ForgeLayer

AgentOS provider-aware routing

Deterministic compatibility, separate from control eligibility.

Modeled fit uses server-owned capabilities. It is not provider performance, assignment, approval, verification, dispatch, or execution.
Inspect routing analysis
Deterministic recommendationNot assigned

Claude Code

secure payment webhook

Highest modeled fit
95/100
Recommendation state
deterministic recommendation
Recommendation use
available for human review
Routing analysis
routing-analysis-secure-payment-webhook
Task / repository
controlled-task-secure-payment-webhook / repository-connection-preview-secure-payment-webhook
Provider contacted
false
Dispatch / execution
disabled / disabled
Repository contents
not fetched
Evaluated
2026-07-31T00:00:00.000Z
Recommendation use blockedNot assigned

Claude Code

harden risky prompt

Highest modeled fit
93/100
Recommendation state
recommendation blocked
Recommendation use
blocked by revocation
Routing analysis
routing-analysis-harden-risky-prompt
Task / repository
controlled-task-harden-risky-prompt / repository-connection-preview-harden-risky-prompt
Provider contacted
false
Dispatch / execution
disabled / disabled
Repository contents
not fetched
Evaluated
2026-07-31T00:00:00.000Z
Recommendation use blockedNot assigned

Cursor

investigate failing tests

Highest modeled fit
95/100
Recommendation state
recommendation blocked
Recommendation use
blocked by kill switch
Routing analysis
routing-analysis-investigate-failing-tests
Task / repository
controlled-task-investigate-failing-tests / repository-connection-preview-investigate-failing-tests
Provider contacted
false
Dispatch / execution
disabled / disabled
Repository contents
not fetched
Evaluated
2026-07-31T00:00:00.000Z

Controlled Task Dispatch v1

Evaluate every dispatch boundary before a task can leave ForgeLayer.

One Controlled Task, one canonical provider recommendation, one explicitly legacy diagnostic profile, and one bounded attempt. AgentOS routing remains recommendation-only, and public production sends nothing.

Inspect dispatch readinessControlled TasksCapabilitiesAgent ConnectionsFuture Output IntakeVerification PrerequisiteApprovalsRepository ConnectionsTrust boundaries
Tasks evaluated: 3Active authorizations: 0Provider requests: 0Execution: disabled

Repository connection dependency

A recorded repository preview never enables dispatch.

Dispatch keeps repository host, workspace binding, installation, ownership, permissions, metadata, contents, approval, revocation, kill switches, verification, provider transport, GitHub transports, and repository execution as separate fail-closed dimensions.
Inspect repository boundaries

GitHub · repository host

acme-payments/payment-webhook-service

Recorded preview

Secure Payment Webhook · paths are deterministic task scope, not fetched repository contents.

Workspace membership
Workspace Recorded
Adapter
github-repository-adapter · github-repository-adapter-v1
Installation
Installation Unverified
Installation ownership
Installation Ownership Unverified
Repository ownership
Repository Ownership Unverified
Permissions
modeled · unrequested · ungranted · unverified
Metadata / contents
not fetched / not fetched
PR / checks
deterministic previews · not fetched
Webhook
Webhook Not Configured
Revocation / kill switch
Not Revoked / Inactive
Read / write / execution
false / false / false
WorkspaceIdentityTrustWorkspace Recorded
GithubHostTrustHost Recorded
GithubAccountIdentityTrustAccount Unverified
InstallationIdentityTrustInstallation Unverified
InstallationOwnershipTrustInstallation Ownership Unverified
RepositoryIdentityTrustRepository Recorded
RepositoryOwnershipTrustRepository Ownership Unverified
PermissionTrustPermissions Unverified
MetadataTrustMetadata Not Fetched
ContentsTrustContents Not Fetched
WebhookTrustWebhook Not Configured
HealthTrustHealth Not Observed
AdapterVersionTrustAdapter Recorded
PolicyBindingTrustDeterministic Preview
ProductionReadinessProduction Not Ready
Inspect deterministic task paths (2)
  • app/api/payments/webhook.ts
  • tests/payment-webhook.test.ts
Permission modelTrust boundaryControlled TaskRepoBrain binding

GitHub · repository host

acme-ai-support/refund-assistant-prompts

Recorded preview

Harden Risky Prompt · paths are deterministic task scope, not fetched repository contents.

Workspace membership
Workspace Recorded
Adapter
github-repository-adapter · github-repository-adapter-v1
Installation
Installation Unverified
Installation ownership
Installation Ownership Unverified
Repository ownership
Repository Ownership Unverified
Permissions
modeled · unrequested · ungranted · unverified
Metadata / contents
not fetched / not fetched
PR / checks
deterministic previews · not fetched
Webhook
Webhook Not Configured
Revocation / kill switch
Not Revoked / Inactive
Read / write / execution
false / false / false
WorkspaceIdentityTrustWorkspace Recorded
GithubHostTrustHost Recorded
GithubAccountIdentityTrustAccount Unverified
InstallationIdentityTrustInstallation Unverified
InstallationOwnershipTrustInstallation Ownership Unverified
RepositoryIdentityTrustRepository Recorded
RepositoryOwnershipTrustRepository Ownership Unverified
PermissionTrustPermissions Unverified
MetadataTrustMetadata Not Fetched
ContentsTrustContents Not Fetched
WebhookTrustWebhook Not Configured
HealthTrustHealth Not Observed
AdapterVersionTrustAdapter Recorded
PolicyBindingTrustDeterministic Preview
ProductionReadinessProduction Not Ready
Inspect deterministic task paths (2)
  • lib/prompts/refund-assistant.ts
  • prompts/refund-assistant-security.md
Permission modelTrust boundaryControlled TaskRepoBrain binding

GitHub · repository host

acme-checkout/checkout-ui

Recorded preview

Investigate Failing Tests · paths are deterministic task scope, not fetched repository contents.

Workspace membership
Workspace Recorded
Adapter
github-repository-adapter · github-repository-adapter-v1
Installation
Installation Unverified
Installation ownership
Installation Ownership Unverified
Repository ownership
Repository Ownership Unverified
Permissions
modeled · unrequested · ungranted · unverified
Metadata / contents
not fetched / not fetched
PR / checks
deterministic previews · not fetched
Webhook
Webhook Not Configured
Revocation / kill switch
Not Revoked / Active
Read / write / execution
false / false / false
WorkspaceIdentityTrustWorkspace Recorded
GithubHostTrustHost Recorded
GithubAccountIdentityTrustAccount Unverified
InstallationIdentityTrustInstallation Unverified
InstallationOwnershipTrustInstallation Ownership Unverified
RepositoryIdentityTrustRepository Recorded
RepositoryOwnershipTrustRepository Ownership Unverified
PermissionTrustPermissions Unverified
MetadataTrustMetadata Not Fetched
ContentsTrustContents Not Fetched
WebhookTrustWebhook Not Configured
HealthTrustHealth Not Observed
AdapterVersionTrustAdapter Recorded
PolicyBindingTrustDeterministic Preview
ProductionReadinessProduction Not Ready
Inspect deterministic task paths (3)
  • tests/checkout-confirmation.test.ts
  • app/checkout/confirmation.tsx
  • package.json
Permission modelTrust boundaryControlled TaskRepoBrain binding

Three previews recorded. Verified installations: 0. GitHub reads: 0. GitHub writes: 0. Repository executions: 0. Approval cannot override unverified ownership, missing permissions, disabled transport, revocation, or an active kill switch.

Narrow v1 boundary

No fan-out, chaining, retry loop, or browser-created remote state

The model explicitly caps one task, provider, adapter, and active attempt. Unknown behavior fails closed.
1task per dispatch
1primary provider
1adapter
0automatic retries
0supporting agents dispatched
0external requests

Provider connection dependency

Recognized products and recorded previews still cannot dispatch.

Dispatch consumes the provider connection projection as another fail-closed prerequisite. Modeled capability and human approval do not supply authentication, ownership, or transport.

Codex

Product recognized
true
Connection record
deterministic preview
Workspace membership
workspace recorded
Ownership
unverified
Authentication
unavailable
Kill switch
inactive
Dispatch / execution
false / false

Claude Code

Product recognized
true
Connection record
deterministic preview
Workspace membership
workspace recorded
Ownership
unverified
Authentication
unavailable
Kill switch
inactive
Dispatch / execution
false / false

Cursor

Product recognized
true
Connection record
deterministic preview
Workspace membership
workspace recorded
Ownership
unverified
Authentication
unavailable
Kill switch
inactive
Dispatch / execution
false / false

Approval cannot override provider or connection revocation, an active provider, workspace, platform, or adapter kill switch, unavailable authentication, unverified ownership, or disabled transport.

Authoritative readiness evaluation

Three tasks, every boundary, no hidden shortcut

Policy, capability, repository, evidence, verification, approval, budget, identity, adapter, and platform checks remain independent.
globally disableddispatch-preview-db15b2cd

Secure a payment webhook

Claude Code · canonical deterministic recommendation

Canonical recommended provider
Claude Code
Routing analysis ID
routing-analysis-secure-payment-webhook
Modeled fit
95/100
Recommendation state
deterministic recommendation
Recommendation use
available for human review
Assignment
none
Provider contacted
false
Provider request
not sent
Dispatch state
disabled
Provider execution
disabled
Repository execution
disabled
Policy snapshot
policy-snapshot-5cc8bbf1
Capability package
capability-package-secure-payment-webhook-v1
Repository
not connected
Evidence / verification
incomplete / simulated
Current authority / budget
blocked platform / preview
Approval requirement
satisfied
Approval evaluated at
2026-08-12T04:24:45.021Z
Authorization
preview only, inactive
Transport
disabled
Provider request / remote task
not sent / none
Cancellation
not requested
Legacy diagnostic profile
Classification
legacy deterministic profile
Legacy profile reference
github_copilot
Legacy provider / adapter
github_copilot / github-copilot-agent-adapter
Compatibility diagnostic
adapter unavailable

Approval requirement satisfied. Repository verification has not run, and execution transport remains disabled.

Current authoritative blockers (3)
  • Repository verification has not run.
  • Execution transport is disabled.
  • Dispatch remains disabled.

Legacy dispatch diagnostics remain deterministic fixture inputs and cannot override this evaluator-owned authority state.

Approval requirement satisfied. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

Inspect task dispatch provenance
globally disableddispatch-preview-ec038137

Harden a risky prompt

Claude Code · canonical deterministic recommendation

Canonical recommended provider
Claude Code
Routing analysis ID
routing-analysis-harden-risky-prompt
Modeled fit
93/100
Recommendation state
recommendation blocked
Recommendation use
blocked by revocation
Assignment
none
Provider contacted
false
Provider request
not sent
Dispatch state
disabled
Provider execution
disabled
Repository execution
disabled
Policy snapshot
policy-snapshot-d8a299d8
Capability package
capability-package-harden-risky-prompt-v1
Repository
not connected
Evidence / verification
incomplete / simulated
Current authority / budget
revocation active / preview
Approval requirement
approval revoked
Approval evaluated at
2026-08-12T04:24:45.021Z
Authorization
preview only, inactive
Transport
disabled
Provider request / remote task
not sent / none
Cancellation
not requested
Legacy diagnostic profile
Classification
legacy deterministic profile
Legacy profile reference
generic_security_agent
Legacy provider / adapter
internal_agents / internal-agent-adapter
Compatibility diagnostic
adapter unavailable

A historical approval exists, but current authorization is revoked.

Current authoritative blockers (4)
  • Current authorization is revoked.
  • Repository verification has not run.
  • Execution transport is disabled.
  • Dispatch remains disabled.

Legacy dispatch diagnostics remain deterministic fixture inputs and cannot override this evaluator-owned authority state.

Keep current authorization revoked. Current authorization is revoked. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

Inspect task dispatch provenance
globally disableddispatch-preview-683d375f

Investigate failing tests

Cursor · canonical deterministic recommendation

Canonical recommended provider
Cursor
Routing analysis ID
routing-analysis-investigate-failing-tests
Modeled fit
95/100
Recommendation state
recommendation blocked
Recommendation use
blocked by kill switch
Assignment
none
Provider contacted
false
Provider request
not sent
Dispatch state
disabled
Provider execution
disabled
Repository execution
disabled
Policy snapshot
policy-snapshot-69ecde00
Capability package
capability-package-investigate-failing-tests-v1
Repository
not connected
Evidence / verification
incomplete / failed
Current authority / budget
kill switch active / preview
Approval requirement
satisfied
Approval evaluated at
2026-08-12T04:24:45.021Z
Authorization
preview only, inactive
Transport
disabled
Provider request / remote task
not sent / none
Cancellation
not requested
Legacy diagnostic profile
Classification
legacy deterministic profile
Legacy profile reference
github_copilot
Legacy provider / adapter
github_copilot / github-copilot-agent-adapter
Compatibility diagnostic
adapter unavailable

An approval exists, but workflow progression is blocked by an active kill switch.

Current authoritative blockers (4)
  • An active kill switch blocks workflow progression.
  • Repository verification has not run.
  • Execution transport is disabled.
  • Dispatch remains disabled.

Legacy dispatch diagnostics remain deterministic fixture inputs and cannot override this evaluator-owned authority state.

Keep workflow progression blocked by the active kill switch. An active kill switch blocks workflow progression. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

Inspect task dispatch provenance

Explicit dependencies

Approval policy and dispatch authorization remain separate

The authorization preview binds one policy snapshot, capability version, repository state, verification, approval, budget, adapter, and idempotency key.

Repository

Connection and task-scoped authority are separate.

Inspect

Policy

Policy allowance is one prerequisite, not dispatch.

Inspect

Capability

An active package is required; current packages are inactive.

Inspect

Verification

Passed, current, non-simulated evidence is required.

Inspect

Approval policy definition

Required policy roles define authority; current satisfaction comes only from the evaluator.

Inspect

Agent adapter

The exact enabled adapter and disabled-by-default transport stay separate.

Inspect

Approval Authority foundation

Approval is bound to one exact work state.

Authority, approval, revocation, kill switches, verification, and execution transport remain separate control dimensions.
Open Approval Center

secure payment webhook

Approval requirement satisfied. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

blocked platform
Required authority
workspace owner
Principal
Demo workspace owner / demo authority
Exact object
controlled-task-secure-payment-webhook
Repository
repository-identity-secure-payment-webhook
Risk / budget
HIGH / task-budget-secure_payment_webhook-v1
Dispatch authorization
dispatch-authorization-preview-db15b2cd
Verification plan
verification-plan-2458e6d26e940ec0
Evaluated at
2026-08-12T04:24:45.235Z
Grant expiry
2030-07-11T09:00:00.000Z / not expired
Capability expiry
2030-07-29T09:00:00.000Z / not expired
Current authority
blocked platform
Approval requirement
Satisfied
Historical grant state
granted
Revocation
not revoked
Kill switch
inactive
Verification
incomplete
Repository runners
not run / blocked platform
Execution transport
disabled

Approval requirement satisfied. Repository verification has not run, and execution transport remains disabled.

Controlled TaskWork RecordReview RunVerification Plan

harden risky prompt

Keep current authorization revoked. Current authorization is revoked. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

revocation active
Required authority
prompt security reviewer
Principal
Demo prompt-security reviewer / demo authority
Exact object
controlled-task-harden-risky-prompt
Repository
repository-identity-harden-risky-prompt
Risk / budget
HIGH / task-budget-harden_risky_prompt-v1
Dispatch authorization
dispatch-authorization-preview-ec038137
Verification plan
verification-plan-d17b2a5528b4be7a
Evaluated at
2026-08-12T04:24:45.235Z
Grant expiry
2030-07-11T09:00:00.000Z / not expired
Capability expiry
2030-07-29T09:00:00.000Z / not expired
Current authority
revocation active
Approval requirement
approval revoked
Historical grant state
granted
Revocation
revoked
Kill switch
inactive
Verification
incomplete
Repository runners
not run / blocked platform
Execution transport
disabled

A historical approval exists, but current authorization is revoked.

Controlled TaskWork RecordReview RunVerification Plan

investigate failing tests

Keep workflow progression blocked by the active kill switch. An active kill switch blocks workflow progression. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

kill switch active
Required authority
engineering approver
Principal
Demo engineering approver / demo authority
Exact object
controlled-task-investigate-failing-tests
Repository
repository-identity-investigate-failing-tests
Risk / budget
MEDIUM / task-budget-investigate_failing_tests-v1
Dispatch authorization
dispatch-authorization-preview-683d375f
Verification plan
verification-plan-b860ede3565b9a00
Evaluated at
2026-08-12T04:24:45.235Z
Grant expiry
2030-07-11T09:00:00.000Z / not expired
Capability expiry
2030-07-29T09:00:00.000Z / not expired
Current authority
kill switch active
Approval requirement
Satisfied
Historical grant state
granted
Revocation
not revoked
Kill switch
active
Verification
incomplete
Repository runners
not run / blocked platform
Execution transport
disabled

An approval exists, but workflow progression is blocked by an active kill switch.

Controlled TaskWork RecordReview RunVerification Plan