casioreview20-glitch/forge-os

ForgeOS

Skill Intelligence OS and Trust Control Plane for AI agents.

ForgeOS decides which skill may run , which context may enter , which steps must be deterministic , and which evidence is strong enough to accept completion .

5-minute path · How it works · Ecosystem comparison · For developers · For experts · Tiếng Việt · 22 translations

Why ForgeOS exists

An agent does not become reliable because it has more prompts, more tools, or a longer context window.

It becomes reliable when the system can answer six questions:

1. What exact outcome is required?
2. Which technique is appropriate—and which similar techniques are wrong here?
3. What is the smallest context needed for this work unit?
4. Which steps must be deterministic rather than delegated to a model?
5. What independent evidence proves the output?
6. Can the same workflow recover, resume, and audit itself after failure?

ForgeOS v0.6 turns those questions into a runtime:

confirmed intent
→ outcome + technique retrieval
→ hard policy and anti-trigger filters
→ minimum RoutePlan DAG
→ isolated ContextPack per work unit
→ deterministic / agent / reflection execution graph
→ anchored outputs + coverage ledger
→ trusted receipts + evidence gates
→ release, rollback, recovery, and learning quarantine

It is not a prompt collection. It is the control plane around skills, rules, hooks, agents, tools, context, evidence, and learning.

What is real in v0.6.1

[!IMPORTANT] The 1,024 legacy nodes are outcome scaffolds, not 1,024 production-grade procedural skills. v0.6 contains 128 deep technique contracts. Thirty-three procedural providers remain in the declared stable routing channel for compatibility, but the final certification audit finds 0/128 evidence-qualified stable and 0 certified under the Revision 2 Definition of Done. The remaining evidence requires holdout, paired multi-model, pressure, independent review, and production receipts.

Kernel inventory: 32 L0 techniques + 96 L1 techniques = 128 deep kernel techniques.

Catalog routing states: 33 declared stable-channel procedural providers and 242 candidates. Formal certification evidence: 0 stable-qualified, 0 certified. See Final Certification Audit.

The release audit intentionally keeps these claims false:

1,024 production-grade procedural skills false
full PostgreSQL lifecycle HA false
universal microVM sandbox false
expert-labeled 200-PR review benchmark false
10,000 paired evaluation runs false

ForgeOS v0.6 does not claim universal production completeness or 1,024 production-grade procedural skills.

See Claims Boundary v0.6.

Universal lanes, governed execution

The immutable Universal Lane Registry routes work across strategy and research, product UX/UI, visual media and 3D, software, data and AI, agents, security, cloud operations, commerce, education, hardware/manufacturing, and robotics/physical AI. A lane is a truthful routing and evidence contract—not a claim that ForgeOS can autonomously operate a factory, robot, payment flow, or production environment.

Physical-world work remains human-approved. High-risk third-party execution requires a compatible configured remote provider; the local broker never pretends to be a microVM. See Remote MicroVM Sandbox.

Five-minute path

Use this path when you want value without learning the Trust Kernel first.

1. Install

npm install
npm test
node src/cli/forge.mjs init

Installed package:

npx forgeos init
forge doctor

forge init creates a safe local SQLite-WAL profile. Its API key is written to a 0600 file and is never printed.

2. Find the right technique

forge skills search "react rerender"
forge skills inspect reducing-react-render-thrashing
forge route --query "compile the minimum context for a large monorepo"

3. Inspect v0.6

forge v06 status
forge profile plan coding --target codex
forge security scan --file agent-surface.json

4. Check the high-risk execution boundary

node src/cli/forge.mjs sandbox status --json

Without a configured remote provider this intentionally returns unavailable and exit code 2; ForgeOS never represents the local broker as a microVM. See Remote MicroVM Sandbox for the signed provider contract.

5. Start the local control plane

npm start
# Dashboard: http://127.0.0.1:8787/dashboard
# MCP: http://127.0.0.1:8787/mcp
# A2A: http://127.0.0.1:8787/a2a

Deep operator path

Use this path when embedding ForgeOS into Codex, Claude Code, ChatGPT, an open-source agent, CI, or an internal platform.

Skill Intelligence Router

The router performs two-stage retrieval instead of matching a skill name:

intent / failed gate
→ outcome retrieval
→ direct technique-trigger retrieval
→ anti-trigger exclusion
→ trust, tenant, maturity, tool, license, freshness filters
→ measured-utility reranking
→ minimum technique DAG
→ provider resolution
→ frozen RoutePlan

Every selected and rejected technique has a reason. Hard blockers always beat score.

Global Context Kernel v2

ForgeOS budgets the complete request:

system · task · selected skill sections · code symbols · artifacts
· memory · tool output · references · lazy tool schemas
· output reserve · safety reserve

It provides:

• one token-accounting interface shared by resolver and materializer;
• section-level skill loading;
• isolated context per work unit;
• lazy tool-schema materialization;
• Semantic ABI symbol IDs and stale-hash rejection;
• artifact delta projection;
• scoped, expiring instinct injection;
• content-addressed raw logs with distilled failure ranges;
• an omission manifest for every source not included.

Deterministic Skill Fabric

A v0.6 technique is compiled into an executable graph:

Deterministic nodes
scope-selection · bundling · rule-resolution · anchoring · evidence

Agent nodes
investigation · hypothesis · domain judgment

Reflection nodes
contradiction · false-positive filter · actionability

Control nodes
parallel join · coverage gate · retry · rollback

The SQLite coverage ledger uses leases, heartbeat, fencing, and trusted receipts. A reclaimed worker cannot mark a work unit complete.

Code Review Intelligence vertical slice

The first complete vertical slice proves the architecture end to end:

complete scope
→ relation-aware work units
→ contextual rule selection
→ isolated agent analysis
→ line/hash anchors
→ relocation after edits
→ independent reflection
→ coverage receipt

The bundled 12-case corpus is a deterministic conformance benchmark. It is not advertised as an expert-labeled 200-PR benchmark.

Continuous Learning—without automatic self-poisoning

Observed patterns become scoped instincts, not stable skills:

trusted run receipts
→ observed instinct
→ tenant/project/harness isolation + TTL
→ compatible instinct cluster
→ candidate evolution proposal
→ independent evaluation
→ human promotion or rollback

The producer cannot promote its own learned behavior.

Harness Runtime v2

ForgeOS distinguishes four surfaces:

Neutral events include before.tool.execute, after.file.write, verification.checkpoint, session.compact, and session.ended. Host adapters must mark unsupported features instead of claiming false parity.

Profiles:

minimal · coding · creative · research · regulated
local-small · enterprise

Agent Surface Security

The security engine scans the agent system itself:

• instruction and prompt-boundary violations;
• hooks and package lifecycle scripts;
• MCP descriptions, permissions, and tool reachability;
• command allowlists;
• secret/environment references;
• secret-to-egress permission paths;
• pipe-to-shell and broad wildcard capability;
• profile permission diffs before installation.

Its adversarial corpus currently passes 20/20 cases.

Brokered local execution

The local runner provides a real safety boundary for normal commands:

• no shell interpolation;
• command and environment allowlists;
• workspace and symlink containment;
• timeout and process-group termination;
• bounded stdout/stderr;
• content-addressed execution receipt.

It is not a universal network-denying microVM sandbox. High-risk third-party execution still requires an external container or microVM isolation layer.

ForgeOS now has a fail-closed remote microVM control-plane adapter: it submits only to a configured HTTPS provider and accepts only request-bound, Ed25519-signed receipts with explicit network and secret isolation evidence. It never falls back to the local broker. The adapter is not a hosted microVM service; a compatible production provider remains an external deployment requirement. See Remote MicroVM Sandbox.

How ForgeOS works

ForgeOS combines two products in one runtime:

1. A Skill Intelligence layer that retrieves techniques, rejects unsafe near-matches, compiles only the required skill sections, and builds a frozen execution plan.
2. An AI control plane that manages projects, artifacts, evidence, approvals, leases, recovery, federation, and release gates.

confirmed intent or failed gate
→ outcome and direct-technique retrieval
→ anti-trigger, tenant, trust, tool, license, and freshness filters
→ minimum frozen RoutePlan DAG
→ isolated ContextPack per work unit
→ deterministic / agent / reflection Execution Graph
→ anchored outputs and fenced Coverage Ledger
→ trusted receipts and assurance-aware gates
→ release, recovery, rollback, or learning quarantine

Ten cooperating systems

... (truncated at the site's per-page length limit; see the source link below for the full text.)