title: "DevForge & Plux Ecosystem Capture Walkthrough"
version: "2026-07-13.1"
status: "execution guide - devforge namespaces secured"

DevForge & Plux Ecosystem Capture Walkthrough

Read first: This runbook outlines the deployment steps used to capture the DevForge Turborepo to the @kaaterskillsawmill organization, and secure the namespaces for QBits, DCoop, and Plux.

1. DevForge Namespace Preparation

All internal DevForge workspace packages were successfully scoped to ensure they deploy under the correct organization.

• packages/cli/package.json -> @kaaterskillsawmill/devforge-cli
• packages/sdk/package.json -> @kaaterskillsawmill/devforge-sdk
• packages/types/package.json -> @kaaterskillsawmill/devforge-types
• packages/registry/package.json -> @kaaterskillsawmill/devforge-registry
• packages/web/package.json -> @kaaterskillsawmill/devforge-web

2. Publish Workflow Setup

The OIDC-authenticated publish.yml was successfully injected into .github/workflows/publish.yml, mirroring the high-security posture established by the DevLuxe claim.

3. The Claim Execution Path

Generate NPM Token

Create a temporary GitHub secret to authenticate the publish workflow.

gh secret set NPM_TOKEN -R katterskillsawmill/devforge --env npm-publish

Dispatch the Publish Workflow

Execute the GitHub Action to claim the 5 newly-scoped packages.

gh workflow run publish.yml -R katterskillsawmill/devforge -f target=npm

Verify DevForge Claim

Test the global availability of the CLI package to ensure the namespaces are secure.

npx @kaaterskillsawmill/devforge-cli --help

4. Next Targets: Namespaces We Actually Own

Corrected 2026-07-15. This section previously planned to reserve @dcoop and @plux. Both belong to third parties and cannot be reserved:

• @dcoop — held by another account. This is why every @dcoop/* publish returned E404: npm returns 404 for a scope you lack access to rather than revealing that it exists. For months that read as "the org does not exist yet", so the fix was mis-stated as "create the org".
• @plux — held by another account. The unscoped plux package has belonged to a different maintainer since 2015.

Ship from the namespaces we own:

Reminder: Do not attempt to claim the root openclaw namespace, as it belongs to external OSS maintainers. Any bridges should be scoped as @ktrskl/openclaw-bridge.

The rule this section learned the hard way: verify a namespace is free before planning to reserve it. GET https://registry.npmjs.org/-/org/<name>/package returns {"error":"Scope not found"} when the scope is available; anything else means somebody already holds it. The openclaw reminder above got this right — the same check was simply never applied to @dcoop or @plux.

Artifact Maintenance Checklist

• [x] Source Markdown exists in walkthroughs/.
• [x] Publishing engine generated Markdown, HTML, DOCX, PDF, manifest JSON, and SHA256 sums.
• [x] Generated HTML passed the tutorial verifier.
• [x] Portal walkthrough index links to the generated HTML, PDF, DOCX, Markdown, manifest, and SHA sums.