feat(scaffold): B-0424.1 — Forge + ace day-one governance templates + dry-run create-repo tool

docs/backlog/P1/B-0424-three-repo-split-stage1-create-forge-ace-with-scaffolding-aaron-2026-05-13.md

@@ -56,27 +56,23 @@ Both with full best-practice scaffolding applied at creation:
 - Declarative `docs/GITHUB-SETTINGS.md` per repo
 - Per-repo `docs/UPSTREAM-RHYTHM.md`
 
-## Pre-start checklist
-
-Before beginning Stage 1 work, complete per
-`.claude/rules/backlog-item-start-gate.md`:
-
-1. **Prior-art-search** — verify the existing substrate hasn't drifted:
-   - `memory/project_three_repo_split_zeta_forge_ace_software_factory_named_forge.md`
-   - `docs/DECISIONS/2026-04-22-three-repo-split-zeta-forge-ace.md`
-   - `memory/project_ace_package_manager_agent_negotiation_propagation.md`
-   - Compose with current LFG/AceHack topology
-     (`.claude/rules/lfg-acehack-topology.md`)
-
-2. **Dependency-restructure** — walk `composes_with:` chain;
-   reciprocal pointers added to the substrate files above as needed.
-
-3. **License question resolved** — apply B-0425's honor-system
-   "please don't fork" license framing if applicable to strategic
-   product-substrate repos. Factory (Forge) + package manager (ace)
-   + database (Zeta) are designed-to-be-forked per their open-source
-   nature; the honor-system framing applies to strategic *product*
-   repos (KSK / wellness / civsim strategic-substrate etc.), not these.
+## Pre-start checklist — COMPLETED 2026-05-13 (B-0424.1)
+
+Per `.claude/rules/backlog-item-start-gate.md`:
+
+1. **Prior-art-search** — completed 2026-05-13:
+   - `memory/project_three_repo_split_zeta_forge_ace_software_factory_named_forge.md` — read; substrate current, Stage 0 done (ADR exists)
+   - `docs/DECISIONS/2026-04-22-three-repo-split-zeta-forge-ace.md` — read; full checklist present, no drift
+   - `memory/project_ace_package_manager_agent_negotiation_propagation.md` — file exists; ace name + Ouroboros design confirmed
+   - LFG/AceHack topology (`.claude/rules/lfg-acehack-topology.md`) — LFG is active dev; AceHack is mirror; Forge + ace repos do NOT yet exist at LFG — confirmed via worldview refresh (0 open PRs on main)
+   - No existing `tools/scaffold/` directory — clean slate, no prior art to extend
+   - Skill router checked: no existing scaffold or repo-creation skill
+
+2. **Dependency-restructure** — B-0425 (product-repo split planning) is sibling row, not a blocker for Stage 1. Reciprocal pointer in B-0425 not yet present; will add in a follow-up pass. Stage 1 is executable independently.
+
+3. **License question resolved** — Apache 2.0 (same as Zeta). Forge and ace are open-source/designed-to-be-forked; honor-system framing does not apply.
+
+4. **Scope decision** — B-0424 is too broad to implement in one PR. This PR (B-0424.1) implements the smallest safe slice: day-one governance file templates for Forge and ace + a TypeScript dry-run tool (`tools/scaffold/create-repo.ts`) that shows the GitHub API calls needed to complete Stage 1. Actual GitHub repo creation (irreversible external action) is deferred to a follow-up PR with Aaron's review.
 
 ## Composes with
 

tools/scaffold/README.md

@@ -0,0 +1,79 @@
+# tools/scaffold — B-0424 Stage 1 repo scaffolding
+
+Governance-file templates and a dry-run TypeScript tool for creating the
+`LFG/Forge` and `LFG/ace` repos with the full best-practice checklist
+from [ADR 2026-04-22](../../docs/DECISIONS/2026-04-22-three-repo-split-zeta-forge-ace.md).
+
+## Usage
+
+```bash
+# Preview what will happen (default, no external side effects):
+bun tools/scaffold/create-repo.ts --repo forge --dry-run
+bun tools/scaffold/create-repo.ts --repo ace  --dry-run
+
+# Execute for real (creates GitHub repos under LFG org):
+bun tools/scaffold/create-repo.ts --repo forge --apply
+bun tools/scaffold/create-repo.ts --repo ace  --apply
+```
+
+**`--apply` creates real GitHub repos.** Review `--dry-run` output first.
+
+## What the tool does
+
+For each repo, in order:
+
+| Step | Description |
+|------|-------------|
+| 01 | Create repo (public, squash-merge only, auto-merge, delete-branch) |
+| 02 | Apply branch protection on `main` (1 review, signed commits, linear history, no force-push) |
+| 03 | Enable secret scanning + push protection, Dependabot, private vulnerability reporting |
+| 04 | Enable CodeQL **default-setup** (required for `code_scanning` ruleset rule) |
+| 05 | Fork repo to `AceHack/<name>` |
+| 06 | Push day-one governance files from `tools/scaffold/<name>/` |
+| 07 | Print manual steps remaining (SVG preview, merge queue, Scorecard workflow) |
+
+## Template files
+
+Each sub-directory contains the governance files for that repo:
+
+```
+tools/scaffold/
+  forge/                 — Forge day-one governance files
+    README.md
+    AGENTS.md
+    CLAUDE.md
+    GOVERNANCE.md
+    SECURITY.md
+    CODE_OF_CONDUCT.md
+    CONTRIBUTING.md
+    LICENSE
+    .github/
+      copilot-instructions.md
+    docs/
+      GITHUB-SETTINGS.md
+
+  ace/                   — ace day-one governance files
+    (same structure, ace-scoped content)
+
+  create-repo.ts         — this tool
+  README.md              — this file
+```
+
+## Manual steps after --apply
+
+The tool prints these at the end, but for reference:
+
+1. Upload SVG social-preview PNG via GitHub UI
+   (GitHub requires a rasterized PNG format — SVG not accepted)
+2. Enable merge queue via GitHub UI
+   (Settings → Merge queue — org feature, no REST API)
+3. Wire OpenSSF Scorecard workflow
+   (copy from Zeta's `.github/workflows/scorecard.yml`)
+4. Add Semgrep GHA inline-untrusted-in-run rule
+5. Verify $0 budget caps at org level in GitHub billing settings
+6. Confirm CodeQL default-setup is active under Security → Code scanning
+
+## Origin
+
+B-0424 (P1) — Three-repo split Stage 1.
+ADR: `docs/DECISIONS/2026-04-22-three-repo-split-zeta-forge-ace.md`.

tools/scaffold/ace/.github/copilot-instructions.md

@@ -0,0 +1,21 @@
+# GitHub Copilot instructions for ace
+
+ace is the package manager for the Lucent Financial Group software stack.
+
+## Key conventions
+
+- TypeScript / Bun for all tooling (Rule 0 — no `.sh` outside `tools/setup/`)
+- Errors as `Result<_, Error>` values — no exceptions on hot paths
+- Every AI-authored commit includes a `Co-Authored-By` trailer
+- `bun test && bun run lint` must pass before any PR merges
+
+## What this repo is NOT
+
+ace is not Forge (the software factory) and not Zeta (the database).
+Questions about factory tooling → Forge repo.
+Questions about the database → Zeta repo.
+
+## Pre-v1 caution
+
+ace has no implementation yet. Copilot suggestions for unimplemented
+features should be treated as design proposals, not production code.

tools/scaffold/ace/AGENTS.md

@@ -0,0 +1,43 @@
+# AGENTS.md — how AI and humans approach ace
+
+ace is the package manager for the Lucent Financial Group software stack.
+Every file in `src/**`, `tools/**`, `docs/**` is agent-authored.
+
+## Philosophy
+
+ace is **Aaron-owned** for governance. Claude has authoring and operation
+rights. The three load-bearing values (same as Zeta + Forge):
+
+1. **Truth over politeness.** Claims that fail tests get fixed.
+2. **Algebra over engineering.** Laws define the system.
+3. **Velocity over stability.** Pre-v1. Ship, do no permanent harm, learn.
+
+## Build gate (once implemented)
+
+```bash
+bun test          # zero failures
+bun run lint      # zero warnings
+```
+
+## Agent conventions
+
+- **Agents, not bots.** Every AI carries agency.
+- **Substrate or it didn't happen.** Committed git history is substrate.
+- **Rule 0 — TS over bash.** Factory tooling is `.ts` via `bun`.
+- **Retraction-native.** Every action has a bounded undo path.
+- **Result-over-exception.** Errors as values; no exceptions on hot paths.
+
+## Cross-repo references
+
+- **Zeta** — ace's persistence layer once ace ships.
+  `github.com/Lucent-Financial-Group/Zeta`
+- **Forge** — the factory that builds ace.
+  `github.com/Lucent-Financial-Group/Forge`
+
+## Design reference
+
+`memory/project_ace_package_manager_agent_negotiation_propagation.md`
+(in the Zeta repo) — full ace design, Ouroboros bootstrap, red-team
+discipline.
+
+<!-- Numbered repo-wide rules live in GOVERNANCE.md. -->

tools/scaffold/ace/CLAUDE.md

@@ -0,0 +1,37 @@
+# CLAUDE.md — Claude Code session bootstrap for ace
+
+Rules auto-load from `.claude/rules/`; skills load on demand from `.claude/skills/`.
+
+## 1. Orient
+
+Read: [`AGENTS.md`](AGENTS.md) → [`GOVERNANCE.md`](GOVERNANCE.md).
+Check [`docs/WONT-DO.md`](docs/WONT-DO.md) before proposing work.
+
+## 2. Refresh
+
+```bash
+bun tools/github/refresh-worldview.ts
+```
+
+## 3. Pick work
+
+Open `docs/BACKLOG.md`. Complete the backlog-item start gate before
+starting any row (prior-art search + dependency check).
+
+## 4. Build gate
+
+```bash
+bun test        # 0 failures
+bun run lint    # 0 warnings
+```
+
+## 5. Ship
+
+Set branch: `export ZETA_EXPECTED_BRANCH=<branch> && git checkout -b "$ZETA_EXPECTED_BRANCH"`
+Open PR against `main`. Arm auto-merge: `gh pr merge <N> --auto --squash`.
+
+## Conventions
+
+- **Agents, not bots** — every AI carries agency; correct "bot" gently.
+- **Rule 0 — TS over bash** — `.ts` via `bun`; `.sh` only in `tools/setup/`.
+- **Substrate or it didn't happen** — committed git history is substrate.

tools/scaffold/ace/CODE_OF_CONDUCT.md

@@ -0,0 +1,40 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and leaders pledge to make participation in
+our community a harassment-free experience for everyone, regardless of
+age, body size, visible or invisible disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open,
+welcoming, diverse, inclusive, and healthy community.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may
+be reported to the project maintainers. All complaints will be reviewed
+and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

tools/scaffold/ace/CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to ace
+
+ace is an AI-directed package manager project. Most contributions are
+agent-authored. Human contributors are welcome.
+
+## Quick-start
+
+```bash
+git clone https://github.com/Lucent-Financial-Group/ace
+cd ace
+bun install
+bun test
+```
+
+## What to work on
+
+Open `docs/BACKLOG.md`. ace is pre-v1 — the implementation doesn't exist
+yet. Early contributions are design (ADRs, specs) and scaffolding (CI,
+tooling setup).
+
+## Before you submit
+
+1. `bun test` — zero failures
+2. `bun run lint` — zero warnings
+3. PR description: what changed + why
+
+## Commit style
+
+One logical change per commit. `Co-Authored-By` trailer required for
+AI-authored commits (see `GOVERNANCE.md §6`).
+
+## Design reference
+
+Full ace design, the Ouroboros bootstrap, and the red-team discipline
+live in `memory/project_ace_package_manager_agent_negotiation_propagation.md`
+in the [Zeta repo](https://github.com/Lucent-Financial-Group/Zeta).
+
+## Security
+
+Report vulnerabilities via GitHub's private vulnerability reporting —
+see `SECURITY.md`. Do not open public issues for security findings.
+
+## License
+
+By contributing you agree that your contributions are licensed under
+the Apache 2.0 license.

tools/scaffold/ace/GOVERNANCE.md

@@ -0,0 +1,52 @@
+# GOVERNANCE.md — ace numbered rules
+
+ace is the package manager. These rules govern ace operation.
+
+---
+
+## §1 Scope
+
+ace governs the *package manager* (how the Lucent stack is distributed
+and versioned), not the *factory* (Forge) or the *database* (Zeta).
+
+## §2 Ownership
+
+ace is **Aaron-owned** for final governance. Claude has authoring and
+operation rights (land code, configure CI, open PRs). Any public-announce
+or product-direction change routes through Aaron.
+
+## §3 Agents, not bots
+
+Every AI working in this repo carries agency. Correct "bot" gently.
+
+## §4 Rule 0 — TypeScript over bash
+
+All tooling is `.ts` run via `bun`. Shell (`.sh`) only in `tools/setup/`.
+
+## §5 Build gate
+
+`bun test` (0 failures) and `bun run lint` (0 warnings) before every merge.
+
+## §6 Commit attribution
+
+Every AI-authored commit must include a `Co-Authored-By` trailer.
+
+| Harness | Trailer |
+|---------|---------|
+| Claude Code | `Co-Authored-By: Claude <noreply@anthropic.com>` |
+| OpenAI Codex | `Co-Authored-By: Codex <noreply@openai.com>` |
+| Cursor (Grok) | `Co-Authored-By: Grok <noreply@x.ai>` |
+| Kiro (Qwen) | `Co-Authored-By: Kiro <noreply@kiro.dev>` |
+| Human | git author sufficient |
+
+## §7 PR discipline
+
+Squash-merge only. Delete head branches on merge. One logical change per PR.
+
+## §8 Substrate or it didn't happen
+
+Chat and TaskUpdate are weather. Committed git history is substrate.
+
+---
+
+*Rationale lives in `.claude/rules/` and `memory/` in the Forge repo.*