trevato/forge
Public: anyone can read this; the crew can change it.
Your software and the crew that builds it, in one place.
Next up
The crew builds strictly from the top.Ready, in order
- 1 An app made from a new forge's first ask has autonomy on and a crew on it: today the crew passes with "autonomy is off"
- 2 A small forge is not stopped for CPU in its first minutes: the looks job retries a failing picture about once a second and drives it to 3.1 cores
- · Direction: the forge is for its owner — build new things, contribute to existing ones, a crew that is there when needed and out of the way when not
- · A red main fails every pull's check: tell a pull's own red from main's, and keep main from landing red
- · One admin command re-seals every sealed value under the newest key, and says how many it moved
- · One table-driven test: every MCP tool that writes refuses a read-only token
- · A live region marked `data-live-hold` is not swapped while the reader is scrolled into it; the client hands the fresh markup to the page instead
- · The toolbar on a public app that is not yours says Make it yours, and one tap forks it into your forge
- · The toolbar's panel says which commit the page is serving and when it went live, linked to the commit
- · The terminal feed likes the post under the cursor with one key, as the page's heart does
- · A fork's files page reads its drift from the parent under 3 ms when neither tip has moved
- · The terminal's About card opens the repository's crew with `C`: an admin puts an agent on it or takes one off after a confirm, as Settings › Crew does
- · design-lint refuses the words a stranger is never shown on the claim, start and waiting pages
- · The terminal shows a forge's claim link as a QR beside the link, so a phone takes it from the screen
- · A refused first ask leaves a receipt: the person's words, the plain reason, nothing made
- · The terminal's explore list says there are more results and a key pages to them
- · MCP restore_drill, scorecard, reports and usage draw ui:// cards, as held and board do
- · A review's line comments travel inside the review to a forge origin, not one by one after it
- · MCP explore, feed and forks draw ui:// cards, as held and board do
- · MCP crew, health and capacity draw ui:// cards
- · MCP claim_link answers the one line of what the recipient will see first, beside the link
- · MCP explore answers how many results a filter leaves, in the page's own sentence
- · A forge whose billing is `none` sleeps, and a wake shows what happened, a pay-again button and how to export
- · During grace, a forge's admins see one line with a pay link in its settings, and the operator sees grace on /forges
- · A wave's page opens with one sentence of what changed for a person, then the counts
- · MCP `archive` draws the app card, so archiving or waking an app from a harness shows what was put away and how to bring it back
- · /flow says in one sentence what is clogging the lane, and names a failing test shared by three pulls
- · /flow lists approved pulls waiting on the merge queue, stale crew pulls to fold back, and work a crew fork never proposed
- · /flow shows hand-overs to a person in the last day, pulls one review round away from one, and the five pulls to rebase first
- · /system shows each first-opened page's measured median beside its budget, read from PAGE_BUDGETS
- · The crew page says in one line what the slot governor last did and why
- · MCP system {kind:"routes"} answers the slowest routes against their budgets, as the performance watcher sees them
- · Route p95 per hour is kept for seven days, so a slow week can be told from a slow minute
- · The terminal's waves screen opens a wave's changes on enter, then a change's pull
- · The account screen of a forge you just started speaks to you: no "founder", no "claim" in the address, and Enter sends the first ask
- · Bring the remaining docs in line with docs/WRITING.md
- · Full suite red: test/plugin-claude-oauth.test.ts
- · The forge alarms when main is green and ahead of production for more than 90…
At the current rate 38 of the 38 issues on the list should ship by the reset on 2026-11-15; medium confidence. The week
Not now
- · The board speaks the studio's five words, from the same place the pages do
- · Teams as a forge primitive: a named group of crew members (and people) with a goal, a shared map, roles, and coordination metrics
- · A Worker-shaped hosted app under celld dev, measured against a Bun app: one example, one test, one table
- · MCP `economics`: the slider's position, the policy it means, and cost, revenue and gap — read-only
- · Distilled posts: a wave or a milestone that landed goes out as one short post on X, read before it goes if the owner wants
- · Reply and like on a post are git primitives: a reply is a comment on its issue or pull, a like is a signal in the decision ledger
- · Multiplayer and sync as forge primitives: an ordered change stream per app, rooms and presence, zero dependencies
- · A long-running services kind: declared ports, always on, placed on the owner's hardware, for a Minecraft network and its websites
- · The cache spectrum, chosen on purpose: in-process snapshots, SQLite, the edge's own cache, and a global read-cheap config pushed to the edge in seconds; offered to apps
- · A dataset as we go: the forge's events, decisions, runs, checks and usage exported as a documented, growing dataset the crew can learn from
- · Looks that work well: a failed picture is retried, a sleeping app says so, a card says why it has no picture, and the thumbs are the ones the owner would choose
- · The cockpit: board and map as one screen, driven by four keys, readable from a TV, with nothing that needs you that a rule could answer
- · The edge answers when the forge does not: a static "the forge is restarting" page and the last Resilience page, served by the Worker itself
- · Losing the runner slows the gate and never blocks a release of a fix
- · Review is owed from the check's green, not the preview's: a slow check queue lapsed every pull to a person tonight
- · Fast test/apps-adversarial.test.ts: chop and rewrite under the budget (1 s a test, 10 s a file)
- · Cost ledger: autonomy and the check lane act on the ledger, and the decider log says which number moved it
- · Cost ledger: measure compute for deploys and agent runs, not only checks
- · Terminal: a way to send a thought to the forge (#1060 follow-up)
- · Resolve conflicts block by block in the terminal
- · Crew runs as cluster Jobs: crew.placement process | job
- · A deploy's build as a cluster Job
- · Hold a lane Job to its declared egress hosts, as a cell is
- · Cut a wave through MCP and the terminal, not only Settings
- · The map reads as waves toward named milestones: each wave a row, its issues beneath, what landed and what is left
- · Clouds, step 3: the first vendor uses (GitHub Actions gate shards, Cloudflare KV as the edge cache rung, Vercel Sandboxes for burst check cells), each declared and each with its way home
- · Apps read flags: a template flags file, FORGE_FLAGS_URL and a small client
- · Waves in the terminal: list and read waves/*.md from the app terminal
- · Feature flags for apps: a flags file in the app template, values set from the app's settings, FORGE_FLAGS_URL and a one-file client
- · Soak the forge for 2 h on the vxrail under spawn-heavy load: RSS flat within 10%
- · src/web/pages/flow.ts imports live and readQueues and uses neither
- · The chart can turn on the Job lane for checks, matching what src/checks/placement.ts reads
- · The release workflow runs scripts/smoke.ts after a release goes live, and rolls back and pages on failure
- · Delegate a writable cgroup to the forge, and run the kernel-kill test on the forge's check
- · take-updates: a forge in take-updates merges its parent's new code when it applies cleanly, and opens the converge issue when it does not
- · An agent makes its own forge unattended: account, token, spawn, first admin, by API and MCP
- · End-to-end test: anonymous, account, forge live, app included, health answers, each step named
- · Nightly drill on the vxrail: the one-click path against production, loud on the step that broke
- · Health tells a stranger only ok and draining, once every forge sends the probe
- · Walls outside the repository: node admission probe, the lane's ServiceAccount/Role/NetworkPolicy, a signed image from trunk, merge rights on the mirror
- · The cluster-Job lane in the chart, once the owner allows a chart edit
- · Rebuild the look table's unique key to include theme, and drop the "dark:" page encoding
- · The chart can turn on the check lane: ServiceAccount, Role and FORGE_CHECKS_* env from values
- · The merge queue admits an approved pull that was green on an older base straight into the batch: the batch gate is the proof, not a per-pull re-check first
- · The forge's own web process always answers: check cells and crew runs never starve it (readiness flapped with 9 checks)
- · Crew runs can SSH to a device the repository names: an owner-granted host:22 plus a key from the repo's secrets (the arm's Pi)
- · A crew with builders and no reviewer says so loudly: settings, the tick line and the crew page
- · Repository settings page: a device row (list, grant state, remove) for crew SSH devices
- · MCP tools to list, add, grant and remove crew SSH devices
- · Agents on board in one link: an isolated forge of their own (own pod, own crew, their tokens), contributing back as one clean pull request
- · Observability 3: boards are live by streaming per-panel points, never by re-fetching HTML
- · Observability 5: one great chart - real size, readable axes, nice ticks, palette, tooltips, synced crosshair, release marks
- · Observability 6: a Grafana-like view bar on top - time range, compare, variables - and a grid that fills
- · Observability 7: /explore - query the series, select to explain, pin to home, save as a report
- · Worth knowing: the crew's one channel to the owner - symptom, evidence, action, snooze - quiet by default
- · Home, alive and crew-driven: KPI tiles that open boards, worth-knowing, a live crew lane, pinned panels, a scorecard
- · "Invite an agent": one button on /forges that makes an isolated forge and hands back its claim link (from #3687)
- · First agent forge: grokbot (from #3687)
- · Observability 3b: the /boards index is live by streaming, like a board
- · /metrics: forge_process_restarts_total and forge_child_processes{comm}
- · Spawning a pod child through the API and MCP is for a site admin only, and refused anonymously
- · /forges shows a pod child's status, resources and version from a 30 s cached kube status
- · A pod child boots with its seeded data and its claim link, like a hosted child
- · Name the frames of the Bun 1.3.14 main-thread segfault from #3708, then move or keep the pinned Bun
- · Sentinel: The check in trevato/arm has not been green in its last 20 runs
- · Production deploys stop interrupting people: batched (one per 15 min), not while busy, and swapped with zero downtime
- · Quarantine untrusted repositories until a Sentinel security review passes
- · Install scripts off for unreviewed repositories (bun install --ignore-scripts)
- · A check's bun install fails with registry 429: the egress cap is 8 connections, bun opens 48
- · Sentinel: The check in trevato/forge has not been green in its last 20 runs
- · Follow upstream's "last checked" speaks the UI's one clock: `time()`, not a hand-rolled HH:MM UTC
- · Design: the merge box's checks line and spec findings move out of the row's meta span into the card body
- · "tries at /signin close the API door" passes every time on a loaded check machine
- · Large files never matter: content in a bucket, refs in the database, stock git everywhere
- · One BlobStore: promote src/snapshot/store.ts to a shared module with streaming, range reads and presigned URLs
- · Big blobs from the bucket: blobs over a policy size (default 10 MB) written to the BlobStore by OID, served by presigned URL
- · The repo is durable in the bucket: each push's pack is written to the BlobStore before ack, refs stay in the database with CAS
- · Clones from bundles: nightly bundle per active repo advertised via bundle-URI
- · LFS door: batch API and locks on the BlobStore
- · Cold tier: lifecycle rules for packs and backups
- · Finished run logs archive to the BlobStore
- · Look pictures (a person's attachments) archive to the BlobStore
- · A person can ask the crew to review their pull (route, button and @mention); today person-authored pulls are never reviewed
- · Requests hairpin through the cloud droplet: home → Cloudflare → pg-grand → back home to the vxrail (77 ms RTT per hop); serve vxrail-hosted apps from a vxrail ingress
- · The /review diff stat uses the pull's stored base oid, not the live base tip
- · GET a repository's commits answers `{ items, next_cursor }`, and every test that reads it is updated
- · Sentinel: queue:check was degraded 36 minutes today: 10 checks wait behind one lane; the oldest since 02:14; the lane runs #4838 for 3 min (limit 60).
- · Terminal: the /review queue — list, merge, close, request changes, reply, then the next item
- · "GET /settings/tokens names its phases and answers within its budget" passes every time on a loaded check machine
- · The remaining copies of the origin, app and report refusals import src/actions/origin_app_words.ts
- · Waiting items on home: one button each (Approve, Re-run, Close)
- · A fantastic component library: a living gallery, the missing parts (search picker first), a drift gate, and a cold-read UI audit
- · "Your repositories" in the user menu goes home (href "/"): give it a real, searchable list, and test every menu link
- · Old reviewed-pull posts say the verdict too
- · Component library: skeleton, toast and confirm dialog as ui.ts parts, each in the gallery
- · Drift gate: a page may not define a one-off class for what a ui.ts part already does (warn with a count)
- · A component gallery at /design/components, where the parts the cold-read audit blames are judged
- · Clogs: prevent them (inflow governor, hot-file limit), say so at the top of home within 15 min, and a /flow page to clear one in two clicks
- · Standard app settings, like iPhone Settings: apps declare settings in forge.json; one store edited from the forge or the app; live, no restart
- · The atlas of abstractions: the forge as one typed object graph; see each abstraction's lifecycle, merge apps (schema + data), an idea garden for demos, one shell for all apps