fix(002): stop shipping the template website/ into produced apps

[bartekus]

Problem

Every produced tenant app shipped with the template's own Docusaurus documentation site (website/, baseUrl: /template-encore/, title: acme-vue-encore) at its repo root. That site documents template-encore itself; it has no runtime role in a generated app.

Root cause: the born-with carry-forward classifier (adapters/acme-vue-encore/scripts/lib/born-with.ts) is whitelist-by-default. Any top-level entry not in a skip set falls through classifyEntry to the 'app' classification and is copied into the produced app. website/ was in no skip set, so it leaked, and nothing tested for its absence.

Fix

• Add 'website' to GENERATOR_ARTIFACT_TOP_LEVEL (the same treatment as scripts / modules / orchestration / .derived).
• Seed a website/ entry in the synthetic baseline fixture (makeBaselineFixture) and add a negative assertion to setup-app.test.ts, so the drop is actually exercised rather than vacuously true.

Deliberately not touched

• requirements/ stays: it is the factory pipeline's output location (per stagecraft importArtifacts.ts, which deliberately excludes it from knowledge ingestion), not a leak.
• specs/ 000-018 stays: it is the intended born-with spec kernel that the produced app's own CI (spec-spine index check, coupling) needs.

Verification

• All 19 setup-app carry-forward tests pass (including the new website assertion).
• Full local CI green: typecheck + 185 tests + lockstep (14 pinned units verified against the baseline).
• Coupling gate clean (the scripts/ files are not spec-claimed paths).

[github-actions]

AI Code Review

Coupling gate violation

specs/002-encore-generator-core/spec.md line 103 explicitly names GENERATOR_ARTIFACT_TOP_LEVEL as the canonical carry classifier (a spec-claimed code path). Adding 'website' to that set in born-with.ts is a behavioral change to a governed constant. The diff contains no changes under specs/. Per the coupling-gate discipline, the owning spec.md must change in the same PR; without it, spec-spine couple will flag a stale claim and the coupling gate will be red.

Fix: Add a line to specs/002-encore-generator-core/spec.md documenting that website/ (the template's own Docusaurus docs site) is classified as a generator artifact and excluded from produced apps. A one-sentence addition to the GENERATOR_ARTIFACT_TOP_LEVEL paragraph at FR-001 is sufficient.

---

Everything else looks correct

• Logic: Adding the literal string 'website' to a ReadonlySet that guards top-level directory names is the right, minimal fix. No path-traversal risk; the set contains simple names used only in equality checks against path.basename results at the copy-walk boundary.
• Test fixture: writeFile(root, 'website/docusaurus.config.ts', ...) correctly seeds the fixture, and the assertion fs.existsSync(path.join(dest, 'website')) correctly verifies absence. Coverage is adequate.
• Lockstep (baseline.lock.json): Does not reference GENERATOR_ARTIFACT_TOP_LEVEL or the born-with set. No update needed.
• Comment style: The multi-line // continuation in born-with.ts is visually detached from its entry. Not a bug, but the house style prefers minimal comments; a single trailing comment would be cleaner.

---

Automated review by Claude. Diff size: 13 lines.

[github-actions]

AI Code Review

Review

No security issues

The change adds a single string to a ReadonlySet<string> used as a membership filter. It introduces no new path operations, external inputs, or string construction.

No lockstep concern

baseline.lock.json pins only template-encore's own app-invariant specs (001-encore-app-architecture and 002-security-data-invariants in the template's numbering). 002-encore-generator-core is a factory-encore meta-spec and is not in the pin; the spec amendment here does not trigger a lockstep failure.

Coupling gate: satisfied

born-with.ts + spec.md + the derived shard hash all move together in one PR. The amendment is dated 2026-07-09; the fixture and test land in the same commit. No gap.

Style violations (house rules)

CLAUDE.md: "Never write multi-paragraph docstrings or multi-line comment blocks — one short line max."

Three violations in this diff:

born-with.ts - 4-line inline comment on the 'website' entry:

'website', // Docusaurus documentation site FOR the template itself (baseUrl
// `/template-encore/`, title `acme-vue-encore`): template-dev docs with no
// runtime role in a produced app. Without this it fell through to the default
// `app` classification and shipped into every generated repo.

Should be trimmed to one line, e.g. // template-dev Docusaurus site; no role in a produced app.

setup-app.test.ts - 2-line comment block before the loop; trim to one line.

test-helpers.ts - 2-line comment block on the fixture writeFile; trim to one line.

Logic: correct set

GENERATOR_ARTIFACT_TOP_LEVEL is the right home for website/. The classifyEntry priority chain is: SKIP_ANYWHERE -> GENERATOR_ARTIFACT_TOP_LEVEL -> specs/ special case -> BORN_WITH_KERNEL_TOP_LEVEL -> default 'app'. website/ is not a governance substrate (BORN_WITH_KERNEL_TOP_LEVEL) and is not node_modules/.git (SKIP_ANYWHERE), so this set is the only correct placement.

Minor: spec amendment meta-commentary

The last line of the spec amendment ("Couples the born-with policy change to its owning spec per the coupling gate") is process narration, not a spec requirement. Strip it; the amendment content above it already demonstrates the coupling.

---

Automated review by Claude. Diff size: 30 lines.