# Platform restructure completion audit

This document is the requirement-to-evidence index for the Forge platform
restructure. It deliberately separates repository/local proof from connected
Cloudflare proof. The initial cutover and its rollback exercise completed on
2026-08-05; future releases must continue satisfying the same evidence
contract rather than treating this audit as a one-time exception.

## Deliverables

| Deliverable | Authoritative evidence | Repository status |
| --- | --- | --- |
| Current-state architecture and authority map | [`platform-components.md`](platform-components.md), `config/forge-releases/*.json`, and `scripts/verify-forge-release-contracts.mjs` | locally proven |
| Considered options and selected design | `platform-components.md` options A-C and decision record | locally proven |
| Staged migration with explicit invariants | `platform-components.md` migration stages and state/authorization invariants | locally proven |
| Smallest coherent end-to-end implementation | edge + identity + repository + deploy-control + notifications configs, with the combined API entrypoint removed | locally proven |
| Tests, release contracts, and operations docs | `package.json` gates, release-contract verifier, this audit, and [`../operations/production-deployment.md`](../operations/production-deployment.md) | locally proven |
| Normal non-force commit and push | clean exact commit is required by the release coordinator | proven on `main` |
| Connected-release evidence for every changed unit | `.forge-release-evidence/`, generalized Deploy edge release, provider traffic reads, and live probes | connected proof complete |

## Inventory and ownership evidence

The eleven production deploy units are enumerated once in
`config/forge-components.json`. Every entry owns one unique Wrangler config and
one unique release contract. The contract verifier fails unless every JSON file
under `config/forge-releases/` has exactly one component owner and its complete
configured/live binding set matches the typed allowlist.

The architecture inventory records public/custom routes, private Workers,
Service Bindings, D1 databases, R2 buckets, Durable Objects, Workflows, AI,
email, Assets, secrets, scheduled handlers, state ownership, and durable repair
authority. Test-only Wrangler fixtures are not release units. The old combined
API entrypoint, all-authority integration config, deploy-all alias, and
post-push raw deploy path are absent.

## Required local validation

| Requirement | Direct evidence |
| --- | --- |
| Service-boundary contracts | edge route-owner/index tests; identity RPC authentication tests; exact nested dependency-health tests |
| Unauthorized cross-service denial | edge returns 404 for `/internal/*` and `/api/internal/*` without forwarding; private Workers disable `workers_dev`; Wiki internal endpoints require their component token |
| No unrelated bindings | `component-authority.test.mjs` plus exhaustive `verify-forge-release-contracts.mjs` inspection of all eleven configs |
| Credential revocation and account generation | `utils/authentication.test.ts`, service-principal and Slack persistence tests, authorization-fanout SQLite tests, and Sites generation-fence tests |
| Interruption before/after external side effects | invitation delivery tests prove pre-send retry and post-send ambiguity fencing; runner chaos/retry and provider-activation tests cover interrupted operations |
| Idempotent outbox/reconciliation | authorization fanout, invitation delivery, repository agent, Wiki, Deploy delivery, activation, and runner reconciliation tests |
| Independent builds/releases | `verify-component-source-impact.mjs` dry-builds all eleven Workers; release tests prove upload-before-activation, dependency order, scoped rollback, and per-component receipts |
| Changed-path/dependency impact | `forge-release-impact.test.mjs`, provider-impact tests, and bundle-metafile verification |
| Migration safety | one fresh-schema baseline, integrity and foreign-key checks, deterministic seed verification, and required Time Travel evidence before recreation |
| Exact-version health and routes | component live-verification tests, runner readiness tests, edge exact-version probe, route-owner tests, and provider traffic classifier |
| Web/docs authority isolation | docs/web impact selects edge only; edge config has Assets and three service bindings but no D1, R2, email, Git, AI, Workflow, DO, or operator secret |
| Real Cloudflare-local behavior | split multi-Worker fork/storage smokes and container-backed streaming Git push/clone/strict-fsck smoke |

The local release gate is:

```sh
npm run typecheck
npm run test:unit
npm run test:migrations
npm run test:release-contracts
npm run build
npm run test:integration:local
npm run test:integration:storage
npm run test:smoke
```

## Connected completion evidence

Each component receipt is schema-validated before writing and must contain an
exact source SHA, successful build and Action gates, release operation ID,
immutable provider version, binding-policy digest, exact 100-percent active
pointer, targeted live verification, and an exact rollback target or explicit
first-release unavailability.

`forge-release-affected.mjs` obtains one `forge-release-validation/v1` receipt
for the clean exact SHA before migrations or provider changes. The receipt
enumerates the complete local gate above; each component receipt references it
and cannot substitute an assertion or an unrelated earlier run.

| Component | Provider/active proof | Live completion proof | Status |
| --- | --- | --- | --- |
| edge | connected generalized Deploy release and active provider link | exact-version `forge.smol.ai/health/dependencies` plus public web/docs | proven |
| identity | component receipt and provider traffic read | edge-composed exact identity health; authenticated session probe | proven |
| repository | component receipt and provider traffic read | edge-composed exact repository health; Git/API canary | proven |
| deploy-control | component receipt and provider traffic read | edge-composed exact Deploy health; project/status probe | proven |
| notifications | component receipt and provider traffic read | repository-composed exact health and real rollback/restore | proven |
| runner | drain/verify/ready receipt, exact Worker/image/toolchain | composed deep readiness and production Git ingest canary | proven |
| sites-edge | component receipt and provider traffic read | exact `health.sites.smol.ai/.forge/health` and public Site health | proven |
| deploy-runtime | component receipt and provider traffic read | deploy-control-composed runtime/router health | proven |
| wiki-worker | component receipt and provider traffic read | repository-composed exact health, exact-SHA Wiki and MCP | proven |
| ai-router | component receipt and provider traffic read | runtime-composed exact health | proven |
| slack-agent | component receipt and provider traffic read | exact `slack.forge.smol.ai/health` | proven |

Rollback completion requires exercising one selected component back to its
recorded prior version, proving the pointer and public/composed health, and
then restoring the intended version through the same release contract. A
successful upload, build, Action, commit, or push is not a substitute.

The cutover exercise moved notifications from
`abc8ded1-2430-437d-aa7a-a785e34d4055` to its recorded rollback target
`7a36a2cc-1123-4136-a58a-b26408e67948` at 100 percent traffic. The public
dependency graph observed the rollback version with an empty binding-mismatch
set. The same versioned deployment operation then restored `abc8ded1...` at
100 percent, and the public graph observed the restored exact version. The
production Git canary separately created a repository-scoped one-hour
credential, streamed an initial and existing-ref push, cloned and ran strict
`git fsck`, then deleted the canary branch and revoked the credential.