@moretea-labs/forge 1.7.2 → 1.8.1

package/docs/tutorials/02-connect-chatgpt.md

@@ -76,7 +76,7 @@ Forge reports this provider ready only when `tunnel-client` reports the managed
 
 #### What address changes?
 
-With Secure Tunnel there is no public Forge `/mcp` address to paste. The ChatGPT App selects the `tunnel_id`; `tunnel-client` forwards commands to Forge's **loopback OAuth Gateway** (default `127.0.0.1:8767/mcp`), which proxies to the internal bearer-only Runtime (default `127.0.0.1:8765/mcp`). If you customize ports, use the OAuth endpoint printed by `forge mcp setup chatgpt --user-level`.
+With Secure Tunnel there is no public Forge `/mcp` address to paste. The ChatGPT App selects the `tunnel_id`; `tunnel-client` forwards commands to Forge's **loopback Secure Tunnel Connector** (default `127.0.0.1:8767/mcp`), which proxies to the internal bearer-only Runtime (default `127.0.0.1:8765/mcp`). The Connector uses the OpenAI tunnel/workspace as its outer authorization boundary (`auth=none` locally); it is not a browser-facing OAuth authorization server and must remain loopback-only. `forge setup next` keeps this transport-specific auth mode aligned automatically.
 
 The App/connector identity and Forge tool schema are separate from the transport. Switching from Cloudflare/HTTPS to Secure Tunnel changes the network path, not the 19-tool Forge schema. A fresh chat is useful for isolated A/B testing, but it is not required merely because transport changed when the same App is already connected.
 
@@ -89,7 +89,7 @@ forge setup configure --controller chatgpt --tunnel cloudflare
 forge setup next
 ```
 
-Setup detects `cloudflared` and the current platform. On macOS it can suggest Homebrew when present; Linux/WSL2 and Windows receive their platform-specific official installation path. After creating a stable named tunnel, record only the resulting `/mcp` URL:
+Setup detects `cloudflared` and the current platform. On macOS it can suggest Homebrew when present; Linux/WSL2 and Windows receive their platform-specific official installation path. The public tunnel must terminate at the loopback OAuth Connector (normally port `8767`), never the bearer-only Runtime. After creating a stable named tunnel, record only the resulting `/mcp` URL:
 
 ```bash
 forge setup configure \
@@ -107,7 +107,7 @@ forge setup configure --controller chatgpt --tunnel tailscale
 forge setup next
 ```
 
-Forge detects the Tailscale CLI and guides Funnel setup for the current platform. Record the final HTTPS `/mcp` URL when available.
+Forge detects the Tailscale CLI and guides Funnel setup for the current platform. Funnel exposes the loopback OAuth Connector (normally port `8767`), never the bearer-only Runtime. Record the final HTTPS `/mcp` URL when available.
 
 ### D. Existing HTTPS endpoint or defer
 
@@ -127,7 +127,7 @@ Cloudflare/Tailscale/existing HTTPS make the MCP endpoint public or internet-rea
 
 The ChatGPT UI changes over time, so follow the current OpenAI developer-mode instructions rather than relying on screenshots in this repository.
 
-For a Secure MCP Tunnel connection, choose the **Tunnel** connection type and select/paste the tunnel ID. For an HTTPS connection, use the stable HTTPS URL ending in `/mcp` and the OAuth flow generated by Forge.
+For a Secure MCP Tunnel connection, choose the **Tunnel** connection type, select/paste the tunnel ID, and choose **No authentication**: the authenticated OpenAI Tunnel is the external authorization boundary. For an HTTPS connection, use the stable HTTPS URL ending in `/mcp` and the OAuth flow generated by Forge.
 
 After creating the app/connector, scan/refresh tools. Do not switch Forge to an exhaustive compatibility toolset simply to expose more names; the bounded default surface is intentional.
 

package/docs/tutorials/02-connect-chatgpt.zh-CN.md

@@ -74,7 +74,7 @@ tunnel-client runtimes status forge --json
 
 #### 地址到底变成什么？
 
-使用 Secure Tunnel 后，不再需要给 Forge 准备一个公网 `/mcp` 地址。ChatGPT App 选择 `tunnel_id`；本机 `tunnel-client` 把命令转发到 Forge 的 **loopback OAuth Gateway**（默认 `127.0.0.1:8767/mcp`），再由 Gateway 代理到内部 bearer-only Runtime（默认 `127.0.0.1:8765/mcp`）。如果改过端口，以 `forge mcp setup chatgpt --user-level` 输出的 OAuth endpoint 为准。
+使用 Secure Tunnel 后，不再需要给 Forge 准备公网 `/mcp` 地址。ChatGPT App 选择 `tunnel_id`；本机 `tunnel-client` 把命令转发到 Forge 的 **loopback Secure Tunnel Connector**（默认 `127.0.0.1:8767/mcp`），再由 Connector 代理到内部 bearer-only Runtime（默认 `127.0.0.1:8765/mcp`）。这个 Connector 以 OpenAI tunnel/workspace 作为外层授权边界，本地使用 `auth=none`；它不是浏览器可访问的 OAuth authorization server，而且必须保持 loopback-only。`forge setup next` 会自动保持 transport 与 auth mode 一致。
 
 App/connector 身份及 Forge 工具 schema 与网络传输层是两件事。Cloudflare/HTTPS 切到 Secure Tunnel 改变的是网络路径，不会生成另一套 19-tool Forge schema。同一个 App 已连接且 schema 没变化时，单纯切换网络不要求新开会话；新会话主要用于隔离 A/B 或排查客户端缓存。
 
@@ -87,7 +87,7 @@ forge setup configure --controller chatgpt --tunnel cloudflare
 forge setup next
 ```
 
-setup 会检测当前平台与 `cloudflared`。macOS 有 Homebrew 时可直接给出安装命令；Linux/WSL2 与 Windows 会给对应的官方安装路径，不会假设所有机器都是 Mac。
+setup 会检测当前平台与 `cloudflared`。macOS 有 Homebrew 时可直接给出安装命令；Linux/WSL2 与 Windows 会给对应的官方安装路径，不会假设所有机器都是 Mac。公网 tunnel 必须终止在 loopback OAuth Connector（通常是 `8767`），绝不能直接暴露 bearer-only Runtime。
 
 named tunnel 建好后，只记录最终 `/mcp` URL：
 
@@ -107,7 +107,7 @@ forge setup configure --controller chatgpt --tunnel tailscale
 forge setup next
 ```
 
-Forge 检查当前平台的 Tailscale CLI 并引导 Funnel；获得最终 HTTPS `/mcp` URL 后再记录。
+Forge 检查当前平台的 Tailscale CLI 并引导 Funnel；Funnel 暴露的是 loopback OAuth Connector（通常是 `8767`），绝不能直接暴露 bearer-only Runtime。获得最终 HTTPS `/mcp` URL 后再记录。
 
 ### D. 已有 HTTPS 或暂缓远程连接
 
@@ -127,7 +127,7 @@ Cloudflare/Tailscale/已有 HTTPS 本质上会让 MCP endpoint 成为公网或
 
 ChatGPT UI 会变化，所以以 OpenAI 当前 Developer Mode 文档为准，不在 Forge 文档中固定截图路径。
 
-使用 Secure MCP Tunnel 时选择 **Tunnel** 连接方式并选择/填入 tunnel ID；使用 HTTPS 时填入稳定、以 `/mcp` 结尾的 URL，并走 Forge 生成的 OAuth 流程。
+使用 Secure MCP Tunnel 时选择 **Tunnel** 连接方式并选择/填入 tunnel ID，然后选择 **无身份验证**：已认证的 OpenAI Tunnel 就是外部授权边界；使用 HTTPS 时填入稳定、以 `/mcp` 结尾的 URL，并走 Forge 生成的 OAuth 流程。
 
 创建后扫描/刷新工具。不要为了看到更多工具名而直接切到 exhaustive compatibility toolset；默认收敛工具面是安全和可用性设计的一部分。
 

package/docs/wiki/Implementation.md

@@ -17,7 +17,7 @@ src/runtime/gateway/mcp/
 
 `toolset-names.ts` defines the bounded default connector surface. The five facade tools come from `src/runtime/control-plane/facade/types.ts`; repository, patch, check, Process, plugin-dispatch, and result tools bring the current default to 19.
 
-The HTTP transport owns authentication and MCP session lifecycle. `McpSessionRegistry` owns session capacity, active-request protection, stream leases, replacement, and close accounting. A tool-surface fingerprint mismatch returns a recoverable reinitialize response; replacement initialize owns actual supersession and transport cleanup.
+The HTTP transport owns authentication and protocol-era routing. MCP 2026-07-28 is the canonical public path: `createMcpHandler` serves each modern request without `Mcp-Session-Id`. `McpSessionRegistry` is retained only for explicit 2025-era compatibility, where it owns session capacity, active-request protection, stream leases, replacement, and close accounting. Durable Work/Process/ControllerRound authority never comes from either transport form. Controller capability rotation and legacy-owner upgrades are Runtime recovery mechanics; ordinary model-facing Work operations neither expose nor require `controller_claim`. Legacy tool-surface mismatches still return a recoverable reinitialize response; modern requests resolve the current Runtime schema per request.
 
 ## 2. Repository registry and execution identity
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moretea-labs/forge",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "description": "Local-first action assistant for software work with resumable execution, bounded tools, and reviewable evidence",
   "license": "MIT",
   "author": "Moretea Labs contributors",
@@ -46,6 +46,7 @@
     "docs/images/",
     "docs/architecture/",
     "docs/operations/",
+    "!docs/operations/v2-candidate-certification.md",
     "docs/wiki/",
     "docs/public-usage-guide.md",
     "docs/public-usage-guide.zh-CN.md",
@@ -61,7 +62,20 @@
     "install.ps1",
     "bin/",
     "scripts/",
+    "!scripts/benchmark-*",
+    "!scripts/route-nl-vs-ts-eval.ts",
+    "!scripts/check-npm-release.sh",
+    "!scripts/check-public-release-surface.sh",
+    "!scripts/check-release-*",
+    "!scripts/check-tarball-install-smoke.sh",
+    "!scripts/public-release*",
+    "!scripts/publish-release-tarball.sh",
+    "!scripts/stage-runtime-release.ts",
+    "!scripts/package-source-archive.sh",
+    "adapters/",
+    "packages/",
     "src/",
+    "supervisor/",
     "AGENTS.md",
     "CLAUDE.md",
     "SKILL.md",
@@ -77,11 +91,10 @@
     "bun": ">=1.0.0"
   },
   "scripts": {
-    "build:controller-ui": "bun scripts/build-controller-ui.ts",
-    "check:controller-ui": "bun scripts/build-controller-ui.ts --check",
     "check:design": "npx -y @google/design.md@0.4.0 lint DESIGN.md",
-    "benchmark:skills": "bun scripts/run-skill-evals.ts",
+    "check:desktop-client": "npm --prefix apps/desktop run check",
     "benchmark:controller-hotpath": "bun scripts/benchmark-controller-hotpath.ts",
+    "benchmark:computer-hotpath": "bun scripts/benchmark-computer-hotpath.ts",
     "benchmark:thin-harness-mcp-e2e": "bun scripts/benchmark-thin-harness-mcp-e2e.ts --json",
     "benchmark:mcp-transport": "bun scripts/benchmark-mcp-transport.ts",
     "benchmark:mcp-host": "bash scripts/benchmark-mcp-host.sh",
@@ -90,7 +103,8 @@
     "benchmark:quality-harness": "bun scripts/benchmark-quality-harness.ts",
     "benchmark:background-check-overlap": "bun scripts/benchmark-background-check-overlap.ts",
     "check:quality-harness": "bun scripts/benchmark-quality-harness.ts",
-    "check:evaluation-framework": "bun test tests/evaluation-framework.test.ts",
+    "check:evaluation-framework": "bun test ./tests/evaluation-framework.test.ts && bun test ./evaluation/protocol.test.ts && bun test ./evaluation/candidate-runner.test.ts && bun test ./evaluation/calibration.test.ts && bun test ./evaluation/certification.test.ts && bun test ./evaluation/public-mcp-runner.test.ts && bun test ./evaluation/cognitive-skill-retirement.test.ts",
+    "check:v2-certification": "bun evaluation/check-v2-certification.ts",
     "check:background-check-overlap": "bun scripts/benchmark-background-check-overlap.ts",
     "check:typescript-navigation": "bun scripts/benchmark-typescript-navigation.ts",
     "check:semantic-navigation-providers": "bun test tests/runtime/semantic-navigation-provider.test.ts",
@@ -104,8 +118,15 @@
     "test:fault": "bun scripts/test-governance.ts fault",
     "test:full": "bun scripts/test-governance.ts full",
     "test:coverage": "bun test --coverage",
-    "check:type": "bun x tsc --noEmit",
+    "check:type": "bun x tsc --noEmit && bun x tsc -p supervisor/tsconfig.json",
+    "workflow-supervisor": "bun supervisor/entry.ts",
+    "smoke:workflow-supervisor": "bun scripts/smoke-workflow-supervisor.ts",
+    "smoke:workflow-supervisor-process-restart": "bun scripts/smoke-workflow-supervisor-process-restart.ts",
+    "smoke:workflow-supervisor-restart-recovery": "bun scripts/smoke-workflow-supervisor-restart-recovery.ts",
+    "smoke:workflow-supervisor-chrome-adapter": "bun scripts/smoke-workflow-supervisor-chrome-adapter.ts",
+    "smoke:user-request-continuation-restart": "bun scripts/smoke-user-request-continuation-restart.ts",
     "check:runtime-architecture": "node scripts/check-runtime-architecture.mjs",
+    "check:repository-hygiene": "node scripts/check-repository-hygiene.mjs",
     "check:generated-authority": "node scripts/sync-generated-authority.mjs --check",
     "check:source-duplication": "node scripts/check-source-duplication.mjs",
     "check:executable-modes": "bun scripts/repair-executable-modes.ts --check",
@@ -113,9 +134,11 @@
     "check:test-governance": "bun scripts/test-governance.ts validate",
     "check:mcp-compatibility": "node --loader ./src/runtime/shared/node-ts-loader.mjs scripts/check-mcp-compatibility.ts",
     "smoke:runtime-recovery": "node --loader ./src/runtime/shared/node-ts-loader.mjs scripts/smoke-runtime-recovery.ts",
+    "smoke:unattended-transport-recovery": "node --loader ./src/runtime/shared/node-ts-loader.mjs scripts/smoke-unattended-transport-recovery.ts",
+    "smoke:control-plane-failure-domain": "node --loader ./src/runtime/shared/node-ts-loader.mjs scripts/smoke-control-plane-failure-domain.ts",
     "smoke:mcp-http-runtime": "node --loader ./src/runtime/shared/node-ts-loader.mjs scripts/smoke-mcp-http-runtime.ts",
     "smoke:tool-surface": "bun scripts/smoke-mcp-tool-surface.ts",
-    "check:smoke": "bun run smoke:mcp-http-runtime && bun run smoke:runtime-recovery && bun run smoke:schedule-engine && bun run smoke:tool-surface",
+    "check:smoke": "bun run smoke:workflow-supervisor && bun run smoke:workflow-supervisor-process-restart && bun run smoke:workflow-supervisor-restart-recovery && bun run smoke:workflow-supervisor-chrome-adapter && bun run smoke:mcp-http-runtime && bun run smoke:runtime-recovery && bun run smoke:unattended-transport-recovery && bun run smoke:control-plane-failure-domain && bun run smoke:schedule-engine && bun run smoke:tool-surface",
     "check:task": "bun scripts/run-governed-gate.ts task",
     "check:main": "bun scripts/run-governed-gate.ts main",
     "check:ci": "bun run check:main",
@@ -131,20 +154,20 @@
     "check:public-export": "bun scripts/public-release.ts",
     "package:source-zip": "bash scripts/package-source-archive.sh",
     "check:release-published": "bash scripts/check-release-published.sh",
-    "smoke:tarball-install": "bash scripts/check-tarball-install-smoke.sh",
+    "smoke:tarball-install": "node scripts/run-bounded-command.mjs --timeout-ms 180000 -- bash scripts/check-tarball-install-smoke.sh",
     "check:release-version": "node scripts/check-release-version.mjs",
     "release:dry-run": "node scripts/check-release-version.mjs && bun run check:release",
     "release:rc": "bash scripts/publish-release-tarball.sh next",
     "release:stable": "bash scripts/publish-release-tarball.sh latest",
-    "check:brain-manifest": "forge run check-brain-manifest",
-    "check:context-files": "forge run check-context-files",
-    "check:deploy-sql": "forge run check-deploy-sql-order",
-    "check:architecture-sync": "forge run check-architecture-sync",
-    "check:task-sync": "forge run check-task-sync",
-    "check:task-workflow": "forge run check-task-workflow --strict",
+    "check:brain-manifest": "bun src/cli/index.ts run check-brain-manifest",
+    "check:context-files": "bun src/cli/index.ts run check-context-files",
+    "check:deploy-sql": "bun src/cli/index.ts run check-deploy-sql-order",
+    "check:architecture-sync": "bun src/cli/index.ts run check-architecture-sync",
+    "check:task-sync": "bun src/cli/index.ts run check-task-sync",
+    "check:task-workflow": "bun src/cli/index.ts run check-task-workflow --strict",
     "runtime:activate-source-baseline": "bun scripts/activate-source-baseline.ts request",
     "plugin:install-desktop-operator": "bun scripts/install-desktop-operator-registration.ts",
-    "sync:brain-docs": "forge run sync-brain-docs --all",
+    "sync:brain-docs": "bun src/cli/index.ts run sync-brain-docs --all",
     "sync:codex-installed": "bash scripts/sync-codex-installed-copies.sh",
     "check:forge-runtime": "bash scripts/verify-forge-runtime.sh",
     "repo:registry": "bun src/cli/v81-entry.ts repo",
@@ -153,27 +176,24 @@
     "test:bun": "bun -e 'console.error(\"[tests] test:bun is deprecated; running explicit test:full\")' && bun run test:full",
     "test:node-smoke": "node --test tests/node/*.test.mjs",
     "check:ci:portable": "FORGE_ALLOW_NODE_ONLY=1 bash scripts/check-ci.sh",
-    "dev:controller-ui": "vite --config src/cli/local-bridge/frontend/vite.config.ts",
-    "prepack": "node scripts/sync-generated-authority.mjs --check"
+    "prepack": "node scripts/sync-generated-authority.mjs --check",
+    "check:portable-package": "node --test tests/node/*.test.mjs && npm run smoke:tarball-install"
   },
   "devDependencies": {
     "@colbymchenry/codegraph": "1.0.1",
     "@types/bun": "latest",
     "@types/cors": "^2.8.19",
-    "@types/express": "^5.0.6",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^5.2.0",
-    "vite": "^7.3.0"
+    "@types/express": "^5.0.6"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.28.0",
     "commander": "^14.0.3",
     "express": "^5.2.1",
     "playwright": "^1.54.1",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.8",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/server-legacy": "^2.0.0",
+    "@modelcontextprotocol/node": "^2.0.0"
   },
   "packageManager": "npm@10.0.0",
   "optionalDependencies": {

package/packages/kernel/cognition/api/index.ts

@@ -0,0 +1,6 @@
+export * from '../domain/memory';
+export * from '../domain/learning';
+export * from '../application/activation-service';
+export * from '../application/consolidation-service';
+export * from '../application/memory-service';
+export * from '../application/legacy-experience-adapter';