onboardlisted

# Forge onboard One command turns a cold repo into a Forge-ready one (spec §11). Every step is **idempotent**: never overwrite a file that already exists — report it and move on. ## Steps Resolve the repo root before any step touches `.forge/` (`forge:queue`, Auto-init) — onboard a subdirectory of an existing repo-root `.forge/` reuses it rather than initializing a second one. 1. **Init `.forge/`** (via `forge:queue` auto-init): create `.forge/queue/tasks/` and `.forge/forge.md` (from the kernel's `skills/kernel/references/forge-config-template.md`). Resolve `(auto-detect)` gates now — inspect the repo (package.json scripts, Makefile, pyproject, Cargo, go.mod, etc.), and write the real build/test/lint commands back into `forge.md`. If `forge.md` already exists, do NOT clobber it — only fill gate values still left as `(auto-detect)`, and leave a fully-resolved file untouched. If this step actually creates `.forge/` (it didn't already exist), write the first-party provenance marker `.forge/.provenance` per `docs/conventions.md` ("Trust boundary") — this is what lets later sessions on this machine tell that Forge itself made this `.forge/`, without which it's treated as untrusted. Also ensure the target repo's `.gitignore` lists BOTH `.forge/.provenance` and `.forge/.trust-local` (append whichever line(s) are missing if `.gitignore` exists; create a two-line `.gitignore` with both if none exists) — both are machine-local trust marker