How it works · illustrations, not a live view

The parts, how they connect, and why it refuses to lie.

Three things on this page explain the Bridge and the engine under it. A map of the parts, drawn from the repository's own record. Three walk-throughs of one piece of work. And three switches you can flip to watch an honest system turn into a confident one.

None of it is the product running. Where a part runs today it is drawn in cyan; where it is partly built, purple; where it is only decided, dashed. The switches are hand-written models that show what a guarantee is for; the executed evidence lives in the test suites behind them.

The map

What exists, what is partly there, what is only decided

Each box is a part of the system. The dot beside each line inside a box says whether that part runs today, is built but narrower than its name, or is a decision with nothing behind it yet. The lines between boxes are the connections, drawn the same way.

carries work today built, exercised only by tests decided, not built

Drawn from the repository at build time through a reviewed list of fields: parts, connections, journeys and their descriptions. Nothing about where anything runs. Commit e3aa047.

One piece of work, walked

Three walk-throughs, each hop labelled with how we know

A map shows parts. A journey shows one thing moving through them. Each step names the connection it crosses and whether a machine saw it, a test showed it, a person vouches for it, or it is simply decided and not built.

Runs today

One mission, end to end, today.

One real piece of work today, from a person saying what they want to the record of what was done. Every hop says how we know it happened.

1Human — the Captain → Forge intent CLI · commanda person vouches
2Forge intent CLI → Forge conformance and authorization gate · commandseen by a machine
3Forge conformance and authorization gate → Event log — the authoritative record · eventseen by a machine
4Human — the Captain → Forge conformance and authorization gate · approvalseen by a machine
5Forge conformance and authorization gate → Event log — the authoritative record · eventseen by a machine
6Forge conformance and authorization gate → Forge Kernel v0 — the effect recorder · authorizationseen by a machine
7Forge Kernel v0 — the effect recorder → Forge conformance and authorization gate · evidenceseen by a machine
8Forge conformance and authorization gate → Event log — the authoritative record · eventseen by a machine
9Event log — the authoritative record → Read model — the return path · eventseen by a machine
10Read model — the return path → Bridge · readshown by a test
11Bridge → Human — the Captain · reada person vouches

Decided, not built

Bridge iOS read path, phone leg pending.

The read path a phone would take. The server half answers today; the phone leg is decided and not built.

1Bridge iOS → Digital Pulse BFF / API · readdecided, not built
2Digital Pulse BFF / API → Read model — the return path · readdecided, not built

Decided, not built

One mission, end to end, once the middle exists.

The same piece of work once the middle exists: a command surface, an authority plane, a platform between the person and the kernel. This is the design, drawn so it cannot be mistaken for the present.

1Human — the Captain → Bridge · commanddecided, not built
2Bridge → Digital Pulse BFF / API · commanddecided, not built
3Digital Pulse BFF / API → ACP — authority plane · commanddecided, not built
4ACP — authority plane → Forge Platform — the missing middle · authorizationdecided, not built
5Forge Platform — the missing middle → Agent harness · commanddecided, not built
6Agent harness → Forge conformance and authorization gate · commanddecided, not built
7Forge conformance and authorization gate → Forge Kernel v0 — the effect recorder · authorizationdecided, not built
8Forge Kernel v0 — the effect recorder → Forge conformance and authorization gate · evidencedecided, not built
9Forge conformance and authorization gate → Event log — the authoritative record · eventdecided, not built
10Event log — the authoritative record → Read model — the return path · eventdecided, not built
11Read model — the return path → Bridge · readdecided, not built
12Bridge → Human — the Captain · readdecided, not built

Try it · 1 of 3

Why “I don't know” beats a confident answer

Two briefings about the same night. One says whatever sounds useful. The other says only what it can trace back to a record, and goes quiet when it cannot. Switch the records on one at a time and watch which one you would bet a decision on.

Illustration — not executed evidence

Both briefings are written into this component by hand. Neither is generated from the event log — this argues the difference between a sourced line and a fluent one; it does not demonstrate it.

The same morning question, asked of two Bridges

Switch on the kernel guarantees and watch the right-hand briefing earn each line it says.

Bridge A · no kernel

3 documents updated overnight. All systems nominal.no source · not verifiable

Everything is stable.asserted, never checked

Bridge B · on the kernel

Nothing it can honestly claim yet.

Claims you could bet a decision on0%

Bridge B refuses to say anything it cannot source. That silence is the feature — an honest “I don’t know” beats a confident fabrication.

Try it · 2 of 3

One effect, even if the process dies halfway

When an agent is allowed to change something real, the hard question is not whether it can, but whether you can prove it happened exactly once. The engine under the Bridge makes a narrow promise: for one request, it creates its target at most once, and if it crashes between doing the thing and writing it down, recovery trusts the durable record, not the file that happens to be there.

What it is not: not a general “everything exactly once”, not proof against a machine losing power, not a lock on every file. One request, one target, one record. That narrowness is the point.

Break it yourself

Illustration — not executed evidence

Every outcome below is a lookup in the evaluate() function on this page — no process is killed and no runtime is touched. It models what the multiprocess SIGKILL harness demonstrated; it is not that harness, and it cannot fail.

Inject failures. Count the effects.

Switch on any combination of failures, then run the loop. The invariant should hold no matter what you throw at it.

Reserve

→

Prepare

→

Effect

→

Commit

→

Event

committed effects

events written

success

outcome

Invariant integrity100%

No failures injected. One effect, one event — the happy path.

Try it · 3 of 3

Turn a gate off. Watch it start lying.

Eight guarantees stand between a request and a briefing you can believe. Each one removes a specific way a system can be confidently wrong. Switch one off and the briefing below re-renders against whatever can still be proven.

Illustration — not executed evidence

The eight gates and their consequences are written into this component by hand — nothing here executes the runtime or reads a test result. It shows what each guarantee is FOR. The executed evidence is the conformance suite and the multiprocess SIGKILL harness.

Turn a gate off. Watch the briefing start lying.

Each gate removes a specific guarantee. The briefing below re-renders live against whatever the substrate can actually prove.

This morning's briefing

Effect authorised before it ran — grant bound to this exact intent.G1 satisfied

Terminal record durable and enumerable, carrying token + digest.G2 satisfied

One writer won the target; the other became an honest conflict.G3 satisfied

Every attempt resolved to a status a program can reconcile.G4 satisfied

The approval is visible and tied to the intent, not a free-floating yes.G5 satisfied

Correlation token threaded dispatch → effect → record.G6 satisfied

The effect is durably installed, then the commit record is published; the window between them is reconciled by recovery.G7 satisfied

One live claim per token; aborted attempts fenced to a terminal.G8 satisfied

Briefing trustworthiness100%

All eight gates satisfied. Every line carries provenance; nothing is asserted that the log cannot substantiate.

That is the machinery

The Bridge is what it is for

Everything above exists so one person can give their crew an idea, step away, and come back to what changed and why. That page is written for the person, not the engineer.

Meet The Bridge

The engineering record behind this page — the stack, the roadmap, the protocol messages — is the team's private working area. Forge is the engine's own page.