II.
Page overview
Reference · livepage:docs-specs-platform-gaps-phase0-g4-npmjs-org-runbook
G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4) overview
Inspect the raw attributes, linked wiki pages, and inbound or outbound graph edges for page:docs-specs-platform-gaps-phase0-g4-npmjs-org-runbook.
Attributes
nodeKind
Page
sourcePath
docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook.md
sourceKind
repo-docs
title
G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)
displayName
G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)
slug
docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook
articlePath
wiki/docs/specs/platform-gaps/phase0/g4-npmjs-org-runbook.md
article
# G4 runbook: defensive npmjs scope registration (spec 15 §4.3 G4)
**Status (2026-09-28): PENDING OWNER ACTION — scope `@fabricstack` is free on public npmjs as of 2026-09-28 (evidence below); the `fabricstack` organization has not been created yet.**
The spec asks for a `fabricstack` organization on the public npm registry that publishes nothing, has 2FA required and membership restricted to the owner, purely so that nobody else can claim the `@fabricstack` scope. Creating the org is a human action with the company's npmjs account; nothing in this repository automates it and nothing is ever published there (D19).
## Evidence that `@fabricstack` is free (read-only, no authentication, 2026-09-28T16:44:59Z)
| Probe | Result |
|---|---|
| `curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/-/org/fabricstack/user` | `404` (no org/user of that name) |
| `curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/fabricstack` | `404` (no unscoped package of that name) |
| `curl -s "https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20"` | `total: 0` — no `@fabricstack/*` package |
| `curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/@fabricstack%2fsmoke` | `404` |
| `curl -s https://registry.npmjs.org/-/user/org.couchdb.user:fabricstack` | `401 {"ok":false}` — this endpoint answers `401` for every unauthenticated user lookup (calibrated against the existing user `defimessiah`, also `401`), so it is not usable as evidence either way |
Calibration on the same day, same probes for the previously chosen name `agentfabric`: org/user `200`, unscoped package `200`, search 5 results. Automated check: `node scripts/ci/publish-isolation-guard.cjs --g4-status` (informational, exit 0) prints `unregistered` for `@fabricstack`.
## History: why the scope was re-locked
The scope originally proposed in spec 15 §2 was `@agentfabric`. Preparing this runbook under WP-RN-04 found it **third-party-owned** on npmjs: `@agentfabric/sdk` 1.0.1 (maintainer `defimessiah`, created 2026-03-18, "Agent Fabric SDK - Decentralized cloud for AI agents", MIT), the unscoped package `agentfabric` 0.0.2 (maintainer `mdirshadengineer`, created 2026-04-25, "AgentFabric CLI"), and `/-/org/agentfabric/user` → `200`. On npmjs a scope belongs to the user or organization of the same name, so that org could not be created by us, and every consumer without the Artifact Registry routing line would have resolved our names against a stranger's packages. At breakpoint `phase0.npmjs-org` on 2026-09-28 the owner chose "Re-lock to `@fabricstack`"; the re-lock (one constant, `.npmrc`, fixtures, smoke package, docs) is recorded in `scope-relock.md`. This file is the only phase-0 record that still spells the old scope, deliberately, as history.
## Registration procedure (human action, never automated)
Prerequisites: an npmjs account owned by the company (not a personal account), a hardware or app 2FA factor for it, and `node scripts/ci/publish-isolation-guard.cjs --g4-status` still printing `unregistered` immediately before you start (someone else may claim the name at any time; if it no longer prints `unregistered`, stop and raise a new breakpoint).
1. Sign in at `https://www.npmjs.com/login` with the company account (2FA enabled on the account first: Account → Two-Factor Authentication → "Authorization and Publishing").
2. Create the organization: `https://www.npmjs.com/org/create`, name `fabricstack`, plan **Free** (unlimited public packages — irrelevant, nothing is published; do not choose a paid plan, private npmjs packages are forbidden by D19 as well).
3. Organization settings (`https://www.npmjs.com/settings/fabricstack/`):
- Members: leave the owner as the sole member with role **Owner**; add nobody; create no teams beyond the default `developers` team, and remove any package access from it.
- Security: enable **Require two-factor authentication** for all members.
- Billing: none.
4. Publish **nothing**. Do not create a placeholder package; do not run `npm publish` with any `@fabricstack/*` name; do not create an automation or granular access token for the org. The org exists only as a tombstone.
5. Record the org URL `https://www.npmjs.com/org/fabricstack` and the owning account in `docs/specs/platform-gaps/phase0/publish-guards.md` (G4 row) and in the Gate B name-lock record (WP-RN-13).
Verification (read-only):
```bash
npm org ls fabricstack # as the owner: exactly one member, role owner
curl -s -o /dev/null -w '%{http_code}\n' https://registry.npmjs.org/-/org/fabricstack/user # 200 once the org exists
curl -s "https://registry.npmjs.org/-/v1/search?text=%40fabricstack&size=20" # must list no @fabricstack/* package
node scripts/ci/publish-isolation-guard.cjs --g4-status # registered-no-packages
```
The publish-isolation guards do not depend on G4: G1/G2/G3/G6 keep `@fabricstack/*` off npmjs whether or not the org exists. G4 only removes the squatting risk for a scope nobody else holds — which, for `@fabricstack`, is the case today and is exactly why the registration should not wait.
documents
[]
Outgoing edges
None.
Incoming edges
contains_page1
- page:docs·PageBabysitter Docs