, rm, mkdir, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runPinnedValidate } from "../../os/core/handlers/pinned-validate.ts";
+import type { ForgeCommandInput, ForgeRuntimeContext } from "../../src/types.ts";
+
+const execFileAsync = promisify(execFile);
+
+async function makeTempDir(): Promise<string> {
+  return mkdtemp(join(tmpdir(), "forge-pinned-validate-test-"));
+}
+
+function makeContext(workspaceRoot: string): ForgeRuntimeContext {
+  return {
+    workspaceRoot,
+    logger: {
+      section: () => {},
+      info: () => {},
+      warn: () => {},
+      error: () => {},
+      success: () => {},
+    },
+    dryRun: false,
+    outputFormat: "json",
+  };
+}
+
+function makeInput(): ForgeCommandInput {
+  return { argv: [], flags: {} };
+}
+
+async function git(dir: string, args: string[]): Promise<void> {
+  await execFileAsync("git", args, { cwd: dir });
+}
+
+/**
+ * Scaffold a git repo with a committed pinned.yaml protecting docs/rfcs/
+ * and one committed RFC file. Returns the repo dir.
+ */
+async function makeRepo(): Promise<string> {
+  const dir = await makeTempDir();
+  await git(dir, ["init"]);
+  await git(dir, ["config", "user.email", "test@example.com"]);
+  await git(dir, ["config", "user.name", "Test"]);
+  await mkdir(join(dir, ".forge"), { recursive: true });
+  await writeFile(
+    join(dir, ".forge", "pinned.yaml"),
+    "pinned:\n  - path: docs/rfcs/\n    mode: protect\n    reason: RFC directory\n",
+  );
+  await mkdir(join(dir, "docs", "rfcs"), { recursive: true });
+  await writeFile(join(dir, "docs", "rfcs", "rfc-0001.md"), "# RFC 1\n");
+  await git(dir, ["add", "-A"]);
+  await git(dir, ["commit", "-m", "init"]);
+  return dir;
+}
+
+describe("runPinnedValidate", () => {
+  test("passes for intra-directory move inside a pinned dir (docs.archive)", async () => {
+    const dir = await makeRepo();
+    try {
+      // Simulate docs.archive: docs/rfcs/rfc-0001.md → docs/rfcs/archive/implemented/rfc-0001.md
+      await mkdir(join(dir, "docs", "rfcs", "archive", "implemented"), { recursive: true });
+      await git(dir, ["mv", "docs/rfcs/rfc-0001.md", "docs/rfcs/archive/implemented/rfc-0001.md"]);
+
+      const result = await runPinnedValidate(makeInput(), makeContext(dir));
+      expect(result.data?.status).toBe("pass");
+      expect(result.data?.violations).toHaveLength(0);
+      expect(result.exitCode).toBe(0);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("flags move out of a pinned dir", async () => {
+    const dir = await makeRepo();
+    try {
+      await mkdir(join(dir, "docs", "other"), { recursive: true });
+      await git(dir, ["mv", "docs/rfcs/rfc-0001.md", "docs/other/rfc-0001.md"]);
+
+      const result = await runPinnedValidate(makeInput(), makeContext(dir));
+      expect(result.data?.status).toBe("fail");
+      expect(result.data?.violations.length).toBeGreaterThan(0);
+      expect(
+        result.data?.violations.some(
+          (v) => v.path === "docs/rfcs/rfc-0001.md" && v.operation === "move",
+        ),
+      ).toBe(true);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("flags move into a pinned dir", async () => {
+    const dir = await makeRepo();
+    try {
+      // Source must be committed first — otherwise git records the staged
+      // result as A (add), not R (rename).
+      await writeFile(join(dir, "incoming.md"), "# incoming\n");
+      await git(dir, ["add", "incoming.md"]);
+      await git(dir, ["commit", "-m", "add incoming"]);
+      await git(dir, ["mv", "incoming.md", "docs/rfcs/incoming.md"]);
+
+      const result = await runPinnedValidate(makeInput(), makeContext(dir));
+      expect(result.data?.status).toBe("fail");
+      expect(
+        result.data?.violations.some(
+          (v) => v.path === "docs/rfcs/incoming.md" && v.operation === "move",
+        ),
+      ).toBe(true);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("flags delete of a pinned file", async () => {
+    const dir = await makeRepo();
+    try {
+      await git(dir, ["rm", "docs/rfcs/rfc-0001.md"]);
+
+      const result = await runPinnedValidate(makeInput(), makeContext(dir));
+      expect(result.data?.status).toBe("fail");
+      expect(
+        result.data?.violations.some(
+          (v) => v.path === "docs/rfcs/rfc-0001.md" && v.operation === "delete",
+        ),
+      ).toBe(true);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/tests/profile-schema.test.ts

@@ -157,7 +157,7 @@ test("artifacts with missing required extensions field fails", () => {
 
 test("all shipped profiles parse without changes", () => {
   const profiles = listStackProfiles(FORGE_ROOT);
-  expect(profiles.length).toBe(5);
+  expect(profiles.length).toBe(6);
   for (const profile of profiles) {
     expect(profile.id).toBeDefined();
     expect(profile.workspace.dirs.length).toBeGreaterThan(0);