v1.1.0 Capability-based default-branch protection

MILESTONE

Forge no longer needs a paid hosting plan to finish bootstrap. Until now, Phase 2 demanded a GitHub ruleset on main, and GitHub reserves that for paid plans on private personal repositories, answering Upgrade to GitHub Pro or make this repository public to enable this feature. A solo developer on a free plan could pass that gate only by paying or by publishing a repository they had deliberately kept private. As of this release, forge protects the default branch at whichever tier your host and account actually grant, proves the one it picked actually works, and writes down what that tier does not cover. Your repository's visibility is never part of the deal.

Added

• templates/branch-protection.js, a provider-neutral protection tool with detect, apply, verify, selftest, gate, migrate, report, and status. Adapters for GitHub (rulesets, falling back to classic branch protection on older Enterprise Server) and GitLab (protected branches), plus an explicit fallback for self-hosted and unrecognised hosts. It records the provider, mechanism, and verification evidence in .forge/protection.json.
• templates/history-guard.js, a managed pre-push history-integrity guard. It reads the ref-update records git writes to a pre-push hook's stdin and refuses deletion of the protected branch and non-fast-forward updates to it, while allowing fast-forward pushes and initial branch creation. It fails closed, naming the fix, when it cannot see the records.
• branch-protection.js selftest, which proves the guard end to end against disposable repositories in a temp directory. Every recursive delete is refused unless the path is a directory the tool itself created with its own prefix.
• A test suite under tests/, run with node --test and wired into CI. 94 tests.

Changed

• Phase 2's protection step is capability based. The gate item is "default-branch history protection verified", satisfied by either verified server-side enforcement or verified managed local enforcement with its narrower trust boundary recorded. An unavailable paid hosting feature is no longer a fatal bootstrap failure.
• templates/lefthook.yml runs the history check first, with use_stdin: true so lefthook forwards git's ref records to it, and piped: true so the secret scan, lint, build, and test commands do not run after it has already refused the push. The command is named 00_history because lefthook orders commands by priority, then by the leading number in the name, then alphabetically, never by their position in the file.
• verify inspects rather than installs, so a hook the user deleted is reported rather than silently recreated. It also confirms the hook is somewhere git will actually run it, honouring core.hooksPath, and that lefthook install has been run rather than trusting lefthook.yml alone.
• forge-standards states the protection policy once, behaviourally and without naming a host, alongside its trust boundary.
• The always-strict repository visibility gate now covers later changes as well as the initial choice. A hosting feature that is only available on public repositories is never a reason to change it, and the tool refuses to issue a visibility mutation at all.

Trust boundary

Server-side enforcement applies to every writer, including web UI and API writes. The local guard protects clones configured with it, and does not stop a push from an unconfigured clone, a write through the host's API or web UI, a hook that was deleted or edited, or an attacker holding valid credentials. Forge prefers the server-side tier wherever it is available and records the difference wherever it is not.

Migration

A project whose environment phase stalled on a paid-plan ruleset resumes with node .forge/branch-protection.js migrate. It re-detects provider capability, installs and verifies the fallback, and names exactly which recorded blocker to clear. Unrelated blockers are preserved.

Install

claude plugin marketplace update dailen
claude plugin update forge-workflow

Or download forge-workflow.zip below and extract it into ~/.claude/skills/.