Audit remediation: docs/config truth, CI gates, silent-failure wiring, trust-layer completion

.env.example

@@ -65,11 +65,12 @@ DATABASE_URL=postgresql+psycopg://forge:change-me@localhost:5432/forge
 # Redis (queue, cache, sessions)
 REDIS_URL=redis://localhost:6379/0
 
-# Object storage (MinIO / S3-compatible)
+# Object storage (MinIO / S3-compatible). Only the root credentials are consumed
+# today — by the compose `minio` service (`${MINIO_ROOT_USER}`/`${MINIO_ROOT_PASSWORD}`).
+# Endpoint/bucket wiring is PARKED with the object-storage scope: no code reads
+# MINIO_ENDPOINT / MINIO_BUCKET yet, so they are omitted until they are wired.
 MINIO_ROOT_USER=forge
 MINIO_ROOT_PASSWORD=change-me
-MINIO_ENDPOINT=http://localhost:9000
-MINIO_BUCKET=forge-artifacts
 
 # Auth (Better Auth / Auth.js)
 AUTH_SECRET=change-me-generate-a-long-random-string
@@ -86,13 +87,30 @@ API_KEY_PEPPER=
 # Beat cadence for the expired platform-key purge (seconds; default 15m).
 FORGE_AUTH_PURGE_KEYS_INTERVAL_SECONDS=900
 
-# BYOK model provider (provider-agnostic; Anthropic reference impl)
-MODEL_PROVIDER=anthropic
-MODEL_PROVIDER_KEY=
-EMBEDDING_PROVIDER=anthropic
-EMBEDDING_MODEL=
-RERANKER_URL=http://localhost:8080
-RERANKER_MODEL=jina-reranker-v2-base-multilingual
+# ---------------------------------------------------------------------------
+# BYOK model provider (provider-agnostic; Anthropic reference impl). UNSET by
+# default: with no FORGE_MODEL_PROVIDER the worker runs the offline, deterministic
+# ScriptedModelClient (canned output, no network) and logs a WARNING each run.
+# Uncomment + fill these in to drive a real provider.
+# ---------------------------------------------------------------------------
+# Master switch: anthropic | openai. Absent -> offline scripted fallback.
+# FORGE_MODEL_PROVIDER=anthropic
+# Model name. Optional for anthropic (a reference default is applied); REQUIRED
+# for openai.
+# FORGE_MODEL_NAME=
+# BYOK key. The provider-native ANTHROPIC_API_KEY / OPENAI_API_KEY takes
+# precedence; FORGE_MODEL_API_KEY is the provider-agnostic fallback.
+# FORGE_MODEL_API_KEY=
+
+# Multi-agent coordinator (supervised runs). Required `true` to enable; when false,
+# supervised runs escalate to a human with reason `multi_agent_disabled`.
+# MULTI_AGENT_ENABLED=false
+
+# Embeddings for hybrid-retrieval evaluation (OpenAI-compatible embedder), shown
+# with the built-in defaults; override to point at another endpoint.
+# EMBEDDING_MODEL=text-embedding-3-small
+# EMBEDDING_BASE_URL=https://api.openai.com/v1
+# EMBEDDING_DIM=1536
 
 # HARD-03 live cross-encoder reranker (BYOK). Provider `fixture` (default) keeps
 # the offline deterministic reranker; `jina`/`cohere`/`selfhosted` build a
@@ -131,8 +149,7 @@ FORGE_GRAFANA_WEBHOOK_SECRET=
 # in the bundled incident.yaml, not an env var).
 FORGE_INCIDENT_RECOVERY_WINDOW_SECONDS=300
 FORGE_INCIDENT_RECOVERY_MAX_WINDOWS=6
-# MinIO bucket for versioned postmortem snapshots.
-FORGE_POSTMORTEMS_BUCKET=forge-postmortems
+# Postmortem-snapshot bucket: PARKED with the object-storage scope (no reader yet).
 
 # External PM adapters (F18 — Jira, Linear). OAuth client creds are optional
 # (api_token auth works without them). Webhook bodies for these routes MUST reach
@@ -177,7 +194,24 @@ FORGE_SANDBOX_MAX_TTL_SECONDS=21600
 # Service URLs (used by web / inter-service calls)
 API_URL=http://localhost:8000
 MCP_GATEWAY_URL=http://localhost:8001
-NEXT_PUBLIC_API_URL=http://localhost:8000
+# Browser REST API base. Inlined into the web bundle at BUILD time (NEXT_PUBLIC_*),
+# so a runtime env var is too late for the client. Leave UNSET for the common
+# cases: the client auto-derives a same-origin `https://<page-host>/api` in the
+# browser (the edge strips `/api` and routes it to the API — see
+# docs/self-hosting/reverse-proxy.md), and keeps `http://localhost:8000` on the
+# local `next dev` server (:3000). Set it ONLY when the API is NOT same-origin —
+# an absolute value (e.g. `https://api.example.com`) is used verbatim, a relative
+# value (e.g. `/api`) resolves against the page origin — and set it as a BUILD
+# arg; a runtime env var alone is too late.
+# NEXT_PUBLIC_API_URL=http://localhost:8000
+# Realtime (board push + spec co-editing) WebSocket endpoint. Inlined into the
+# web bundle at BUILD time (NEXT_PUBLIC_*). Leave UNSET for the common cases:
+# the client auto-derives a same-origin `wss://<page-host>/ws` in the browser
+# (which the edge routes to the API — see docs/self-hosting/reverse-proxy.md),
+# and keeps `ws://localhost:8000/ws` on the local `next dev` server (:3000).
+# Set it ONLY when the WS endpoint is NOT same-origin (e.g. a dedicated realtime
+# host), and set it as a BUILD arg — a runtime env var alone is too late.
+# NEXT_PUBLIC_WS_URL=wss://forge.example.com/ws
 
 # MCP sync-and-index (F20) — periodic ingestion of MCP resources into the index.
 MCP_INDEX_POLL_SECONDS=300

.github/workflows/ci.yml

@@ -241,7 +241,7 @@ jobs:
         run: uv run pytest -m live_slack -q
 
   web:
-    name: web (lint + build)
+    name: web (lint + types + tests + build)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -263,6 +263,16 @@ jobs:
       - name: Lint
         run: pnpm -r lint
 
+      # The web package ships 89 vitest files and a `tsc --noEmit` typecheck that
+      # previously only ran in the (unreachable) release workflow. Gate both on
+      # every PR/push, after lint and before build, so a type error or a broken
+      # component test blocks the merge instead of shipping.
+      - name: Type-check (tsc)
+        run: pnpm --filter @forge/web typecheck
+
+      - name: Test (vitest)
+        run: pnpm --filter @forge/web test
+
       - name: Build
         run: pnpm -r build
 

.github/workflows/release.yml

@@ -189,15 +189,24 @@ jobs:
              cp CHANGELOG.md RELEASE_NOTES.md
 
       # --- Publish the GitHub Release (gh CLI, GITHUB_TOKEN) --- #
+      # Draft by default: a tag push always creates a draft (the `inputs`
+      # context is empty on a non-workflow_dispatch trigger, so the first
+      # disjunct short-circuits `true`); only an explicit `workflow_dispatch`
+      # run with draft=false produces a published (non-draft) release.
       - name: Create GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_IS_DRAFT: ${{ (github.event_name != 'workflow_dispatch') || inputs.draft }}
         run: |
+          DRAFT_FLAG=""
+          if [ "$RELEASE_IS_DRAFT" = "true" ]; then
+            DRAFT_FLAG="--draft"
+          fi
           gh release create "${GITHUB_REF_NAME}" \
             --title "${GITHUB_REF_NAME}" \
             --notes-file RELEASE_NOTES.md \
-            --draft \
+            $DRAFT_FLAG \
             release/sbom/forge-source.cdx.json \
             deploy/sbom/*.cdx.json \
             deploy/build-manifest.json \

.github/workflows/security.yml

@@ -5,6 +5,15 @@
 #
 # Third-party (and official actions/*) actions are pinned to a full commit SHA
 # with a human-readable version comment, so a moved tag cannot alter what runs.
+#
+# NOTE — intentional overlap with ci.yml's `security` job: that job runs the
+# same scanners (bandit, pip-audit, gitleaks) plus semgrep + SBOM + the
+# enforcement-matrix suite as part of the full green gate. This workflow is
+# kept as a separate, minimal-permission (contents: read only), fast-to-review
+# check so the core secret/SAST/dependency gate can be reasoned about (and
+# required in branch protection) independently of the rest of CI. Do not
+# de-duplicate one into the other without checking branch-protection required
+# status checks first.
 name: security
 
 on:

CHANGELOG.md

@@ -17,6 +17,42 @@ sections by hand; write a well-formed commit instead.
 
 ### Added
 
+- **self-eval**: enforce the gate on config changes + worker-driven run (Phase A wiring) (#66)
+- **self-eval**: baseline persistence + live agent-backed eval runner (Phase A substrate) (#65)
+- Self-Eval Gate — block config changes that regress a workspace's private per-repo suite (trust-layer 4/4) (#64)
+- Red-Team Gate (trust layer, phase 3) — adversary must break the change in-sandbox before the human gate (#63)
+- Time-Travel Runs (trust layer, phase 2) — deterministic record-replay of agent runs (#62)
+- Attested Changesets (trust layer, phase 1) — signed provenance chained into the tamper-evident audit log (#61)
+- OIDC SSO + marketplace publish + benchmark leaderboard + under-dev banner (#57)
+- frontend UX pass — clearer IA/nav, one primary action, progressive disclosure, empty/loading/error states, a11y (#39)
+- IaC — OpenTofu infra/ (Hetzner control-plane + Cloudflare + Fly agents), dev/staging/prod, remote state, runbook (#38)
+- F40 deferred-scope deltas — PM adapters (BYO board), MCP, policy, automations, sprint depth, observability (#37)
+- realtime co-editing (WS server + CRDT spec co-editing + live push) (#36)
+- Spec Studio — dual-format spec authoring (Guided/Markdown/YAML/Read), BYOK AI draft, lifecycle, versioning (#33)
+- adaptive orchestration (auto model routing + per-role effort + settings + cost-by-tier) (#32)
+- public-readiness — under-dev banner, honest status, live spec dashboard (#30)
+- **web/walkthrough**: In-app guided walkthrough
+- **web/workflow-editor**: Workflow visual editor
+- **web/pm-integrations**: PM integrations
+- **web/rbac-admin**: Multi-team & RBAC admin
+- **web/sso-settings**: SSO / SCIM settings
+- **web/deployment-gates**: Deployment gates
+- **web/audit-log**: Audit viewer
+- **web/sprints**: Sprints & velocity
+- **web/observability**: Observability & cost
+- **web/incidents**: Incidents
+- **web/marketplace**: Marketplace
+- **web/spec-dashboard**: Spec-validation dashboard
+- **web/run-trace-viewer**: Run-trace viewer
+- **web/approval-inbox**: Approval inbox
+- **web/board-depth**: Board depth
+- **HARD-06**: live-slack
+- **HARD-05**: live-mcp-server
+- **HARD-03**: live-reranker
+- **HARD-02**: live-model-byok
+- **HARD-01**: live-github-app
+- **HARD-08**: kubernetes-helm-deploy
+- **HARD-12**: release-engineering
 - **HARD-10**: observability-cost-prod
 - **HARD-04**: real-eval-corpus
 - **HARD-11**: reliability-maturity
@@ -62,3 +98,7 @@ sections by hand; write a well-formed commit instead.
 - **phase0**: 0.3 contracts (packages/contracts)
 - **phase0**: 0.2 data-model (packages/db)
 - **phase0**: 0.1 workspace+tooling
+
+### Fixed
+
+- **config**: document real FORGE_MODEL_* env vars and warn on scripted-client fallback

Makefile

@@ -14,7 +14,8 @@ MYPY_PACKAGES := \
 	forge_contracts forge_db forge_workflow forge_agent forge_coordinator \
 	forge_spec forge_board forge_knowledge forge_integrations forge_mcp \
 	forge_policy forge_authz forge_skill forge_eval forge_approval forge_api \
-	forge_worker forge_mcp_gateway forge_orchestration_policy
+	forge_worker forge_mcp_gateway forge_orchestration_policy \
+	forge_deploy forge_auth forge_marketplace forge_obs
 
 help: ## Show available targets
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
@@ -125,8 +126,10 @@ hooks: ## Install the commit-msg hook that enforces Conventional Commits (cz che
 	@chmod +x .git/hooks/commit-msg
 	@echo "Installed .git/hooks/commit-msg (uv run cz check)."
 
-release-readiness: ## Run the automated RELEASE_READINESS gate at the PRODUCTION bar
-	uv run forge-release-readiness --bar production
+BAR ?= beta
+
+release-readiness: ## Run the automated RELEASE_READINESS gate at BAR (default: beta; override with BAR=production)
+	uv run forge-release-readiness --bar $(BAR)
 
 source-sbom: ## Generate the source-tree CycloneDX SBOM (release/sbom/forge-source.cdx.json)
 	release/scripts/source-sbom.sh

README.md

@@ -7,7 +7,7 @@
 > ⚠️ **Under active development — pre-1.0, not production-ready.** Forge is shared
 > openly for **evaluation and testing**, not for production use yet. Expect rough
 > edges, changing APIs, and features that are API/CLI-first with their UI or live
-> integrations still landing. Read **[Status](#status)** for the honest per-area
+> integrations pending. Read **[Status](#status)** for the honest per-area
 > state before you rely on it, and please contribute via pull request.
 
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](./LICENSE)
@@ -36,12 +36,13 @@ Forge is **pre-1.0 and under active development** — usable for evaluation and
 self-host testing, **not yet for production**. The backend platform, HTTP API,
 CLI, workflow/agent runtime, and self-hosting substrate are the mature surface,
 exercised by a large test suite (~3,700 tests on real pgvector Postgres, green
-in CI). The **web UI ships 15 feature screens** (board, approvals, run-trace
-viewer, spec dashboard, marketplace, incidents, observability, sprints, audit,
-deployment gates, SSO/SCIM, RBAC admin, PM integrations, workflow editor, and a
-guided walkthrough) on the Forge design system. Some screens carry **honestly
-marked gaps** where a backend projection or live credential is still landing
-(e.g. a couple of dashboard projections, OIDC), and the
+in CI). The **web UI ships 15 feature screens** — `approvals`, `audit`,
+`board`, `deployments`, `depth`, `incidents`, `leaderboard`, `marketplace`,
+`observability`, `runs`, `settings` (SSO/OIDC/SCIM, RBAC, PM integrations,
+model BYOK), `specs`, `sprints`, `walkthrough`, and `workflow` — on the Forge
+design system. Some screens carry **honestly marked gaps** where a backend
+projection or live credential is pending (e.g. a couple of dashboard
+projections), and the
 third-party integrations (GitHub App, model BYOK, reranker, MCP, Slack) are
 code-complete with tests + runbooks but need **your keys** to verify live. We
 try hard not to advertise anything that is only parked — the pre-1.0 notice at
@@ -54,9 +55,10 @@ individual screens mark in-progress areas inline.
 - **Spec-driven development** — author a `manifest.yaml` spec; the spec engine
   validates it and drives the work. Includes a spec-validation dashboard.
 - **Agent runtime** — a LangGraph agent loop that runs work inside sandboxed
-  execution (Docker today; gVisor / Firecracker isolation classes are modelled
-  and mapped, with the real-runtime tiers gated behind a virtualization-enabled
-  CI job).
+  execution (`worktree` git-worktree isolation by default, a per-task Docker
+  `container` sandbox also available; gVisor / Firecracker isolation classes
+  are modelled and mapped, with the real-runtime tiers gated behind a
+  virtualization-enabled CI job).
 - **Multi-agent coordination** — a coordinator for fanning work across agents.
 - **Workflow engine** — a Postgres finite-state-machine workflow layer, with
   Temporal available in the production stack for durable orchestration.
@@ -65,13 +67,14 @@ individual screens mark in-progress areas inline.
 - **Native project board** — a board core for tracking runs and work items.
 - **Policy, skill, integration & MCP SDKs** — declarative `.forge/policy.yaml`,
   skill profiles, integration definitions, and an MCP gateway for tool sources.
-- **Integration marketplace** — browse and install integrations (UI shipped;
-  publishing still via the offline author CLI).
-- **Enterprise SSO / SCIM** — SAML SSO and SCIM provisioning with an admin UI
-  (OIDC and live IdP verification still landing).
+- **Integration marketplace** — browse, install, and publish integrations
+  from the in-app UI (the offline `forge marketplace package` CLI works too).
+- **Enterprise SSO / SCIM** — SAML SSO and OIDC, plus SCIM provisioning, with
+  an admin UI (live IdP verification needs your own IdP, like the third-party
+  integrations above).
 - **Human approval system** — gated approvals for sensitive agent actions.
-- **Benchmark leaderboard** — submit, verify, and rank agent benchmark runs
-  (backend; **UI in progress**).
+- **Benchmark leaderboard** — submit, verify, and rank agent benchmark runs,
+  with a public leaderboard UI.
 - **Auth, secrets & BYOK** — envelope-encrypted secrets, a key vault, and
   bring-your-own-key model-provider credentials.
 - **Observability & cost metrics + audit log** — structured, redaction-aware
@@ -133,6 +136,7 @@ forge/
 │   ├── workflow-engine/         # forge_workflow
 │   ├── agent-runtime/           # forge_agent
 │   ├── multi-agent-coordinator/ # forge_coordinator
+│   ├── orchestration-policy/    # forge_orchestration_policy
 │   ├── spec-engine/             # forge_spec
 │   ├── board-core/              # forge_board
 │   ├── knowledge-core/          # forge_knowledge

RELEASE_READINESS.md

@@ -2,8 +2,8 @@
 
 - **Target bar:** Beta
 - **Overall verdict:** ❌ **NOT MET**
-- **Generated (UTC):** 2026-07-10T16:14:12Z
-- **Commit:** `34d48693fe97ca9c29845949573b0a9da29ea897`
+- **Generated (UTC):** 2026-07-21T04:40:04Z
+- **Commit:** `16974346f379a6e1cc2761ab90bef50b4decf910`
 - **Version (cz):** `0.1.0`
 
 > A bar is **MET** only when every gate at-or-below it is `GREEN` or `MANUAL_ATTESTED`. `SKIPPED_NO_CREDS`, `MISSING_EVIDENCE`, `STALE`, `MANUAL_PENDING`, and `RED` all mean **NOT MET** — the engine never infers a pass.
@@ -12,16 +12,16 @@
 
 | Gate | Blocker | Workstream | Status | Evidence (cmd/artifact) | Last-checked |
 |---|---|---|---|---|---|
-| `G-DB` | #6 | HARD-01 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m postgres -q packages/db | 2026-07-10T16:14:12Z |
-| `G-MODEL` | #1 | HARD-02 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q apps/api -k model_provider | 2026-07-10T16:14:12Z |
-| `G-RAG-REAL` | #2 | HARD-04 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m realeval -q | 2026-07-10T16:14:12Z |
-| `G-GH` | #1 | HARD-05 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q -k github_app | 2026-07-10T16:14:12Z |
-| `G-MCP` | #1 | HARD-06 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q -k mcp_live | 2026-07-10T16:14:12Z |
-| `G-SLACK` | #1 | HARD-07 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q -k slack_live | 2026-07-10T16:14:12Z |
-| `G-BUILD` | #3 | HARD-08 | 🟢 GREEN | deploy/build-manifest.json | 2026-07-10T16:14:12Z |
-| `G-TYPES` | #6 | HARD-12 | 🟢 GREEN | make typecheck | 2026-07-10T16:14:12Z |
-| `G-SEC-AUTOMATED` | #4 | HARD-09 | 🟢 GREEN | uv run pytest -m security -q | 2026-07-10T16:14:12Z |
-| `G-CRYPTO` | #5 | HARD-10 | 🟢 GREEN | uv run pytest -q apps/api/tests/test_auth_crypto_envelope.py apps/api/tests/test_cli_secrets.py | 2026-07-10T16:14:12Z |
+| `G-DB` | #6 | HARD-01 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m postgres -q packages/db | 2026-07-21T04:40:04Z |
+| `G-MODEL` | #1 | HARD-02 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q apps/api -k model_provider | 2026-07-21T04:40:04Z |
+| `G-RAG-REAL` | #2 | HARD-04 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m realeval -q | 2026-07-21T04:40:04Z |
+| `G-GH` | #1 | HARD-05 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q -k github_app | 2026-07-21T04:40:04Z |
+| `G-MCP` | #1 | HARD-06 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q -k mcp_live | 2026-07-21T04:40:04Z |
+| `G-SLACK` | #1 | HARD-07 | ⏭️ SKIPPED_NO_CREDS | uv run pytest -m integration -q -k slack_live | 2026-07-21T04:40:04Z |
+| `G-BUILD` | #3 | HARD-08 | 🟢 GREEN | deploy/build-manifest.json | 2026-07-21T04:40:04Z |
+| `G-TYPES` | #6 | HARD-12 | 🟢 GREEN | make typecheck | 2026-07-21T04:40:04Z |
+| `G-SEC-AUTOMATED` | #4 | HARD-09 | 🟢 GREEN | uv run pytest -m security -q | 2026-07-21T04:40:04Z |
+| `G-CRYPTO` | #5 | HARD-10 | 🟢 GREEN | uv run pytest -q apps/api/tests/test_auth_crypto_envelope.py apps/api/tests/test_cli_secrets.py | 2026-07-21T04:40:04Z |
 
 ## Verdict