feat(forge): P38 F1 server skeleton, auth, bootstrap CLI

.github/workflows/ci.yml

@@ -52,6 +52,20 @@ jobs:
       - name: doc
         run: cargo doc --workspace --no-deps
 
+  # sc-forge conformance (P38): replays the recorded Gitea contract against the in-tree
+  # server, bootstrapped the way Engine bootstraps Gitea (admin CLI, then serve). Only
+  # the exchanges the built slices answer run; crates/forge/conformance/slice-pending.json
+  # lists the rest and shrinks as slices land.
+  forge-conformance:
+    name: sc-forge conformance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@2fe4ca74464c5902a4f6e302d0a619b4ea911ccc # 1.96.1
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
+      - name: check
+        run: bash crates/forge/conformance/forge-check.sh
+
   # Advisory (not a required context): proves the Windows build and the owner-only
   # ACL on .sc/local-key, the `sc keygen` identity and the TLS serve key (#214,
   # #281). Deliberately not `cargo test --workspace`; the wider suite still has

.github/workflows/sbom.yml

@@ -49,6 +49,7 @@ jobs:
         run: |
           mkdir -p sbom-out
           cp crates/cli/sc_bin.cdx.json sbom-out/
+          cp crates/forge/sc-forge_bin.cdx.json sbom-out/
           cp apps/desktop/src-tauri/scl-desktop_bin.cdx.json sbom-out/
           cp apps/desktop/desktop-frontend.cdx.json sbom-out/
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

CLAUDE.md

@@ -49,7 +49,10 @@ reaching for TLS elsewhere, add a function to `tlsio` instead. **Object-store
 SDKs must stay quarantined in `objio`** — if you find yourself reaching for
 S3 elsewhere, add a function to `objio` instead. **`repo` must not depend on
 `gitio`** — `cli` links both and passes imported snapshots down; `repo` stays
-Git-agnostic.
+Git-agnostic. **`forge` (the `sc-forge` Git forge, P38, unix-only) is a third top-level adapter
+and may link only `{crypto, core}`** — never `repo`, `vfs` or `gitio` (hosted
+repositories are plain Git); HTTP, SQLite and process supervision stay confined
+to it, and password hashing and token generation live in `crypto`.
 
 ## Core invariants (do not break)
 

Cargo.toml

@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["crates/core", "crates/vfs", "crates/gitio", "crates/crypto", "crates/repo", "crates/cli", "crates/tlsio", "crates/objio", "apps/desktop/src-tauri"]
+members = ["crates/core", "crates/vfs", "crates/gitio", "crates/crypto", "crates/repo", "crates/cli", "crates/tlsio", "crates/objio", "crates/forge", "apps/desktop/src-tauri"]
 exclude = ["vendor/glib-0.18.5-patched", "fuzz"]
 
 # Tauri 2's Linux GTK3 stack is pinned to glib 0.18.5, whose VariantStrIter
@@ -36,3 +36,10 @@ too_many_arguments = "allow"    # deliberate: commit/snapshot-assembly fns
 
 [profile.release]
 lto = true
+
+# Argon2 is deliberately slow; unoptimised it makes every password test take
+# seconds. Optimise the hashing crates only, the rest keeps debug info.
+[profile.dev.package.argon2]
+opt-level = 3
+[profile.dev.package.blake2]
+opt-level = 3

ROADMAP.md

@@ -701,8 +701,9 @@ a Gitea-compatible Git forge (bare repos over smart HTTP, a recorded subset of
 `/api/v1`, SQLite metadata) so a platform can swap its project Git host by
 config. Design:
 `docs/superpowers/specs/2026-10-22-p38-forge-design.md`. Slices F0 (contract
-capture) through F6 (acceptance on the first deployment). Hosted repos are bare
-Git and get none of the `.sc/` features.
+capture) through F6 (acceptance on the first deployment); F0 and F1 (server
+skeleton, users, organizations, tokens, `admin` CLI) are built. Hosted repos are
+bare Git and get none of the `.sc/` features.
 
 Other follow-up work is tracked as GitHub issues and listed under Deferred
 below.

crates/crypto/Cargo.toml

@@ -17,6 +17,7 @@ blake3 = "1.8.5"
 hex = "0.4.3"
 thiserror = "2.0.18"
 ed25519-dalek = "3.0.0"
+argon2 = "0.5"
 
 [dev-dependencies]
 rand_chacha = "0.3"