How it works

1. Discovery, with consent

ForgeOS starts with read-only access you grant through short-lived roles. It never asks for permanent cloud keys.

2. A plan you can inspect

The project portal shows the proposed architecture, the data each tool and model can see, the cost estimate, and the rollback path. Diagrams come from structured plan data, not from screenshots or guesses about runtime state.

3. Approvals bound to a plan revision

Each approval records the checkpoint, the exact resources in scope, who approved, when it expires, and the hash of the plan it covers. A chat message is not an approval. High-risk steps need re-authentication.

4. Changes as pull requests

Code and infrastructure changes arrive as pull requests with test and policy evidence, are verified in an isolated non-production environment, and are deployed only after a separate deployment approval.