Filed from infra#87 and infra#122 (both closing). Scaffolding moved here from dma-cli per the 2026-08-05 decision — dma-cli has no scaffold command under any name, and its scope is now auth / code / models. This verb is the choke point where a generated repo can be prevented from ever shipping CI-red.
Part 1 — smoke gate (infra#87)
Goal: a repo generated from a template can never ship CI-red. Five checks at generation time:
task check passes in the generated tree
workflow YAML on: is not accidentally a string (the classic on: push → true YAML 1.1 trap)
go.mod Go version pin matches what the template's CI image actually provides
DockerfileFROM version matches the same
CDN-vs-vendored asset choice is consistent with the template's declared intent
Generation should fail loudly rather than emit a repo that goes red on its first push.
Part 2 — dry-run gate (ADR-0005 F-A2)
F-A2 was an open fork of infra's ADR-0005: scaffold performs remote stateful actions (creates a Gitea repo, wires GitOps/Flux/ESO, sets topics and secrets) with no dry-run and no gate. That fork is re-homed here, because this verb is where those actions happen.
Wanted: a dry-run mode that reports exactly what would be created or mutated remotely, without doing it. dma-cli's Layer B already models the pattern — WritePolicy with ConfirmRequireYes / ConfirmPrompt / ConfirmAutoApprove. Worth mirroring the shape rather than inventing a second one.
Why it matters
Both halves protect the same thing: scaffolding is the highest-leverage surface in the estate, since every future repo inherits whatever it emits. A wrong template propagates silently; a remote stateful action with no dry-run is unreviewable before the fact.
Acceptance
The 5 checks run at generation time and fail generation on violation
Dry-run reports remote actions without performing them
A deliberately broken template is proven to fail generation (mechanically, not just wired)
Refs
infra#87, infra#122 (both closed against this)
infra ADR-0005 F-A2 (docs/decisions/ADR-0005-agentic-dev-platform-three-layer-model.md)
infra docs/superpowers/specs/2026-08-11-backlog-verification.md
Filed from infra#87 and infra#122 (both closing). Scaffolding moved here from dma-cli per the 2026-08-05 decision — dma-cli has no scaffold command under any name, and its scope is now `auth` / `code` / `models`. This verb is the choke point where a generated repo can be prevented from ever shipping CI-red.
## Part 1 — smoke gate (infra#87)
Goal: **a repo generated from a template can never ship CI-red.** Five checks at generation time:
1. `task check` passes in the generated tree
2. workflow YAML `on:` is not accidentally a string (the classic `on: push` → `true` YAML 1.1 trap)
3. `go.mod` Go version pin matches what the template's CI image actually provides
4. `Dockerfile` `FROM` version matches the same
5. CDN-vs-vendored asset choice is consistent with the template's declared intent
Generation should fail loudly rather than emit a repo that goes red on its first push.
## Part 2 — dry-run gate (ADR-0005 F-A2)
F-A2 was an open fork of infra's ADR-0005: **scaffold performs remote stateful actions** (creates a Gitea repo, wires GitOps/Flux/ESO, sets topics and secrets) with no dry-run and no gate. That fork is re-homed here, because this verb is where those actions happen.
Wanted: a dry-run mode that reports exactly what would be created or mutated remotely, without doing it. dma-cli's Layer B already models the pattern — `WritePolicy` with `ConfirmRequireYes` / `ConfirmPrompt` / `ConfirmAutoApprove`. Worth mirroring the shape rather than inventing a second one.
## Why it matters
Both halves protect the same thing: scaffolding is the highest-leverage surface in the estate, since every future repo inherits whatever it emits. A wrong template propagates silently; a remote stateful action with no dry-run is unreviewable before the fact.
## Acceptance
- [ ] The 5 checks run at generation time and fail generation on violation
- [ ] Dry-run reports remote actions without performing them
- [ ] A deliberately broken template is proven to fail generation (mechanically, not just wired)
## Refs
- infra#87, infra#122 (both closed against this)
- infra ADR-0005 F-A2 (`docs/decisions/ADR-0005-agentic-dev-platform-three-layer-model.md`)
- infra `docs/superpowers/specs/2026-08-11-backlog-verification.md`
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Filed from infra#87 and infra#122 (both closing). Scaffolding moved here from dma-cli per the 2026-08-05 decision — dma-cli has no scaffold command under any name, and its scope is now
auth/code/models. This verb is the choke point where a generated repo can be prevented from ever shipping CI-red.Part 1 — smoke gate (infra#87)
Goal: a repo generated from a template can never ship CI-red. Five checks at generation time:
task checkpasses in the generated treeon:is not accidentally a string (the classicon: push→trueYAML 1.1 trap)go.modGo version pin matches what the template's CI image actually providesDockerfileFROMversion matches the sameGeneration should fail loudly rather than emit a repo that goes red on its first push.
Part 2 — dry-run gate (ADR-0005 F-A2)
F-A2 was an open fork of infra's ADR-0005: scaffold performs remote stateful actions (creates a Gitea repo, wires GitOps/Flux/ESO, sets topics and secrets) with no dry-run and no gate. That fork is re-homed here, because this verb is where those actions happen.
Wanted: a dry-run mode that reports exactly what would be created or mutated remotely, without doing it. dma-cli's Layer B already models the pattern —
WritePolicywithConfirmRequireYes/ConfirmPrompt/ConfirmAutoApprove. Worth mirroring the shape rather than inventing a second one.Why it matters
Both halves protect the same thing: scaffolding is the highest-leverage surface in the estate, since every future repo inherits whatever it emits. A wrong template propagates silently; a remote stateful action with no dry-run is unreviewable before the fact.
Acceptance
Refs
docs/decisions/ADR-0005-agentic-dev-platform-three-layer-model.md)docs/superpowers/specs/2026-08-11-backlog-verification.md