Nothing is “done” without a check you can run — a test, a build exit code, a screenshot.
Forge’s verification gates each add one more catch. With per-task miss rate 1 − p and a
gate catch rate c, silent misses fall to (1 − p)(1 − c), and every gate here is one
more c.
Verification reduces, does not certify. Crew verifiers and the hallucinated-symbol
flag cut review burden; they do not prove the code correct. Tests and human
corrections always win.
Independent verification — forge verify
An independent gate: it runs the repo’s real tests, flags hallucinated symbols, and
checks provenance.
--deep (v0.19+) escalates to a multi-lens consensus: the change must clear several
independent verification lenses, not just one.
forge verify --deep reports a four-state status, not a binary pass/fail:
PASS — every lens agreed and the core forge verify tests status is also
PASS. Only this state counts as verified.FAIL — at least one lens reported a real failure.INCOMPLETE — a lens could not finish (timeout, crash, missing dependency). Nothing
was disproven, but nothing was proven either.NOT_CONFIGURED — no lenses are wired up for this repo, so --deep had nothing to
check.
The PASS-implies-base-PASS rule is deliberate: a green deep consensus can never
outrun a red base run, so INCOMPLETE or NOT_CONFIGURED on the base test lens
downgrades the deep result to match.
The hallucinated-symbol flag — forge atlas has
forge atlas has <symbol> is the hallucination check: if the model calls a symbol that
is not in the code graph, the gate flags it.
The atlas is plain JSON on purpose — Codex, Cursor, Gemini, and Aider read
.forge/atlas.json via the CLI or plain jq, with no MCP dependency to consume.
Spec-as-contract — forge spec
Pin behavior to a spec and detect drift from it:
The skill-gate — forge scan
Before installing a skill or MCP server, vet it for injection, RCE, or exfiltration:
A clean scan is not a safety certification. The built-in heuristic only catches
known attack shapes (critical) and a few high-severity patterns; a pass means “no
critical signature detected”, not “safe to install”. Always review the source,
permissions, package provenance, and network behaviour yourself. A high-severity
finding is not marked safe even though it does not hard-block. The external scanner is
opt-in and runs no network call unless you enable it.
Hardening — forge harden
Wire the security controls that keep secrets and unsafe changes out:
Commit-level gate — forge precommit
forge precommit (v0.19+) is a commit-level gate — it runs the verification floor at
commit time so partial or unverified work is caught before it lands.
Completion gate — test evidence required
The Stop-path completion gate (see
Cross-session memory) no longer accepts an agent
handoff as proof that code changes are done. For any session that touched source code,
the gate requires real test evidence:
- a test file changed in the session’s diff, or
- a fresh passing
forge verify recorded against the current changes.
A forge handoff snapshot on its own does not satisfy the gate — it records intent, not
verification. If neither piece of evidence is present, the gate blocks once with a
repair checklist:
Doc-only, config-only, and other non-code sessions are unaffected — the test-evidence
requirement fires only when the session’s diff actually changes code.
UI checks — forge uicheck
Deterministic UI checks, no LLM and no screenshots for the first three lenses:
Pair it with forge taste to pick one visual direction (brutalist, corporate,
editorial, minimalist, playful) and parameterize the design gate thresholds. 
