page:docs-specs-platform-gaps-phase0-g4-npmjs-org-runbook
G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4) reference
The spec asks for a fabricstack organization on the public npm registry that publishes nothing, has 2FA required and membership restricted to the owner, purely so that nobody else can claim the @fabricstack scope. Creating the org is a human action with the company's npmjs account; nothing in this repository automates it and nothing is ever published there (D19).
G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)
**Status (2026-09-28): PENDING OWNER ACTION — scope @fabricstack is free on public npmjs as of 2026-09-28 (evidence below); the fabricstack organization has not been created yet.**
The spec asks for a fabricstack organization on the public npm registry that publishes nothing, has 2FA required and membership restricted to the owner, purely so that nobody else can claim the @fabricstack scope. Creating the org is a human action with the company's npmjs account; nothing in this repository automates it and nothing is ever published there (D19).
Evidence that `@fabricstack` is free (read-only, no authentication, 2026-09-28T16:44:59Z)
| Probe | Result |
|---|---|
curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/-/org/fabricstack/user | 404 (no org/user of that name) |
curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/fabricstack | 404 (no unscoped package of that name) |
curl -s "https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20" | total: 0 — no @fabricstack/* package |
curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/@fabricstack%2fsmoke | 404 |
curl -s https://registry.npmjs.org/-/user/org.couchdb.user:fabricstack | 401 {"ok":false} — this endpoint answers 401 for every unauthenticated user lookup (calibrated against the existing user defimessiah, also 401), so it is not usable as evidence either way |
Calibration on the same day, same probes for the previously chosen name agentfabric: org/user 200, unscoped package 200, search 5 results. Automated check: node scripts/ci/publish-isolation-guard.cjs --g4-status (informational, exit 0) prints unregistered for @fabricstack.
History: why the scope was re-locked
The scope originally proposed in spec 15 §2 was @agentfabric. Preparing this runbook under WP-RN-04 found it **third-party-owned** on npmjs: @agentfabric/sdk 1.0.1 (maintainer defimessiah, created 2026-03-18, "Agent Fabric SDK - Decentralized cloud for AI agents", MIT), the unscoped package agentfabric 0.0.2 (maintainer mdirshadengineer, created 2026-04-25, "AgentFabric CLI"), and /-/org/agentfabric/user → 200. On npmjs a scope belongs to the user or organization of the same name, so that org could not be created by us, and every consumer without the Artifact Registry routing line would have resolved our names against a stranger's packages. At breakpoint phase0.npmjs-org on 2026-09-28 the owner chose "Re-lock to @fabricstack"; the re-lock (one constant, .npmrc, fixtures, smoke package, docs) is recorded in scope-relock.md. This file is the only phase-0 record that still spells the old scope, deliberately, as history.
Registration procedure (human action, never automated)
Prerequisites: an npmjs account owned by the company (not a personal account), a hardware or app 2FA factor for it, and node scripts/ci/publish-isolation-guard.cjs --g4-status still printing unregistered immediately before you start (someone else may claim the name at any time; if it no longer prints unregistered, stop and raise a new breakpoint).
1. Sign in at https://www.npmjs.com/login with the company account (2FA enabled on the account first: Account → Two-Factor Authentication → "Authorization and Publishing"). 2. Create the organization: https://www.npmjs.com/org/create, name fabricstack, plan **Free** (unlimited public packages — irrelevant, nothing is published; do not choose a paid plan, private npmjs packages are forbidden by D19 as well). 3. Organization settings (https://www.npmjs.com/settings/fabricstack/): - Members: leave the owner as the sole member with role **Owner**; add nobody; create no teams beyond the default developers team, and remove any package access from it. - Security: enable **Require two-factor authentication** for all members. - Billing: none. 4. Publish **nothing**. Do not create a placeholder package; do not run npm publish with any @fabricstack/* name; do not create an automation or granular access token for the org. The org exists only as a tombstone. 5. Record the org URL https://www.npmjs.com/org/fabricstack and the owning account in docs/specs/platform-gaps/phase0/publish-guards.md (G4 row) and in the Gate B name-lock record (WP-RN-13).
Verification (read-only):
npm org ls fabricstack # as the owner: exactly one member, role owner
curl -s -o /dev/null -w '%{http_code}\n' https://registry.npmjs.org/-/org/fabricstack/user # 200 once the org exists
curl -s "https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20" # must list no @fabricstack/* package
node scripts/ci/publish-isolation-guard.cjs --g4-status # registered-no-packagesThe publish-isolation guards do not depend on G4: G1/G2/G3/G6 keep @fabricstack/* off npmjs whether or not the org exists. G4 only removes the squatting risk for a scope nobody else holds — which, for @fabricstack, is the case today and is exactly why the registration should not wait.