v1.1.0 Capability-based default-branch protection

MILESTONE

Forge no longer needs a paid hosting plan to finish bootstrap. Until now, Phase 2 demanded a GitHub ruleset on main, and GitHub reserves that for paid plans on private personal repositories, answering Upgrade to GitHub Pro or make this repository public to enable this feature. A solo developer on a free plan could pass that gate only by paying or by publishing a repository they had deliberately kept private. As of this release, forge protects the default branch at whichever tier your host and account actually grant, proves the one it picked actually works, and writes down what that tier does not cover. Your repository's visibility is never part of the deal.

Added

• templates/branch-protection.js, a provider-neutral protection tool with detect, apply, verify, selftest, gate, migrate, report, and status. Adapters for GitHub (rulesets, falling back to classic branch protection on older Enterprise Server) and GitLab (protected branches), plus an explicit fallback for self-hosted and unrecognised hosts. It records the provider, mechanism, and verification evidence in .forge/protection.json.
• templates/history-guard.js, a managed pre-push history-integrity guard. It reads the ref-update records git writes to a pre-push hook's stdin and refuses deletion of the protected branch and non-fast-forward updates to it, while allowing fast-forward pushes and initial branch creation. It fails closed, naming the fix, when it cannot see the records.
• branch-protection.js selftest, which proves the guard end to end against disposable repositories in a temp directory. Every recursive delete is refused unless the path is a directory the tool itself created with its own prefix.
• A test suite under tests/, run with node --test and wired into CI. 94 tests.

Changed

• Phase 2's protection step is capability based. The gate item is "default-branch history protection verified", satisfied by either verified server-side enforcement or verified managed local enforcement with its narrower trust boundary recorded. An unavailable paid hosting feature is no longer a fatal bootstrap failure.
• templates/lefthook.yml runs the history check first, with use_stdin: true so lefthook forwards git's ref records to it, and piped: true so the secret scan, lint, build, and test commands do not run after it has already refused the push. The command is named 00_history because lefthook orders commands by priority, then by the leading number in the name, then alphabetically, never by their position in the file.
• verify inspects rather than installs, so a hook the user deleted is reported rather than silently recreated. It also confirms the hook is somewhere git will actually run it, honouring core.hooksPath, and that lefthook install has been run rather than trusting lefthook.yml alone.
• forge-standards states the protection policy once, behaviourally and without naming a host, alongside its trust boundary.
• The always-strict repository visibility gate now covers later changes as well as the initial choice. A hosting feature that is only available on public repositories is never a reason to change it, and the tool refuses to issue a visibility mutation at all.

Trust boundary

Server-side enforcement applies to every writer, including web UI and API writes. The local guard protects clones configured with it, and does not stop a push from an unconfigured clone, a write through the host's API or web UI, a hook that was deleted or edited, or an attacker holding valid credentials. Forge prefers the server-side tier wherever it is available and records the difference wherever it is not.

Migration

A project whose environment phase stalled on a paid-plan ruleset resumes with node .forge/branch-protection.js migrate. It re-detects provider capability, installs and verifies the fallback, and names exactly which recorded blocker to clear. Unrelated blockers are preserved.

Install

claude plugin marketplace update dailen
claude plugin update forge-workflow

Or download forge-workflow.zip below and extract it into ~/.claude/skills/.

v1.0.0

Forge 1.0.0 rewrites every skill lean for Claude 5 era models.

Forge was originally written in the defensive, verification-heavy style that Claude 4
era models rewarded. That style is counterproductive on Claude 5: the model follows
instructions well and verifies its own work, so the scaffolding spends tokens and
suppresses quality instead of adding safety. Every skill has been rewritten against
Anthropic's Claude 5 prompting guidance. The prompt corpus is about 26 percent smaller
and the plugin does exactly the same things.

Nothing about the workflow changed. Every gate and safety behavior is intact.

Changed

• Removed self-verification and re-check instructions. Claude 5 already verifies its
  own work, and instructing it again caused over-verification rather than better
  results.
• Converted model-babysitting absolute bans into adaptive guidance, while keeping every
  ban that protects your repository.
• De-duplicated instructions across layers. Testing discipline, git lifecycle, release
  cadence, documentation duties, and typography are stated once in forge-standards,
  and the phase skills point at it rather than restating it.
• Trimmed generic engineering sermons and speculative guards for failure modes that
  were never actually observed.
• The dailen marketplace now lives in the catalog repo DailenG/dailens-claude-toolbelt.
  Install is claude plugin marketplace add DailenG/dailens-claude-toolbelt then
  claude plugin install forge-workflow@dailen.

Unchanged, deliberately

The detection ladder and its project-state check, SRS approval as an always-strict gate
that Claude never self-approves, record-versus-reality reconciliation that stops on a
discrepancy, the full always-confirmed action list, the pre-push gate with --no-verify
prohibited, failing regression tests before bug fixes, test harness failure
verification, the code-intelligence license gate, and ASCII-only typography.

On older models

If you run Claude 4 era models, use forge4-workflow (command /forge4) instead. It is
a frozen snapshot that keeps the original defensive prompting, enforces the same gates,
and produces the same project files.

Upgrading

claude plugin marketplace update dailen
claude plugin update forge-workflow

The version is also the plugin cache key, so this bump from 0.1.0 is what delivers the
rewrite to existing installs.

v0.1.0

This release lets you install Forge into Claude Code with two commands and run a single command, /forge, that carries a project from a blank folder all the way to a tagged release. It works out what phase you are in, asks the right questions until it understands the problem, sets up the toolchain, then builds the thing test-first, keeping enough written state that you can walk away and pick up later in a fresh session.

New here? Read the illustrated guide: https://daileng.github.io/forge-workflow/

Install

claude plugin marketplace add DailenG/forge-workflow
claude plugin install forge-workflow@dailen

Prefer a manual install? Download forge-workflow.zip below and extract it to ~/.claude/skills/forge-workflow/ (%USERPROFILE%\.claude\skills\forge-workflow\ on Windows).

Added

• /forge orchestrator command: detects the current phase, reconciles the recorded state against the repository, and does the next thing.
• Phase 1 (/forge-spec): requirements discovery to 95 percent confidence, producing docs/SRS.md behind a mandatory approval gate.
• Phase 2 (/forge-env): toolchain and repository bootstrap, testing harness, git hooks, and CI. Windows and PowerShell specific today.
• Phase 3 (/forge-code): test-driven implementation in vertical slices, branch per slice, with a pre-push gate running build, tests, lint, and a secret scan.
• forge-standards: always-loaded engineering standards covering typography, testing discipline, git lifecycle, and resumability.
• SessionStart, PreToolUse, PostToolUse, and Stop hooks for state injection and drift detection, backed by four Node scripts.
• Project file templates for CONTINUE.md, TODO.md, traceability, docs and image manifests, CI, and release tooling.
• Illustrated user guide hosted on GitHub Pages.
• Marketplace distribution via the dailen marketplace, plus a manual skills-directory install path.

Notes

This is an early release (0.1.0). Forge has had a partial shakedown, not a complete one. Phase 2 assumes Windows and PowerShell today; the rest is platform-neutral. The hooks need Node.js on your PATH, and without it cross-session resume becomes best-effort. See the README for details.