Implement bounded context issuance and evidence for #179

.env.example

@@ -40,9 +40,19 @@ POSTGRES_PASSWORD=change_me
 POSTGRES_DB=forge
 DATABASE_URL=postgresql://forge:change_me@localhost:5432/forge
 
+# Legacy leakage scrub (operator-run maintenance; never print the key bytes).
+# Use a dedicated PostgreSQL admin connection, not the ordinary app role.
+# FORGE_DATABASE_ADMIN_URL=postgresql://forge_scrub_admin:...@localhost:5432/forge
+# FORGE_LEGACY_LEAKAGE_SCRUB_FINGERPRINT_KEY= # exactly 32 random bytes, hex or base64
+# FORGE_LEGACY_LEAKAGE_SCRUB_FINGERPRINT_KEY_ID= # bounded non-secret label, e.g. scrub-v2
+
 # Redis — job queues and agent scheduling.
 # Use localhost on the host; Docker Compose services use redis://redis:6379/0.
 REDIS_URL=redis://localhost:6379/0
+# Protected runtime: use separate Redis principals. The publisher may run the
+# task-event Lua script and publish; the subscriber may only read/subscribe.
+FORGE_TASK_EVENT_PUBLISHER_REDIS_URL=
+FORGE_TASK_EVENT_SUBSCRIBER_REDIS_URL=
 
 # Web UI — Next.js app
 NEXT_PUBLIC_APP_URL=http://localhost:3000
@@ -52,14 +62,15 @@ NEXT_TELEMETRY_DISABLED=1
 
 # Worker — Redis claim timeout for the dedicated task helper
 FORGE_WORKER_CLAIM_TIMEOUT_SECONDS=5
-# Work-package execution and local repository writes are enabled by default.
-# Set either value to 0, false, off, no, or disabled when you want approval to
-# produce reviewable handoff artifacts without running specialists or applying
-# generated files.
-# FORGE_WORK_PACKAGE_EXECUTION=1
-# FORGE_HOST_REPOSITORY_WRITES=1
-# ACP package execution is enabled after task approval. Set this to 0 when local
-# adapter process access is not acceptable; ACP is not OS-confined by Forge.
+# Specialist execution and file materialization are currently unavailable.
+# These settings are reserved and cannot override the missing operating-system-
+# enforced confined writer. The normal path creates handoff artifacts only.
+# Leave the execution flag unset or disabled.
+# FORGE_WORK_PACKAGE_EXECUTION=0
+FORGE_HOST_REPOSITORY_WRITES=0
+# ACP package execution is also currently unavailable. This reserved setting
+# cannot enable it, and Forge does not provide an operating-system sandbox for
+# ACP processes.
 # FORGE_ACP_WORK_PACKAGE_EXECUTION=0
 
 # Workspace root — where Forge stores user-owned operational files: projects,
@@ -86,6 +97,25 @@ FORGE_WORKER_CLAIM_TIMEOUT_SECONDS=5
 # Generate with: openssl rand -hex 32
 # Also used to derive the encryption key for provider API keys stored in the DB.
 SESSION_SECRET=change_me_generate_with_openssl_rand_hex_32
+# Keep strict for fresh installs. During a rolling upgrade from the legacy
+# `session:<cookie>` Redis format, set dual only until every old web process is
+# drained, then restore strict before running session credential reconciliation.
+FORGE_SESSION_CREDENTIAL_MODE=strict
+
+# Protected S4 execution and Architect history are activated by the database,
+# not by environment variables alone. Preprovision the complete set below
+# while database authority is disabled; Forge continues on the legacy path and
+# does not connect as a protected principal. After the audited activation step,
+# every value is required. A partial active configuration fails closed.
+# FORGE_PACKET_ISSUER_DATABASE_URL=postgresql://forge_packet_issuer:...@localhost:5432/forge
+# FORGE_ARCHITECT_PLAN_WRITER_DATABASE_URL=postgresql://forge_architect_plan_writer:...@localhost:5432/forge
+# FORGE_ARCHITECT_PLAN_RESOLVER_DATABASE_URL=postgresql://forge_architect_plan_resolver:...@localhost:5432/forge
+# FORGE_ARCHITECT_PLAN_HISTORY_READER_DATABASE_URL=postgresql://forge_architect_plan_history_reader:...@localhost:5432/forge
+# FORGE_REVIEW_SOURCE_RESOLVER_DATABASE_URL=postgresql://forge_review_source_resolver@localhost:5432/forge
+# Passwordless fixed-role URL. Supply credentials through the PostgreSQL client environment (for example, a service file).
+# FORGE_S4_RECOVERY_OPERATOR_DATABASE_URL=postgresql://forge_s4_recovery_operator@localhost:5432/forge
+# FORGE_ARCHITECT_PLAN_DIGEST_KEY_HEX=replace_with_at_least_32_bytes_of_lowercase_hex
+# FORGE_ARCHITECT_PLAN_DIGEST_KEY_ID=production-v1
 
 # Optional — dedicated key for encrypting stored secrets. If unset, the key is
 # derived from SESSION_SECRET. Set this if you want to rotate it independently.

README.md

@@ -45,15 +45,19 @@ Human intent
   -> durable work packages
   -> capability and Model Context Protocol (MCP) admission
   -> bounded context
-  -> sandboxed specialist execution
+  -> specialist handoff artifacts
   -> quality assurance (QA) / Reviewer / Security gates
   -> evidence, recovery, and GitHub handoff
 ```
 
-FORGE is currently a **single-operator beta**. It can plan and execute approved
-specialist packages, apply guarded local repository changes, and preserve the
-evidence needed for review. It deliberately stops short of general autonomous
-commits, merges, broad live MCP authority, or unrestricted host control.
+FORGE is currently a **single-operator beta**. It can plan approved specialist
+packages and produce handoff artifacts for review. Specialist execution and
+file materialization are currently unavailable because Forge does not yet have
+an operating-system-enforced confined writer. The work-package and ACP flags
+are reserved settings; they cannot enable execution today. Direct host
+repository writes remain unavailable.
+It also stops short of autonomous commits, merges, broad live MCP authority, or
+unrestricted host control.
 
 ## Why FORGE
 
@@ -79,11 +83,8 @@ commits, merges, broad live MCP authority, or unrestricted host control.
 ### Execute within policy
 
 - Queue work through Redis and persist orchestration truth in PostgreSQL.
-- Execute eligible specialist packages sequentially.
-- Build bounded repository context packets.
-- Write generated output into per-attempt sandboxes under `.forge/task-runs`.
-- Apply validated repository-affecting files through guarded local-write policy.
-- Enforce command, file-count, byte, timeout, validation, and retry limits.
+- Prepare specialist handoff artifacts for review after approval.
+- Build bounded repository context packets for planning and handoff evidence.
 - Broker MCP requirements through explicit admission and approval state.
 
 ### Review and preserve evidence
@@ -104,8 +105,8 @@ Create task
   -> FORGE materializes packages and gates
   -> operator reviews the plan
   -> capability/MCP admission runs
-  -> specialist executes in a bounded attempt sandbox
-  -> validated output may be applied to the local project
+  -> specialist handoff artifacts are prepared for operator review
+  -> operator reviews and manually applies any separately supplied files
   -> QA / Reviewer / Security evidence is collected
   -> operator accepts, requests rework, or stops
 ```
@@ -200,16 +201,21 @@ Not built or intentionally deferred:
 - earned autonomy without verified historical evidence;
 - the full dockable Forge Workspace shell and link graph.
 
-Current execution paths can be disabled with explicit flags including:
+Specialist execution is currently unavailable. These reserved settings do not
+override the missing confined writer; leave them unset or disabled:
 
 ```text
 FORGE_WORKFORCE_MATERIALIZATION=0
 FORGE_WORK_PACKAGE_HANDOFF=0
 FORGE_WORK_PACKAGE_EXECUTION=0
-FORGE_HOST_REPOSITORY_WRITES=0
 FORGE_ACP_WORK_PACKAGE_EXECUTION=0
 ```
 
+Host repository writes are not an available execution path. Leave
+`FORGE_HOST_REPOSITORY_WRITES` unset or disabled. Setting it to an enable value
+does not make file materialization available; the request fails closed because
+path validation is not an operating-system sandbox.
+
 ## Roadmap
 
 The near-term order is deliberately reliability-first:

docs/acp-zed-connector.md

@@ -53,7 +53,8 @@ run a full task.
 
 ## What Happens During A Task
 
-When a task uses an ACP provider, Forge:
+When a task uses an ACP provider for the available planning/health-check path,
+Forge:
 
 1. Starts a fresh adapter process for that provider call, using a
    deny-by-default environment allowlist that does not forward Forge provider
@@ -71,22 +72,20 @@ When a task uses an ACP provider, Forge:
 Forge uses one adapter process per call. It does not keep a long-lived pool of
 ACP agents.
 
-Executable Workforce packages may use a configured ACP provider after task
-approval. ACP adapters are local processes and Forge does not OS-confine them
-to the package attempt sandbox. Set `FORGE_ACP_WORK_PACKAGE_EXECUTION=0` to
-disable ACP package execution on hosts where that local process risk is not
-acceptable.
+Specialist ACP package execution is currently unavailable. The
+`FORGE_ACP_WORK_PACKAGE_EXECUTION` setting is reserved and cannot override the
+missing operating-system-enforced confined writer. ACP adapters are local
+processes and Forge does not OS-confine them.
 
 ## Current Limits
 
 - ACP output is plain text in Forge's current provider interface.
 - Forge does not receive detailed token usage from ACP.
 - Tool calls from the underlying coding agent are not exposed as Forge runtime
   MCP grants.
-- ACP package execution is enabled after task approval unless the operator sets
-  `FORGE_ACP_WORK_PACKAGE_EXECUTION=0`. When active, it relies on the package
-  attempt working directory and Forge's execution JSON path guards; it is not an
-  OS sandbox or a general live tool grant.
+- Specialist ACP package execution is unavailable pending a real confined
+  writer. The setting `FORGE_ACP_WORK_PACKAGE_EXECUTION` cannot enable it; path
+  guards are not an operating-system sandbox.
 - If a runtime does not expose model selection through ACP, Forge stores the
   selected model on the provider record but cannot force the local runtime to
   use it.

docs/adr/0006-executable-workforce-beta-boundary.md

@@ -17,44 +17,41 @@ Forge is trusted with commits or PR automation.
 
 ## Decision
 
-Forge will allow executable Workforce beta runs with default-on local project
-edits and a reviewable sandbox copy of every generated file.
+Forge currently keeps the specialist Workforce path handoff-only. Specialist
+execution and file materialization are unavailable because Forge does not yet
+have an operating-system-enforced confined writer. Direct host repository
+writes are also unavailable.
 
 ### Execution Boundary
 
-- Work-package materialization, handoff, model execution, and local repository
-  writes are enabled by default.
-- `FORGE_WORK_PACKAGE_EXECUTION=0`, `false`, `off`, `no`, or `disabled`
-  disables model execution and keeps the handoff-artifact-only path.
-- `FORGE_HOST_REPOSITORY_WRITES=0`, `false`, `off`, `no`, or `disabled` lets
-  package models run but keeps generated files sandbox-only.
-- ACP-backed work-package execution is enabled after an operator configures an
-  ACP provider and approves the task. ACP adapters are local processes and are
-  not OS-confined by Forge. Set `FORGE_ACP_WORK_PACKAGE_EXECUTION=0`, `false`,
-  `off`, `no`, or `disabled` to prevent ACP package execution.
-- After Architect plan approval, Forge may execute one eligible specialist work
-  package at a time. Parallel specialist execution remains out of scope.
+- Work-package materialization and handoff are available after approval; model
+  execution and file materialization are unavailable. The normal path creates
+  handoff artifacts only.
+- `FORGE_WORK_PACKAGE_EXECUTION` is a reserved setting. No value can override
+  the missing confined writer or enable specialist execution today.
+- `FORGE_HOST_REPOSITORY_WRITES` is unavailable. Enable values fail closed;
+  the legacy `FORGE_REPOSITORY_EDITS` alias follows the same rule.
+- `FORGE_ACP_WORK_PACKAGE_EXECUTION` is also reserved and cannot enable ACP
+  package execution. ACP adapters are local processes and are not OS-confined
+  by Forge.
+- A future security-reviewed slice may execute one eligible specialist package
+  at a time after it supplies a real confined writer. Parallel specialist
+  execution remains out of scope.
 - Forge may collect bounded read-only host-repository context before a package
   runs. That context is limited to inspectable evidence such as a bounded file
   list, selected source/context artifacts, git status evidence, previous run
   artifacts, package inputs, acceptance criteria, and review feedback. It must
   not give the specialist an unbounded filesystem view.
-- Generated output is first written under the validated project root at
-  `.forge/task-runs/<task-id>/<work-package-id>/attempt-<attempt-number>/`.
-- After the package execution step, repository-affecting package output is
-  applied to the local project unless host repository writes are explicitly
-  disabled. This is a local file edit, not a branch, commit, pull request,
-  merge, or issue update. Forge blocks this path when the working tree is dirty
-  so generated output does not interleave with operator edits.
+- A future confined execution surface may write output under a per-attempt
+  directory for review. The current path creates no generated execution
+  sandbox files.
 - File writes must use relative paths. Absolute paths, path traversal, `.git`,
   `.forge`, `node_modules`, symlink targets, and local conflict-copy names are
   outside the beta boundary.
 - Package validation requests are limited to the approved validation surface,
   currently `npm test`, `npm run build`, and `npm run lint`. In the beta,
   Forge performs static validation for those command labels against generated
-  sandbox output; it does not run arbitrary package scripts. Repository-
-  affecting packages that provide no validation commands fail before host files
-  are applied.
+  sandbox output; it does not run arbitrary package scripts.
 - Repository evidence commands are limited to read-only Git status/diff
   evidence, redacted, bounded, and audited. Host package-manager validation is
   blocked in repository evidence; package validation remains inside the sandbox.
@@ -138,14 +135,15 @@ The executable Workforce beta explicitly defers:
 - user-edited grant scopes,
 - autonomous QA, Reviewer, or Security agent-run gates,
 - harness-enforced execution policy,
+- direct host repository writes,
 - remote repository writes.
 
 ## Consequences
 
-Operators can review generated sandbox files, applied host-file metadata, static
-validation results, repository evidence, proposed and brokered grants, blocked
-reasons, prompt overlays, review gates, rework reasons, and structured security
-findings before deciding whether output is useful.
+Operators can review generated sandbox files, static validation results,
+repository evidence, proposed and brokered grants, blocked reasons, prompt
+overlays, review gates, rework reasons, and structured security findings before
+manually applying useful output.
 
 The cost is extra terminology and a stricter product boundary. That cost is
 intentional: Forge should prove sequential execution and manual review before

docs/adr/0008-filesystem-mcp-bounded-context-grants.md

@@ -51,10 +51,14 @@ same project when they ask for the same or narrower capabilities.
   stay visible near the `Always allow` action because that choice reduces future
   prompts for the same project.
 
-Every filesystem packet decision is auditable by task, work package, optional
-agent run, optional grant approval id, status, requested capabilities, approved
-capabilities, root, included file count, byte count, omitted count, and redaction
-summary. Audit rows must not persist raw file contents.
+Every filesystem packet decision is auditable by task, work package, run, grant
+decision, and bounded typed evidence. The privacy-safe packet vocabulary is an
+opaque project `rootRef`; bounded included/byte/omitted/redaction counts; separate
+assembly, delivery, and terminal outcome; and a closed failure code/stage. An
+audit, artifact, log, event, queue payload, or API response must not persist or
+display an absolute/relative path, selected name, excerpt, file content, prompt,
+or raw/free-text error. ADR 0009 owns the detailed claim, evidence, recovery, and
+compatibility schema; this ADR owns the read-only/no-live-handle boundary.
 
 Project-level approval does not widen the beta security boundary. It only saves
 the operator's decision for the same project and covered capabilities. It still
@@ -64,9 +68,12 @@ allowlist.
 
 ## Consequences
 
-This closes the MCP Filesystem epic for the safe beta path: installation/status,
-approval, runtime enforcement, and auditability are implemented without exposing
-arbitrary host filesystem access to agents.
+When the ADR 0009 S3–S6 slices are implemented and their release evidence passes,
+this decision completes the Forge-issued MCP-channel beta path for setup,
+approval, cooperative enforcement, and auditability without issuing arbitrary
+filesystem access through that MCP channel. It does **not** confine an Agent
+Client Protocol (ACP) process: ACP may still have shell, network, environment,
+credential, or equivalent host-filesystem access outside Forge's MCP channel.
 
 Future live filesystem MCP execution needs a separate design for hard process
 sandboxing, path-scoped tool brokering, write approval, and adversarial prompt