Governed capability memory

Skills should be earned before they are remembered.

ForgeAgent gives coding agents a durable, inspectable way to acquire capabilities: propose a tool, reject unsafe code, prove the repair, version the result, and reuse only trusted work.

Verified live-provider proof: GPT-5.6 Terra repaired an invoice extractor through adversarial proof, promoted v2 at score 100, then reused it without another generation. This hosted walkthrough remains key-free.

Run the capability chain →Test the trust gate
89repository tests in suite
50deterministic evaluation cases
10unsafe proposal patterns blocked
MCP v2tools for coding agents
The method

Memory is a promotion, not a cache.

A capability is not reusable simply because an agent generated it. ForgeAgent attaches policy, proof, provenance, version history, and a human decision when risk warrants one.

01

Identify the gap

Map a user task to the missing capability.

02

Constrain proposal

Require a narrow contract and deterministic tests.

03

Enforce policy

Block unsafe imports, file access, network access, and dynamic execution.

04

Prove in isolation

Run every candidate in a fresh, time-bounded subprocess.

05

Govern & reuse

Persist trusted versions, approvals, receipts, and rollback history.

ForgeGraph

Why this agent can act—now.

The graph records the task, selected capabilities, proof evidence, dependencies, and decision lineage. Click a node or scrub the timeline to inspect the state of memory.

Interactive capability run

Bring an incident. Inspect every step.

This is a deterministic browser run, not a prerecorded animation. It demonstrates the hosted experience honestly; no incident leaves this page.

Ready. The browser version performs deterministic redaction, triage, and term extraction.

Awaiting a task payload. The ordered run will redact sensitive values, classify risk, extract recurring terms, and record the capability lineage.

Hosted boundary: this static page executes deterministic demo capabilities in the browser. The repository adds AST policy checks, isolated subprocess proof, SQLite project memory, signed capability packages, a 50-case evaluation arena, and MCP v2 tools. Its local control plane adds tenant roles, hashed API tokens, approval state, and audit-safe metrics; the production runner is rootless, read-only, and has network egress disabled.

Capability Foundry

Persistent memory with a control plane.

The Foundry Council records planner, builder, security, evaluator, and governor decisions. SQLite namespaces keep project memory isolated; the MCP server makes that governed memory available to coding agents.

Promotion rules

A tool moves from proposal to trusted memory only after policy clearance and isolated proof. The production policy always waits for a named human approver; failed live proposals can receive bounded repair attempts with their failure evidence preserved.

Low-risk transformsPromote only after normal, edge, and contract proof passes.
Production reviewEvery candidate waits for a named reviewer and evidence-backed reason.
Isolated executionRead-only, non-root container with egress disabled.

Signed capability marketplace

Teams can export proof-backed capabilities and import them into another project without losing source, provenance, tests, or approval history.

  • PII redactorproof cases · policy result · trusted reuseTRUSTED
  • Invoice extractorsigned package · receiving-project review · rollback pathPENDING REVIEW
Production preflight

Prove the boundary before promotion.

Run a judge-facing simulation of the same production admission controls implemented in the repository: isolated runtime, denied egress, restricted resources, and human sign-off.

Sandbox admission contract

This page simulates the deterministic policy result. The real command is in Dockerfile.sandbox and compose.production.yml; it is not falsely executed by your browser.

  • Rootless runtimeDedicated non-root UID; no host mounts.READY
  • Network egressDocker runtime receives --network none.READY
  • Runtime restrictionsRead-only FS, dropped capabilities, CPU/memory/PID limits.READY
  • Human approvalProduction policy requires a named reviewer and reason.READY
Awaiting preflight. This browser panel visualizes the repository's production controls. Run it to inspect the ordered evidence trail.
No receipt issued.

Honest boundary: browser code cannot create an OS container or enforce network policy. The interactive preflight makes the real enforcement contract inspectable; clone the repository and run Docker to execute it on your machine.

Developer surface

One governed layer for every coding agent.

Codex, Cursor, and Claude Code keep their own reasoning and editing loop. ForgeAgent gives them a shared, inspectable memory boundary instead of another opaque agent.

Inspect first

Query repository context and capability memory before generating duplicate tools.

forge_inspect_repository

Request safely

Submit a capability lifecycle that records proof and waits for production approval.

forge_request_capability

Govern and reuse

Read integrity-hashed receipts, approve a reviewed version, then reuse it.

MCP v2 + control plane
Policy attack lab

Try to make the agent trust the wrong thing.

Paste candidate source or load a preset. This browser-only static screen never executes submitted code; repository proof remains the promotion boundary.

Presets populate source. Paste any candidate to run the non-executing static policy screen.

no candidate evaluated
No candidate evaluatedChoose a failure to inspect the policy and proof trail.
Evidence suite

Claims are backed by runnable checks.

The repository’s key-free evaluation reports actual local outputs—not invented model costs or benchmark scores.

Stateless baseline

Rebuilds every capability on each step of the measured recurring workflow.

36 new skills · 0 reuses

ForgeAgent memory

Proves four capabilities once, then reuses them across the same 18-step workload.

4 new skills · 32 reuses

Trust-gate safety

Static policy suite rejects filesystem, network, dynamic execution, alias, and dunder escape attempts.

8 / 8 attack patterns blocked