Fullstack Forge v0.2.0

Release notes — v0.2.0

Fullstack Forge v0.2.0 adds Build mode: a second, additive product mode that guides an AI coding
agent while it starts a project or implements a feature, so production quality is built in from the
beginning instead of discovered only by the final audit. The existing audit, fix, verify, and ship
system is unchanged and remains the independent backstop for everything Build mode produces.

What Fullstack Forge does

Build mode: forge new frames a product once (users, business rules, risk-class inputs, stack
rationale, explicit non-goals such as "no Redis", design direction, initial feature list);
forge feature <slug> then runs each feature through frame → plan → implement → check → done with
proportional rigor. Audit mode: forge <section> audit|fix|verify|report, forge all ..., and the
fail-closed forge ship release gate, exactly as in v0.1.x.

Build mode in brief

• Three risk tiers — light (one-shot), standard, high — computed from recorded inputs. The CLI
  enforces a tier floor: identity, payments, tenancy, uploads, AI, migration, secrets, session,
  cryptography, SSRF, and destructive-operation triggers escalate a feature to high with the
  triggers recorded; a lower tier requires a recorded --reason override. The floor is re-applied
  at plan, check, and done.
• check and done are enforced: statuses are derived by the CLI from real executions
  (changed-scope analyzers, argv project commands behind --allow-run, structural checks), never
  written by the agent, and re-verified by per-file SHA-256 on every reload. A reloaded
  discipline:* PASS — which the deriver never produces — is demoted to NOT_VERIFIED.
• accept-risk requires a reason, is recorded immutably, is rendered distinctly (never as PASS),
  and is refused for required security controls at high tier (auth, authorization, security,
  privacy, tenancy, uploads, payments).
• 42 hand-authored build-discipline briefs ("decide before coding" + "evidence to produce while
  building"), one per audit module, with CI-enforced exact slug-set coverage. Concluding that a
  project needs no cache, no Redis, no queue, and no microservices is a first-class recorded
  outcome.
• Resumable state under .forge/build/ with fail-closed schema validation, redaction of
  agent-authored text, a criterion-scoped repair-cycle cap of 2, and terminal blocked /
  abandoned edges.
• Build state satisfies zero forge ship or forge all audit gates. Both always re-derive
  their own evidence independently.

Supported agents

Codex and generic Agent Skills clients (.agents/skills), Claude Code (.claude/skills), Google
Antigravity (project .agents/skills, user ~/.gemini/config/skills), Gemini CLI
(.gemini/skills), Cursor (.cursor/skills), Windsurf (.windsurf/skills), and GitHub Copilot
(.github/skills). The two new command skills, forge-new and forge-feature, ship to all six
generated platform roots alongside the 42 audit skills.

Installation

npm install --save-dev github:thethunderbolt/fullstack-forge-skill#v0.2.0
npx forge init all

Or download the platform archive from the release, verify it against SHA256SUMS.txt, and extract
at the project root. Existing v0.1.x installations upgrade with forge update <platform>; the
upgrade is additive and invalidates no existing .forge/ artifact.

Commands

Build mode: forge new, forge feature <slug> [frame|plan|check|done|accept-risk|abandon|status],
forge resume. Audit mode: unchanged (forge <section> <audit|fix|verify|report>, forge all ...,
forge ship, platform lifecycle, and forge tool <name>). See docs/BUILD_MODE.md,
docs/COMMANDS.md, and docs/CLI_REFERENCE.md.

Evidence and safety model

Unchanged foundations: findings use the shared schema with PASS, FAIL, WARNING,
NOT_APPLICABLE, NOT_VERIFIED, and BLOCKED; a PASS requires affirmative evidence; missing
evidence is never converted to a pass. Build mode adds: enforcement honesty (frame/plan are
recorded guidance, only check/done are machine-enforced), layered state-trust defenses, and
strict ship-gate isolation. See docs/SECURITY_MODEL.md for the build-mode threat surface.

Distribution files

Nine platform ZIP archives (fullstack-forge-<platform>-v0.2.0.zip plus the all bundle),
SHA256SUMS.txt, and manifest.json, built deterministically and attested by the release workflow.
The final post-release verification asset is generated by the tag workflow after draft-asset
verification and is not part of tagged source.

Known limitations

• The CLI cannot force analysis quality in frame and plan; they are recorded guidance.
• Most discipline criteria resolve to NOT_VERIFIED or a reasoned NOT_APPLICABLE without runtime
  evidence; the independent backstop remains forge all audit and forge ship.
• Build state files are local and writable; hand-edited statuses can misrepresent only build-mode
  bookkeeping, never a ship or audit decision.
• The social preview image requires a manual upload step documented in docs/RELEASING.md; do not
  assume it is configured.

Attribution

Build mode is original work grounded in the project's existing primary-standards research (recorded
in research/SOURCES.md and THIRD_PARTY_NOTICES.md). No third-party skill text was copied.