Platform restructure completion audit#

This document is the requirement-to-evidence index for the Forge platform restructure. It deliberately separates repository/local proof from connected Cloudflare proof. The initial cutover and its rollback exercise completed on 2026-08-05; future releases must continue satisfying the same evidence contract rather than treating this audit as a one-time exception.

Deliverables#

Deliverable	Authoritative evidence	Repository status
Current-state architecture and authority map	`platform-components.md`, `config/forge-releases/*.json`, and `scripts/verify-forge-release-contracts.mjs`	locally proven
Considered options and selected design	`platform-components.md` options A-C and decision record	locally proven
Staged migration with explicit invariants	`platform-components.md` migration stages and state/authorization invariants	locally proven
Smallest coherent end-to-end implementation	edge + identity + repository + deploy-control + notifications configs, with the combined API entrypoint removed	locally proven
Tests, release contracts, and operations docs	`package.json` gates, release-contract verifier, this audit, and `../operations/production-deployment.md`	locally proven
Normal non-force commit and push	clean exact commit is required by the release coordinator	proven on `main`
Connected-release evidence for every changed unit	`.forge-release-evidence/`, generalized Deploy edge release, provider traffic reads, and live probes	connected proof complete

Inventory and ownership evidence#

The eleven production deploy units are enumerated once in config/forge-components.json. Every entry owns one unique Wrangler config and one unique release contract. The contract verifier fails unless every JSON file under config/forge-releases/ has exactly one component owner and its complete configured/live binding set matches the typed allowlist.

The architecture inventory records public/custom routes, private Workers, Service Bindings, D1 databases, R2 buckets, Durable Objects, Workflows, AI, email, Assets, secrets, scheduled handlers, state ownership, and durable repair authority. Test-only Wrangler fixtures are not release units. The old combined API entrypoint, all-authority integration config, deploy-all alias, and post-push raw deploy path are absent.

Required local validation#

Requirement	Direct evidence
Service-boundary contracts	edge route-owner/index tests; identity RPC authentication tests; exact nested dependency-health tests
Unauthorized cross-service denial	edge returns 404 for `/internal/` and `/api/internal/` without forwarding; private Workers disable `workers_dev`; Wiki internal endpoints require their component token
No unrelated bindings	`component-authority.test.mjs` plus exhaustive `verify-forge-release-contracts.mjs` inspection of all eleven configs
Credential revocation and account generation	`utils/authentication.test.ts`, service-principal and Slack persistence tests, authorization-fanout SQLite tests, and Sites generation-fence tests
Interruption before/after external side effects	invitation delivery tests prove pre-send retry and post-send ambiguity fencing; runner chaos/retry and provider-activation tests cover interrupted operations
Idempotent outbox/reconciliation	authorization fanout, invitation delivery, repository agent, Wiki, Deploy delivery, activation, and runner reconciliation tests
Independent builds/releases	`verify-component-source-impact.mjs` dry-builds all eleven Workers; release tests prove upload-before-activation, dependency order, scoped rollback, and per-component receipts
Changed-path/dependency impact	`forge-release-impact.test.mjs`, provider-impact tests, and bundle-metafile verification
Migration safety	one fresh-schema baseline, integrity and foreign-key checks, deterministic seed verification, and required Time Travel evidence before recreation
Exact-version health and routes	component live-verification tests, runner readiness tests, edge exact-version probe, route-owner tests, and provider traffic classifier
Web/docs authority isolation	docs/web impact selects edge only; edge config has Assets and three service bindings but no D1, R2, email, Git, AI, Workflow, DO, or operator secret
Real Cloudflare-local behavior	split multi-Worker fork/storage smokes and container-backed streaming Git push/clone/strict-fsck smoke

The local release gate is:

npm run typecheck
npm run test:unit
npm run test:migrations
npm run test:release-contracts
npm run build
npm run test:integration:local
npm run test:integration:storage
npm run test:smoke

Connected completion evidence#

Each component receipt is schema-validated before writing and must contain an exact source SHA, successful build and Action gates, release operation ID, immutable provider version, binding-policy digest, exact 100-percent active pointer, targeted live verification, and an exact rollback target or explicit first-release unavailability.

forge-release-affected.mjs obtains one forge-release-validation/v1 receipt for the clean exact SHA before migrations or provider changes. The receipt enumerates the complete local gate above; each component receipt references it and cannot substitute an assertion or an unrelated earlier run.

Component	Provider/active proof	Live completion proof	Status
edge	connected generalized Deploy release and active provider link	exact-version `forge.smol.ai/health/dependencies` plus public web/docs	proven
identity	component receipt and provider traffic read	edge-composed exact identity health; authenticated session probe	proven
repository	component receipt and provider traffic read	edge-composed exact repository health; Git/API canary	proven
deploy-control	component receipt and provider traffic read	edge-composed exact Deploy health; project/status probe	proven
notifications	component receipt and provider traffic read	repository-composed exact health and real rollback/restore	proven
runner	drain/verify/ready receipt, exact Worker/image/toolchain	composed deep readiness and production Git ingest canary	proven
sites-edge	component receipt and provider traffic read	exact `health.sites.smol.ai/.forge/health` and public Site health	proven
deploy-runtime	component receipt and provider traffic read	deploy-control-composed runtime/router health	proven
wiki-worker	component receipt and provider traffic read	repository-composed exact health, exact-SHA Wiki and MCP	proven
ai-router	component receipt and provider traffic read	runtime-composed exact health	proven
slack-agent	component receipt and provider traffic read	exact `slack.forge.smol.ai/health`	proven

Rollback completion requires exercising one selected component back to its recorded prior version, proving the pointer and public/composed health, and then restoring the intended version through the same release contract. A successful upload, build, Action, commit, or push is not a substitute.

The cutover exercise moved notifications from abc8ded1-2430-437d-aa7a-a785e34d4055 to its recorded rollback target 7a36a2cc-1123-4136-a58a-b26408e67948 at 100 percent traffic. The public dependency graph observed the rollback version with an empty binding-mismatch set. The same versioned deployment operation then restored abc8ded1... at 100 percent, and the public graph observed the restored exact version. The production Git canary separately created a repository-scoped one-hour credential, streamed an initial and existing-ref push, cloned and ran strict git fsck, then deleted the canary branch and revoked the credential.

Opening the page…