{
  "id": "page:docs-specs-platform-gaps-phase0-g4-npmjs-org-runbook",
  "_kind": "Page",
  "_file": "wiki/docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook.md",
  "_cluster": "wiki",
  "attributes": {
    "nodeKind": "Page",
    "sourcePath": "docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook.md",
    "sourceKind": "repo-docs",
    "title": "G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)",
    "displayName": "G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)",
    "slug": "docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook",
    "articlePath": "wiki/docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook.md",
    "article": "\n# G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)\n\n**Status (2026-09-28): PENDING OWNER ACTION — scope `@fabricstack` is free on public npmjs as of 2026-09-28 (evidence below); the `fabricstack` organization has not been created yet.**\n\nThe spec asks for a `fabricstack` organization on the public npm registry that publishes nothing, has 2FA required and membership restricted to the owner, purely so that nobody else can claim the `@fabricstack` scope. Creating the org is a human action with the company's npmjs account; nothing in this repository automates it and nothing is ever published there (D19).\n\n## Evidence that `@fabricstack` is free (read-only, no authentication, 2026-09-28T16:44:59Z)\n\n| Probe | Result |\n|---|---|\n| `curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/-/org/fabricstack/user` | `404` (no org/user of that name) |\n| `curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/fabricstack` | `404` (no unscoped package of that name) |\n| `curl -s \"https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20\"` | `total: 0` — no `@fabricstack/*` package |\n| `curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/@fabricstack%2fsmoke` | `404` |\n| `curl -s https://registry.npmjs.org/-/user/org.couchdb.user:fabricstack` | `401 {\"ok\":false}` — this endpoint answers `401` for every unauthenticated user lookup (calibrated against the existing user `defimessiah`, also `401`), so it is not usable as evidence either way |\n\nCalibration on the same day, same probes for the previously chosen name `agentfabric`: org/user `200`, unscoped package `200`, search 5 results. Automated check: `node scripts/ci/publish-isolation-guard.cjs --g4-status` (informational, exit 0) prints `unregistered` for `@fabricstack`.\n\n## History: why the scope was re-locked\n\nThe scope originally proposed in spec 15 §2 was `@agentfabric`. Preparing this runbook under WP-RN-04 found it **third-party-owned** on npmjs: `@agentfabric/sdk` 1.0.1 (maintainer `defimessiah`, created 2026-03-18, \"Agent Fabric SDK - Decentralized cloud for AI agents\", MIT), the unscoped package `agentfabric` 0.0.2 (maintainer `mdirshadengineer`, created 2026-04-25, \"AgentFabric CLI\"), and `/-/org/agentfabric/user` → `200`. On npmjs a scope belongs to the user or organization of the same name, so that org could not be created by us, and every consumer without the Artifact Registry routing line would have resolved our names against a stranger's packages. At breakpoint `phase0.npmjs-org` on 2026-09-28 the owner chose \"Re-lock to `@fabricstack`\"; the re-lock (one constant, `.npmrc`, fixtures, smoke package, docs) is recorded in `scope-relock.md`. This file is the only phase-0 record that still spells the old scope, deliberately, as history.\n\n## Registration procedure (human action, never automated)\n\nPrerequisites: an npmjs account owned by the company (not a personal account), a hardware or app 2FA factor for it, and `node scripts/ci/publish-isolation-guard.cjs --g4-status` still printing `unregistered` immediately before you start (someone else may claim the name at any time; if it no longer prints `unregistered`, stop and raise a new breakpoint).\n\n1. Sign in at `https://www.npmjs.com/login` with the company account (2FA enabled on the account first: Account → Two-Factor Authentication → \"Authorization and Publishing\").\n2. Create the organization: `https://www.npmjs.com/org/create`, name `fabricstack`, plan **Free** (unlimited public packages — irrelevant, nothing is published; do not choose a paid plan, private npmjs packages are forbidden by D19 as well).\n3. Organization settings (`https://www.npmjs.com/settings/fabricstack/`):\n   - Members: leave the owner as the sole member with role **Owner**; add nobody; create no teams beyond the default `developers` team, and remove any package access from it.\n   - Security: enable **Require two-factor authentication** for all members.\n   - Billing: none.\n4. Publish **nothing**. Do not create a placeholder package; do not run `npm publish` with any `@fabricstack/*` name; do not create an automation or granular access token for the org. The org exists only as a tombstone.\n5. Record the org URL `https://www.npmjs.com/org/fabricstack` and the owning account in `docs/specs/platform-gaps/phase0/publish-guards.md` (G4 row) and in the Gate B name-lock record (WP-RN-13).\n\nVerification (read-only):\n\n```bash\nnpm org ls fabricstack                                   # as the owner: exactly one member, role owner\ncurl -s -o /dev/null -w '%{http_code}\\n' https://registry.npmjs.org/-/org/fabricstack/user   # 200 once the org exists\ncurl -s \"https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20\"                 # must list no @fabricstack/* package\nnode scripts/ci/publish-isolation-guard.cjs --g4-status                                      # registered-no-packages\n```\n\nThe publish-isolation guards do not depend on G4: G1/G2/G3/G6 keep `@fabricstack/*` off npmjs whether or not the org exists. G4 only removes the squatting risk for a scope nobody else holds — which, for `@fabricstack`, is the case today and is exactly why the registration should not wait.\n",
    "documents": []
  },
  "outgoingEdges": [],
  "incomingEdges": [
    {
      "from": "page:docs",
      "to": "page:docs-specs-platform-gaps-phase0-g4-npmjs-org-runbook",
      "kind": "contains_page"
    }
  ]
}