forgeos 0.1.0-alpha.40 → 0.1.0-alpha.42

package/src/forge/cli/dev.ts

@@ -34,6 +34,7 @@ import { FORGE_PGLITE_STORE_ABORTED } from "../compiler/diagnostics/codes.ts";
 import { isPgliteAbortMessage } from "../runtime/db/pglite-adapter.ts";
 import { forgeCliCommandForWorkspace, forgeCliCommandsForWorkspace } from "../workspace/forge-cli.ts";
 import { writeLastRunRecord } from "./last-run.ts";
+import { runSeedCommand, type SeedCommandResult } from "./seed.ts";
 
 export interface DevCommandOptions {
   workspaceRoot: string;
@@ -58,6 +59,9 @@ export interface DevCommandOptions {
   allowDevAuth?: boolean;
   skipStartupConsole?: boolean;
   detach?: boolean;
+  seed?: boolean;
+  seedCommand?: string;
+  seedAllTenants?: boolean;
   lifecycle?: "status" | "stop";
 }
 
@@ -75,7 +79,7 @@ export interface DevGenerateResult {
   exitCode: 0 | 1;
 }
 
-interface DevStartupGeneratedEvidence {
+export interface DevStartupGeneratedEvidence {
   ok: boolean;
   state: "fresh" | "regenerated" | "stale-risk";
   changedFiles: number;
@@ -86,7 +90,7 @@ interface DevStartupGeneratedEvidence {
   checkCommand: string;
 }
 
-interface WebDevServerHandle {
+export interface WebDevServerHandle {
   url: string;
   port: number;
   requestedPort?: number;
@@ -95,7 +99,7 @@ interface WebDevServerHandle {
   stop: () => void;
 }
 
-interface DevStartupSummary {
+export interface DevStartupSummary {
   schemaVersion: "0.1.0";
   ok: true;
   mode: "dev";
@@ -155,11 +159,31 @@ interface DevStartupSummary {
     checkCommand: string;
     message: string;
   };
+  seed: {
+    requested: boolean;
+    available: boolean;
+    commands: string[];
+    selectedCommand?: string;
+    readiness?: SeedCommandResult["readiness"];
+    ran: boolean;
+    ok?: boolean;
+    responseStatus?: number;
+    tenantRuns?: Array<{
+      tenantId: string;
+      label?: string;
+      organizationName?: string;
+      ok: boolean;
+      responseStatus?: number;
+    }>;
+    error?: string;
+    nextActions: string[];
+  };
   next: {
     browserUrl: string;
     apiIndex: string;
     inspect: string;
     verify: string;
+    changed: string;
   };
   pid: number;
 }
@@ -283,6 +307,9 @@ function buildDetachedDevArgs(options: DevCommandOptions): string[] {
   if (options.webPort !== undefined) args.push("--web-port", String(options.webPort));
   if (options.telemetry.length > 0) args.push("--telemetry", options.telemetry.join(","));
   if (options.envFile) args.push("--env-file", options.envFile);
+  if (options.seed) args.push("--seed");
+  if (options.seedCommand) args.push("--seed-command", options.seedCommand);
+  if (options.seedAllTenants) args.push("--all-tenants");
   return args;
 }
 
@@ -486,6 +513,27 @@ async function isPortAvailable(host: string, port: number): Promise<boolean> {
   });
 }
 
+async function reserveEphemeralPort(host: string): Promise<number> {
+  const server = createNetServer();
+  return new Promise<number>((resolve, reject) => {
+    const cleanup = () => {
+      server.removeAllListeners();
+    };
+    server.once("error", (error) => {
+      cleanup();
+      reject(error);
+    });
+    server.listen(0, host, () => {
+      const address = server.address();
+      const port = typeof address === "object" && address !== null ? address.port : 0;
+      server.close(() => {
+        cleanup();
+        resolve(port);
+      });
+    });
+  });
+}
+
 function classifyDevStartFailure(input: {
   rawMessage: string;
   host: string;
@@ -602,7 +650,11 @@ export async function resolveAvailableWebPort(input: {
   const attempts = input.maxAttempts ?? 20;
   const start = Math.max(0, Math.floor(input.preferredPort));
   if (start === 0) {
-    return { port: 0, autoPortSelected: false };
+    return {
+      port: await reserveEphemeralPort(input.host),
+      requestedPort: 0,
+      autoPortSelected: true,
+    };
   }
 
   for (let offset = 0; offset < attempts; offset += 1) {
@@ -787,12 +839,27 @@ function startWebDevServer(input: {
   };
 }
 
-function buildStartupSummary(input: {
+function seedReadinessForWorkspace(
+  workspaceRoot: string,
+  readiness: SeedCommandResult["readiness"],
+): SeedCommandResult["readiness"] {
+  return {
+    ...readiness,
+    emptyWorkspaceRecovery: forgeCliCommandsForWorkspace(
+      workspaceRoot,
+      readiness.emptyWorkspaceRecovery,
+    ),
+  };
+}
+
+export function buildStartupSummary(input: {
   workspaceRoot: string;
   handle: DevServerHandle;
   web?: WebDevServerHandle | null;
   watch: boolean;
   generated?: DevStartupGeneratedEvidence;
+  seed?: SeedCommandResult;
+  seedRequested?: boolean;
 }): DevStartupSummary {
   const frontend = readGeneratedJson<FrontendGraph>(
     input.workspaceRoot,
@@ -819,6 +886,22 @@ function buildStartupSummary(input: {
         },
       ]
     : [];
+  if (input.seed && input.seed.subcommand !== "status" && input.seed.ok === false) {
+    warnings.push({
+      code: input.seed.diagnostics[0]?.code ?? "FORGE_SEED_FAILED",
+      message: input.seed.diagnostics[0]?.message ?? "Seed command failed.",
+      nextAction: forgeCliCommandForWorkspace(input.workspaceRoot, "forge seed status --json"),
+    });
+  }
+  for (const diagnostic of input.seed?.diagnostics.filter((item) => item.severity === "warning") ?? []) {
+    warnings.push({
+      code: diagnostic.code,
+      message: diagnostic.message,
+      nextAction: diagnostic.suggestedCommands?.[0]
+        ? forgeCliCommandForWorkspace(input.workspaceRoot, diagnostic.suggestedCommands[0])
+        : forgeCliCommandForWorkspace(input.workspaceRoot, "forge seed status --json"),
+    });
+  }
   const preview = previewSummaryFor({
     workspaceRoot: input.workspaceRoot,
     host: input.handle.host,
@@ -884,11 +967,34 @@ function buildStartupSummary(input: {
       checkCommand: input.generated?.checkCommand ?? forgeCliCommandForWorkspace(input.workspaceRoot, "forge generate --check --json"),
       message: input.generated?.message ?? (buildInfoRaw ? "generated artifacts are loaded" : "generated build info is missing"),
     },
+    seed: {
+      requested: input.seedRequested === true,
+      available: (input.seed?.commands.length ?? 0) > 0,
+      commands: input.seed?.commands.map((command) => command.name) ?? [],
+      ...(input.seed?.selectedCommand ? { selectedCommand: input.seed.selectedCommand } : {}),
+      ...(input.seed?.readiness ? { readiness: seedReadinessForWorkspace(input.workspaceRoot, input.seed.readiness) } : {}),
+      ran: input.seedRequested === true && input.seed?.subcommand !== "status",
+      ...(input.seed && input.seed.subcommand !== "status" ? { ok: input.seed.ok } : {}),
+      ...(input.seed?.response ? { responseStatus: input.seed.response.status } : {}),
+      ...(input.seed?.tenantRuns ? {
+        tenantRuns: input.seed.tenantRuns.map((run) => ({
+          tenantId: run.tenantId,
+          ...(run.label ? { label: run.label } : {}),
+          ...(run.organizationName ? { organizationName: run.organizationName } : {}),
+          ok: run.ok,
+          ...(run.response ? { responseStatus: run.response.status } : {}),
+        })),
+      } : {}),
+      ...(!input.seed?.ok && input.seed?.diagnostics[0]?.message ? { error: input.seed.diagnostics[0].message } : {}),
+      nextActions: input.seed?.nextActions.map((action) => forgeCliCommandForWorkspace(input.workspaceRoot, action)) ??
+        [forgeCliCommandForWorkspace(input.workspaceRoot, "forge seed status --json")],
+    },
     next: {
       browserUrl,
       apiIndex: input.handle.url,
       inspect: forgeCliCommandForWorkspace(input.workspaceRoot, "forge inspect summary --json"),
       verify: forgeCliCommandForWorkspace(input.workspaceRoot, "forge dev --once --json"),
+      changed: forgeCliCommandForWorkspace(input.workspaceRoot, "forge changed --json"),
     },
     pid: process.pid,
   };
@@ -898,7 +1004,7 @@ function printStartupJson(summary: DevStartupSummary): void {
   process.stdout.write(`${JSON.stringify(summary)}\n`);
 }
 
-function printStartupHuman(summary: DevStartupSummary): void {
+export function formatStartupHuman(summary: DevStartupSummary): string {
   const lines = ["Forge Dev", ""];
   lines.push("API runtime");
   lines.push(`  URL: ${summary.api.url}`);
@@ -909,6 +1015,39 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push(`  Generated: ${summary.generated.state}${summary.generated.changedFiles > 0 ? ` (${summary.generated.changedFiles} changed)` : ""}${summary.generated.runtimeStaleRisk ? " (stale risk)" : ""}`);
   lines.push(`  Generated note: ${summary.generated.message}`);
   lines.push(`  Generated check: ${summary.generated.checkCommand}`);
+  if (summary.seed.available || summary.seed.requested) {
+    lines.push(`  Seed: ${summary.seed.available ? summary.seed.commands.join(", ") : "none detected"}`);
+    if (summary.seed.readiness) {
+      const autoSeedNote = summary.seed.readiness.autoSeedMode !== "none"
+        ? summary.seed.readiness.autoSeedMode === "all-tenants"
+          ? " (npm run dev auto-seeds all local tenants)"
+          : " (npm run dev auto-seeds)"
+        : "";
+      lines.push(`  Seed readiness: ${summary.seed.readiness.ready ? "ready" : summary.seed.readiness.reason}${autoSeedNote}`);
+      if (summary.seed.readiness.emptyWorkspaceRecovery.length > 0) {
+        lines.push("  Seed recovery:");
+        for (const action of summary.seed.readiness.emptyWorkspaceRecovery) {
+          lines.push(`    - ${action}`);
+        }
+      }
+    }
+    if (summary.seed.requested) {
+      lines.push(`  Seed run: ${summary.seed.ok ? "ok" : "failed"}${summary.seed.selectedCommand ? ` (${summary.seed.selectedCommand})` : ""}${summary.seed.responseStatus ? ` HTTP ${summary.seed.responseStatus}` : ""}`);
+      if (summary.seed.tenantRuns && summary.seed.tenantRuns.length > 0) {
+        const okCount = summary.seed.tenantRuns.filter((run) => run.ok).length;
+        lines.push(`  Seed tenants: ${okCount}/${summary.seed.tenantRuns.length} ok`);
+        for (const run of summary.seed.tenantRuns) {
+          const label = run.organizationName ?? run.label ?? run.tenantId;
+          lines.push(`    - ${run.ok ? "ok" : "failed"} ${label} (${run.tenantId})${run.responseStatus ? ` HTTP ${run.responseStatus}` : ""}`);
+        }
+      }
+      if (summary.seed.error) {
+        lines.push(`  Seed error: ${summary.seed.error}`);
+      }
+    } else if (summary.seed.available) {
+      lines.push(`  Seed next: ${summary.seed.nextActions[0] ?? "forge seed dev --json"}`);
+    }
+  }
   for (const warning of summary.warnings) {
     lines.push(`  Warning ${warning.code}: ${warning.message}`);
     if (warning.nextAction) {
@@ -920,8 +1059,9 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push("Web app");
   if (summary.web) {
     lines.push(`  URL: ${summary.web.url}`);
-    if (summary.web.autoPortSelected && summary.web.requestedPort) {
-      lines.push(`  Requested port: ${summary.web.requestedPort} (busy; selected ${summary.web.port})`);
+    if (summary.web.autoPortSelected && summary.web.requestedPort !== undefined) {
+      const reason = summary.web.requestedPort === 0 ? "ephemeral" : "busy";
+      lines.push(`  Requested port: ${summary.web.requestedPort} (${reason}; selected ${summary.web.port})`);
     }
     lines.push(`  Framework: ${summary.web.framework}`);
     lines.push(`  API env: ${summary.web.apiUrlEnv ?? "unknown"}=${summary.api.url}`);
@@ -948,7 +1088,7 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push("Agent checks");
   lines.push(`  ${summary.next.verify}`);
   lines.push(`  ${summary.next.inspect}`);
-  lines.push("  forge changed --json");
+  lines.push(`  ${summary.next.changed}`);
   lines.push("");
 
   lines.push("Preview");
@@ -959,7 +1099,11 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push(`  Note: ${summary.preview.note}`);
   lines.push("");
 
-  process.stdout.write(`${lines.join("\n")}\n`);
+  return `${lines.join("\n")}\n`;
+}
+
+function printStartupHuman(summary: DevStartupSummary): void {
+  process.stdout.write(formatStartupHuman(summary));
 }
 
 function openBrowser(url: string): void {
@@ -1311,12 +1455,34 @@ export async function runDevCommand(
         json: options.json,
       });
 
+  const seedStatus = await runSeedCommand({
+    subcommand: "status",
+    command: options.seedCommand,
+    args: {},
+    url: handle.url,
+    json: true,
+    workspaceRoot,
+  });
+  const seedResult = options.seed
+    ? await runSeedCommand({
+        subcommand: "dev",
+        command: options.seedCommand ?? seedStatus.selectedCommand,
+        args: {},
+        url: handle.url,
+        allTenants: options.seedAllTenants,
+        json: true,
+        workspaceRoot,
+      })
+    : seedStatus;
+
   const startupSummary = buildStartupSummary({
     workspaceRoot,
     handle,
     web: webHandle,
     watch: options.watch,
     generated: startupGenerated,
+    seed: seedResult,
+    seedRequested: options.seed,
   });
   if (options.json) {
     printStartupJson(startupSummary);

package/src/forge/cli/field-test.ts

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { runNewCommand, type NewPackageManager, type NewTemplateName } from "./new.ts";
 import { normalizeForgeCliCommandsInValue } from "../workspace/forge-cli.ts";
 
@@ -21,6 +21,8 @@ export interface FieldTestCommandOptions {
   keep: boolean;
   runtimeProbes: boolean;
   authProbes: boolean;
+  uiProbes: boolean;
+  realistic: boolean;
   timeoutMs: number;
   writeReport?: string;
 }
@@ -54,6 +56,10 @@ function defaultReportPath(): string {
   return ".forge/field-test-report.json";
 }
 
+function resolveReportPath(workspaceRoot: string, reportPath: string): string {
+  return isAbsolute(reportPath) ? reportPath : join(workspaceRoot, reportPath);
+}
+
 function parseJsonOutput(text: string): unknown | null {
   const trimmed = text.trim();
   if (!trimmed) return null;
@@ -77,19 +83,156 @@ function summarizeReport(data: unknown) {
   const plannedCases = Array.isArray(root.cases) ? root.cases as Array<Record<string, unknown>> : [];
   const failed = results.filter((result) => result.ok === false && result.skipped !== true);
   const skipped = results.filter((result) => result.skipped === true);
+  const topLevelSteps = results.flatMap((result) =>
+    Array.isArray(result.steps) ? result.steps as unknown[] : [],
+  );
   const runtimeProbeSteps = results.flatMap((result) => {
     const runtime = result.runtime && typeof result.runtime === "object"
       ? result.runtime as Record<string, unknown>
       : {};
     return Array.isArray(runtime.steps) ? runtime.steps as unknown[] : [];
   });
+  const hasVendorAccessCase = results.some((result) => result.template === "vendor-access");
+  const commandOf = (step: unknown): string =>
+    step && typeof step === "object" && typeof (step as { command?: unknown }).command === "string"
+      ? (step as { command: string }).command
+      : "";
+  const stdoutOf = (step: unknown): string =>
+    step && typeof step === "object" && typeof (step as { stdout?: unknown }).stdout === "string"
+      ? (step as { stdout: string }).stdout
+      : "";
+  const okStep = (step: unknown): boolean =>
+    Boolean(step && typeof step === "object" && (step as { ok?: unknown }).ok === true);
+  const jsonOfStep = (step: unknown): Record<string, unknown> | null => {
+    const stdout = stdoutOf(step).trim();
+    if (!stdout) return null;
+    const parsed = parseJsonOutput(stdout);
+    return parsed && typeof parsed === "object" ? parsed as Record<string, unknown> : null;
+  };
+  const hasOkRuntimeCommand = (pattern: RegExp): boolean =>
+    runtimeProbeSteps.some((step) => okStep(step) && pattern.test(commandOf(step)));
+  const hasOkTopLevelCommand = (pattern: RegExp): boolean =>
+    topLevelSteps.some((step) => okStep(step) && pattern.test(commandOf(step)));
+  const seedProbeSteps = runtimeProbeSteps.filter((step) => commandOf(step).includes("seed-"));
+  const seedReadinessSteps = runtimeProbeSteps.filter((step) => commandOf(step).includes("seed-status"));
+  const seedReadinessResults = seedReadinessSteps
+    .filter((step) => okStep(step))
+    .map((step) => {
+      const payload = jsonOfStep(step);
+      const readiness = payload?.readiness && typeof payload.readiness === "object"
+        ? payload.readiness as Record<string, unknown>
+        : {};
+      const recovery = Array.isArray(readiness.emptyWorkspaceRecovery)
+        ? readiness.emptyWorkspaceRecovery.filter((item) => typeof item === "string")
+        : [];
+      return {
+        ready: readiness.ready === true,
+        autoSeedOnDev: readiness.autoSeedOnDev === true,
+        autoSeedAllTenantsOnDev: readiness.autoSeedAllTenantsOnDev === true,
+        autoSeedMode: typeof readiness.autoSeedMode === "string" ? readiness.autoSeedMode : undefined,
+        selectedCommand: typeof readiness.selectedCommand === "string" ? readiness.selectedCommand : undefined,
+        recoveryCommands: recovery.length,
+      };
+    });
+  const seedReadinessEvidence = !hasVendorAccessCase || seedReadinessResults.some((result) =>
+    result.ready &&
+    result.selectedCommand === "seedVendorAccessDemo" &&
+    result.recoveryCommands >= 2,
+  );
+  const seedAllTenantsAutoSeedEvidence = !hasVendorAccessCase || seedReadinessResults.some((result) =>
+    result.ready &&
+    result.selectedCommand === "seedVendorAccessDemo" &&
+    (result.autoSeedMode === "all-tenants" || result.autoSeedAllTenantsOnDev),
+  );
+  const vendorAccessProbeSteps = runtimeProbeSteps.filter((step) => commandOf(step).includes("vendor-access-"));
+  const uiProbeSteps = runtimeProbeSteps.filter((step) => /^GET\s+https?:\/\/[^/]+\/$/i.test(commandOf(step)));
+  const authMetadataProbeSteps = runtimeProbeSteps.filter((step) =>
+    /^(HEAD|GET)\s+https?:\/\/[^/]+\/(auth\.md|\.well-known\/oauth-protected-resource)\b/i.test(commandOf(step)),
+  );
+  const authSetupProbeSteps = topLevelSteps.filter((step) =>
+    /forge\s+(?:--\s+)?(add\s+auth\s+workos|authmd\s+generate|authmd\s+check|workos\s+doctor|workos\s+seed|workos\s+prove|auth\s+prove)/.test(commandOf(step)),
+  );
+  const uiErgonomicsResults = results
+    .map((result) => result.uiErgonomics)
+    .filter((value): value is Record<string, unknown> => Boolean(value && typeof value === "object"));
+  const uiErgonomicsWarnings = uiErgonomicsResults.reduce((total, result) =>
+    total + (typeof result.warnings === "number" ? result.warnings : 0), 0);
+  const uiErgonomicsErrors = uiErgonomicsResults.reduce((total, result) =>
+    total + (typeof result.errors === "number" ? result.errors : 0), 0);
+  const uiErgonomicsWarningCodes = Array.from(new Set(uiErgonomicsResults.flatMap((result) =>
+    Array.isArray(result.diagnosticCodes)
+      ? result.diagnosticCodes.filter((code): code is string => typeof code === "string")
+      : [],
+  ))).sort();
+  const uiScenarioNames = Array.from(new Set(uiErgonomicsResults.flatMap((result) =>
+    Array.isArray(result.scenarioNames)
+      ? result.scenarioNames.filter((name): name is string => typeof name === "string")
+      : [],
+  ))).sort();
+  const vendorAccessRequiredUiScenarios = [
+    "vendor-access-autoseed-data-visible",
+    "vendor-access-local-login",
+    "vendor-access-requester-denied-visible",
+    "vendor-access-seed-control-visible",
+  ];
   const ok = root.ok === true;
   const runtimeProbes = root.runtimeProbes === true;
   const authProbes = root.authProbes === true;
+  const uiProbes = root.uiProbes === true;
+  const uiErgonomics = !uiProbes || (results.length > 0 && uiErgonomicsResults.length === results.filter((result) => result.skipped !== true).length);
+  const runtimeHealthEvidence = !runtimeProbes || hasOkRuntimeCommand(/\bGET\s+.*\/health\b/i);
+  const runtimeEntriesEvidence = !runtimeProbes || hasOkRuntimeCommand(/\bGET\s+.*\/entries\b/i);
+  const authSetupEvidence = !authProbes || [
+    /forge\s+(?:--\s+)?add\s+auth\s+workos\b/,
+    /forge\s+(?:--\s+)?authmd\s+generate\b/,
+    /forge\s+(?:--\s+)?authmd\s+check\b/,
+    /forge\s+(?:--\s+)?workos\s+doctor\b/,
+    /forge\s+(?:--\s+)?workos\s+seed\b/,
+    /forge\s+(?:--\s+)?workos\s+prove\b/,
+    /forge\s+(?:--\s+)?auth\s+prove\b/,
+  ].every((pattern) => hasOkTopLevelCommand(pattern));
+  const authMetadataEvidence = !authProbes || [
+    /^HEAD\s+.*\/auth\.md\b/i,
+    /^GET\s+.*\/auth\.md\b/i,
+    /^HEAD\s+.*\/\.well-known\/oauth-protected-resource\b/i,
+    /^GET\s+.*\/\.well-known\/oauth-protected-resource\b/i,
+  ].every((pattern) => hasOkRuntimeCommand(pattern));
+  const uiProbeEvidence = !uiProbes || uiProbeSteps.some((step) => okStep(step));
+  const vendorAccessSeedEvidence = !hasVendorAccessCase ||
+    hasOkRuntimeCommand(/vendor-access-seed-all-tenants:/) ||
+    [
+      /vendor-access-seed-acme:/,
+      /vendor-access-seed-globex:/,
+    ].every((pattern) => hasOkRuntimeCommand(pattern));
+  const vendorAccessEvidence = !hasVendorAccessCase || (
+    vendorAccessSeedEvidence &&
+    [
+      /vendor-access-query-acme:/,
+      /vendor-access-query-globex:/,
+      /vendor-access-owner-approve:/,
+      /vendor-access-requester-approve-denied:/,
+      /vendor-access-cross-tenant-approve-denied:/,
+    ].every((pattern) => hasOkRuntimeCommand(pattern))
+  );
+  const vendorAccessUiScenarioEvidence = !hasVendorAccessCase || !uiProbes ||
+    vendorAccessRequiredUiScenarios.every((scenario) => uiScenarioNames.includes(scenario));
   const productionEvidenceMissing = [
     ...(!ok ? ["passing field-test report"] : []),
     ...(!runtimeProbes ? ["runtime probes"] : []),
     ...(!authProbes ? ["auth probes"] : []),
+    ...(!uiProbes ? ["ui probes"] : []),
+    ...(!runtimeHealthEvidence ? ["runtime health probe"] : []),
+    ...(!runtimeEntriesEvidence ? ["runtime entries probe"] : []),
+    ...(!authSetupEvidence ? ["auth setup probes"] : []),
+    ...(!authMetadataEvidence ? ["auth metadata endpoint probes"] : []),
+    ...(!uiProbeEvidence ? ["web UI probe"] : []),
+    ...(!seedReadinessEvidence ? ["seed readiness evidence"] : []),
+    ...(!seedAllTenantsAutoSeedEvidence ? ["seed readiness all-tenants auto-seed evidence"] : []),
+    ...(!vendorAccessEvidence ? ["vendor-access multi-tenant domain probes"] : []),
+    ...(!vendorAccessUiScenarioEvidence ? ["vendor-access UI scenarios"] : []),
+    ...(!uiErgonomics ? ["UI ergonomics audit"] : []),
+    ...(uiErgonomicsWarnings > 0 ? ["zero UI ergonomics warnings"] : []),
+    ...(uiErgonomicsErrors > 0 ? ["zero UI ergonomics errors"] : []),
     ...(failed.length > 0 ? ["zero failed cases"] : []),
   ];
   return {
@@ -102,7 +245,35 @@ function summarizeReport(data: unknown) {
     skipped: skipped.length,
     runtimeProbes,
     authProbes,
+    uiProbes,
+    uiErgonomics,
+    uiErgonomicsWarnings,
+    uiErgonomicsErrors,
+    uiErgonomicsWarningCodes,
+    uiScenarios: {
+      names: uiScenarioNames,
+      vendorAccessReady: vendorAccessUiScenarioEvidence,
+      requiredVendorAccess: hasVendorAccessCase ? vendorAccessRequiredUiScenarios : [],
+    },
     runtimeProbeSteps: runtimeProbeSteps.length,
+    seedProbeSteps: seedProbeSteps.length,
+    seedReadiness: {
+      ready: seedReadinessEvidence,
+      steps: seedReadinessSteps.length,
+      autoSeedOnDev: seedReadinessResults.some((result) => result.autoSeedOnDev),
+      autoSeedAllTenantsOnDev: seedReadinessResults.some((result) => result.autoSeedAllTenantsOnDev),
+      allTenantsAutoSeedReady: seedAllTenantsAutoSeedEvidence,
+      autoSeedModes: Array.from(new Set(seedReadinessResults
+        .map((result) => result.autoSeedMode)
+        .filter((value): value is string => Boolean(value)))),
+      selectedCommands: Array.from(new Set(seedReadinessResults
+        .map((result) => result.selectedCommand)
+        .filter((value): value is string => Boolean(value)))),
+    },
+    authSetupProbeSteps: authSetupProbeSteps.length,
+    authMetadataProbeSteps: authMetadataProbeSteps.length,
+    uiProbeSteps: uiProbeSteps.length,
+    vendorAccessProbeSteps: vendorAccessProbeSteps.length,
     productionEvidence: {
       readyForDeployCheck: productionEvidenceMissing.length === 0,
       missing: productionEvidenceMissing,
@@ -119,11 +290,9 @@ function summarizeReport(data: unknown) {
 
 function runCommandForOptions(templates: NewTemplateName[], packageManagers: NewPackageManager[]): string {
   return [
-    "forge field-test run",
+    "forge field-test run --realistic",
     `--templates ${templates.join(",")}`,
     `--package-managers ${packageManagers.join(",")}`,
-    "--runtime-probes",
-    "--auth-probes",
     "--json",
   ].join(" ");
 }
@@ -136,7 +305,7 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
       kind: "field-test",
       action: "create",
       data: { error: "forge field-test create requires an app name" },
-      nextActions: ["forge field-test create vendor-access --auth workos --template minimal-web --json"],
+      nextActions: ["forge field-test create vendor-access --auth workos --json"],
       exitCode: 1,
     };
   }
@@ -152,9 +321,21 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
         template: options.template,
         packageManager: options.packageManager,
         auth: options.auth,
+        install: true,
+        git: true,
         command: `forge new ${options.name} --template ${options.template} --package-manager ${options.packageManager} --field-test --install`,
+        goldenPath: [
+          `forge field-test create ${options.name} --auth ${options.auth ?? "none"} --template ${options.template} --package-manager ${options.packageManager} --install --git --json`,
+          `cd ${options.name}`,
+          "forge field-test run --realistic --json",
+          "forge field-test report --json",
+          "forge deploy plan --target docker --json",
+          "forge deploy check --production --json",
+        ],
       },
-      nextActions: [`forge new ${options.name} --template ${options.template} --package-manager ${options.packageManager} --field-test --install`],
+      nextActions: [
+        `forge field-test create ${options.name} --auth ${options.auth ?? "none"} --template ${options.template} --package-manager ${options.packageManager} --install --git --json`,
+      ],
       exitCode: 0,
     });
   }
@@ -198,9 +379,12 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
             `${options.packageManager} run forge -- authmd check --json`,
             `${options.packageManager} run forge -- workos doctor --json`,
             `${options.packageManager} run forge -- workos seed --file workos-seed.yml --dry-run --json`,
+            `${options.packageManager} run forge -- workos prove --file workos-seed.yml --json`,
             `${options.packageManager} run forge -- workos setup --file workos-seed.yml --json`,
           ]
         : []),
+      `${options.packageManager} run forge -- field-test run --realistic --json`,
+      `${options.packageManager} run forge -- field-test report --json`,
       `${options.packageManager} run forge -- dev --once --json`,
       `${options.packageManager} run forge -- verify --smoke --json`,
       `${options.packageManager} run forge -- handoff --json`,
@@ -236,8 +420,9 @@ function runHarness(options: FieldTestCommandOptions): FieldTestCommandResult {
   ];
   if (options.dryRun) args.push("--dry-run");
   if (options.keep) args.push("--keep");
-  if (options.runtimeProbes) args.push("--runtime-probes");
-  if (options.authProbes) args.push("--auth-probes");
+  if (options.runtimeProbes || options.realistic) args.push("--runtime-probes");
+  if (options.authProbes || options.realistic) args.push("--auth-probes");
+  if (options.uiProbes || options.realistic) args.push("--ui-probes");
   if (options.forgeSpec) args.push("--forge-spec", options.forgeSpec);
   if (reportPath) args.push("--write-report", reportPath);
   if (options.json) args.push("--json");
@@ -246,7 +431,7 @@ function runHarness(options: FieldTestCommandOptions): FieldTestCommandResult {
     encoding: "utf8",
     windowsHide: true,
   });
-  const reportAbsolute = reportPath ? join(options.workspaceRoot, reportPath) : null;
+  const reportAbsolute = reportPath ? resolveReportPath(options.workspaceRoot, reportPath) : null;
   const reportData = reportAbsolute && existsSync(reportAbsolute)
     ? JSON.parse(readFileSync(reportAbsolute, "utf8")) as unknown
     : parseJsonOutput(result.stdout ?? "");
@@ -276,7 +461,7 @@ function readReport(options: FieldTestCommandOptions): FieldTestCommandResult {
     ".forge/field-test-report.json",
     "field-reports/full-alpha.json",
   ].filter(Boolean) as string[];
-  const report = candidates.find((candidate) => existsSync(join(options.workspaceRoot, candidate)));
+  const report = candidates.find((candidate) => existsSync(resolveReportPath(options.workspaceRoot, candidate)));
   if (!report) {
     return {
       schemaVersion: "0.1.0",
@@ -284,11 +469,11 @@ function readReport(options: FieldTestCommandOptions): FieldTestCommandResult {
       kind: "field-test",
       action: "report",
       data: { searched: candidates },
-      nextActions: ["forge field-test run --runtime-probes --auth-probes --write-report .forge/field-test-report.json --json"],
+      nextActions: ["forge field-test run --realistic --write-report .forge/field-test-report.json --json"],
       exitCode: 1,
     };
   }
-  const data = JSON.parse(readFileSync(join(options.workspaceRoot, report), "utf8")) as unknown;
+  const data = JSON.parse(readFileSync(resolveReportPath(options.workspaceRoot, report), "utf8")) as unknown;
   const summary = summarizeReport(data);
   const productionEvidence = (summary as { productionEvidence?: { readyForDeployCheck?: boolean } }).productionEvidence;
   return {
@@ -301,7 +486,7 @@ function readReport(options: FieldTestCommandOptions): FieldTestCommandResult {
     data,
     nextActions: productionEvidence?.readyForDeployCheck
       ? ["forge deploy check --production --json"]
-      : ["forge field-test run --runtime-probes --auth-probes --write-report .forge/field-test-report.json --json"],
+      : ["forge field-test run --realistic --write-report .forge/field-test-report.json --json"],
     exitCode: (data && typeof data === "object" && "ok" in data && (data as { ok?: unknown }).ok !== true) ? 1 : 0,
   };
 }