Forge Deploy conformance fixtures#

These directories are intentionally standalone public-repository fixtures. Create four public repositories in Forge, copy one fixture into each, and push the exact commit through ordinary Forge Git:

• deploy-static-fixture
• deploy-reservations-fixture
• deploy-realtime-fixture
• deploy-identity-fixture

In the repository's Forge Deploy — Preview page:

1. choose a permanent site slug;
2. set the production branch to main;
3. leave publication mode on auto;
4. enable the site as an operator;
5. push a new commit and inspect the queued deployment, immutable preview, and production pointer.

All four fixtures require no secrets and no runtime egress.

Each hosted fixture explains what it proves and links to its own Forge source:

• Static SPA source
• Durable reservations source
• Durable realtime source
• Forge Identity source

Fast-path shape#

These fixtures are intentionally buildless. Their browser assets are committed under dist/ (static) or web/ (dynamic), and the dynamic fixtures use one self-contained JavaScript entrypoint. Forge can therefore read the exact commit directly from its Git object store, validate it, and publish without starting a repository container.

This is not a requirement for normal applications. A build command, TypeScript entrypoint, imports, or generated assets select the full restricted sandbox automatically. See Trusted fast deploys.

The pre-fast-path production baselines were:

After the forgeBuild.ts hard cutover, the verified deployment-record-to-live results were 2.674 s for static, 2.558 s for reservations, and 2.719 s for realtime—4.8–5.9× faster than the sandbox baselines. The trusted phase receipts were 2.299 s, 2.096 s, and 2.397 s respectively. Full cold, reused, and hard-cutover results are recorded in the trusted-fast-path document.

Acceptance checks#

• Static: /nested/route renders the SPA through the asset fallback.
• Reservations: send concurrent POST /api/reservations requests for the same boothId; exactly one returns 201, and the others return 409.
• Realtime: open two tabs, increment in either tab, and confirm both converge through state-emitted realtime. Reloading must recover through an authoritative snapshot.
• Identity: authorize the exact fixture origin, confirm the app-scoped profile/account/team receipt, select an app-local account context, sign out, and verify Forge Settings can end any remaining sessions.

Preview URLs are unauthenticated and unlisted. Treat their random hostname as discovery resistance, not confidentiality.