forge substrate "<task>" (and the MCP tool substrate_check) runs one ordered pass of checks
and returns a single verdict. It composes the individually-callable stages —
preflight, route, atlas, impact, reuse, context, scope, lean, anchor,
verify — into one pre-action contract.
The three phases
1
Intake
preflight finds the assumption gap — what the task names that the repo doesn’t
define. route picks the cheapest capable model tier.
2
Analysis
atlas reads the code graph, impact computes the blast radius, predict
names the tests likely to fail, and reuse checks for a verified cache hit.
3
Safety and fit
context runs the completeness gate, scope surfaces coupled files, memory
injects recall + lessons, minimality measures the lean footprint, and
goal-anchor checks for drift.
Blast radius
Blast radius — the set of files an edit is predicted to impact, read from the code graph.forge impact computes it; the pipeline surfaces it before the model touches
anything.
Advisory by default
The verdict is advisory by default — it reports, it does not block. SetFORGE_ENFORCE=1 to turn the strongest signals into a hard block:
Vacuous prompt
preflight finds no actionable intent — an underspecified task.
Un-assemblable context
the completeness gate cannot cover the predicted edit set.
Blast radius over threshold
the impacted set exceeds the default ~25-file threshold.
On Claude Code the whole gate runs on every prompt automatically via a
UserPromptSubmit hook — silent on clean tasks. forge substrate "<task>" --json
gives the machine-readable verdict for scripting.Running it
ASK FIRST, ask the returned assumption.questions before editing —
do not guess an under-specified task. Start at the recommended route.tier and escalate
only after an external verifier fails, never preemptively.
How memory feeds the gate
The memory stage reads from the proof-carrying ledger.