ecosystem-init

/ecosystem-init — Onboard an Ecosystem (once per fork)

The once-per-fork ceremony that configures a NEW ecosystem (canon, or a client fork that copied the loom↔build↔use ecosystem). One of the three onboarding surfaces — distinct from /enroll (once per operator) and /onboard (read-only, every session); see (loom-internal reference). The three share ZERO write-authority: /onboard writes nothing, /enroll writes roster + local-links, /ecosystem-init writes the ecosystem-config + genesis trust-root.

Usage: /ecosystem-init (no args; runs in the current fork's loom checkout)

Strictly dependency-ordered BEFORE this command, for a client fork: /clean-instantiate — the once-per-clone CLEAR ceremony (.claude/commands/clean-instantiate.md) — MUST have run to a 0-exit fail-closed assert-zero gate on any repo templated or cloned FROM canon. C3 below re-anchors genesis to the CLIENT's owner; it MUST NOT run over a clone that still carries canon's trust-identity (roster, journal, ecosystem.json) at rest — re-anchoring on top of un-cleared identity leaves canon's substrate readable underneath the new root. Canon itself (never cloned FROM anything) has no such precursor and runs /ecosystem-init directly. For a client whose clone is not yet clear, /ecosystem-init is NOT the first command to run — /clean-instantiate is.

Strictly dependency-ordered after this command: an operator runs /enroll (identity), then /onboard (reads each session). /ecosystem-init does NOT silently enroll the initiating operator — it hands off to /enroll (C5). Procedure detail (input prompts, the D6 schema field set, the disclosure-scan invocation shape, the genesis-ceremony call) lives in .claude/skills/43-ecosystem-init/SKILL.md per cc-artifacts.md Rule 3; this command is the entry point.

The five invariants (load-bearing — the redteam surface)

1. C1 disclosure gate fires BEFORE the ecosystem-config write. The config names real org slugs (the #255/#252 disclosure class). node .claude/bin/scan-synced-disclosure.mjs --check --root <fork-checkout> MUST run and exit 0 BEFORE .claude/bin/ecosystem.json is written; ANY finding → HALT, genericize + relocate, re-scan. Placement does not proceed on a non-zero exit (the artifact-flow.md Intake-Scrub shape, applied at ecosystem-config write time). The scan covers the SURROUNDING synced surface, NOT ecosystem.json's own slugs (the scan runs BEFORE the config is written, and the scanner self-excludes the config at loom-source) — those slugs are fenced by PATH (invariant 5: loom-only never-synced + publish-excluded), not by this scrub (the SKILL § "Disclosure isolation" carries the full nuance).
2. Human gate confirms the org slugs. For a CLIENT fork, the human MUST confirm each slug points at the CLIENT's org, never canon's — a fork AUTHORS its OWN ecosystem.json (it never inherits canon's; the structural basis of cross-ecosystem isolation, D6 plan §A1). Automated org-slug placement is BLOCKED.
3. Genesis trust-root is established via the EXISTING ceremony. C3 invokes .claude/hooks/lib/genesis-ceremony.js::runEnrollmentCeremony (the org-owned-bootstrap path, multi-operator-coordination.md §6 + §1 issue-#358 relaxation) — it does NOT re-implement genesis. Owner-class gate; fail-CLOSED (any failed gh-api verification refuses to anchor). On a client fork, C3 MUST NOT run until /clean-instantiate's fail-closed assert-zero gate has exited 0 (see above) — the CLEAR precedes the establish-new-root step it gates.
4. C5 does NOT silently enroll the initiating operator. The ceremony ends by handing off to /enroll; enrolling the operator is /enroll's job, gated separately (knowledge-convergence.md MUST-5 forbids /onboard-class commands auto-running roster/genesis writes for an operator).
5. ecosystem.json is ecosystem-private by path. It is written to .claude/bin/ecosystem.json — committed-but-never-synced (sync-manifest.yaml::loom_only), never-published (publish-to-public.mjs EXCLUDE+KILL), and scanner-self-excluded ONLY at loom-source (REPO_ROOT_ACTIVE === REPO_ROOT); a DESTINATION --root scan of another repo DOES scan a stray copy, failing loud on bare org slugs — the belt-and-suspenders backstop. A fork carries its OWN file; no canon→client sync path exists, so canon org slugs cannot travel into a client (D6 plan §4 fence-i).