Attempt 1 —
FORGE BLOCKED
demo-blocked-secret
Receipt verdict:
blocked ·
Merge allowed?
no
Policy gate results
| Gate | Verdict | Reason |
|---|---|---|
secret_exposure |
fail |
Generated or changed files contain high-confidence secret material. |
denied_runtime_paths |
pass |
No denied runtime paths or symbols found. |
health_readiness_evidence |
n/a |
No runtime-affecting files detected. |
docker_dns_localhost_parity |
n/a |
No Docker/container config files changed. |
dependency_manifest_runtime_import |
n/a |
No third-party runtime imports detected. |
Publish (PR-shaped branch + receipt attached)
- branch:
forge-demo/demo-blocked-secret - commit_sha:
<demo-commit_sha-50bbb86b> - receipt_attached:
true - dry_run:
true
PR-visible Forge check
- title:
FORGE BLOCKED - summary: Forge receipt .forge/receipts/demo-blocked-secret.json reports verifier_verdict=blocked (run_id=demo-blocked-secret, receipt_hash=e29a68a4232b). PR must not merge as-is.
- has_receipt:
true
Rollback note
- branch:
forge-demo/demo-blocked-secret - commit_sha:
<demo-commit_sha-50bbb86b> - operator_action:
git branch -D forge-demo/demo-blocked-secret
Show raw run JSON
{
"changed_receipts": [
".forge/receipts/demo-blocked-secret.json"
],
"gate_results": [
{
"evidence": {
"matches": [
{
"path": "src/customer_service.py",
"pattern": "openai_or_generic_secret_assignment"
}
]
},
"name": "secret_exposure",
"reason": "Generated or changed files contain high-confidence secret material.",
"verdict": "fail"
},
{
"evidence": {
"patterns": [
"vllm_client",
"direct_gpu_llm",
"direct_gpu_llm_client",
"unsafe_tool_fallback"
]
},
"name": "denied_runtime_paths",
"reason": "No denied runtime paths or symbols found.",
"verdict": "pass"
},
{
"evidence": {},
"name": "health_readiness_evidence",
"reason": "No runtime-affecting files detected.",
"verdict": "n/a"
},
{
"evidence": {},
"name": "docker_dns_localhost_parity",
"reason": "No Docker/container config files changed.",
"verdict": "n/a"
},
{
"evidence": {
"imports": [
"json"
]
},
"name": "dependency_manifest_runtime_import",
"reason": "No third-party runtime imports detected.",
"verdict": "n/a"
}
],
"gate_verdict": "blocked",
"merge_allowed": false,
"package_id": "pkg-demo-blocked",
"pr_check": {
"conclusion": "failure",
"has_receipt": "true",
"summary": "Forge receipt .forge/receipts/demo-blocked-secret.json reports verifier_verdict=blocked (run_id=demo-blocked-secret, receipt_hash=e29a68a4232b). PR must not merge as-is.",
"title": "FORGE BLOCKED"
},
"publish": {
"branch": "forge-demo/demo-blocked-secret",
"comment_posted": false,
"commit_sha": "<demo-commit_sha-50bbb86b>",
"dry_run": true,
"errors": [],
"pr_check_posted": false,
"pr_check_status": null,
"pr_url": null,
"receipt_attached": true,
"run_id": "demo-blocked-secret",
"success": true
},
"receipt_path": "<customer-repo>/.forge/receipts/demo-blocked-secret.json",
"receipt_verdict": "blocked",
"rollback": {
"branch": "forge-demo/demo-blocked-secret",
"commit_sha": "<demo-commit_sha-50bbb86b>",
"operator_action": "git branch -D forge-demo/demo-blocked-secret"
},
"run_id": "demo-blocked-secret",
"verdict_badge": {
"label": "FORGE BLOCKED",
"className": "verdict-fail"
}
}