@warpgogol/forge 5.1.2 → 5.1.3

package/src/onboarding/doctor-token-check.test.ts

@@ -0,0 +1,124 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for the npm-token probe (RFC-1125, AC-2) — .npmrc parsing, token presence detection, and the fail-fast fixHint contract used by forge create and forge.doctor.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial npm-token probe tests (AC-2 evidence).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  checkNpmToken,
+  readNpmrcTokenStatus,
+  workshopNeedsWarpgogolToken,
+} from "./npm-token-check.ts";
+
+let tempDir: string;
+
+beforeEach(async () => {
+  tempDir = await mkdtemp(join(tmpdir(), "npm-token-check-"));
+});
+
+afterEach(async () => {
+  await rm(tempDir, { recursive: true, force: true });
+});
+
+const NPMRC_WITH_TOKEN = `@warpgogol:registry=https://registry.npmjs.org/
+//registry.npmjs.org/:_authToken=npm_real_token_123
+`;
+
+const NPMRC_PLACEHOLDER = `@warpgogol:registry=https://registry.npmjs.org/
+//registry.npmjs.org/:_authToken=YOUR_NPM_TOKEN
+`;
+
+const NPMRC_ENV_REF = `@warpgogol:registry=https://registry.npmjs.org/
+//registry.npmjs.org/:_authToken=\${NPM_TOKEN}
+`;
+
+// --- readNpmrcTokenStatus ---
+
+test("detects registry and literal token from .npmrc", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_WITH_TOKEN);
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.registry).toBe("https://registry.npmjs.org/");
+  expect(status.tokenPresent).toBe(true);
+});
+
+test("YOUR_NPM_TOKEN placeholder does not count as a token", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.tokenPresent).toBe(false);
+});
+
+test("NPM_TOKEN env satisfies the probe even with placeholder .npmrc", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  const status = readNpmrcTokenStatus(tempDir, { NPM_TOKEN: "npm_env_token" });
+  expect(status.tokenPresent).toBe(true);
+});
+
+test("${NPM_TOKEN} reference resolves against env", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_ENV_REF);
+  expect(readNpmrcTokenStatus(tempDir, { NPM_TOKEN: "x" }).tokenPresent).toBe(true);
+  expect(readNpmrcTokenStatus(tempDir, {}).tokenPresent).toBe(false);
+});
+
+test("missing .npmrc → no registry, no token", () => {
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.registry).toBeNull();
+  expect(status.tokenPresent).toBe(false);
+});
+
+test("detects _authToken when it is not the last line (scaffolded .npmrc shape)", async () => {
+  // Regression: scaffolded .npmrc appends dangerously-allow-all-builds and
+  // ignore-workspace-root-check AFTER the token line — the regex must match mid-file.
+  await writeFile(
+    join(tempDir, ".npmrc"),
+    `@warpgogol:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=npm_real_token\ndangerously-allow-all-builds=true\nignore-workspace-root-check=true\n`,
+  );
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.tokenPresent).toBe(true);
+});
+
+// --- workshopNeedsWarpgogolToken ---
+
+test("needs token when .npmrc declares @warpgogol scope", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  expect(workshopNeedsWarpgogolToken(tempDir, [])).toBe(true);
+});
+
+test("needs token when install pulls @warpgogol packages", () => {
+  expect(workshopNeedsWarpgogolToken(tempDir, ["pnpm add -wD @warpgogol/forge"])).toBe(true);
+});
+
+test("skips probe when no @warpgogol usage", () => {
+  expect(workshopNeedsWarpgogolToken(tempDir, ["pnpm add -wD prettier"])).toBe(false);
+});
+
+// --- checkNpmToken ---
+
+test("canFetch=true → fixHint is null", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_WITH_TOKEN);
+  const result = await checkNpmToken(tempDir, { fetchVersion: () => true, env: {} });
+  expect(result.canFetch).toBe(true);
+  expect(result.fixHint).toBeNull();
+});
+
+test("canFetch=false with token → fixHint mentions expiry/revocation", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_WITH_TOKEN);
+  const result = await checkNpmToken(tempDir, { fetchVersion: () => false, env: {} });
+  expect(result.canFetch).toBe(false);
+  expect(result.fixHint).toContain("expired or revoked");
+});
+
+test("canFetch=false without token → fixHint names NPM_TOKEN and .npmrc", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  const result = await checkNpmToken(tempDir, { fetchVersion: () => false, env: {} });
+  expect(result.canFetch).toBe(false);
+  // AC-2: the fixHint must be actionable — name the exact remediation path
+  expect(result.fixHint).toContain("NPM_TOKEN");
+  expect(result.fixHint).toContain(".npmrc");
+});

package/src/onboarding/doctor.ts

@@ -49,6 +49,7 @@ import type { DuplicatePair } from "../knowledge/index.ts";
 import { checkMemoryLayerHealth } from "./memory-scaffold.ts";
 import { checkInvariants } from "./invariant-engine.ts";
 import type { InvariantViolation } from "./invariant-engine.ts";
+import { checkNpmToken, workshopNeedsWarpgogolToken } from "./npm-token-check.ts";
 import { execSync } from "node:child_process";
 import fs from "node:fs";
 import type { ProfilePrerequisite } from "../profiles/profile-schema.ts";
@@ -1272,6 +1273,22 @@ export async function runDoctor(
       : "docs/adrs/ directory not found — run 'forge create' to create ADR directory",
   });
 
+  // RFC-1125: re-verify the @warpgogol npm token post-install when the workshop
+  // uses the private scope (.npmrc declares it or package.json has @warpgogol deps)
+  const pkgJsonPath = join(workspaceRoot, "package.json");
+  const pkgHasWarpgogol =
+    fs.existsSync(pkgJsonPath) && fs.readFileSync(pkgJsonPath, "utf8").includes("@warpgogol/");
+  if (workshopNeedsWarpgogolToken(workspaceRoot, []) || pkgHasWarpgogol) {
+    const tokenCheck = await checkNpmToken(workspaceRoot);
+    checks.push({
+      name: "npm-token (@warpgogol)",
+      status: tokenCheck.canFetch ? "pass" : "fail",
+      message: tokenCheck.canFetch
+        ? `npm token fetches @warpgogol/werkstatt-engine (${tokenCheck.registry ?? "default registry"})`
+        : tokenCheck.fixHint!,
+    });
+  }
+
   // Check git branch is 'main' (not 'master')
   checks.push(checkGitBranch(workspaceRoot));
 

package/src/onboarding/init.ts

@@ -49,6 +49,7 @@ export interface InitDomainFields {
   terminology?: Record<string, string>;
   semanticBindings?: Record<string, string | null>;
   profileId?: string;
+  nextSteps?: string;
   compass?: {
     fileExtensions?: string[];
     testPatterns?: string[];

package/src/onboarding/npm-token-check.ts

@@ -0,0 +1,140 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Non-interactive npm-token probe for the private @warpgogol registry scope (RFC-1125) — parses .npmrc for the @warpgogol scope registry and auth token presence, probes the registry via `npm view @warpgogol/werkstatt-engine version` (injectable for tests) before pnpm install runs in forge create, re-verifies post-install in forge.doctor, and returns a structured NpmTokenCheck with an actionable fixHint on failure.</purpose>
+<non-goals>
+  <item>Do not prompt the operator — the probe is non-interactive (create.ts forbids prompts).</item>
+  <item>Do not accept tokens via CLI flags — tokens must not appear in argv/history.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial npm-token probe — checkNpmToken + readNpmrcTokenStatus, wired into scaffold-project (pre-install fail-fast) and doctor (post-install re-verify).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+/** Result of the npm-token probe (RFC-1125). */
+export interface NpmTokenCheck {
+  /** Registry URL from `.npmrc` `@warpgogol:registry=` (null when undeclared). */
+  registry: string | null;
+  /** A usable token is configured — NPM_TOKEN env or a real _authToken value. */
+  tokenPresent: boolean;
+  /** `npm view @warpgogol/werkstatt-engine version` succeeded from workspaceRoot. */
+  canFetch: boolean;
+  /** Actionable remediation when canFetch is false; null on success. */
+  fixHint: string | null;
+}
+
+/** Injectable dependencies for testing. */
+export interface NpmTokenProbeDeps {
+  /** Override the registry probe — return true when the fetch succeeds. */
+  fetchVersion?: (cwd: string) => boolean;
+  /** Override the environment (defaults to process.env). */
+  env?: Record<string, string | undefined>;
+}
+
+const WARPGOGOL_SCOPE = "@warpgogol";
+const PROBE_PACKAGE = "@warpgogol/werkstatt-engine";
+const PROBE_TIMEOUT_MS = 15_000;
+const PLACEHOLDER_TOKENS = new Set(["YOUR_NPM_TOKEN", ""]);
+
+/**
+ * Parse the workspace `.npmrc` for the @warpgogol scope: registry URL and
+ * whether a usable auth token is configured. A token counts as present when
+ * NPM_TOKEN is set in the env, or when `_authToken` holds a real value
+ * (not the YOUR_NPM_TOKEN placeholder, not an unset ${VAR} reference).
+ */
+export function readNpmrcTokenStatus(
+  workspaceRoot: string,
+  env: Record<string, string | undefined> = process.env,
+): { registry: string | null; tokenPresent: boolean } {
+  const npmrcPath = path.join(workspaceRoot, ".npmrc");
+  const npmrc = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, "utf8") : "";
+
+  const registryMatch = npmrc.match(/^@warpgogol:registry=(\S+)\s*$/m);
+  const registry = registryMatch?.[1] ?? null;
+
+  // Token sources, in precedence order:
+  // 1. NPM_TOKEN env (agent-driven installs; also satisfies ${NPM_TOKEN} refs)
+  if (env.NPM_TOKEN && env.NPM_TOKEN.trim().length > 0) {
+    return { registry, tokenPresent: true };
+  }
+
+  // 2. Literal _authToken in .npmrc for the scope's registry host.
+  // `m` flag required — the token line is never last in a scaffolded .npmrc
+  // (dangerously-allow-all-builds + appended ignore-workspace-root-check follow it).
+  const tokenMatch = npmrc.match(/_authToken=(\S+)[ \t]*$/m);
+  if (tokenMatch) {
+    const value = tokenMatch[1];
+    // ${VAR} references resolve at install time — count as present only when set
+    const varRef = value.match(/^\$\{(\w+)\}$/);
+    if (varRef) {
+      const envValue = env[varRef[1]];
+      return { registry, tokenPresent: !!envValue && envValue.trim().length > 0 };
+    }
+    return { registry, tokenPresent: !PLACEHOLDER_TOKENS.has(value) };
+  }
+
+  return { registry, tokenPresent: false };
+}
+
+/**
+ * Whether the workspace needs the @warpgogol token at all — true when `.npmrc`
+ * declares the scope or any install command pulls `@warpgogol/` packages.
+ * Profiles without @warpgogol deps skip the probe entirely.
+ */
+export function workshopNeedsWarpgogolToken(workspaceRoot: string, installCmds: string[]): boolean {
+  const npmrcPath = path.join(workspaceRoot, ".npmrc");
+  if (fs.existsSync(npmrcPath)) {
+    const npmrc = fs.readFileSync(npmrcPath, "utf8");
+    if (npmrc.includes(`${WARPGOGOL_SCOPE}:registry`) || npmrc.includes(`${WARPGOGOL_SCOPE}/`)) {
+      return true;
+    }
+  }
+  return installCmds.some((cmd) => cmd.includes(`${WARPGOGOL_SCOPE}/`));
+}
+
+function defaultFetchVersion(cwd: string): boolean {
+  try {
+    execSync(`npm view ${PROBE_PACKAGE} version`, {
+      cwd,
+      stdio: "pipe",
+      timeout: PROBE_TIMEOUT_MS,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function buildFixHint(tokenPresent: boolean): string {
+  const base =
+    `npm token for the @warpgogol scope cannot fetch ${PROBE_PACKAGE}. ` +
+    `Set NPM_TOKEN env or replace YOUR_NPM_TOKEN in .npmrc with a valid npm read token ` +
+    `(issued at workshop provisioning — see NEXT_STEPS.md §Token lifecycle).`;
+  return tokenPresent
+    ? `${base} A token is configured but was rejected — it may be expired or revoked; request a fresh one.`
+    : base;
+}
+
+/**
+ * Run the npm-token probe: parse `.npmrc`, then verify the registry actually
+ * serves the package. Non-interactive — never prompts, never reads argv.
+ */
+export async function checkNpmToken(
+  workspaceRoot: string,
+  deps: NpmTokenProbeDeps = {},
+): Promise<NpmTokenCheck> {
+  const env = deps.env ?? process.env;
+  const fetchVersion = deps.fetchVersion ?? defaultFetchVersion;
+  const { registry, tokenPresent } = readNpmrcTokenStatus(workspaceRoot, env);
+  const canFetch = fetchVersion(workspaceRoot);
+  return {
+    registry,
+    tokenPresent,
+    canFetch,
+    fixHint: canFetch ? null : buildFixHint(tokenPresent),
+  };
+}

package/src/onboarding/scaffold-project.ts

@@ -22,6 +22,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { execSync } from "node:child_process";
 import { listStackProfiles, type StackProfile } from "../profiles/stack-profile.ts";
+import { checkNpmToken, workshopNeedsWarpgogolToken } from "./npm-token-check.ts";
 import { resolveForgeRoot } from "../config/forge-config.ts";
 import type {
   ForgeCommandInput,
@@ -166,6 +167,16 @@ export async function runScaffoldProject(
     }
   }
 
+  // RFC-1125: non-interactive npm-token probe — fail fast before pnpm install when
+  // the @warpgogol scope is needed but the token cannot fetch @warpgogol/werkstatt-engine.
+  // Runs after .npmrc is materialized so the probe sees the final token state.
+  if (profile.install.length > 0 && workshopNeedsWarpgogolToken(workspaceRoot, profile.install)) {
+    const tokenCheck = await checkNpmToken(workspaceRoot);
+    if (!tokenCheck.canFetch) {
+      return fail("forge.scaffold", profileId, tokenCheck.fixHint!, errors, outputFormat, logger);
+    }
+  }
+
   // Run ALL install commands AFTER all files are created (atomicity: no partial state if install fails)
   // Root workspace install commands
   if (outputFormat === "pretty" && profile.install.length > 0) {

package/src/onboarding/site-workshop-profile.test.ts

@@ -0,0 +1,84 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for the site-workshop stack profile (RFC-1125) — verifies the profile parses, scaffolds the workshop contract, and never scaffolds systems-cache inside the workshop root.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial site-workshop profile tests (AC-1 evidence).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { test, expect } from "vitest";
+import { join } from "node:path";
+import { listStackProfiles } from "../profiles/stack-profile.ts";
+
+// Resolve forge root from this test file's location
+const FORGE_ROOT = join(import.meta.dirname, "..", "..");
+
+function loadSiteWorkshop() {
+  const profiles = listStackProfiles(FORGE_ROOT);
+  const profile = profiles.find((p) => p.id === "site-workshop");
+  expect(profile, "site-workshop profile must exist in packages/forge/profiles/").toBeDefined();
+  return profile!;
+}
+
+test("site-workshop profile parses and is discoverable", () => {
+  const profile = loadSiteWorkshop();
+  expect(profile.schema).toBe("forge/stack-profile@1");
+  expect(profile.displayName).toBeTruthy();
+});
+
+test("scaffolds kernel wiring, missions/, and governance dirs — but never systems-cache", () => {
+  const profile = loadSiteWorkshop();
+  const dirs = profile.workspace.dirs;
+  const filePaths = profile.workspace.files.map((f) => f.path);
+
+  // AC-1: kernel wiring + missions + governance dirs present
+  expect(dirs).toContain("missions");
+  expect(dirs).toContain("docs");
+  expect(dirs).toContain("tools");
+  expect(filePaths).toContain("tools/kernel.config.ts");
+  expect(filePaths).toContain("missions/.gitkeep");
+
+  // AC-1: systems-cache is a sibling (../systems-cache), never scaffolded inside root
+  expect(
+    dirs,
+    "systems-cache must not be a scaffolded dir — sibling convention per RFC-1125",
+  ).not.toContain("systems-cache");
+  expect(
+    filePaths.some((p) => p.startsWith("systems-cache")),
+    "no systems-cache files may be scaffolded — created by sternsystem.register on demand",
+  ).toBe(false);
+});
+
+test("scaffolded kernel.config.ts consumes the single-sourced WorkshopModuleMap", () => {
+  const profile = loadSiteWorkshop();
+  const kernelConfig = profile.workspace.files.find((f) => f.path === "tools/kernel.config.ts");
+  expect(kernelConfig, "profile must scaffold tools/kernel.config.ts").toBeDefined();
+  // AC-5: the scaffolded config spreads workshopModuleLoaders() — no hand-copied loader list
+  expect(kernelConfig!.content).toContain("workshopModuleLoaders");
+  expect(kernelConfig!.content).toContain("@warpgogol/werkstatt-engine/kernel/module-map");
+  expect(
+    kernelConfig!.content,
+    "kernel.config.ts must not embed per-module loader thunks — they live in WORKSHOP_MODULE_MAP",
+  ).not.toContain("createMissionModule");
+});
+
+test("install set includes engine, site plugin, and forge", () => {
+  const profile = loadSiteWorkshop();
+  const install = profile.install.join(" ");
+  expect(install).toContain("@warpgogol/werkstatt-engine");
+  expect(install).toContain("@warpgogol/werkstatt-site");
+  expect(install).toContain("@warpgogol/forge");
+});
+
+test("ships .npmrc token template and site-workshop nextSteps guidance", () => {
+  const profile = loadSiteWorkshop();
+  const npmrc = profile.workspace.files.find((f) => f.path === ".npmrc");
+  expect(npmrc, "profile must scaffold .npmrc for the private @warpgogol scope").toBeDefined();
+  expect(npmrc!.content).toContain("@warpgogol:registry");
+
+  // RFC-1125: token lifecycle + identity.bootstrap guidance lives in NEXT_STEPS.md
+  expect(profile.nextSteps, "profile must provide nextSteps for token/identity onboarding").toBeTruthy();
+  expect(profile.nextSteps).toContain("NPM_TOKEN");
+  expect(profile.nextSteps).toContain("identity.bootstrap");
+});

package/src/profiles/profile-schema.ts

@@ -363,6 +363,7 @@ export const stackProfileDomainFieldsSchema = z.object({
   templates: z.array(profileTemplateSchema).optional(),
   scriptDir: z.string().min(1).optional(),
   rootAgentsMdTemplate: z.string().optional(),
+  nextSteps: z.string().optional(),
   compass: compassPolicyOverridesSchema.optional(),
 });
 
@@ -380,5 +381,6 @@ export interface StackProfileDomainFields {
   templates?: ProfileTemplate[];
   scriptDir?: string;
   rootAgentsMdTemplate?: string;
+  nextSteps?: string;
   compass?: CompassPolicyOverrides;
 }

package/src/profiles/stack-profile.ts

@@ -80,6 +80,8 @@ export const stackProfileSchema = z.object({
   scriptDir: stackProfileDomainFieldsSchema.shape.scriptDir,
   // Profile-driven root AGENTS.md template
   rootAgentsMdTemplate: stackProfileDomainFieldsSchema.shape.rootAgentsMdTemplate,
+  // RFC-1125: profile-driven NEXT_STEPS.md content override
+  nextSteps: stackProfileDomainFieldsSchema.shape.nextSteps,
   // Profile-driven Compass file extensions
   compass: stackProfileDomainFieldsSchema.shape.compass,
 });

package/src/tests/adr-implement-stamp.test.ts

@@ -70,6 +70,48 @@ Test consequences.
 Test evolution.
 `;
 
+const ADR_BODY_WITH_AC = (
+  id: string,
+  status: string,
+  createdAt: string,
+  acBlock: string,
+): string => `---
+id: ${id}
+title: "Test ADR"
+status: ${status}
+scope: workspace
+decider: human:test
+createdAt: ${createdAt}
+updatedAt: ${createdAt}
+---
+
+# ${id}: Test ADR
+
+## Context
+
+Test context.
+
+## Decision
+
+Test decision.
+
+## Justification
+
+Test justification.
+
+## Consequences
+
+Test consequences.
+
+## Evolution
+
+Test evolution.
+
+## Acceptance criteria
+
+${acBlock}
+`;
+
 async function makeGitRepo(dir: string): Promise<void> {
   execFileSync("git", ["init"], { cwd: dir, timeout: 5000 });
   execFileSync("git", ["config", "user.email", "test@test.com"], { cwd: dir, timeout: 5000 });
@@ -295,6 +337,114 @@ describe("adr.implement.stamp", () => {
     expect(result.data?.violations.some((v) => v.rule === "ADR-IMP-05")).toBe(true);
   });
 
+  // ── ADR-IMP-02: acceptance criteria completeness (post-cutoff, mirrors AV-17) ──
+
+  it("rejects post-cutoff ADR with unchecked acceptance criteria", async () => {
+    await writeFile(
+      join(workspaceRoot, "docs", "adrs", "adr-0001-test.md"),
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-09-10",
+        "- [ ] AC-1: THE artifact SHALL exist (evidence: file: x.ts:1)\n- [x] AC-2: THE other SHALL pass (evidence: file: y.ts:2)",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("fail");
+    expect(result.data?.violations.some((v) => v.rule === "ADR-IMP-02")).toBe(true);
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("rejects post-cutoff ADR with checked criteria lacking evidence annotation", async () => {
+    await writeFile(
+      join(workspaceRoot, "docs", "adrs", "adr-0001-test.md"),
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-09-10",
+        "- [x] AC-1: THE artifact SHALL exist",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("fail");
+    expect(result.data?.violations.some((v) => v.rule === "ADR-IMP-02")).toBe(true);
+  });
+
+  it("stamps post-cutoff ADR when all criteria are checked with evidence", async () => {
+    const adrPath = join(workspaceRoot, "docs", "adrs", "adr-0001-test.md");
+    await writeFile(
+      adrPath,
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-09-10",
+        "- [x] AC-1: THE artifact SHALL exist (evidence: file: x.ts:1)\n- [x] AC-2: THE other SHALL pass (evidence: file: y.ts:2)",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.data?.criteriaChecked).toBe(2);
+
+    const afterContent = await readFile(adrPath, "utf-8");
+    expect(afterContent).toContain("status: implemented");
+  });
+
+  it("stamps pre-cutoff ADR with unchecked criteria (AV-17 exempt)", async () => {
+    await writeFile(
+      join(workspaceRoot, "docs", "adrs", "adr-0001-test.md"),
+      ADR_BODY_WITH_AC(
+        "ADR-0001",
+        "accepted",
+        "2026-08-01",
+        "- [ ] AC-1: THE artifact SHALL exist (evidence: file: x.ts:1)",
+      ),
+    );
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("pass");
+    expect(result.data?.data?.criteriaChecked).toBeUndefined();
+  });
+
+  it("stamps post-cutoff ADR without an acceptance criteria section", async () => {
+    const adrPath = join(workspaceRoot, "docs", "adrs", "adr-0001-test.md");
+    const body = ADR_BODY("ADR-0001", "accepted").replace(
+      "createdAt: 2026-08-01",
+      "createdAt: 2026-09-10",
+    );
+    await writeFile(adrPath, body);
+    const sha = await commitAll(workspaceRoot, "implement: ADR-0001 add feature");
+
+    const result = await runAdrImplementStamp(
+      makeInput("ADR-0001", sha),
+      makeContext(workspaceRoot),
+    );
+
+    expect(result.data?.status).toBe("pass");
+  });
+
   // ── Dry-run ──────────────────────────────────────────────────────────────────
 
   it("dry-run checks preconditions without mutating file", async () => {

package/src/tests/profile-schema.test.ts

@@ -157,7 +157,7 @@ test("artifacts with missing required extensions field fails", () => {
 
 test("all shipped profiles parse without changes", () => {
   const profiles = listStackProfiles(FORGE_ROOT);
-  expect(profiles.length).toBe(5);
+  expect(profiles.length).toBe(6);
   for (const profile of profiles) {
     expect(profile.id).toBeDefined();
     expect(profile.workspace.dirs.length).toBeGreaterThan(0);