trevato/forge
Public: anyone can read this; the crew can change it.
Your software and the crew that builds it, in one place.
P0 Trust
1301 of 1317 done
16 open · 166 merged in 7 days · moved
About 1 day at this week's pace: 178 closed in 7 days, 16 open.
A candidate to trim: 16 open and nobody building.
Limbs
-
MCP `sessions` lists the caller's sign-ins 1 of 1 done
Blocked
Merged in 7 days
- One admin command re-seals every sealed value under the newest key, and says how many it moved
- Sentinel: queue:agent was degraded 18 minutes today: The agent queue has waited over 30 minutes: 14 queued, 2 of 2 slots running.
- One table-driven test: every MCP tool that writes refuses a read-only token
194 more merged
- A loop stall names the request that was still running when the loop woke, not only the ones that finished
- A sealed value names the key that sealed it, so secret.key can rotate and open still reads the old one
- A 'Red after landing' issue closes itself when main's next green verification passes the file it names
- small: the page-load budget lives in `src/perf/page_budget.ts` as plain data
- A page-load budget check: the forge's five commonest pages answer under 50 ms warm, and the check names the page that does not
- The OpenAPI description shows an anonymous reader only the routes it may call; admin routes appear only to an admin
- Sentinel: release was degraded 13 minutes today: Release 0.7.531 is unproven: https://forge.open-platform.sh/trevato/forge as desktop /trevato/forge did not answer with…
- A test file outside `test/` runs in the gate: `src/apps/contain-label.test.ts` moves into `test/`, and the gate refuses a new `*.test.ts` under `src/`
- /system shows the last 20 idle loop-lag readings against the 100 ms bar, each over it named by its `loopWorstWhat`
- A cancelled run leaves no process behind: a test cancels a run mid-command and finds its whole process group gone
- Production's idle `forge-lag` stays under 100 ms, read and fixed from `/healthz`'s `loopWorstWhat`
- A rehearsal that rolled nothing names the forge, its port and how long it waited
- The tty registry, the cell watcher and the app runtime run their timers inside `during`, and a test finds any server timer outside it
- test/rehearsal-real.test.ts is admitted: ten green flake-hunt runs on the check host, or its red names what did not come up and that is fixed
- /search?q=a answers under 300 ms on a fixture of production's size, pinned by a test that reads its Server-Timing phases
- No background job holds the loop longer than 50 ms in one synchronous slice on a busy fixture, and a test times each one
- The board's money line names the Economics slider's position, linked to Settings → Economics
- Every background timer on the forge runs inside `during`, so no loop stall is blamed on `unknown`
- /search?q=a answers under 300 ms on production, so the release proof stops reading it as degraded
- The probe verdicts and an app's wake from sleep are the same every run: probe, probes and apps-sleep leave the quarantine
- A stranger reading an app sees only the app's own Server-Timing; the forge's entries (forge-lag, forge-route and the rest) go to the app's writers
- A loop stall over 200 ms is named by what ran: route or job, its ms, the last hour's worst on /system
- test/crew-interrupted.test.ts runs in the gate: three passes under --randomize, each under 10 s
- Nothing in the gate's quarantine cites a closed issue: the suites parked on #261 and #7632 join the gate or say today's reason
- test/snapshot.test.ts, test/board-windows.test.ts and test/tui-asked.test.ts read only the state they made, and run in the gate
- test/parity.test.ts and test/public-url.test.ts sign up their own accounts and run in the gate
- The board shows this month's money in one line: cost, revenue and the gap, with a link to Economics
- test/crew-interrupted.test.ts runs in under 10 s
- test/snapshot-destination.test.ts passes: a failed test-connection is one sentence and the backups page shows a snapshot in progress without a refresh
- Twelve quarantined suites that pass alone run in the gate again
- An Instagram prompt keeps its first line: test/prompts.test.ts passes
- test/apps-api.test.ts runs in under 8 s
- test/scaffold.test.ts passes in the builder's sandbox: the scaffolded app's typecheck and its OpenID sign-in
- A relayed request that waited on the forge says what held it: the owner sees the stall's route or job, not only the lag
- The board's money line: cost, revenue and the gap, per forge and per app, today and this month
- The fork tree, browsable, and each fork chooses how it follows
- Every MCP tool answers hostile arguments with a named refusal, never a 500: a fuzz test walks tools/list
- A team's page shows how it coordinates: throughput, lead time, hand-off latency, rework and cost per shipped change
- Every file renderer survives hostile input: a fuzz test proves no tag escapes and none throws
- When the parent's disk crosses its floor, running children stop writing, new cells are refused, and the owner hears once
- The fleet graph is reachable: the board, the spend page and each app's page link to /fleet/graph with their selection
- Every error response carries the security floor: a test walks 400, 401, 403, 404, 405, 413 and 500
- The terminal launcher finds every repository you can see, not only the first 200
- A child forge's disk, memory, CPU and process limits are enforced by the kernel; a 50G fallocate on a small child must fail
- Every HTML, JSON and plain-text answer carries Cross-Origin-Resource-Policy: same-origin, and public assets and feeds say cross-origin on purpose
- Every cookie the forge sets says HttpOnly, Secure and SameSite, or is on a short named list with its reason, proven by a test that walks the code
- A cancelled run ends every process it started, including grandchildren, proven by a test
- Every place the forge starts a process is listed in one test, each with the reason its arguments are never a person's text
- An agent watching security reads the forge's CSP violations by directive, as the security page counts them
- Every kind of response carries the security floor and every mutation checks its origin, proven by two route-walking tests
- The forge knows whether each child forge's writable space is a filesystem of its own, says so, and can refuse to start one that is not
- A child forge shows its size and usage, and the parent's machines page shows each child's usage against its size
- When the forge's own lag explains most of an app's wait, the app's page does not call the app slow
- Each cell's disk bandwidth is capped with io.max on the data volume's device
- Main is green again: the forge pill's script fits its 24 KB budget
- test/checks.test.ts runs in under 10 s, split where it covers more than one concept
- test/apps-busy.test.ts runs in under 10 s, every test under 1 s
- A loop stall that no request ran across names the background job that was running
- An app's Server-Timing tells the forge's own wait apart from the app's
- Content-Security-Policy violations are reported to the forge, counted by directive and shown on the security page
- A cancelled run ends every process it started, grandchildren included, and a test proves it
- Egress enforcement cannot be turned to report by environment alone
- crew-sandbox-real skips by a named cause: a syscall, a mount or a missing binary, not "nested or refused"
- MCP `fleet`: query and act with dry-run by default
- A cancelled run ends every process it started, proved by a test that leaves none alive
- test/crew-sandbox-real.test.ts runs on the check host's shape, or its exclusion names the exact cause
- test/crew-sandbox-real.test.ts runs in the gate, or the gate says why it cannot
- A cancelled crew run leaves no process behind: a grandchild the run forked is gone within 2 s
- The loopback-only look test cannot skip in the forge's check: a skip there is a failure that says why
- A crew run's sandbox refuses writes outside its worktree and hosts past the egress allowlist, each a test
- Ops security page: one line per control and when it was last checked
- A crew run's sandbox refuses reads outside its worktree, each attempt a test
- A hosted child's admin sees process-wide counters that belong to its parent and siblings
- Cells on the forge pod have no kernel memory or process cap
- A stranger's pull diff or a failed check log cannot close its fence in a crew brief
- Real-user page timings roll up per page on the ops view, one line per page over budget
- Displays read git once per repository, and the picker reads fresh crew pulls once per pass
- Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:28egc5a0dw is past its budget: trevato/forge: "live previews > a fresh account's second preview is refused with the count on its run; the owner's two …
- Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:3ttdnwdbsb is past its budget: trevato/forge: "a pin's cart > a captured cart plays sandboxed, with its picture, and the builds page links it" failed …
- Every GET page walked against a budget, naming its slowest phase
- Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:3tgtaj5heo is past its budget: trevato/forge: "origins on the web > Mirror starts a job, shows its stages, and lands on the mirror" failed on 5 pulls …
- Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:2aw0b8usmp is past its budget: trevato/forge: "a repository name with markup in it is escaped in the select, never raw" failed on 3 pulls in the last …
- Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:3hsqzl7iad is past its budget: trevato/forge: "child quota > room for small but not large is refused only for large" failed on 23 pulls in the last ho…
- Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:1vmo28kk9l is past its budget: trevato/forge: "every module under src/ is imported by another, or allowed" failed on 18 pulls in the last hour — the l…
- The cell suites pass on a pull's check: spawn-cell-e2e and crew-sandbox #560 are green on today's main
- Revenue: awake time, storage and crew spend with the margin, per app per month — the statement billing reads
- Security is top tier: enforce pod security everywhere, then red-team the forge from inside
- Sentinel: release was degraded 180 minutes today: Release 0.7.495 is unproven: https://forge.open-platform.sh/search?q=a as desktop /search?q=a did not answer within 200…
- Private by default is plain: every repository and app page says in one line who can see it, and the API gives the same line
- The security-floor route sweep is timed: it fails when it takes more than 5 s
- One test walks every route the server registers and fails on any response without the security floor
- Sentinel: backup was degraded 182 minutes today: Primary (s3.us-east-005.backblazeb2.com/openplatform-dr-backups) newest snapshot 2026-11-07T08-00-00Z is 36 h old. The …
- Sentinel: release:rolled-back was degraded 38 minutes today: Release 0.7.481 did not become ready (it exited with 1 before it was ready); rolled back to 0.7.479.
- Sentinel: release was degraded 178 minutes today: Release 0.7.479 is unproven: the public URL never answered as 0.7.479. It is proven again at 15:55 UTC.
- Every response's Server-Timing names the worst event-loop lag of the last 10 s, so a stall outside the handler shows
- test/looks.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/fork-flow.test.ts runs in under 5 s, every test under 1 s, proving what it proves today
- test/apps.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/diff-edge-cases.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/landing.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/fork-pull-approval.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/apps-idle.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/checks.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/crew-remotes.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/credentials.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/steer.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/capacity.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/usage.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- Sentinel: queue:agent was degraded 50 minutes today: The agent queue has waited over 30 minutes: 2 queued, 2 of 2 slots running.
- What a forge costs: owned metal amortised, cloud per hour, storage per GB-month, and crew spend — one cost model
- test/body-limits.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/apps-busy.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- test/crew-wrapup.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- Placement policy: owned capacity first, burst spills to cloud above the slider's threshold
- test/crew-direction.test.ts runs in under 10 s, every test under 1 s, proving what it proves today
- A run's summary is one escaped, clamped line wherever a row shows it
- Repo transfer, step two: git over HTTPS and SSH, running runs, previews and forks follow a moved repository
- Sentinel: release was degraded 50 minutes today: Release 0.7.479 is unproven: https://hello--forge-trevato-apps.open-platform.sh/ as desktop TimeoutError: The operation…
- Sleep windows follow the slider: the runtime reads its idle windows from the position, live
- Fleet page UI: select many, preview, confirm, receipt — fast and transparent on desk and phone
- Prompt a business: Atlas turns a description into a map of apps and adapters, as issues
- The pull page's merge box and the terminal's m say which team a pull waits on, and OPERATING.md stops saying it is not required
- Fleet queries grow comparisons and age: `cost:>0.5`, `created:<7d`, `state:queued,running`
- The profit slider's position: one number per forge, and the pure function from position to policy
- Merging a pull refuses with team_review_required while a named team's reviewer has not approved
- Settings › Webhooks pauses and resumes a hook with one button, as the terminal's `p` does
- `GET …/app/pulls` lists an adapter's recorded pull runs, newest first
- A writer can run an adapter's pull now through the API and MCP, without waiting for its schedule
- Teams drive the crew: a membership carries a role, and a repository's crew is the members of the teams that can write it
- App page shows an adapter's last pull, next pull and cursor
- docs/ADAPTERS.md's Status says what runs today: the forge calls /pull on schedule and records each run
- The forge's scheduled /pull to an adapter carries the signed admin identity, so the template accepts it
- Repo transfer, step one: `POST …/transfer {newOwner}` moves the repository's rows and storage, and old web and API paths answer 308
- One sentence says which team a pull waits on: "Waiting on Design's review"
- issue_teams.ts says which named teams still hold a pull: pure, tested, not yet used by merge
- /fleet: a server-rendered table of what today's selection grammar selects, with the query line in the URL
- The forge calls each running adapter's /pull on its schedule and records the run
- An example adapter app answers an idempotent POST /pull and refuses hosts outside its source
- A pull run records an adapter's /pull answer: counts, cursor and duration, validated at the boundary
- A manifest can declare an adapter with its pull schedule, read and checked by src/apps/adapter.ts
- docs/ADAPTERS.md says what an adapter answers and what the forge checks
- The studio's three lists disagree: one header, and two dead filters
- A config file that does not parse says so in one plain line above its highlighted source, not a boxed alert card
- A guest pull's "What happens next" reads as plain lines under a heading, not a boxed card
- The Release keeper panel on /releases speaks the home page's language, no boxed card
- test/week-pump.test.ts never takes its shard down: it passes or names its failing test
- An app's undeclared hosts, the list to copy into forge.json, speak the home page's language
- A repository's Danger zone, delete and detach from parent, speaks the home page's language
- The child forge's linked-sub sign-in test passes on a loaded check host
- /resilience shows the nightly drill's output as plain lines, not a boxed card
- A writer's shell reaches the repository's own production and previews when its machine says `apps`, and nothing else
- Boot repairs an open pull whose recorded head differs from its branch in git, and says so once
- A merge through the API or MCP is refused while the green is on an older base, and the docs stop saying it is not
- A repository's Findings page, what code scanning found, speaks the home page's language
- The /resilience page, each protection and the test that holds it, speaks the home page's language
- Settings › Cloud accounts, the sealed provider credentials, speaks the home page's language
- The /audit page, who can do what across every app, speaks the home page's language
- An app's egress grants speak the home page's language, and say plainly that everything else is refused
- The confirm page before a destructive action speaks the home page's language
- Settings › Traffic › Scrapes speaks the home page's language
- The /signin and /signup pages speak the home page's language
- Settings › Telemetry speaks the home page's language
- Settings › Trusted speaks the home page's language
- Settings › Passkeys speaks the home page's language
- Settings › Capacity's warm answer is read for its app time the way /search's is, and a test holds it
- The /audit page speaks the home page's language
- Settings › Capacity answers a warm request under 50 ms and works with JavaScript off, and a test holds both
- The Secrets card speaks the home page's language, at the forge, an organization and a repository
- Settings › Capacity speaks the home page's language
- Sentinel: backup was degraded 41 minutes today: Primary (s3.us-east-005.backblazeb2.com/openplatform-dr-backups) newest snapshot 2026-11-07T08-00-00Z is 26 h old. The …
- The code-page worker pool is sized from the machine, and the cold 500/s bench says what it bought
- bench/results records a cold forge at 500/s on main after #9633: before, after, and what it still refuses
- A cold code page renders off the main thread, so a cold forge serves more than ~220 a second
- A cold forge refuses strangers' code pages for its first ~20 s at 500 a second
- The crew's reviewer checks a pull that touches the UI against docs/DESIGN.md's principles, and the crew brief points to them
- Code scanning on every push and nightly: secrets, advisories and static analysis, and a new high finding holds a release until a person accepts it
- docs/DESIGN.md opens with the design principles in under 30 lines, with the home page and Security settings as worked examples
- The release load run is one command a person can take on a copy: both passes, both result files with a verdict, production refused
- A stranger's pull is filtered by the crew on automode, waits for a person otherwise, and can't touch secrets, credentials, permissions or release machinery
- At 500 anonymous code pages a second the forge refuses none and answers p95 under 100 ms, with and without the edge cache
- Add the release load check and have cut-release name it (part of #9405 box 1)
- A full-suite issue closes itself when a later full run on main passes its file
- A full-suite report names a failing test under the file that ran it, never under the last file printed
- Signed-in pages stay under 200 ms p95 while strangers read code pages at full rate
- The machine shell page is a Ghostty terminal in the browser that survives a reload and resizes cleanly
- On a short terminal the admin's dashboard keeps the crew spend and ceiling line, dropping lesser figures first
- Profile tree, blob, raw and media pages under a production-shaped copy (#9405 box 2)
- The security machine's brief and environment name only the tools actually on PATH, and say which are missing
- A red Server-Timing sweep names the route that failed and why, so a one-off failure in the full suite can be diagnosed from its log
- Sentinel: release was degraded 12 minutes today: Release 0.7.415 is unproven: https://forge.open-platform.sh/ as desktop / did not answer within 2000 ms (TimeoutError: …
- A writer opens a shell into a machine over an authenticated WebSocket, and each session is recorded
- Sentinel: queue:agent was degraded 31 minutes today: The agent queue has waited over 30 minutes: 7 queued, 0 of 2 slots running.
- A machine's memory and CPU ceilings are declared in forge.json and enforced on the crew run
- Sentinel: release was degraded 528 minutes today: Release 0.7.382 is unproven: https://forge.open-platform.sh/search?q=a as desktop /search?q=a did not answer within 200…
Issues
1341 closed
-
Flaky: test/security-merge.test.ts #2104 done
-
Flaky: test/search.test.ts #2105 done
-
Flaky: test/reviews.test.ts #2106 done
-
Flaky: test/reviews-states.test.ts #2107 done
-
Flaky: test/audit.test.ts #2108 done
-
Flaky: test/policy.test.ts #2109 done
-
Flaky: test/secret-store.test.ts #2110 done
-
Flaky: test/push-through.test.ts #2111 done
-
Flaky: test/revert.test.ts #2112 done
-
Flaky: test/subscriptions.test.ts #2113 done
-
test/checks.test.ts runs under 10 s #3494 done
-
test/studio-shipping.test.ts runs under 10 s #3562 done
-
test/studio-door.test.ts runs under 10 s #3566 done
-
test/studio-changes.test.ts runs under 10 s #3575 done
-
test/studio-search.test.ts runs under 10 s #3576 done
-
test/studio-runs.test.ts runs under 10 s #3578 done
-
test/forks.test.ts runs under 10 s #3579 done
-
test/crew-continues.test.ts runs under 10 s #3592 done
-
test/crew-pause.test.ts runs under 10 s #3593 done
-
test/crew-review.test.ts runs under 10 s #3594 done
-
test/crew-declines.test.ts runs under 10 s #3595 done
-
test/crew-feedback.test.ts runs under 10 s #3603 done
-
First two adapters: real syncs from the owner's businesses #438 not doing
-
A crew run's processes carry the cell label crew:<name> #2810 not doing
-
test/crew-parks.test.ts runs under 10 s #3495 not doing
-
.error-note leaves the stylesheet and docs/DESIGN.md §5d #5074 not doing
-
Settings › Capacity speaks the home page's language #9709 not doing
-
Twelve quarantined suites that pass alone run in the gate again #11049 not doing
-
test/crew-interrupted.test.ts runs in under 10 s #11053 not doing
-
test/apps-api.test.ts runs in under 8 s #11054 not doing
-
The gate's quarantine is down to suites with an open reason #11055 not doing
-
The forge's worst loop stall at idle stays under 100 ms #11070 not doing