@warpgogol/forge 5.2.0 → 5.2.3

package/os/compass/handlers/tests/compass-ledger-scope.test.ts

@@ -0,0 +1,124 @@
+/*
+<MODULE_CONTRACT>
+  <purpose>
+    RFC-1139 AC-5: compass.audit.baseline must not seed ledger entries for
+    paths under missions/ or gitignored roots — the tracked ledger only
+    accumulates entries for paths that can be audited long-term.
+  </purpose>
+</MODULE_CONTRACT>
+*/
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, mkdir, writeFile, rm, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { parse as yamlParse } from "yaml";
+import { runCompassAuditBaseline } from "../compass-audit-handler.ts";
+import type { ForgeCommandInput, ForgeRuntimeContext } from "../../../../src/types.ts";
+
+const execFileAsync = promisify(execFile);
+
+const logger = {
+  section() {},
+  info() {},
+  warn() {},
+  error() {},
+  success() {},
+  getEvents() {
+    return [];
+  },
+};
+
+function makeContext(workspaceRoot: string): ForgeRuntimeContext {
+  return {
+    workspaceRoot,
+    site: undefined,
+    siteExplicit: false,
+    logger: logger as never,
+    dryRun: false,
+    outputFormat: "json",
+    io: {} as never,
+    actualState: undefined as never,
+    fileIntents: [],
+  } as unknown as ForgeRuntimeContext;
+}
+
+function makeInput(flags: Record<string, unknown> = {}): ForgeCommandInput {
+  return { argv: [], flags } as unknown as ForgeCommandInput;
+}
+
+interface LedgerEntry {
+  path: string;
+}
+
+describe("compass.audit.baseline — RFC-1139 ledger scope", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), "compass-ledger-"));
+    // Authored source file (plain .ts, no generated marker → authored entry)
+    await mkdir(join(root, "packages", "foo"), { recursive: true });
+    await writeFile(join(root, "packages", "foo", "index.ts"), "export const x = 1;\n", "utf8");
+    // Mission workpiece file — would be authored but must be excluded
+    await mkdir(join(root, "missions", "acme-m000001", "workpiece", "src"), {
+      recursive: true,
+    });
+    await writeFile(
+      join(root, "missions", "acme-m000001", "workpiece", "src", "local.ts"),
+      "export const y = 2;\n",
+      "utf8",
+    );
+    // Gitignored generated dir — excluded via check-ignore
+    await mkdir(join(root, "dist"), { recursive: true });
+    await writeFile(join(root, "dist", "bundle.ts"), "export const z = 3;\n", "utf8");
+    await writeFile(join(root, ".gitignore"), "dist/\nmissions/\n", "utf8");
+    // Git repo for getRevisionByPath + check-ignore
+    await execFileAsync("git", ["init"], { cwd: root });
+    await execFileAsync("git", ["config", "user.email", "test@test.com"], { cwd: root });
+    await execFileAsync("git", ["config", "user.name", "Test"], { cwd: root });
+    await execFileAsync("git", ["add", "."], { cwd: root });
+    await execFileAsync("git", ["commit", "-m", "init"], { cwd: root });
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("AC-5: baseline seeds no missions/ or gitignored ledger entries", async () => {
+    const result = await runCompassAuditBaseline(makeInput(), makeContext(root));
+    expect(result.exitCode).toBe(0);
+
+    const ledgerRaw = await readFile(
+      join(root, "docs", "compass-audit-ledger.generated.yaml"),
+      "utf8",
+    );
+    const ledger = yamlParse(ledgerRaw) as { entries: LedgerEntry[] };
+    const paths = ledger.entries.map((e) => e.path);
+
+    expect(paths.some((p) => p.startsWith("missions/"))).toBe(false);
+    expect(paths.some((p) => p.startsWith("dist/"))).toBe(false);
+    expect(paths).toContain("packages/foo/index.ts");
+  });
+
+  it("AC-5: pre-existing missions/ entries are pruned on next baseline", async () => {
+    // Seed a ledger with a stale missions/ entry
+    await mkdir(join(root, "docs"), { recursive: true });
+    await writeFile(
+      join(root, "docs", "compass-audit-ledger.generated.yaml"),
+      `entries:\n  - path: missions/acme-m000001/workpiece/src/local.ts\n    entityId: ""\n    auditedRevision: abc\n    auditedHash: def\n    auditedAt: "2026-01-01T00:00:00Z"\n    verdict: baseline\n    agent: system:baseline\n`,
+      "utf8",
+    );
+
+    const result = await runCompassAuditBaseline(makeInput(), makeContext(root));
+    expect(result.exitCode).toBe(0);
+
+    const ledgerRaw = await readFile(
+      join(root, "docs", "compass-audit-ledger.generated.yaml"),
+      "utf8",
+    );
+    const ledger = yamlParse(ledgerRaw) as { entries: LedgerEntry[] };
+    expect(ledger.entries.some((e) => e.path.startsWith("missions/"))).toBe(false);
+  });
+});

package/os/core/core.module.ts

@@ -305,7 +305,7 @@ export async function createForgeCoreModule(): Promise<ForgeModule> {
       {
         name: "forge.scaffold",
         description:
-          "Create a working pnpm + Turborepo monorepo from a stack profile in an empty directory.",
+          "Create a working pnpm + Turborepo monorepo from a stack profile in an empty directory. Required flags: `--profile`, `--name`.",
         scope: "workspace",
         supportsAllSites: false,
         flags: {

package/os/mission/handlers/archive.test.ts

@@ -572,4 +572,53 @@ describe("mission.archive", () => {
     expect(data.skipped).toHaveLength(1);
     expect(data.skipped[0].reason).toContain("use --clean-orphans");
   });
+
+  test("RFC-1138 AC-2: git add -A skipped when archive target is gitignored", async () => {
+    execSyncMock.mockReset();
+    execSyncMock.mockImplementation((cmd: string) => {
+      if (cmd.startsWith("pnpm install")) return "";
+      if (cmd.startsWith("git status --porcelain pnpm-lock.yaml")) return "M pnpm-lock.yaml";
+      // git check-ignore exits 0 → path is ignored (missions/ is gitignored)
+      if (cmd.startsWith("git check-ignore")) return "";
+      return "";
+    });
+    await writeMissionManifest(missionsDir, "test-r1138-01", "closed");
+
+    await runMissionArchive(makeInput(), makeContext(tmpDir));
+
+    const checkIgnoreCall = execSyncMock.mock.calls.find(
+      (c) => typeof c[0] === "string" && c[0].startsWith("git check-ignore"),
+    );
+    expect(checkIgnoreCall).toBeDefined();
+
+    const addArchiveCall = execSyncMock.mock.calls.find(
+      (c) => typeof c[0] === "string" && c[0].startsWith("git add -A"),
+    );
+    expect(addArchiveCall).toBeUndefined();
+
+    // Lockfile itself is still staged + committed
+    const lockfileAdd = execSyncMock.mock.calls.find(
+      (c) => typeof c[0] === "string" && c[0] === "git add pnpm-lock.yaml",
+    );
+    expect(lockfileAdd).toBeDefined();
+  });
+
+  test("RFC-1138 AC-2: git add -A still runs when archive target is NOT gitignored", async () => {
+    execSyncMock.mockReset();
+    execSyncMock.mockImplementation((cmd: string) => {
+      if (cmd.startsWith("pnpm install")) return "";
+      if (cmd.startsWith("git status --porcelain pnpm-lock.yaml")) return "M pnpm-lock.yaml";
+      // git check-ignore exits 1 → not ignored → execSync throws
+      if (cmd.startsWith("git check-ignore")) throw new Error("exit 1");
+      return "";
+    });
+    await writeMissionManifest(missionsDir, "test-r1138-02", "closed");
+
+    await runMissionArchive(makeInput(), makeContext(tmpDir));
+
+    const addArchiveCall = execSyncMock.mock.calls.find(
+      (c) => typeof c[0] === "string" && c[0].startsWith("git add -A"),
+    );
+    expect(addArchiveCall).toBeDefined();
+  });
 });

package/os/mission/handlers/archive.ts

@@ -13,7 +13,6 @@ archive subdirectories back to missions/.
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>RFC-0733: add pinned-files pre-check — skip pinned mission directories with warning instead of moving them.</item>
   <item>RFC-0804: auto-refresh pnpm-lock.yaml after directory moves.</item>
   <item>RFC-0982: fallback state detection for orphaned workpiece dirs (no mission.yaml) via .closed marker and cache-only heuristic; --clean-orphans flag; improved skip reasons.</item>
   <item>RFC-1097: step 6 — compass.migrate codemod run
@@ -22,7 +21,8 @@ Mechanical v1 to v2 header migration across the workspace: 942 files rewritten
   <item>RFC-1097: sweep — packages/forge + services clean
 
 Sweep batch 2: real KEY_DECISIONS on 10 files, expanded purposes (CONTRACT-02/PURPOSE-02), headers on mission/index + gen-upstreams, sanitizeItemText in summary.record (literal Compass tags corrupted history), excludedPaths for wrangler types, test-fixtures testPattern. forge+services now 0 diagnostics under --mode error.</item>
-  <history>RFC-0573, RFC-0801</history>
+  <item>RFC-1138: pipeline hygiene — module-scoped exempt entries, archive gitignore guard, dns upsert to deploy phases, promote auto-sync, rfc.create claim protocol, siteHasRuntime filter</item>
+  <history>RFC-0573, RFC-0733, RFC-0801</history>
 </CHANGE_SUMMARY>
 */
 
@@ -520,10 +520,25 @@ export async function runMissionArchive(
           stdio: ["pipe", "pipe", "pipe"],
         });
         for (const m of moved) {
-          execSync(`git add -A ${JSON.stringify(m.to)}`, {
-            cwd: workspaceRoot,
-            stdio: ["pipe", "pipe", "pipe"],
-          });
+          // RFC-1138: missions/ is gitignored — `git add` on the archive path is
+          // structurally guaranteed to fail. Skip staging when the target is
+          // ignored (git check-ignore exits 0 = ignored, 1 = not ignored).
+          let targetIgnored = false;
+          try {
+            execSync(`git check-ignore -q ${JSON.stringify(m.to)}`, {
+              cwd: workspaceRoot,
+              stdio: ["pipe", "pipe", "pipe"],
+            });
+            targetIgnored = true;
+          } catch {
+            targetIgnored = false;
+          }
+          if (!targetIgnored) {
+            execSync(`git add -A ${JSON.stringify(m.to)}`, {
+              cwd: workspaceRoot,
+              stdio: ["pipe", "pipe", "pipe"],
+            });
+          }
           if (existsSync(m.from)) continue;
           execSync(`git rm -r --cached --ignore-unmatch ${JSON.stringify(m.from)}`, {
             cwd: workspaceRoot,

package/os/program/lease.ts

@@ -38,7 +38,7 @@ export function leasePath(workspaceRoot: string, program: string, packetId: stri
  * Generate a random opaque lease token (32 bytes hex).
  */
 export function generateLeaseToken(): string {
-  return randomBytes(32).toString("hex");
+  return Array.from(randomBytes(32), (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
 /**

package/os/queue/queue.module.ts

@@ -31,7 +31,7 @@ export async function createForgeQueueModule(): Promise<ForgeModule> {
         description:
           "Validate a queue manifest (docs/queues/*.yaml) and report derived " +
           "per-item pipeline status plus the next actionable item. Read-only — " +
-          "the pipeline orchestrator runs this before starting a queued batch (RFC-1140).",
+          "the pipeline orchestrator runs this before starting a queued batch (RFC-1140). Required flags: `--file`.",
         scope: "workspace",
         contract: "queue",
         rules: ["QUEUE-01", "QUEUE-02", "QUEUE-03", "QUEUE-04", "QUEUE-05", "QUEUE-06"],

package/os/rfc/handlers/list-create.ts

@@ -6,13 +6,16 @@
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>RFC-0303: extracted list and create handlers from handlers.ts into handlers/list-create.ts.</item>
   <item>RFC-1097: step 6 — compass.migrate codemod run
 
 Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
   <item>RFC-1097: sweep — werkstatt-engine clean
 
 Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
+  <item>RFC-1138: pipeline hygiene — module-scoped exempt entries, archive gitignore guard, dns upsert to deploy phases, promote auto-sync, rfc.create claim protocol, siteHasRuntime filter</item>
+  <item>RFC-1139: CLI hint accuracy and agent-safety hygiene — rfc.create hint, EC-14-PARTIAL, amend delegation, ledger scope, sync footer, mission.open remnants</item>
+  <item>RFC-1139: second hint fix (rfc.list empty-state) + read-only test fix</item>
+  <history>RFC-0303</history>
 </CHANGE_SUMMARY>
 */
 
@@ -140,7 +143,7 @@ export async function runRfcList(
       entries.length === 0
         ? [
             {
-              action: `Create a new RFC: pnpm exec forge run rfc.create --title "..."`,
+              action: `Create a new RFC: pnpm exec werkstatt run rfc.create --title "..."`,
               kind: "optional",
             },
           ]
@@ -184,21 +187,6 @@ export async function runRfcCreate(
   }
   await assertSatisfiesIdsExist(workspaceRoot, satisfies);
 
-  const files = await listRfcFiles(rfcDirPath);
-  let maxId = 0;
-  for (const f of files) {
-    const basename = path.basename(f);
-    const match = basename.match(/^rfc-(\d{4})/);
-    if (match) {
-      const num = parseInt(match[1]!, 10);
-      if (num > maxId) maxId = num;
-    }
-  }
-  const nextNum = maxId + 1;
-  const paddedNum = String(nextNum).padStart(4, "0");
-  const nextSlug = `rfc-${paddedNum}`;
-  const nextId = `RFC-${paddedNum}`;
-
   const templatePath = resolveRfcTemplate(workspaceRoot);
   let templateContent: string;
   try {
@@ -208,7 +196,6 @@ export async function runRfcCreate(
   }
 
   const kebabTitle = toKebabCase(title);
-  const fileName = `${nextSlug}-${kebabTitle}.md`;
 
   // RFC-0329: consult decision log before scaffolding
   let consultedDecisions: ConsultedDecision[] = [];
@@ -230,25 +217,86 @@ export async function runRfcCreate(
     }
   }
 
-  let content = templateContent;
-  content = content.replace(/^id: RFC-0000$/m, `id: ${nextId}`);
-  content = content.replace(/^title: ".*"$/m, `title: "${title}"`);
-  content = content.replace(/^kind: \w+$/m, `kind: ${kind}`);
-  content = content.replace(/^scope: \w+$/m, `scope: ${scope}`);
-  content = content.replace(/^createdAt: YYYY-MM-DD$/m, `createdAt: ${today}`);
-  content = content.replace(/^updatedAt: YYYY-MM-DD$/m, `updatedAt: ${today}`);
-  if (satisfies.length > 0) {
-    content = content.replace(
-      /^satisfies: \[\]$/m,
-      `satisfies:\n${satisfies.map((id) => `  - ${id}`).join("\n")}`,
-    );
+  // RFC-1138: atomic id allocation — scan → claim the id via wx on a
+  // title-independent `rfc-NNNN.claim` file → write the real file → release.
+  // The claim must be on the id, not the filename: two creates with different
+  // titles produce different filenames, so a wx write on the target path can
+  // never collide. `.claim` files are invisible to listRfcFiles (.md-only),
+  // so they don't pollute rfc.list or the maxId scan. Stale claims (crashed
+  // create) are reclaimed after CLAIM_STALE_MS.
+  const MAX_CREATE_ATTEMPTS = 10;
+  const CLAIM_STALE_MS = 30_000;
+  let nextId = "";
+  let relativeFile = "";
+  let allocated = false;
+
+  const files = await listRfcFiles(rfcDirPath);
+  let maxId = 0;
+  for (const f of files) {
+    const basename = path.basename(f);
+    const match = basename.match(/^rfc-(\d{4})/);
+    if (match) {
+      const num = parseInt(match[1]!, 10);
+      if (num > maxId) maxId = num;
+    }
   }
-  content = content.replace(/^# RFC-0000: .+$/m, `# ${nextId}: ${title}`);
+  let candidate = maxId + 1;
+
+  for (let attempt = 1; attempt <= MAX_CREATE_ATTEMPTS; attempt++) {
+    const paddedNum = String(candidate).padStart(4, "0");
+    const nextSlug = `rfc-${paddedNum}`;
+    nextId = `RFC-${paddedNum}`;
+    const fileName = `${nextSlug}-${kebabTitle}.md`;
+    const claimPath = path.join(rfcDirPath, `${nextSlug}.claim`);
+
+    try {
+      await fs.writeFile(claimPath, `${process.pid}\n`, { flag: "wx" });
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code === "EEXIST") {
+        // Stale claim (crashed create) → reclaim and retry the same id.
+        // Live claim → another create holds this id — move to the next.
+        const st = await fs.stat(claimPath).catch(() => null);
+        if (st && Date.now() - st.mtimeMs > CLAIM_STALE_MS) {
+          await fs.rm(claimPath, { force: true });
+        } else {
+          candidate++;
+        }
+        continue;
+      }
+      throw err;
+    }
 
-  const targetPath = path.join(rfcDirPath, fileName);
-  await fs.writeFile(targetPath, content, "utf-8");
+    try {
+      let content = templateContent;
+      content = content.replace(/^id: RFC-0000$/m, `id: ${nextId}`);
+      content = content.replace(/^title: ".*"$/m, `title: "${title}"`);
+      content = content.replace(/^kind: \w+$/m, `kind: ${kind}`);
+      content = content.replace(/^scope: \w+$/m, `scope: ${scope}`);
+      content = content.replace(/^createdAt: YYYY-MM-DD$/m, `createdAt: ${today}`);
+      content = content.replace(/^updatedAt: YYYY-MM-DD$/m, `updatedAt: ${today}`);
+      if (satisfies.length > 0) {
+        content = content.replace(
+          /^satisfies: \[\]$/m,
+          `satisfies:\n${satisfies.map((id) => `  - ${id}`).join("\n")}`,
+        );
+      }
+      content = content.replace(/^# RFC-0000: .+$/m, `# ${nextId}: ${title}`);
+
+      const targetPath = path.join(rfcDirPath, fileName);
+      await fs.writeFile(targetPath, content, { flag: "wx" });
+      relativeFile = path.join(RFC_DIR, fileName);
+      allocated = true;
+    } finally {
+      await fs.rm(claimPath, { force: true });
+    }
+    if (allocated) break;
+  }
 
-  const relativeFile = path.join(RFC_DIR, fileName);
+  if (!allocated) {
+    throw new Error(
+      `rfc.create: id allocation failed after ${MAX_CREATE_ATTEMPTS} attempts — concurrent creates keep claiming the next id`,
+    );
+  }
 
   if (outputFormat === "pretty") {
     logger.success(`Created ${nextId}: ${title}`);
@@ -269,7 +317,7 @@ export async function runRfcCreate(
     summary: `Created ${nextId}: ${title}`,
     nextSteps: [
       {
-        action: `Validate the RFC: pnpm exec forge run rfc.validate --file ${relativeFile}`,
+        action: `Validate the RFC: pnpm exec werkstatt run rfc.validate --id ${nextId}`,
         kind: "optional",
       },
     ],

package/os/rfc/handlers/validate-rules.test.ts

@@ -385,6 +385,56 @@ describe("V-32: implementation commit drift detection", () => {
     }
   });
 
+  test("no V-32 or V-17 when implemented RFC is later superseded", async () => {
+    const dir = createGitRepoWithCommits([
+      { message: "implement: RFC-9999 — step 1", date: "2026-01-02T10:00:00" },
+    ]);
+    try {
+      const parsed = makeParsed("superseded", BASE_BODY, {
+        supersededBy: "RFC-0001",
+      });
+      const { add, violations } = makeViolationsCollector();
+      const allParsed = new Map([
+        [
+          "RFC-0001",
+          {
+            fileName: "rfc-0001-other.md",
+            parsed: makeParsed("accepted", BASE_BODY, { supersedes: ["RFC-9999"] }),
+          },
+        ],
+      ]);
+      await validateSingleRfc(
+        "rfc-9999-test.md",
+        parsed,
+        allParsed,
+        new Map(),
+        new Set(),
+        new Set(),
+        new Set(Object.keys(parsed.frontmatter)),
+        dir,
+        add,
+      );
+      expect(filterRule(violations, "V-32")).toHaveLength(0);
+      expect(filterRule(violations, "V-17")).toHaveLength(0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("no V-32 when status is rejected", async () => {
+    const dir = createGitRepoWithCommits([
+      { message: "implement: RFC-9999 — step 1", date: "2026-01-02T10:00:00" },
+    ]);
+    try {
+      const parsed = makeParsed("rejected", BASE_BODY);
+      const violations = await runValidateInDir(parsed, dir);
+      const v32 = filterRule(violations, "V-32");
+      expect(v32).toHaveLength(0);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("no V-32 when no implement: commits exist", async () => {
     const dir = createGitRepoWithCommits([
       { message: "feat: add some feature", date: "2026-01-02T10:00:00" },

package/os/rfc/rfc-create-concurrent.test.ts

@@ -0,0 +1,118 @@
+import { test, expect, describe, beforeEach, afterEach } from "vitest";
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { runRfcCreate } from "./handlers/list-create.ts";
+import type { ForgeCommandInput, ForgeRuntimeContext } from "../../src/types.ts";
+
+/*
+<MODULE_CONTRACT>
+  <purpose>
+    RFC-1138 AC-5: concurrent rfc.create invocations must produce distinct
+    RFC ids — the wx (exclusive-create) write + bounded retry on EEXIST
+    replaces the old scan-then-write race.
+  </purpose>
+</MODULE_CONTRACT>
+*/
+
+const RFC_TEMPLATE = `---
+id: RFC-0000
+title: "TEMPLATE"
+kind: command
+scope: workspace
+createdAt: YYYY-MM-DD
+updatedAt: YYYY-MM-DD
+satisfies: []
+---
+
+# RFC-0000: TEMPLATE
+`;
+
+function makeContext(workspaceRoot: string): ForgeRuntimeContext {
+  return {
+    workspaceRoot,
+    logger: {
+      info: () => {},
+      success: () => {},
+      warn: () => {},
+      error: () => {},
+      debug: () => {},
+    },
+    outputFormat: "json",
+    dryRun: false,
+  } as unknown as ForgeRuntimeContext;
+}
+
+function makeInput(title: string): ForgeCommandInput {
+  return {
+    commandName: "rfc.create",
+    // kind "command" avoids the post-cutoff --satisfies requirement
+    // (only architecture|contract require DNA ids).
+    flags: { title, kind: "command", scope: "workspace" },
+  } as unknown as ForgeCommandInput;
+}
+
+describe("rfc.create — RFC-1138 concurrent id allocation", () => {
+  let tmpDir: string;
+  let rfcDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "rfc-create-"));
+    rfcDir = path.join(tmpDir, "docs", "rfcs");
+    await fs.mkdir(rfcDir, { recursive: true });
+    await fs.writeFile(path.join(rfcDir, "rfc-0000-template.md"), RFC_TEMPLATE, "utf-8");
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  test("AC-5: five concurrent creates produce five distinct ids", async () => {
+    const results = await Promise.all(
+      [1, 2, 3, 4, 5].map((n) =>
+        runRfcCreate(makeInput(`Concurrent RFC ${n}`), makeContext(tmpDir)),
+      ),
+    );
+
+    const ids = results.map((r) => (r.data as { id: string }).id);
+    expect(new Set(ids).size).toBe(5);
+
+    const files = (await fs.readdir(rfcDir)).filter((f) => f.startsWith("rfc-") && f !== "rfc-0000-template.md");
+    expect(files).toHaveLength(5);
+  });
+
+  test("AC-5: sequential creates still allocate monotonically", async () => {
+    const first = await runRfcCreate(makeInput("First"), makeContext(tmpDir));
+    const second = await runRfcCreate(makeInput("Second"), makeContext(tmpDir));
+
+    const firstId = (first.data as { id: string }).id;
+    const secondId = (second.data as { id: string }).id;
+    expect(firstId).not.toBe(secondId);
+    expect(secondId > firstId).toBe(true);
+  });
+
+  test("AC-5: pre-existing highest id is respected after a collision", async () => {
+    // Seed rfc-0001 so the first create takes 0002; a file racing in at 0002
+    // forces the retry path to land on 0003.
+    await fs.writeFile(path.join(rfcDir, "rfc-0001-seeded.md"), "---\nid: RFC-0001\n---\n", "utf-8");
+    const winner = runRfcCreate(makeInput("Winner"), makeContext(tmpDir));
+    // Interleave a manual claim at the id the scan will compute.
+    const claim = (async () => {
+      // Small delay so the create's scan completes first, then we steal 0002.
+      await new Promise((r) => setTimeout(r, 5));
+      await fs
+        .writeFile(path.join(rfcDir, "rfc-0002-interloper.md"), "---\nid: RFC-0002\n---\n", {
+          flag: "wx",
+        })
+        .catch(() => {});
+    })();
+    const [result] = await Promise.all([winner, claim]);
+
+    const id = (result.data as { id: string }).id;
+    // Either the create won 0002 (interloper lost the wx race) or it retried to 0003.
+    expect(["RFC-0002", "RFC-0003"]).toContain(id);
+    const files = (await fs.readdir(rfcDir)).filter((f) => f.startsWith("rfc-") && f !== "rfc-0000-template.md");
+    // Seeded + interloper (if it won) + create output — never a silent overwrite.
+    expect(files.length).toBeGreaterThanOrEqual(2);
+  });
+});