ForgeLayer
Workspace boundary

Private beta workspace boundary: demo mode. Persistence and GitHub posting remain limited until workspace auth is enabled; live agent execution and billing are disabled.

ForgeLayer beta demo

Private demo guide

AI Software Teams. Controlled.

ForgeLayer is the AI software work control layer for code changes. It turns an AI task, PR diff, and optional repo rules into a merge decision, AI Work Record, RepoBrain policy context, and GitHub-style review comment.

AI agents write the code. ForgeLayer keeps the work organized, traceable, reviewable, and safe to merge.

Back to dashboardPricing previewGitHub App setupStart private betaOpen demo scriptCheck readinessProduction architectureGive feedback
Private demo ready

Current truth

The manual dashboard is still the primary demo. The GitHub App dry-run loop now works end to end: webhook, diff fetch, repo policy, risk report, PR comment preview, and Supabase review_run storage. Posting stays disabled.

Safe modeNo live billingNo live agents

Three layers

What reviewers should understand first

01

MergeGuard

Answers whether the pasted or imported change is safe to merge.

02

AI Work Ledger

Records what AI changed, what risk was found, and what decision was made.

03

RepoBrain

Applies pasted repo rules so team policy can shape the review.

Current product

What works today

  • Manual pasted diff analysis
  • Public GitHub PR .diff import
  • OpenAI mode with mock fallback
  • RepoBrain from pasted repo rules
  • PR Comment Preview and Copy PR Comment
  • Verified GitHub webhook dry-run
  • GitHub App private beta setup guide
  • Async review queue foundation with safe queue statuses
  • Review Run Status Lifecycle
  • GitHub Check Preview
  • PR Comment Preview v2
  • Supabase review_run storage for webhook dry-runs
  • Review Runs stored safe summaries
  • AI Work Ledger foundation
  • PromptForge v1 deterministic analysis, rewrite, and security tests
  • AgentOS Foundation registry/routing
  • Task-to-Agent Workflow draft planning
  • Agent Work Records draft records
  • Agent Comparison deterministic comparison

Guided path

Start private beta onboarding

Follow the safest pilot path: safe mode, GitHub App setup, repo rules, review run, PromptForge, AgentOS, Work Record, Ledger, and next-step decision.

Start private betaOpen demo script

Foundation implemented

Production architecture activation

The trusted identity, membership and role, tenant-schema, RLS migration, safe store, and append-only audit foundations are built. Local isolated validation passed for Supabase Auth, Migrations 001-003, 61/61 RLS assertions, workspace switching, and restart durability. Hosted staging configuration is inactive and validation is pending; no hosted project has been contacted. Production adapters remain inactive, no production migration was applied, and production authentication, persistence, and validation remain unavailable. Local validation is not production validation; production activation remains blocked.

View production architecture plan

Reviewer path

How to test

  1. Open the dashboard and load one of the four built-in scenarios.
  2. Generate a report and inspect risk, recommendation, and required follow-ups.
  3. Check RepoBrain policy context when example repo rules are loaded.
  4. Open PR Comment Preview and confirm it reads like a GitHub review.
  5. Open Review Runs after a webhook dry-run to inspect the stored safe summary.

Default operating mode

Safe mode

Private beta testing should keep GITHUB_COMMENT_POSTING_ENABLED=false. ForgeLayer still verifies webhooks, fetches diffs and repo policy, generates the report, prepares the PR comment, and stores a safe review_run summary.

  • GitHub comment posting is disabled unless enabled server-side
  • No auth requirement for the dashboard demo
  • No live agent execution, no autonomous workflows, no billing, no production team/workspace controls, and no automatic merge behavior.
  • No private-repo production workflow yet

Early ledger view

What to look for in /review-runs

  • Latest GitHub webhook review run appears after a successful redelivery.
  • Repository, PR number, risk, recommendation, and mode are visible.
  • RepoBrain categories and protected/sensitive path match counts are summarized.
  • Raw diffs, raw repo rules, tokens, private keys, and webhook payloads are not shown.

Decision signal

What feedback to send

  • Did you understand what ForgeLayer does in under 30 seconds?
  • Which scenario felt most valuable?
  • What felt confusing?
  • Would this help you review AI-generated PRs?
  • What would need to exist before you trusted it on a real repo?
Give private beta feedback

What to test

Private beta checklist

  • Run the low-risk README/docs scenario and confirm it stays calm.
  • Run the medium-risk database migration and look for caution-level follow-ups.
  • Run the high-risk auth/security scenario and inspect required security actions.
  • Run the prompt-injection scenario and confirm malicious instructions are ignored.
  • Load example forgelayer.yml and check RepoBrain policy context.
  • Copy the PR comment and export Markdown from a generated report.

Primary demo

Manual dashboard demo

  1. Open the dashboard.
  2. Click Load example forgelayer.yml when showing RepoBrain policy.
  3. Run docs, auth/security, database, and prompt-injection scenarios.
  4. Show MergeGuard risk, AI Work Ledger record, RepoBrain profile, and PR Comment Preview.
  5. Copy the PR comment or export Markdown.

Optional technical demo

GitHub webhook dry-run

  1. Open GitHub App setup for the private beta checklist.
  2. Use the allowed test repo only.
  3. Keep GITHUB_COMMENT_POSTING_ENABLED=false.
  4. Open or update a small PR.
  5. Confirm the webhook returns diff_fetched, repo_rules_fetched, report_generated, dry_run, and review_run_stored.
  6. Use GitHub and Supabase diagnostics if a health flag is false.

Before redelivery

GitHub dry-run checklist

  • GitHub App installed on selected test repo
  • Contents: Read
  • Pull requests: Read
  • Metadata: Read
  • Webhook secret set
  • GITHUB_ALLOWED_REPOS set
  • GITHUB_COMMENT_POSTING_ENABLED=false
  • forgelayer.yml exists in the repo
  • PR webhook redelivered or PR updated

Verified path

Current beta backend loop

  1. GitHub PR event arrives at the webhook.
  2. ForgeLayer fetches the PR diff and repo forgelayer.yml policy.
  3. RepoBrain applies policy context to the MergeGuard report.
  4. The API returns a PR comment preview while posting remains disabled.
  5. A safe Supabase review_run summary is stored.

Safety

Intentionally disabled

  • GitHub comment posting is disabled unless enabled server-side
  • No auth requirement for the dashboard demo
  • No live agent execution, no autonomous workflows, no billing, no production team/workspace controls, and no automatic merge behavior.
  • No private-repo production workflow yet

Private beta scope

Known limitations

  • Reviews pasted or imported diffs only.
  • Does not scan the full repository yet.
  • AI Work Ledger persistence is localStorage-only.
  • Webhook processing has an async review queue foundation, but no external queue worker is live yet.
  • No live billing, subscriptions, or payment collection.
  • AgentOS modules are planning/control only and do not execute agents.
  • PromptForge v1 is deterministic and does not persist raw prompts.
  • No automatic GitHub posting in the current private-beta mode.

Honest limits

Not production-ready yet

  • AI Work Ledger persistence is localStorage-only
  • Webhook processing has an async review queue foundation, but no external queue worker is live yet.
  • Full repository scanning and live billing are not implemented
  • Full ledger persistence, analytics, and production audit workflows are not implemented

Feedback

Ask trusted reviewers

  • Did you understand what ForgeLayer does in under 30 seconds?
  • Which scenario felt most valuable?
  • What felt confusing?
  • Would this help you review AI-generated PRs?
  • What would need to exist before you trusted it on a real repo?
  • Would you pay for this if GitHub integration worked cleanly?
  • What price would feel reasonable for a small team?

Private beta feedback

Send private beta feedback

After testing the scenarios, send the answers that would help decide what to build next. Billing is not live, GitHub posting is disabled by default, and integration limitations are known.