feat(scaffold): B-0424.1 — Forge + ace day-one governance templates + dry-run create-repo tool

[AceHack]

Summary

B-0424 (P1) — Three-repo split Stage 1. This PR is the smallest safe slice: governance file templates and an executable dry-run plan. No actual GitHub repos are created yet (that's an irreversible external action requiring Aaron's review of the --dry-run JSON output before --apply).

• tools/scaffold/forge/ — 10 day-one governance files for LFG/Forge (README, AGENTS, CLAUDE, GOVERNANCE, SECURITY, CODE_OF_CONDUCT, CONTRIBUTING, LICENSE, .github/copilot-instructions, docs/GITHUB-SETTINGS)
• tools/scaffold/ace/ — same set scoped to the LFG/ace package manager repo
• tools/scaffold/create-repo.ts — TypeScript dry-run tool (Rule 0) that emits a 7-step GitHub API plan (merge settings, branch protection, secret scanning, CodeQL default-setup, Dependabot, AceHack fork, file push) as structured JSON
• docs/backlog/P1/B-0424 — pre-start checklist completed per backlog-item-start-gate.md

Dry-run output (verified)

bun tools/scaffold/create-repo.ts --repo forge --dry-run
# → "DRY RUN — 10 operations planned for Lucent-Financial-Group/Forge. Pass --apply to execute."

bun tools/scaffold/create-repo.ts --repo ace --dry-run
# → "DRY RUN — 10 operations planned for Lucent-Financial-Group/ace. Pass --apply to execute."

Checks

• dotnet build -c Release → 0 Warning(s) 0 Error(s)
• Dry-run output: structured JSON with all 7 steps planned for both repos
• Rule 0 (TS over bash): ✓ — the tool is .ts run via bun
• No external side effects in this PR

Follow-on steps (not in this PR)

Once Aaron has reviewed the dry-run output:

1. bun tools/scaffold/create-repo.ts --repo forge --apply
2. bun tools/scaffold/create-repo.ts --repo ace --apply
3. Wire OpenSSF Scorecard + Semgrep GHA workflows
4. Upload SVG social-preview PNG via GitHub UI
5. Enable merge queue via GitHub Settings UI (no REST API)
6. Close this B-0424 row with Stage-1-complete note; open B-0424.2 for --apply execution

ADR reference

docs/DECISIONS/2026-04-22-three-repo-split-zeta-forge-ace.md

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea871e46bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR adds initial scaffolding for the planned Forge + ace repo split (B-0424 Stage 1): governance-file templates for both repos plus a Bun/TypeScript tool that produces (and can optionally apply) a GitHub API “create repo” plan, and updates the B-0424 backlog row to mark the pre-start gate as completed.

Changes:

• Add tools/scaffold/{forge,ace}/ day-one governance templates (README/AGENTS/CLAUDE/GOVERNANCE/SECURITY/CONTRIBUTING/CODE_OF_CONDUCT/LICENSE + Copilot instructions + declarative GitHub settings doc).
• Add tools/scaffold/create-repo.ts to emit a structured dry-run plan (and --apply execution path) for repo creation and baseline settings.
• Update the B-0424 backlog item with a completed pre-start checklist and narrowed scope for B-0424.1.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 18 comments.

Show a summary per file

File	Description
tools/scaffold/README.md	Documents the scaffold directory and how to run the create-repo tool.
tools/scaffold/create-repo.ts	Bun/TS tool to plan/apply GitHub repo creation + settings + scaffold file push.
tools/scaffold/forge/README.md	Forge repo README template.
tools/scaffold/forge/AGENTS.md	Forge agent/human collaboration template.
tools/scaffold/forge/CLAUDE.md	Forge Claude session bootstrap template.
tools/scaffold/forge/GOVERNANCE.md	Forge governance rules template.
tools/scaffold/forge/SECURITY.md	Forge security policy template.
tools/scaffold/forge/CONTRIBUTING.md	Forge contributing guide template.
tools/scaffold/forge/CODE_OF_CONDUCT.md	Forge code of conduct template.
tools/scaffold/forge/LICENSE	Forge license template (Apache 2.0 text).
tools/scaffold/forge/.github/copilot-instructions.md	Forge Copilot instructions template.
tools/scaffold/forge/docs/GITHUB-SETTINGS.md	Forge declarative GitHub settings template.
tools/scaffold/ace/README.md	ace repo README template.
tools/scaffold/ace/AGENTS.md	ace agent/human collaboration template.
tools/scaffold/ace/CLAUDE.md	ace Claude session bootstrap template.
tools/scaffold/ace/GOVERNANCE.md	ace governance rules template.
tools/scaffold/ace/SECURITY.md	ace security policy template.
tools/scaffold/ace/CONTRIBUTING.md	ace contributing guide template.
tools/scaffold/ace/CODE_OF_CONDUCT.md	ace code of conduct template.
tools/scaffold/ace/LICENSE	ace license template (Apache 2.0 text).
tools/scaffold/ace/.github/copilot-instructions.md	ace Copilot instructions template.
tools/scaffold/ace/docs/GITHUB-SETTINGS.md	ace declarative GitHub settings template.
docs/backlog/P1/B-0424-three-repo-split-stage1-create-forge-ace-with-scaffolding-aaron-2026-05-13.md	Marks pre-start checklist completed and scopes B-0424.1 deliverables.

Comments suppressed due to low confidence (2)

tools/scaffold/create-repo.ts:134

• The helper execute() is declared but never used, which will fail TypeScript with noUnusedLocals: true. Either wire it into the execution path or remove it to avoid a build/lint break.

function ghApiPatch(
  path: string,
  data: Record<string, unknown>,
  description: string,
  step: string
): Operation {
  const body = JSON.stringify(data);
  const op = plan(step, description, `gh api --method PATCH ${path} --input -`, data);
  if (!dryRun) {
    const result = spawnSync(
      "gh",
      ["api", "--method", "PATCH", path, "--input", "-"],
      { input: body, encoding: "utf8", maxBuffer: 8 * 1024 * 1024 }
    );
    op.status = result.status === 0 ? "executed" : "failed";

tools/scaffold/create-repo.ts:476

• Most tools in this repo follow the pattern export function main(argv) + if (import.meta.main) process.exit(main(...)) to make scripts importable/testable and avoid side effects on import. This file currently runs at module top-level; consider refactoring to the standard main entrypoint + guard so it matches the codebase tooling convention.

step07_summary();

const failed = ops.filter((o) => o.status === "failed").length;
const executed = ops.filter((o) => o.status === "executed").length;
const planned = ops.filter((o) => o.status === "planned").length;

const result: RunResult = {
  repo: `${config.org}/${config.name}`,
  dryRun,
  operations: ops,
  summary: dryRun
    ? `DRY RUN — ${planned} operations planned for ${config.org}/${config.name}. Pass --apply to execute.`
    : `${executed} executed, ${failed} failed out of ${ops.length} total operations.`,
};

console.log(JSON.stringify(result, null, 2));

if (!dryRun && failed > 0) {
  process.exit(1);
}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bcd753ed03

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 40a3d376f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

tools/scaffold/README.md:66

• The “Manual steps after --apply” section is missing the required-status-checks bootstrapping step that the tool prints (adding bun-test, bun-lint, codeql, scorecard as required checks after workflows are wired). Adding it here would avoid readers missing that follow-up action.

## Manual steps after --apply

The tool prints these at the end, but for reference:

1. Upload SVG social-preview PNG via GitHub UI

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a6b1b57c8c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f8e6695748

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 14 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (2)

tools/scaffold/forge/CLAUDE.md:24

• bun tools/github/refresh-worldview.ts and docs/trajectories/*/RESUME.md are referenced as if present, but the Stage 1 file push only includes governance docs (no tools/github/ and no docs/trajectories/). Consider adding to the existing day-one note that these paths arrive in Stage 2 migration (and point to Zeta equivalents in the interim), otherwise the first suggested command/path will fail in the freshly created repo.

```bash
bun tools/github/refresh-worldview.ts

Read active trajectories: docs/trajectories/*/RESUME.md.

**tools/scaffold/ace/CLAUDE.md:15**
* `bun tools/github/refresh-worldview.ts` is referenced as a standard refresh step, but the Stage 1 scaffold being pushed does not include `tools/github/` yet. Add a short day-one note (or a link to the Zeta equivalent) so a fresh repo doesn’t immediately instruct users to run a non-existent command.

2. Refresh

bun tools/github/refresh-worldview.ts

</details>