@warpgogol/forge 5.1.2 → 5.2.0

package/skills/fo/fo-idea-i-just-want-to-see-the-result/SKILL.md

@@ -8,6 +8,7 @@ dependsOn: ['my-preferences']
 languagePolicy: ref(PREFERENCES.md)
 triggers: ["I just want to see the result", "run the full pipeline automatically", "implement this end-to-end without pauses"]
 ---
+
 <!--
 <MODULE_CONTRACT>
 <purpose>fo-idea-i-just-want-to-see-the-result skill — Orchestrate the full feature pipeline (idea, audit, enhance, plan, implement, review, fix) in one invocation. Accepts a raw idea or RFC/ADR id. Use when the operator wants the complete pipeline.</purpose>
@@ -19,10 +20,15 @@ triggers: ["I just want to see the result", "run the full pipeline automatically
   <item>RFC-1097: sweep — SKILL.md headers + classification fixes
 
 Sweep batch 1: add Compass v2 headers to 45 SKILL.md files (purpose derived from frontmatter description). Fix non-skill-markdown exclusion to check filename not workspace-relative path (packages/AGENTS.md escaped it). Add .coverage to ignoredDirs.</item>
+  <item>RFC-1140: step 5 — queue-mode section in orchestrator SKILL.md
+
+Add Queue mode section (pre-flight queue.validate, loop semantics, failure handling, manifest immutability) to fo-idea-i-just-want-to-see-the-result SKILL.md, sync .agents copy, add forgeQueueModule row to forge AGENTS.md.</item>
+  <item>RFC-1140: queue mode — materialize manifest at invocation from pasted doc list
+
+When the invocation carries >=2 RFC/ADR ids without a manifest path, the orchestrator builds docs/queues/session-<timestamp>.yaml from the pasted order, runs queue.validate, then processes queue mode. Unresolvable ids are named explicitly.</item>
 </CHANGE_SUMMARY>
 -->
 
-
 # Full Pipeline — Just Want to See the Result
 
 Before starting, read `PREFERENCES.md` at the repository root. If the file is missing or `aiLanguage` is unset, ask the operator once and create the file using the `my-preferences` skill semantics.
@@ -48,8 +54,47 @@ The operator may provide either:
 
 - **A raw idea** — natural-language description of a feature, change, or decision. The skill will invoke `fo-idea` as step 0 to create the RFC/ADR first.
 - **An existing RFC/ADR id** — e.g. `RFC-XXXX` or `ADR-XXXX`. The skill skips idea creation and starts the pipeline from the appropriate step.
+- **A queue manifest** — `--queue <path>` or a `docs/queues/*.yaml` path in the invocation text. The skill enters queue mode (see §Queue mode) and processes the manifest's `items[]` in order.
+- **A pasted document list** — >=2 `RFC-XXXX`/`ADR-XXXX` ids in the invocation text (e.g. another agent's ordered implementation plan). The skill materializes a session manifest (see §Queue mode → Manifest materialization) and enters queue mode.
 - **Nothing** — if neither is provided, check session context and IDE for a recently created document. If none found, ask the operator: "Какую идею реализуем? Опишите идею или укажите RFC-XXXX / ADR-XXXX."
 
+## Queue mode
+
+The orchestrator runs in **queue mode** when the invocation carries `--queue <path>`, a `docs/queues/*.yaml` path, OR a pasted document list (>=2 `RFC-XXXX`/`ADR-XXXX` ids — e.g. another agent's ordered implementation plan).
+
+**Manifest materialization (mandatory when no manifest path is given):** Build the manifest from the invocation text before anything else:
+
+1. Extract `RFC-\d{4}`/`ADR-\d{4}` tokens in order of appearance; dedupe preserving first-seen order. The pasted order IS the dependency order — preserve it even when the surrounding prose discusses a different grouping.
+2. Write `docs/queues/session-<YYYYMMDD>-<HHmm>.yaml`:
+
+   ```yaml
+   id: session-<YYYYMMDD>-<HHmm>
+   createdAt: <YYYY-MM-DD>
+   items:
+     - id: RFC-XXXX
+     - id: ADR-XXXX
+   ```
+
+   The `id` field MUST equal the filename stem (`queue.validate` enforces this). Leave the file uncommitted — it is a session artifact; the operator may commit it for cross-session durability.
+
+3. If the paste mixes ids with prose, ignore the prose — only the id sequence matters. Do not invent items that are not in the text.
+
+**Pre-flight (mandatory):** Run `pnpm exec werkstatt run queue.validate --file <manifest> --json`. If the command exits non-zero (schema errors, unknown ids, duplicates, id↔filename mismatch), do NOT start the batch — report the errors and stop. When a pasted list references ids that do not resolve (QUEUE-04), name them explicitly — the operator must create those documents first or fix the list.
+
+**Batch plan preview:** Emit the existing batch plan preview per `_shared/fo-pipeline-conventions.md` §Batch plan preview, listing items in manifest order.
+
+**Loop semantics:** Process `items[]` in manifest order with no pauses between items:
+
+1. **Skip terminal items** — items whose derived status is `implemented` or `skipped` (rejected/superseded frontmatter) are recorded in the batch summary and skipped.
+2. **Resume mid-pipeline items** — an `in-progress` item resumes at its derived `pipelineStep`, not from step 1.
+3. **Run the existing per-doc pipeline** — RFC items run audit → enhance → plan → implement; ADR items run implement only. All skill-internal interactions (grilling) stay inside the invoked skills.
+4. **Batch-item checkpoint** — after each item, emit the context checkpoint per `_shared/fo-pipeline-conventions.md` §Context checkpoint between batch items.
+5. **Clean-tree gate** — before starting the next item, verify the working tree has no uncommitted leftovers from the completed item; warn and stop if dirty.
+
+**Failure:** If an item fails after its error checkpoint, stop the batch. The report names the blocked item id and the remaining item count. `blocked` is in-session report language only — never persist it into frontmatter, manifests, or files. Resume = re-invoke with the same manifest; `queue.validate` derives where to continue.
+
+**Manifest immutability:** Do not edit `items[]` or the manifest during a queue run. Reordering requires stopping the batch and re-validating.
+
 ## Process
 
 ### 0. Idea creation (conditional)

package/src/onboarding/create.ts

@@ -94,6 +94,9 @@ function loadProfileDomainFields(profileId: string, forgeRoot: string): InitDoma
     if (profile.compass) {
       fields.compass = profile.compass;
     }
+    if (profile.nextSteps) {
+      fields.nextSteps = profile.nextSteps;
+    }
     return fields;
   } catch {
     return {};
@@ -384,9 +387,9 @@ export async function runCreate(
     }
   }
 
-  // 13. Write NEXT_STEPS.md (RFC-0550)
+  // 13. Write NEXT_STEPS.md (RFC-0550); RFC-1125: profile may override via nextSteps field
   const nextStepsPath = path.join(targetDir, "NEXT_STEPS.md");
-  const nextStepsContent = `# Next Steps
+  const nextStepsContent = initDomainFields.nextSteps ?? `# Next Steps
 
 Your Forge project is ready. The next step is mandatory: run \`/forge-bootstrap\` to configure your project interactively.
 

package/src/onboarding/doctor-token-check.test.ts

@@ -0,0 +1,124 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for the npm-token probe (RFC-1125, AC-2) — .npmrc parsing, token presence detection, and the fail-fast fixHint contract used by forge create and forge.doctor.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial npm-token probe tests (AC-2 evidence).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  checkNpmToken,
+  readNpmrcTokenStatus,
+  workshopNeedsWarpgogolToken,
+} from "./npm-token-check.ts";
+
+let tempDir: string;
+
+beforeEach(async () => {
+  tempDir = await mkdtemp(join(tmpdir(), "npm-token-check-"));
+});
+
+afterEach(async () => {
+  await rm(tempDir, { recursive: true, force: true });
+});
+
+const NPMRC_WITH_TOKEN = `@warpgogol:registry=https://registry.npmjs.org/
+//registry.npmjs.org/:_authToken=npm_real_token_123
+`;
+
+const NPMRC_PLACEHOLDER = `@warpgogol:registry=https://registry.npmjs.org/
+//registry.npmjs.org/:_authToken=YOUR_NPM_TOKEN
+`;
+
+const NPMRC_ENV_REF = `@warpgogol:registry=https://registry.npmjs.org/
+//registry.npmjs.org/:_authToken=\${NPM_TOKEN}
+`;
+
+// --- readNpmrcTokenStatus ---
+
+test("detects registry and literal token from .npmrc", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_WITH_TOKEN);
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.registry).toBe("https://registry.npmjs.org/");
+  expect(status.tokenPresent).toBe(true);
+});
+
+test("YOUR_NPM_TOKEN placeholder does not count as a token", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.tokenPresent).toBe(false);
+});
+
+test("NPM_TOKEN env satisfies the probe even with placeholder .npmrc", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  const status = readNpmrcTokenStatus(tempDir, { NPM_TOKEN: "npm_env_token" });
+  expect(status.tokenPresent).toBe(true);
+});
+
+test("${NPM_TOKEN} reference resolves against env", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_ENV_REF);
+  expect(readNpmrcTokenStatus(tempDir, { NPM_TOKEN: "x" }).tokenPresent).toBe(true);
+  expect(readNpmrcTokenStatus(tempDir, {}).tokenPresent).toBe(false);
+});
+
+test("missing .npmrc → no registry, no token", () => {
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.registry).toBeNull();
+  expect(status.tokenPresent).toBe(false);
+});
+
+test("detects _authToken when it is not the last line (scaffolded .npmrc shape)", async () => {
+  // Regression: scaffolded .npmrc appends dangerously-allow-all-builds and
+  // ignore-workspace-root-check AFTER the token line — the regex must match mid-file.
+  await writeFile(
+    join(tempDir, ".npmrc"),
+    `@warpgogol:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=npm_real_token\ndangerously-allow-all-builds=true\nignore-workspace-root-check=true\n`,
+  );
+  const status = readNpmrcTokenStatus(tempDir, {});
+  expect(status.tokenPresent).toBe(true);
+});
+
+// --- workshopNeedsWarpgogolToken ---
+
+test("needs token when .npmrc declares @warpgogol scope", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  expect(workshopNeedsWarpgogolToken(tempDir, [])).toBe(true);
+});
+
+test("needs token when install pulls @warpgogol packages", () => {
+  expect(workshopNeedsWarpgogolToken(tempDir, ["pnpm add -wD @warpgogol/forge"])).toBe(true);
+});
+
+test("skips probe when no @warpgogol usage", () => {
+  expect(workshopNeedsWarpgogolToken(tempDir, ["pnpm add -wD prettier"])).toBe(false);
+});
+
+// --- checkNpmToken ---
+
+test("canFetch=true → fixHint is null", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_WITH_TOKEN);
+  const result = await checkNpmToken(tempDir, { fetchVersion: () => true, env: {} });
+  expect(result.canFetch).toBe(true);
+  expect(result.fixHint).toBeNull();
+});
+
+test("canFetch=false with token → fixHint mentions expiry/revocation", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_WITH_TOKEN);
+  const result = await checkNpmToken(tempDir, { fetchVersion: () => false, env: {} });
+  expect(result.canFetch).toBe(false);
+  expect(result.fixHint).toContain("expired or revoked");
+});
+
+test("canFetch=false without token → fixHint names NPM_TOKEN and .npmrc", async () => {
+  await writeFile(join(tempDir, ".npmrc"), NPMRC_PLACEHOLDER);
+  const result = await checkNpmToken(tempDir, { fetchVersion: () => false, env: {} });
+  expect(result.canFetch).toBe(false);
+  // AC-2: the fixHint must be actionable — name the exact remediation path
+  expect(result.fixHint).toContain("NPM_TOKEN");
+  expect(result.fixHint).toContain(".npmrc");
+});

package/src/onboarding/doctor.ts

@@ -49,6 +49,7 @@ import type { DuplicatePair } from "../knowledge/index.ts";
 import { checkMemoryLayerHealth } from "./memory-scaffold.ts";
 import { checkInvariants } from "./invariant-engine.ts";
 import type { InvariantViolation } from "./invariant-engine.ts";
+import { checkNpmToken, workshopNeedsWarpgogolToken } from "./npm-token-check.ts";
 import { execSync } from "node:child_process";
 import fs from "node:fs";
 import type { ProfilePrerequisite } from "../profiles/profile-schema.ts";
@@ -1272,6 +1273,22 @@ export async function runDoctor(
       : "docs/adrs/ directory not found — run 'forge create' to create ADR directory",
   });
 
+  // RFC-1125: re-verify the @warpgogol npm token post-install when the workshop
+  // uses the private scope (.npmrc declares it or package.json has @warpgogol deps)
+  const pkgJsonPath = join(workspaceRoot, "package.json");
+  const pkgHasWarpgogol =
+    fs.existsSync(pkgJsonPath) && fs.readFileSync(pkgJsonPath, "utf8").includes("@warpgogol/");
+  if (workshopNeedsWarpgogolToken(workspaceRoot, []) || pkgHasWarpgogol) {
+    const tokenCheck = await checkNpmToken(workspaceRoot);
+    checks.push({
+      name: "npm-token (@warpgogol)",
+      status: tokenCheck.canFetch ? "pass" : "fail",
+      message: tokenCheck.canFetch
+        ? `npm token fetches @warpgogol/werkstatt-engine (${tokenCheck.registry ?? "default registry"})`
+        : tokenCheck.fixHint!,
+    });
+  }
+
   // Check git branch is 'main' (not 'master')
   checks.push(checkGitBranch(workspaceRoot));
 

package/src/onboarding/init.ts

@@ -49,6 +49,7 @@ export interface InitDomainFields {
   terminology?: Record<string, string>;
   semanticBindings?: Record<string, string | null>;
   profileId?: string;
+  nextSteps?: string;
   compass?: {
     fileExtensions?: string[];
     testPatterns?: string[];

package/src/onboarding/npm-token-check.ts

@@ -0,0 +1,140 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Non-interactive npm-token probe for the private @warpgogol registry scope (RFC-1125) — parses .npmrc for the @warpgogol scope registry and auth token presence, probes the registry via `npm view @warpgogol/werkstatt-engine version` (injectable for tests) before pnpm install runs in forge create, re-verifies post-install in forge.doctor, and returns a structured NpmTokenCheck with an actionable fixHint on failure.</purpose>
+<non-goals>
+  <item>Do not prompt the operator — the probe is non-interactive (create.ts forbids prompts).</item>
+  <item>Do not accept tokens via CLI flags — tokens must not appear in argv/history.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial npm-token probe — checkNpmToken + readNpmrcTokenStatus, wired into scaffold-project (pre-install fail-fast) and doctor (post-install re-verify).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+/** Result of the npm-token probe (RFC-1125). */
+export interface NpmTokenCheck {
+  /** Registry URL from `.npmrc` `@warpgogol:registry=` (null when undeclared). */
+  registry: string | null;
+  /** A usable token is configured — NPM_TOKEN env or a real _authToken value. */
+  tokenPresent: boolean;
+  /** `npm view @warpgogol/werkstatt-engine version` succeeded from workspaceRoot. */
+  canFetch: boolean;
+  /** Actionable remediation when canFetch is false; null on success. */
+  fixHint: string | null;
+}
+
+/** Injectable dependencies for testing. */
+export interface NpmTokenProbeDeps {
+  /** Override the registry probe — return true when the fetch succeeds. */
+  fetchVersion?: (cwd: string) => boolean;
+  /** Override the environment (defaults to process.env). */
+  env?: Record<string, string | undefined>;
+}
+
+const WARPGOGOL_SCOPE = "@warpgogol";
+const PROBE_PACKAGE = "@warpgogol/werkstatt-engine";
+const PROBE_TIMEOUT_MS = 15_000;
+const PLACEHOLDER_TOKENS = new Set(["YOUR_NPM_TOKEN", ""]);
+
+/**
+ * Parse the workspace `.npmrc` for the @warpgogol scope: registry URL and
+ * whether a usable auth token is configured. A token counts as present when
+ * NPM_TOKEN is set in the env, or when `_authToken` holds a real value
+ * (not the YOUR_NPM_TOKEN placeholder, not an unset ${VAR} reference).
+ */
+export function readNpmrcTokenStatus(
+  workspaceRoot: string,
+  env: Record<string, string | undefined> = process.env,
+): { registry: string | null; tokenPresent: boolean } {
+  const npmrcPath = path.join(workspaceRoot, ".npmrc");
+  const npmrc = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, "utf8") : "";
+
+  const registryMatch = npmrc.match(/^@warpgogol:registry=(\S+)\s*$/m);
+  const registry = registryMatch?.[1] ?? null;
+
+  // Token sources, in precedence order:
+  // 1. NPM_TOKEN env (agent-driven installs; also satisfies ${NPM_TOKEN} refs)
+  if (env.NPM_TOKEN && env.NPM_TOKEN.trim().length > 0) {
+    return { registry, tokenPresent: true };
+  }
+
+  // 2. Literal _authToken in .npmrc for the scope's registry host.
+  // `m` flag required — the token line is never last in a scaffolded .npmrc
+  // (dangerously-allow-all-builds + appended ignore-workspace-root-check follow it).
+  const tokenMatch = npmrc.match(/_authToken=(\S+)[ \t]*$/m);
+  if (tokenMatch) {
+    const value = tokenMatch[1];
+    // ${VAR} references resolve at install time — count as present only when set
+    const varRef = value.match(/^\$\{(\w+)\}$/);
+    if (varRef) {
+      const envValue = env[varRef[1]];
+      return { registry, tokenPresent: !!envValue && envValue.trim().length > 0 };
+    }
+    return { registry, tokenPresent: !PLACEHOLDER_TOKENS.has(value) };
+  }
+
+  return { registry, tokenPresent: false };
+}
+
+/**
+ * Whether the workspace needs the @warpgogol token at all — true when `.npmrc`
+ * declares the scope or any install command pulls `@warpgogol/` packages.
+ * Profiles without @warpgogol deps skip the probe entirely.
+ */
+export function workshopNeedsWarpgogolToken(workspaceRoot: string, installCmds: string[]): boolean {
+  const npmrcPath = path.join(workspaceRoot, ".npmrc");
+  if (fs.existsSync(npmrcPath)) {
+    const npmrc = fs.readFileSync(npmrcPath, "utf8");
+    if (npmrc.includes(`${WARPGOGOL_SCOPE}:registry`) || npmrc.includes(`${WARPGOGOL_SCOPE}/`)) {
+      return true;
+    }
+  }
+  return installCmds.some((cmd) => cmd.includes(`${WARPGOGOL_SCOPE}/`));
+}
+
+function defaultFetchVersion(cwd: string): boolean {
+  try {
+    execSync(`npm view ${PROBE_PACKAGE} version`, {
+      cwd,
+      stdio: "pipe",
+      timeout: PROBE_TIMEOUT_MS,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function buildFixHint(tokenPresent: boolean): string {
+  const base =
+    `npm token for the @warpgogol scope cannot fetch ${PROBE_PACKAGE}. ` +
+    `Set NPM_TOKEN env or replace YOUR_NPM_TOKEN in .npmrc with a valid npm read token ` +
+    `(issued at workshop provisioning — see NEXT_STEPS.md §Token lifecycle).`;
+  return tokenPresent
+    ? `${base} A token is configured but was rejected — it may be expired or revoked; request a fresh one.`
+    : base;
+}
+
+/**
+ * Run the npm-token probe: parse `.npmrc`, then verify the registry actually
+ * serves the package. Non-interactive — never prompts, never reads argv.
+ */
+export async function checkNpmToken(
+  workspaceRoot: string,
+  deps: NpmTokenProbeDeps = {},
+): Promise<NpmTokenCheck> {
+  const env = deps.env ?? process.env;
+  const fetchVersion = deps.fetchVersion ?? defaultFetchVersion;
+  const { registry, tokenPresent } = readNpmrcTokenStatus(workspaceRoot, env);
+  const canFetch = fetchVersion(workspaceRoot);
+  return {
+    registry,
+    tokenPresent,
+    canFetch,
+    fixHint: canFetch ? null : buildFixHint(tokenPresent),
+  };
+}

package/src/onboarding/scaffold-project.ts

@@ -22,6 +22,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { execSync } from "node:child_process";
 import { listStackProfiles, type StackProfile } from "../profiles/stack-profile.ts";
+import { checkNpmToken, workshopNeedsWarpgogolToken } from "./npm-token-check.ts";
 import { resolveForgeRoot } from "../config/forge-config.ts";
 import type {
   ForgeCommandInput,
@@ -166,6 +167,16 @@ export async function runScaffoldProject(
     }
   }
 
+  // RFC-1125: non-interactive npm-token probe — fail fast before pnpm install when
+  // the @warpgogol scope is needed but the token cannot fetch @warpgogol/werkstatt-engine.
+  // Runs after .npmrc is materialized so the probe sees the final token state.
+  if (profile.install.length > 0 && workshopNeedsWarpgogolToken(workspaceRoot, profile.install)) {
+    const tokenCheck = await checkNpmToken(workspaceRoot);
+    if (!tokenCheck.canFetch) {
+      return fail("forge.scaffold", profileId, tokenCheck.fixHint!, errors, outputFormat, logger);
+    }
+  }
+
   // Run ALL install commands AFTER all files are created (atomicity: no partial state if install fails)
   // Root workspace install commands
   if (outputFormat === "pretty" && profile.install.length > 0) {

package/src/onboarding/site-workshop-profile.test.ts

@@ -0,0 +1,84 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Unit tests for the site-workshop stack profile (RFC-1125) — verifies the profile parses, scaffolds the workshop contract, and never scaffolds systems-cache inside the workshop root.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1125: initial site-workshop profile tests (AC-1 evidence).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { test, expect } from "vitest";
+import { join } from "node:path";
+import { listStackProfiles } from "../profiles/stack-profile.ts";
+
+// Resolve forge root from this test file's location
+const FORGE_ROOT = join(import.meta.dirname, "..", "..");
+
+function loadSiteWorkshop() {
+  const profiles = listStackProfiles(FORGE_ROOT);
+  const profile = profiles.find((p) => p.id === "site-workshop");
+  expect(profile, "site-workshop profile must exist in packages/forge/profiles/").toBeDefined();
+  return profile!;
+}
+
+test("site-workshop profile parses and is discoverable", () => {
+  const profile = loadSiteWorkshop();
+  expect(profile.schema).toBe("forge/stack-profile@1");
+  expect(profile.displayName).toBeTruthy();
+});
+
+test("scaffolds kernel wiring, missions/, and governance dirs — but never systems-cache", () => {
+  const profile = loadSiteWorkshop();
+  const dirs = profile.workspace.dirs;
+  const filePaths = profile.workspace.files.map((f) => f.path);
+
+  // AC-1: kernel wiring + missions + governance dirs present
+  expect(dirs).toContain("missions");
+  expect(dirs).toContain("docs");
+  expect(dirs).toContain("tools");
+  expect(filePaths).toContain("tools/kernel.config.ts");
+  expect(filePaths).toContain("missions/.gitkeep");
+
+  // AC-1: systems-cache is a sibling (../systems-cache), never scaffolded inside root
+  expect(
+    dirs,
+    "systems-cache must not be a scaffolded dir — sibling convention per RFC-1125",
+  ).not.toContain("systems-cache");
+  expect(
+    filePaths.some((p) => p.startsWith("systems-cache")),
+    "no systems-cache files may be scaffolded — created by sternsystem.register on demand",
+  ).toBe(false);
+});
+
+test("scaffolded kernel.config.ts consumes the single-sourced WorkshopModuleMap", () => {
+  const profile = loadSiteWorkshop();
+  const kernelConfig = profile.workspace.files.find((f) => f.path === "tools/kernel.config.ts");
+  expect(kernelConfig, "profile must scaffold tools/kernel.config.ts").toBeDefined();
+  // AC-5: the scaffolded config spreads workshopModuleLoaders() — no hand-copied loader list
+  expect(kernelConfig!.content).toContain("workshopModuleLoaders");
+  expect(kernelConfig!.content).toContain("@warpgogol/werkstatt-engine/kernel/module-map");
+  expect(
+    kernelConfig!.content,
+    "kernel.config.ts must not embed per-module loader thunks — they live in WORKSHOP_MODULE_MAP",
+  ).not.toContain("createMissionModule");
+});
+
+test("install set includes engine, site plugin, and forge", () => {
+  const profile = loadSiteWorkshop();
+  const install = profile.install.join(" ");
+  expect(install).toContain("@warpgogol/werkstatt-engine");
+  expect(install).toContain("@warpgogol/werkstatt-site");
+  expect(install).toContain("@warpgogol/forge");
+});
+
+test("ships .npmrc token template and site-workshop nextSteps guidance", () => {
+  const profile = loadSiteWorkshop();
+  const npmrc = profile.workspace.files.find((f) => f.path === ".npmrc");
+  expect(npmrc, "profile must scaffold .npmrc for the private @warpgogol scope").toBeDefined();
+  expect(npmrc!.content).toContain("@warpgogol:registry");
+
+  // RFC-1125: token lifecycle + identity.bootstrap guidance lives in NEXT_STEPS.md
+  expect(profile.nextSteps, "profile must provide nextSteps for token/identity onboarding").toBeTruthy();
+  expect(profile.nextSteps).toContain("NPM_TOKEN");
+  expect(profile.nextSteps).toContain("identity.bootstrap");
+});