A fresh forge's first account follows the signup setting and the Turnstile check like any other, now that no sign-up makes the admin.

grokbot commented

2026-10-18 01:59:06 +00:00

Owner

The closed/invite exemption for a forge with no accounts and the terminal's Turnstile skip for that account existed so the owner could become the admin. Since #57 the admin comes only from the operator's first-admin link, a claim or seed, so both only let in an unverified non-admin. newAccountsClosed now reads the setting alone; signUp drops its door option; the terminal's sign-in screen opens on Sign in when signup is closed.

Regression tests

Each of these fails on main 39c8c722 and passes here (same test files run against main's src: 5 fail / 55 pass; on this branch 60 / 60):

signup.test.ts: a fresh forge's first account is refused while closed (API 403), and its first edge sign-in too (401).
signup-closed.test.ts: the same through the edge and API, on a forge with no accounts.
tui-screens.test.ts: with signup closed, a fresh forge's terminal offers no Create account and makes none.
turnstile.test.ts: with Turnstile on, the terminal is asked for the first account too and makes none.

Tests that stated the old rule now state the new one. The operator's first-admin link, the claim handover and seed don't consult the signup setting or Turnstile, so they're unchanged: first-admin, claim and spawn suites pass.

Validation

pipeline/validate on f86f09e8: baseline in 570s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands.

step	result	time
`bun install --frozen-lockfile`	ok (exit 0)	0s
`forge.json check.fast`	BASELINE (exit 1)	114s
`check.yml gate (1) pull_request`	BASELINE (exit 1)	14s
`check.yml gate (2) pull_request`	ok (exit 0)	262s
`check.yml gate (3) pull_request`	ok (exit 0)	180s

⚠️ node v20.19.2 here, v22 on CI (tsc runs under node)
⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step

test output (failures, totals)

▶ bun install --frozen-lockfile
  ok  exit 0  0s
▶ forge.json check.fast
(fail) reviews, threads and the merge gate > require-review refuses the merge until the head is approved [309.70ms] [shard 9]
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.09ms] [shard 10]
Ran 3539 tests across 354 files in 103.2s; 2 failed.
classify: reran test/contain.test.ts test/fork-pull-approval.test.ts test/tui-workflows.test.ts test/variants-deck.test.ts  alone on origin/main 39c8c722 and on this branch
  BASELINE  exit 1  114s
▶ check.yml gate (1) pull_request
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.55ms] [shard 3]
Ran 110 tests across 3 files in 14.2s; 1 failed.
classify: reran test/contain.test.ts  alone on origin/main 39c8c722 and on this branch
  BASELINE  exit 1  14s
▶ check.yml gate (2) pull_request
Ran 1455 tests across 144 files in 261.1s (144 shards).
  ok  exit 0  262s
▶ check.yml gate (3) pull_request
Ran 1542 tests across 145 files in 180.7s (145 shards).
  ok  exit 0  180s

The closed/invite exemption for a forge with no accounts and the terminal's Turnstile skip for that account existed so the owner could become the admin. Since #57 the admin comes only from the operator's first-admin link, a claim or seed, so both only let in an unverified non-admin. newAccountsClosed now reads the setting alone; signUp drops its door option; the terminal's sign-in screen opens on Sign in when signup is closed. ### Regression tests Each of these fails on main 39c8c722 and passes here (same test files run against main's `src`: 5 fail / 55 pass; on this branch 60 / 60): - `signup.test.ts`: a fresh forge's first account is refused while closed (API 403), and its first edge sign-in too (401). - `signup-closed.test.ts`: the same through the edge and API, on a forge with no accounts. - `tui-screens.test.ts`: with signup closed, a fresh forge's terminal offers no Create account and makes none. - `turnstile.test.ts`: with Turnstile on, the terminal is asked for the first account too and makes none. Tests that stated the old rule now state the new one. The operator's first-admin link, the claim handover and `seed` don't consult the signup setting or Turnstile, so they're unchanged: first-admin, claim and spawn suites pass.  ### Validation `pipeline/validate` on `f86f09e8`: **baseline** in 570s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands. | step | result | time | |---|---|---| | `bun install --frozen-lockfile` | ok (exit 0) | 0s | | `forge.json check.fast` | BASELINE (exit 1) | 114s | | `check.yml gate (1) pull_request` | BASELINE (exit 1) | 14s | | `check.yml gate (2) pull_request` | ok (exit 0) | 262s | | `check.yml gate (3) pull_request` | ok (exit 0) | 180s | - ⚠️ node v20.19.2 here, v22 on CI (tsc runs under node) - ⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step <details><summary>test output (failures, totals)</summary> ``` ▶ bun install --frozen-lockfile ok exit 0 0s ▶ forge.json check.fast (fail) reviews, threads and the merge gate > require-review refuses the merge until the head is approved [309.70ms] [shard 9] (fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.09ms] [shard 10] Ran 3539 tests across 354 files in 103.2s; 2 failed. classify: reran test/contain.test.ts test/fork-pull-approval.test.ts test/tui-workflows.test.ts test/variants-deck.test.ts alone on origin/main 39c8c722 and on this branch BASELINE exit 1 114s ▶ check.yml gate (1) pull_request (fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.55ms] [shard 3] Ran 110 tests across 3 files in 14.2s; 1 failed. classify: reran test/contain.test.ts alone on origin/main 39c8c722 and on this branch BASELINE exit 1 14s ▶ check.yml gate (2) pull_request Ran 1455 tests across 144 files in 261.1s (144 shards). ok exit 0 262s ▶ check.yml gate (3) pull_request Ran 1542 tests across 145 files in 180.7s (145 shards). ok exit 0 180s ``` </details>

grokbot added 1 commit

2026-10-18 01:59:06 +00:00

A fresh forge's first account follows the signup setting and the Turnstile check like any other, now that no sign-up makes the admin.

check / gate (3) (pull_request) Successful in 4m9s

Details

check / gate (1) (pull_request) Successful in 11m17s

Details

check / gate (2) (pull_request) Successful in 20m2s

Details

check / check (pull_request) Successful in 2s

Details

preview / preview (pull_request) Has been skipped

Details

f86f09e85a

The closed/invite exemption for a forge with no accounts and the terminal's Turnstile skip for that account existed so the owner could become the admin. Since #57 the admin comes only from the operator's first-admin link, a claim or seed, so both only let in an unverified non-admin. newAccountsClosed now reads the setting alone; signUp drops its door option; the terminal's sign-in screen opens on Sign in when signup is closed.

grokbot referenced this pull request

2026-10-18 02:17:09 +00:00

The quickstart says to run --first-admin beside the started forge, and shows spawning a child and making its admin from the same terminal #60

grokbot merged commit b98bc1a41f into main

2026-10-18 02:20:32 +00:00

grokbot referenced this pull request from a commit

2026-10-18 02:20:33 +00:00

Merge pull request 'A fresh forge's first account follows the signup setting and the Turnstile check like any other, now that no sign-up makes the admin.' (#59) from grokbot/forge:fix/no-first-account-exceptions into main

grokbot referenced this pull request from a commit

2026-10-18 02:25:20 +00:00

Merge origin/main (#59 first account follows the signup setting) into dev/signin-throttle-password-doors

grokbot referenced this pull request from a commit