AgentOS provider-aware routing

Deterministic compatibility, separate from control eligibility.

Modeled fit uses server-owned capabilities. It is not provider performance, assignment, approval, verification, dispatch, or execution.

Inspect routing analysis

Deterministic recommendationNot assigned

Claude Code

secure payment webhook

Highest modeled fit: 95/100
Recommendation state: deterministic recommendation
Recommendation use: available for human review
Routing analysis: routing-analysis-secure-payment-webhook
Task / repository: controlled-task-secure-payment-webhook / repository-connection-preview-secure-payment-webhook
Provider contacted: false
Dispatch / execution: disabled / disabled
Repository contents: not fetched
Evaluated: 2026-07-31T00:00:00.000Z

Recommendation use blockedNot assigned

Claude Code

harden risky prompt

Highest modeled fit: 93/100
Recommendation state: recommendation blocked
Recommendation use: blocked by revocation
Routing analysis: routing-analysis-harden-risky-prompt
Task / repository: controlled-task-harden-risky-prompt / repository-connection-preview-harden-risky-prompt
Provider contacted: false
Dispatch / execution: disabled / disabled
Repository contents: not fetched
Evaluated: 2026-07-31T00:00:00.000Z

Recommendation use blockedNot assigned

Cursor

investigate failing tests

Highest modeled fit: 95/100
Recommendation state: recommendation blocked
Recommendation use: blocked by kill switch
Routing analysis: routing-analysis-investigate-failing-tests
Task / repository: controlled-task-investigate-failing-tests / repository-connection-preview-investigate-failing-tests
Provider contacted: false
Dispatch / execution: disabled / disabled
Repository contents: not fetched
Evaluated: 2026-07-31T00:00:00.000Z

Trust Center · reviewed 2026-08-03

Security architecture, without unsupported claims.

ForgeLayer is building an independent control, verification, and evidence layer for AI-generated software work.

This page separates active demo behavior, current foundations, previews, planned controls, disabled capabilities, and areas that are not configured.

Review architecture Review data handling Production prerequisites Least-privilege model Agent adapter boundary

Approval Authority foundation

Approval is bound to one exact work state.

Authority, approval, revocation, kill switches, verification, and execution transport remain separate control dimensions.

Open Approval Center

secure payment webhook

Approval requirement satisfied. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

blocked platform

Required authority: workspace owner
Principal: Demo workspace owner / demo authority
Exact object: controlled-task-secure-payment-webhook
Repository: repository-identity-secure-payment-webhook
Risk / budget: HIGH / task-budget-secure_payment_webhook-v1
Dispatch authorization: dispatch-authorization-preview-db15b2cd
Verification plan: verification-plan-2458e6d26e940ec0
Evaluated at: 2026-08-10T08:38:25.474Z
Grant expiry: 2030-07-11T09:00:00.000Z / not expired
Capability expiry: 2030-07-29T09:00:00.000Z / not expired
Current authority: blocked platform
Approval requirement: Satisfied
Historical grant state: granted
Revocation: not revoked
Kill switch: inactive
Verification: incomplete
Repository runners: not run / blocked platform
Execution transport: disabled

Approval requirement satisfied. Repository verification has not run, and execution transport remains disabled.

Immutable bindingsapproval-grant-integrity-a9cdee22ac5c873d5f817dc8policy-snapshot-5cc8bbf1capability-package-secure-payment-webhook-v1verification-plan-2458e6d26e940ec0

Reasoning trail (3)

The exact human approval requirement is satisfied.
Repository verification is incomplete.
Repository runners are not run and execution transport is disabled.

Grant conditions (3)

Repository verification remains separate.
Execution transport remains disabled.
Any immutable binding change requires reevaluation.

Append-only lifecycle (3)

approval authority requested · historical lifecycle event: Exact authority and immutable scope were requested.
approval granted · historical lifecycle event: A deterministic historical approval grant was recorded.
workflow progression blocked · historical lifecycle event: Workflow progression remains blocked; repository execution was not running.

Controlled Task Work Record Review Run Verification Plan

harden risky prompt

Keep current authorization revoked. Current authorization is revoked. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

revocation active

Required authority: prompt security reviewer
Principal: Demo prompt-security reviewer / demo authority
Exact object: controlled-task-harden-risky-prompt
Repository: repository-identity-harden-risky-prompt
Risk / budget: HIGH / task-budget-harden_risky_prompt-v1
Dispatch authorization: dispatch-authorization-preview-ec038137
Verification plan: verification-plan-d17b2a5528b4be7a
Evaluated at: 2026-08-10T08:38:25.474Z
Grant expiry: 2030-07-11T09:00:00.000Z / not expired
Capability expiry: 2030-07-29T09:00:00.000Z / not expired
Current authority: revocation active
Approval requirement: approval revoked
Historical grant state: granted
Revocation: revoked
Kill switch: inactive
Verification: incomplete
Repository runners: not run / blocked platform
Execution transport: disabled

A historical approval exists, but current authorization is revoked.

Immutable bindingsapproval-grant-integrity-05dae0fed2dafcfb581b00bapolicy-snapshot-d8a299d8capability-package-harden-risky-prompt-v1verification-plan-d17b2a5528b4be7a

Reasoning trail (2)

The exact human approval requirement is satisfied.
An effective append-only revocation overrides the historical grant.

Grant conditions (3)

Repository verification remains separate.
Execution transport remains disabled.
Any immutable binding change requires reevaluation.

Append-only lifecycle (4)

approval authority requested · historical lifecycle event: Exact authority and immutable scope were requested.
approval granted · historical lifecycle event: A deterministic historical approval grant was recorded.
approval revoked · historical lifecycle event: Authorization revoked; no external cancellation was performed.
workflow progression blocked · historical lifecycle event: Workflow progression remains blocked; repository execution was not running.

Authorization revokedPrompt digest requires a new prompt-security approval.No external cancellation was performed.

Controlled Task Work Record Review Run Verification Plan

investigate failing tests

Keep workflow progression blocked by the active kill switch. An active kill switch blocks workflow progression. Repository verification has not run. Execution transport is disabled. Dispatch remains disabled.

kill switch active

Required authority: engineering approver
Principal: Demo engineering approver / demo authority
Exact object: controlled-task-investigate-failing-tests
Repository: repository-identity-investigate-failing-tests
Risk / budget: MEDIUM / task-budget-investigate_failing_tests-v1
Dispatch authorization: dispatch-authorization-preview-683d375f
Verification plan: verification-plan-b860ede3565b9a00
Evaluated at: 2026-08-10T08:38:25.474Z
Grant expiry: 2030-07-11T09:00:00.000Z / not expired
Capability expiry: 2030-07-29T09:00:00.000Z / not expired
Current authority: kill switch active
Approval requirement: Satisfied
Historical grant state: granted
Revocation: not revoked
Kill switch: active
Verification: incomplete
Repository runners: not run / blocked platform
Execution transport: disabled

An approval exists, but workflow progression is blocked by an active kill switch.

Immutable bindingsapproval-grant-integrity-36095571ec30a139cd54c748policy-snapshot-69ecde00capability-package-investigate-failing-tests-v1verification-plan-b860ede3565b9a00

Reasoning trail (2)

The exact human approval requirement is satisfied.
controlled_task kill switch blocks workflow progression.

Grant conditions (3)

Repository verification remains separate.
Execution transport remains disabled.
Any immutable binding change requires reevaluation.

Append-only lifecycle (4)

approval authority requested · historical lifecycle event: Exact authority and immutable scope were requested.
approval granted · historical lifecycle event: A deterministic historical approval grant was recorded.
kill switch activated · historical lifecycle event: Kill switch activated; workflow progression blocked.
workflow progression blocked · historical lifecycle event: Workflow progression remains blocked; repository execution was not running.

Kill switch active / controlled taskFailing-test remediation remains unverified.Workflow progression blocked; repository execution was not running.

Controlled Task Work Record Review Run Verification Plan

Approval authority limits

Approval is narrow authorization, not proof or execution.

A grant applies only to one immutable work state. One server-owned evaluation timestamp determines the current authority state; historical grants remain visible but cannot override expiry, revocation, or kill switches.

What the foundation controls

Server-owned roles and exact workspace, repository, task, policy, capability, dispatch, verification, budget, risk, and digest scope.
Expiry, staleness, append-only revocation, and independent kill-switch precedence.
Exact expiry boundaries: expiresAt less than or equal to evaluatedAt is expired for grants, principals, and Capability Packages.
Reevaluation after kill-switch release; release never restores invalid authority automatically.

What remains unavailable

Production Supabase session activation, production RLS/durability validation, and verified installation ownership.
Persistent grants, transactional audit enforcement, external cancellation, repository runners, and privileged transport.
Agent execution, provider calls, repository writes, GitHub posting, commands, and automatic merge.

Task-specific authority

Deterministic internal authority model with globally disabled external capabilities.

Capability packages now model least-privilege decisions structurally. They remain inactive previews and do not issue credentials, secrets, repository access, or agent authority.

Foundation only

3 task-specific packages

Policy can only narrow authority. Budgets are deterministic estimates, not provider metering or billing.

Active packages: 0
Credentials or secrets issued: none
Repository or agent operations: disabled
Production enforcement: not live

Inspect Capability Packages

Current boundaries

Deterministic internal authority model with globally disabled external capabilities.
Packages are task-specific, workspace-owned, repository-scoped, temporary, expiring, revocable, and non-persistent.
Policy, approval, verification, repository, and budget layers can only narrow authority.
No credentials, secret values, capability tokens, repository access, network access, commands, agent dispatch, GitHub writes, pull requests, workflows, or automatic merge are issued.
Local browser actions cannot activate, refill, extend, revoke, or otherwise mutate authoritative packages.
Production enforcement requires trusted identity, persistence, repository validation, isolated adapters, revocation, and durable audit events.

Current security posture

Implementation status by control area

Each statement includes its evidence, limitation, and next prerequisite.

Disabled

Authentication

A server-owned authenticated identity interface verifies opaque sessions and projects safe user metadata. Local Supabase Auth and session resolution passed; hosted staging validation is pending; demo pages remain separate.

Evidence: Authenticated-user server adapter; Local Supabase Auth verifier; Safe session product API; Current-workspace resolver
Limitation: No hosted staging project has been contacted and no trusted production Supabase session adapter is configured in the public deployment.
Next prerequisite: Validate the explicit hosted staging Auth configuration first without using service-role access in normal requests; production remains a separate blocked phase.

Foundation Only

Workspace isolation

Workspace roles, membership checks, ownership envelopes, switching, and cross-workspace denial passed against isolated local Supabase.

Evidence: Workspace role matrix; Workspace context resolver; 61/61 local pgTAP RLS assertions
Limitation: Local isolation validation is neither hosted staging nor production RLS validation.
Next prerequisite: Repeat cross-workspace and RLS integration tests against the approved non-production staging target before any production planning.

Disabled

Production persistence

Server-owned tenant stores, safe durable records, workspace-scoped idempotency, and append-only Ledger controls survived new clients and an app restart against isolated localhost.

Evidence: Workspace control-plane store; Local Migrations 001-003 replay; Local durability verifier
Limitation: No hosted staging or production migration was applied; hosted staging validation is pending and production persistence and durability remain unavailable.
Next prerequisite: Validate the guarded staging target, migration, RLS, and durability first; production operations, retention, backup, and recovery remain later prerequisites.

Disabled

Repository access

Repository Connection v1 defines a GitHub App read-only foundation, but the workspace grants no live connection, metadata fetch, source fetch, write, or task capability.

Evidence: Fail-closed repository flags; Server-only GitHub read adapter; Inactive Controlled Task repository references
Limitation: Authentication, workspace persistence, installation validation, and public self-service connection remain disabled.
Next prerequisite: Validate workspace identity, RLS, installation ownership, revocation, and Metadata: Read plus Contents: Read permissions.

Disabled

Agent execution

AgentOS recommends and compares agents. Controlled Tasks are not dispatched and no external agent is called.

Evidence: Agent Governance execution states; Controlled Task execution flags
Limitation: No sandbox, agent adapter, execution isolation, or revocation path is active.
Next prerequisite: Design and independently review isolated adapters, kill switches, and revocation.

Preview

Policy enforcement

The Executable Policy Engine is the deterministic source for task restrictions, verification requirements, evidence, and approver roles.

Evidence: Executable Policy Engine v1; Policy snapshots; Controlled Task intervention model
Limitation: Policy gates internal previews but does not enforce repository or runtime permissions.
Next prerequisite: Bind versioned policy decisions to trusted server identity and durable authorized tasks.

Foundation Only

Task capability authority

Task-specific capability packages intersect platform, workspace, repository, policy, approval, verification, expiry, revocation, and budget controls.

Evidence: Task Capability Package v1; Central authorization decisions; Deterministic budget intersection
Limitation: All packages are inactive, non-persistent previews and external capabilities are globally disabled.
Next prerequisite: Add trusted identity, durable package state, repository validation, isolated adapters, revocation events, and audit evidence.

Preview

Verification

Verification Runners v1 maps Policy Engine requirements to deterministic plans, internal metadata controls, blocked repository runners, and separate human checks.

Evidence: Verification Center; Verification plan builder; Server-owned command allowlist; Disabled execution transport
Limitation: ForgeLayer can validate internal control and evidence consistency. It does not execute repository verification commands in public production, and an internal-control pass does not prove code correctness or security.
Next prerequisite: Add trusted identity, repository snapshots, an isolated execution transport, revocation, durable provenance, and independently reviewed runner controls.

Current

Human approval

Human approval remains a required product boundary and local actions cannot infer approval.

Evidence: Approval Center; Controlled Task advancement guard
Limitation: Current decisions are browser-local preview state, not durable authorized production decisions.
Next prerequisite: Persist authorized approval events with identity, policy version, and evidence references.

Disabled

GitHub posting

Workspace GitHub posting and automatic merge are hard-disabled in the current foundation.

Evidence: Workspace feature flags; Controlled Task safety fields
Limitation: Controlled integration code exists for earlier private-beta testing, so deployment configuration still requires review.
Next prerequisite: Add workspace authorization, approved-repository checks, idempotency, audit events, and a kill switch.

Foundation Only

Audit evidence

Work Records and Ledger entries provide typed, linked evidence structure for deterministic previews.

Evidence: Work Record detail model; AI Work Ledger model; Workspace record envelopes
Limitation: ForgeLayer does not claim immutable, complete, or production-grade audit guarantees.
Next prerequisite: Add durable provenance, retention, integrity controls, and authorized audit events.

Disabled

Billing

Billing is not live. Controlled Task cost values are fixed demo estimates only.

Evidence: Billing feature flag; Controlled Task demo budget labels
Limitation: No real usage metering, invoices, checkout, or customer billing records exist.
Next prerequisite: Define authorized usage provenance and commercial controls before billing work.

Planned

Production readiness

ForgeLayer is suitable for guided deterministic private-beta evaluation, not production self-service.

Evidence: Private Beta Readiness; Production architecture plan
Limitation: Identity, durable persistence, operational controls, security validation, and runbooks remain incomplete.
Next prerequisite: Complete and independently review the production prerequisites.

Architecture and data flow

Control and evidence stay distinct from future execution

The flow below includes active demo behavior, foundations, previews, and a disabled future execution boundary.

01
Workspace
User or requester
Frames a deterministic task request.
No production identity is established.
Current
02
Workspace Identity
Workspace boundary
Resolves trusted user identity through active membership and scopes safe records to one workspace.
The production Supabase session and persistence adapters remain disabled.
Foundation Only
03
Tasks
Controlled Task
Composes control, evidence, and record context.
No dispatch or persistence occurs.
Current
04
RepoBrain / Policies
Policy evaluation
Derives repository-specific control requirements.
No repository permission is enforced.
Preview
05
AgentOS
Agent recommendation
Recommends agent fit and required oversight.
No external agent API is called.
Preview
06
Capabilities
Task capability package
Computes a task-specific authority decision from every control layer.
The package is inactive, non-persistent, and grants no credentials or external authority.
Foundation Only
07
Execution adapter
Future controlled execution
Represents a future isolated action boundary.
No adapter, sandbox, or execution is active.
Disabled
08
Controlled Task
Output intake
Separates proposed output from trusted evidence.
Output may be simulated or absent.
Preview
09
Verification Center
Verification
Classifies evidence and required human checks.
Simulated evidence cannot become real evidence.
Preview
10
Approval Center
Human approval
Keeps a human decision gate explicit.
Current actions are local and non-persistent.
Current
11
Work Records
Work Record
Links task, evidence, control, and outcome context.
Production persistence is disabled.
Foundation Only
12
AI Work Ledger
Ledger
Provides derived evidence and relationship structure.
No immutable audit guarantee is claimed.
Foundation Only

Data handled

Data classes and current handling

The table does not imply that production customer data is currently stored.

Data class	Current state	Handling	Storage boundary	Production requirement
User identityhigh sensitivity	Schema Only	A server identity interface validates opaque sessions and exposes an allowlisted projection; local Supabase Auth passed with non-production users.	No production session adapter is configured and raw session references are never returned.	Production Supabase Auth lifecycle and operations validation.
Workspace membershiphigh sensitivity	Deterministic Demo	Visible memberships remain seeded demo records; isolated local Auth/RLS tests validate active membership, switching, and tenant denial.	The 61/61 pgTAP result is local-only and does not establish production RLS behavior.	Production RLS validation and workspace operations.
Task requestsmoderate sensitivity	Deterministic Demo	Three fixed Controlled Task scenarios are composed locally.	No production task request is persisted.	Authorized workspace task repository and retention policy.
Prompts and contextrestricted sensitivity	Conditionally Processed	PromptForge runs deterministic browser analysis; optional report generation code can process supplied text when separately configured.	Raw prompts are not stored by the Controlled Task model. Browser state may retain current input during a session.	Explicit provider routing, redaction, consent, and retention controls.
Repository metadatamoderate sensitivity	Deterministic Demo	Fake repository names, paths, and PR metadata support demos; a disabled server-only adapter can later read bounded GitHub metadata.	No workspace repository connection is granted and no GitHub metadata is fetched in demo mode.	Approved installation ownership and scoped Metadata: Read and Contents: Read access.
Source-code contentrestricted sensitivity	Not Collected	The Trust Center and Controlled Task demos do not fetch customer source code.	Existing manual diff and controlled webhook code paths are separate and must be reviewed before production use.	Least-privilege access, redaction, isolation, and retention policy.
Policy configurationhigh sensitivity	Deterministic Demo	Sample forgelayer.yml rules and derived policy records are used.	No production policy version is persisted.	Authorized, versioned policy storage with provenance.
Agent and model metadatamoderate sensitivity	Deterministic Demo	Seeded agent registry and routing recommendations are used.	No provider account, credential, or live agent connection is created.	Approved provider inventory and adapter controls.
Tool activityhigh sensitivity	Not Collected	Capability packages list possible tools but remain inactive.	No command, network, or execution telemetry exists.	Isolated execution logs with integrity and access controls.
Outputs and diffsrestricted sensitivity	Deterministic Demo	Seeded summaries and simulated evidence illustrate the record shape.	No output is treated as executed or trusted production work.	Provenance-backed output intake and content controls.
Verification evidencehigh sensitivity	Deterministic Demo	Records label observed, simulated, failed, and missing evidence.	Simulated results are never promoted to real evidence.	Signed or provenance-backed test and review evidence.
Approvalshigh sensitivity	Deterministic Demo	Browser-local approval previews demonstrate human gates.	They are not durable authorized decisions.	Authenticated approver identity and immutable decision provenance.
Work Recordshigh sensitivity	Deterministic Demo	Derived records link task, controls, evidence, and next action.	Workspace record persistence is disabled.	Audited repositories, RLS, retention, and deletion.
Ledger eventshigh sensitivity	Deterministic Demo	Derived Ledger entries show future evidence relationships.	No production audit completeness or immutability is claimed.	Durable append controls, integrity review, and audit access.
Cost and usage metadatamoderate sensitivity	Not Collected	Task budgets use deterministic estimates and strict minimum limits across control layers.	No real token, cost, billing, or customer usage telemetry is collected.	Authorized metering definitions, provenance, and retention controls.

Permissions model

Server membership is the intended authorization source

A submitted role or workspace ID is not trusted. Authenticated product resolution is membership-derived and fail-closed; public demos remain an explicit separate mode.

Workspace settings

Role	Foundation permissions	Current boundary
owner	view workspace, manage workspace, invite members, review work, approve work, manage policies, configure repositories	Permissions require active server-resolved membership; client-submitted roles are not trusted.
admin	view workspace, manage workspace, invite members, review work, approve work, manage policies, configure repositories	Permissions require active server-resolved membership; client-submitted roles are not trusted.
member	view workspace, review work	Permissions require active server-resolved membership; client-submitted roles are not trusted.
reviewer	view workspace, review work, approve work	Permissions require active server-resolved membership; client-submitted roles are not trusted.
operator	view workspace, review work	Permissions require active server-resolved membership; client-submitted roles are not trusted.
viewer	view workspace	Permissions require active server-resolved membership; client-submitted roles are not trusted.

Repository and agent boundaries

No repository permission or agent authority is currently granted

Integration code and product previews do not equal an enabled capability.

Repository Connections Agent Connections Dispatch readiness

Repository controls

Disabled

Repository access

Repository Connection v1 defines a GitHub App read-only foundation, but the workspace grants no live connection, metadata fetch, source fetch, write, or task capability.

Evidence: Fail-closed repository flags; Server-only GitHub read adapter; Inactive Controlled Task repository references
Limitation: Authentication, workspace persistence, installation validation, and public self-service connection remain disabled.

Disabled

GitHub posting

Workspace GitHub posting and automatic merge are hard-disabled in the current foundation.

Evidence: Workspace feature flags; Controlled Task safety fields
Limitation: Controlled integration code exists for earlier private-beta testing, so deployment configuration still requires review.

Agent controls

Disabled

Agent execution

AgentOS recommends and compares agents. Controlled Tasks are not dispatched and no external agent is called.

Evidence: Agent Governance execution states; Controlled Task execution flags
Limitation: No sandbox, agent adapter, execution isolation, or revocation path is active.

GitHub is modeled as a repository host, not an AI provider.The workspace owns three deterministic repository preview records; no live connection is claimed.A future reviewed GitHub App installation is the intended authentication model, but no installation exists in Part 133.Repository permissions are modeled for least privilege; none were requested, granted, verified, or enforced against GitHub.Repository identity, GitHub account identity, installation identity, installation ownership, repository ownership, and permission trust remain separate.No repository metadata, contents, PR, check, comment, branch, commit, or webhook data was fetched or received.No repository write, hidden action, background execution, or automatic merge.ForgeLayer revocation can block internal workflow progression but did not uninstall a GitHub App or cancel an external GitHub operation.Repository and task kill switches cannot be overridden by approval.Provider connection records never grant repository access.No agent dispatch or external agent API call from the controlled product models.Controlled Task Dispatch v1 can evaluate eligibility, create inactive authorization previews, and model idempotency, timeout, and cancellation; it cannot send a provider request.The privileged server boundary uses a disabled transport. No prompt, source code, credential, command, or repository content is transmitted.Future access must be explicit, scoped, temporary, revocable, authorized, and auditable.

Workspace repository inventory

1 repository host recognized

3 scenario-isolated GitHub repository previews. Installation, ownership, permissions, metadata, and contents remain unverified or unavailable.

Inspect Repository Connections

3Recorded previews

0Verified installations

0Verified repositories

0Metadata read enabled

0Contents read enabled

0Write enabled

0Webhooks configured

0Repository executions

Deterministic previewGitHub requests: 0GitHub writes: 0Provider inventory remains separate

Provider boundaries

Providers evidenced by the repository

No legal terms, regions, DPAs, retention periods, or provider certifications are inferred.

Vercel

Current

Purpose: Application hosting and deployment metadata

Current usage: ForgeLayer uses Vercel-oriented deployment metadata and hosting configuration.

Data exposure: Application requests and rendered content may traverse the hosting environment.

Limitation: Region, contractual terms, retention, SLA, and certifications are not asserted by this repository.

Supabase

Foundation Only

Purpose: Intended workspace identity and persistence provider

Current usage: Client/server adapters and workspace schema/RLS definitions exist; local Auth, RLS, tenant isolation, and durability validation passed.

Data exposure: The Trust Center does not query Supabase. Production workspace authentication and persistence flags remain disabled.

Limitation: Local migration/RLS validation is not production validation; production backup, retention, deletion, recovery, and monitoring remain unvalidated.

OpenAI

Not Configured

Purpose: Optional report generation provider

Current usage: An optional server report-provider code path exists. Deterministic Trust, Task, AgentOS, and PromptForge product models do not require it.

Data exposure: Supplied prompt/diff text could be sent only when that separate provider path is configured and invoked.

Limitation: Runtime enablement, region, retention, contractual controls, and model settings are not exposed or verified here.

Codex

Foundation Only

Purpose: Workspace AI provider connection preview

Current usage: The workspace records a deterministic Codex product relationship using the Part 131 provider registry and adapter definition.

Data exposure: No OpenAI account identity, credential, provider output, repository access, health observation, dispatch, or execution exists.

Limitation: Production use requires authenticated workspace identity, secure secret storage, verified provider ownership, reviewed adapter controls, and sandboxed transport.

Claude Code

Foundation Only

Purpose: Workspace AI provider connection preview

Current usage: Claude Code is a first-class deterministic workspace provider product with registry-owned modeled capabilities.

Data exposure: No Anthropic account identity, credential, provider output, repository access, health observation, dispatch, or execution exists.

Limitation: Production use requires provider-specific authentication, ownership and permission validation, adapter security review, containment, cancellation, and durable auditing.

Cursor

Foundation Only

Purpose: Workspace AI coding environment connection preview

Current usage: Cursor is recorded as an AI coding environment with future IDE-extension or local-bridge semantics.

Data exposure: ForgeLayer cannot access or remotely control a Cursor desktop session and has no identity, credential, health, output, dispatch, or execution state.

Limitation: A future integration requires explicit workspace identity, reviewed local bridge or extension boundaries, isolation, redaction, and user-controlled authorization.

GitHub

Disabled

Purpose: Webhook, repository policy, and read-only repository connection foundation

Current usage: GitHub App helpers and a server-only Repository Connection v1 adapter define Metadata: Read and Contents: Read access for identity, default-branch head, and bounded tree metadata.

Data exposure: Current workspace connections and source-content fetches are disabled. Installation tokens are intended to remain short-lived, server-only, unlogged, and non-persistent.

Limitation: Production requires trusted workspace identity, validated RLS persistence, installation ownership, revocation, audit events, and task-scoped authorization; posting and writes remain separate disabled boundaries.

Recorded preview · unverified

Codex workspace connection boundary

Membership is recorded for ForgeLayer Guided Beta; provider account ownership is not verified.

Identity and ownership: unverified
Authentication: unavailable; no provider secret stored
Health: not checked; no live observation
Provider output: not received
Dispatch and execution: disabled

Recorded preview · unverified

Claude Code workspace connection boundary

Membership is recorded for ForgeLayer Guided Beta; provider account ownership is not verified.

Identity and ownership: unverified
Authentication: unavailable; no provider secret stored
Health: not checked; no live observation
Provider output: not received
Dispatch and execution: disabled

Claude Code is first-class in the launch model without implying live Anthropic connectivity.

Recorded preview · unverified

Cursor workspace connection boundary

Membership is recorded for ForgeLayer Guided Beta; provider account ownership is not verified.

Identity and ownership: unverified
Authentication: unavailable; no provider secret stored
Health: not checked; no live observation
Provider output: not received
Dispatch and execution: disabled

Cursor is an AI coding environment; ForgeLayer cannot access or control a desktop session.

Storage and retention

Foundations exist; production lifecycle policy does not

Storage boundaries

Current

Deterministic demo state

Most product records are seeded or derived on request and explicitly marked persisted: false.

Evidence: Demo workspace identity; Workspace record-source adapter
Limitation: Some browser-local inputs, filters, or history can remain in the current browser; that is not server persistence.

Foundation Only

Conditional Review Run storage

A server-side Supabase path can store safe GitHub review-run summaries when separately configured.

Evidence: Review Run storage module; Supabase admin transport
Limitation: It is not the authenticated workspace persistence system and this Trust Center does not verify deployment state.

Foundation Only

Workspace record schema

Additive migrations define workspace identity plus safe provider, repository, task, routing, approval, Work Record, idempotency, and append-only Ledger foundations with RLS.

Evidence: Workspace identity migrations; 61/61 local pgTAP RLS suite; Local runtime durability verifier
Limitation: Migrations 001-003 replayed only against isolated local Postgres; no remote or production migration was applied.

Retention and deletion

Not Applicable Demo

Demo retention

Deterministic server-rendered records are recreated from code. Browser-local state follows the browser feature that created it.

Evidence: Deterministic product models; Browser-local action components
Limitation: ForgeLayer does not claim that all browser data is automatically erased.

Planned

Production retention policy

A customer retention schedule has not been finalized.

Evidence: Production architecture prerequisites
Limitation: No production retention promise should be inferred.

Planned

Deletion workflow

Production workspace and record deletion workflows are not implemented.

Evidence: Workspace persistence roadmap
Limitation: Browser-local reset actions are not production deletion.

Not Configured

Backup and recovery

Application-level backup and recovery procedures are not implemented or verified.

Evidence: Production readiness blockers
Limitation: Provider defaults are not documented here as ForgeLayer guarantees.

Encryption boundaries

Provider assumptions are not ForgeLayer guarantees

The repository supports precise statements about HTTPS endpoints and secret separation, not end-to-end or at-rest guarantees.

Current encryption statements

Foundation Only

Transport protection

Configured provider endpoints use HTTPS URLs in application code.

Evidence: Provider client modules
Limitation: TLS deployment configuration and provider controls are not independently verified by this repository.

Not Configured

Application-level field encryption

No application-level encryption layer for workspace records is implemented.

Evidence: Workspace persistence foundation
Limitation: Do not infer end-to-end encryption or encrypted fields.

Not Configured

Encryption at rest

ForgeLayer has not independently verified or documented an application guarantee for encryption at rest.

Evidence: Provider boundary review
Limitation: Provider capabilities are not restated as ForgeLayer guarantees.

Current

Secrets handling

Server-only configuration is separated from client-safe configuration, and diagnostics return booleans or safe codes instead of values.

Evidence: Environment template; GitHub diagnostics; Supabase diagnostics
Limitation: A production secrets-management runbook, rotation process, and access review are not documented.

Verification, approvals, and evidence

Recommendations, restrictions, evidence, and human decisions stay separate

Verification

Preview

Verification

Verification Runners v1 maps Policy Engine requirements to deterministic plans, internal metadata controls, blocked repository runners, and separate human checks.

Evidence: Verification Center; Verification plan builder; Server-owned command allowlist; Disabled execution transport
Limitation: ForgeLayer can validate internal control and evidence consistency. It does not execute repository verification commands in public production, and an internal-control pass does not prove code correctness or security.

Human approval

Current

Human approval

Human approval remains a required product boundary and local actions cannot infer approval.

Evidence: Approval Center; Controlled Task advancement guard
Limitation: Current decisions are browser-local preview state, not durable authorized production decisions.

Audit evidence foundation

Foundation Only

Audit evidence

Work Records and Ledger entries provide typed, linked evidence structure for deterministic previews.

Evidence: Work Record detail model; AI Work Ledger model; Workspace record envelopes
Limitation: ForgeLayer does not claim immutable, complete, or production-grade audit guarantees.

Output and evidence handling

Provider output remains untrusted until independently verified

Evidence Intake validates and normalizes safe metadata. Verification Runners v1 can check internal record consistency, while repository commands and external scanners remain disabled.

Inspect Evidence Intake Verification Boundaries

Foundation only

Validation does not establish truth

Provider output is treated as untrusted input. Schema-valid output is not considered verified, and provider-reported evidence cannot promote itself into ForgeLayer-observed or independently verified evidence.

Reconstruction only

Replay does not execute work

Replay reconstructs recorded lifecycle evidence; it does not re-execute an agent session. Integrity references identify normalized metadata but do not prove an external action or create immutable history.

Known limitation

Redaction remains conservative and heuristic

Pattern-based redaction records that filtering occurred, but it is not a guarantee of complete secret detection and never raises evidence trust.

Incident response and operations

Operational gaps remain visible

Security contact: Use the communication channel agreed for the private-beta review.

Not Configured

Security contact

A public security contact is not published in the product.

Design partners should use the agreed private-beta communication channel.

Planned

Incident response

A production incident-response process and escalation matrix are not documented.

No response-time commitment is offered.

Foundation Only

Security logging

Selected integration paths log safe metadata and avoid raw secrets or payloads.

There is no centralized production security logging or audit-event service.

Disabled

Production telemetry

Analytics uses deterministic sample data and production telemetry is disabled.

No continuous production monitoring capability is claimed.

Not Configured

Uptime and SLA

No production uptime target or service-level agreement is offered.

Hosting availability is not restated as a ForgeLayer SLA.

Planned

Vulnerability disclosure

A public vulnerability-disclosure policy is not published.

No public intake or response process is promised.

Not Configured

Penetration testing

No independent penetration test is claimed.

Independent testing remains a production prerequisite.

Compliance and certifications

No formal certification or legal compliance status is claimed

Certifications claimed: 0

ForgeLayer does not currently claim SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, GDPR compliance, or another formal certification or legal compliance status.

SOC 2
ISO 27001
HIPAA
PCI DSS
FedRAMP
GDPR compliance
Any other formal certification or legal compliance status

Privacy and security are design goals. They are not a substitute for independent certification, contractual review, or legal advice.

Production prerequisites

Required before controlled production use

This roadmap is a security gate list, not a production commitment.

Production architecture

01Review an approved production Supabase target and repeat Auth, RLS, isolation, and durability validation there.
02Review production session lifecycle, rotation, recovery, and owner bootstrap operations.
03Review production persistence failure behavior, monitoring, retention, backup, and recovery.
04Review GitHub installation ownership and least-privilege repository permissions.
05Enforce task-specific capability packages at a server authorization boundary.
06Security-review every agent/provider adapter before connection.
07Provide execution isolation, network controls, kill switches, and revocation.
08Establish evidence provenance and integrity controls.
09Persist authorized operational audit events.
10Implement and test backup and recovery procedures.
11Publish an incident-response and vulnerability-disclosure process.
12Document secrets management, rotation, monitoring, and alerting.
13Define customer retention and deletion policies.
14Complete independent security review and penetration testing.
15Create production deployment, rollback, and emergency runbooks.

Design-partner security review

Informational questions only. Answers are not submitted or persisted.

Which repositories may be connected?
Which paths and data are sensitive?
Which agents and model providers are currently used?
Which commands, tools, or environments may be accessed?
Is outbound network access permitted?
Which tests and evidence are required before approval?
Which workspace roles may review and approve?
What retention and deletion window is acceptable?
Which data must not leave the customer-controlled environment?
Which security review is required before pilot access?

Trust Center boundaries

Deterministic private-beta demonstration; not production self-service.
Production authentication and workspace persistence adapters remain disabled; trusted identity and durable workspace schemas exist as a foundation.
No repository connection is active; Repository Connection v1 is a disabled GitHub App read-only foundation with no live metadata, source content, write, posting, or task access.
No agent dispatch, live execution, background workflow, or external agent call.
Provider connection records are deterministic workspace previews; identity, ownership, authentication, health, and output remain unverified or unavailable.
No GitHub posting, Check Run creation, or automatic merge.
No billing, customer usage analytics, or production telemetry.
Simulated evidence cannot become verified evidence. Generic Platform Guidance: Human approval remains required.
No certification, legal compliance, encryption, uptime, backup, recovery, or incident-response guarantee is claimed.

Security architecture, without unsupported claims.

ForgeLayer is building an independent control, verification, and evidence layer for AI-generated software work.

This page separates active demo behavior, current foundations, previews, planned controls, disabled capabilities, and areas that are not configured.

Data class

Current state

Handling

Storage boundary

Production requirement

User identityhigh sensitivity

Schema Only

A server identity interface validates opaque sessions and exposes an allowlisted projection; local Supabase Auth passed with non-production users.

No production session adapter is configured and raw session references are never returned.

Production Supabase Auth lifecycle and operations validation.

Workspace membershiphigh sensitivity

Deterministic Demo

Visible memberships remain seeded demo records; isolated local Auth/RLS tests validate active membership, switching, and tenant denial.

The 61/61 pgTAP result is local-only and does not establish production RLS behavior.

Production RLS validation and workspace operations.

Task requestsmoderate sensitivity

Deterministic Demo

Three fixed Controlled Task scenarios are composed locally.

No production task request is persisted.

Authorized workspace task repository and retention policy.

Prompts and contextrestricted sensitivity

Conditionally Processed

PromptForge runs deterministic browser analysis; optional report generation code can process supplied text when separately configured.

Raw prompts are not stored by the Controlled Task model. Browser state may retain current input during a session.

Explicit provider routing, redaction, consent, and retention controls.

Repository metadatamoderate sensitivity

Deterministic Demo

Fake repository names, paths, and PR metadata support demos; a disabled server-only adapter can later read bounded GitHub metadata.

No workspace repository connection is granted and no GitHub metadata is fetched in demo mode.

Approved installation ownership and scoped Metadata: Read and Contents: Read access.

Source-code contentrestricted sensitivity

Not Collected

The Trust Center and Controlled Task demos do not fetch customer source code.

Existing manual diff and controlled webhook code paths are separate and must be reviewed before production use.

Least-privilege access, redaction, isolation, and retention policy.

Policy configurationhigh sensitivity

Deterministic Demo

Sample forgelayer.yml rules and derived policy records are used.

No production policy version is persisted.

Authorized, versioned policy storage with provenance.

Agent and model metadatamoderate sensitivity

Deterministic Demo

Seeded agent registry and routing recommendations are used.

No provider account, credential, or live agent connection is created.

Approved provider inventory and adapter controls.

Tool activityhigh sensitivity

Not Collected

Capability packages list possible tools but remain inactive.

No command, network, or execution telemetry exists.

Isolated execution logs with integrity and access controls.

Outputs and diffsrestricted sensitivity

Deterministic Demo

Seeded summaries and simulated evidence illustrate the record shape.

No output is treated as executed or trusted production work.

Provenance-backed output intake and content controls.

Verification evidencehigh sensitivity

Deterministic Demo

Records label observed, simulated, failed, and missing evidence.

Simulated results are never promoted to real evidence.

Signed or provenance-backed test and review evidence.

Approvalshigh sensitivity

Deterministic Demo

Browser-local approval previews demonstrate human gates.

They are not durable authorized decisions.

Authenticated approver identity and immutable decision provenance.

Work Recordshigh sensitivity

Deterministic Demo

Derived records link task, controls, evidence, and next action.

Workspace record persistence is disabled.

Audited repositories, RLS, retention, and deletion.

Ledger eventshigh sensitivity

Deterministic Demo

Derived Ledger entries show future evidence relationships.

No production audit completeness or immutability is claimed.

Durable append controls, integrity review, and audit access.

Cost and usage metadatamoderate sensitivity

Not Collected

Task budgets use deterministic estimates and strict minimum limits across control layers.

No real token, cost, billing, or customer usage telemetry is collected.

Authorized metering definitions, provenance, and retention controls.

Role

Foundation permissions

Current boundary

owner

view workspace, manage workspace, invite members, review work, approve work, manage policies, configure repositories