# Forge Discover

> Build an evidence-backed application profile and architecture map before any specialized audit begins.

- Skill: `is-bo/forge-discover-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add is-bo/forge-discover-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/is-bo/forge-discover-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: is-bo (https://skillmd.com/u/is-bo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/is-bo/forge-discover-3

---


# forge-discover: Project discovery

Engine: Forge native

## Purpose

Build an evidence-backed application profile and architecture map before any specialized audit begins.



Resolve and read `../fullstack-forge/references/shared/module-contract.md` (applicability,
execution, mutation, verification, completion) and
`../fullstack-forge/references/shared/evidence-rules.md` (statuses, standards, tools, findings via
`../fullstack-forge/references/PROTOCOL.md`) relative to this module `SKILL.md` before reporting.

Never hide failed checks or claim that an operation ran when it did not.

## Automatic activation signals

Activate when a request or direct repository evidence involves project discovery, when
the user explicitly names `forge-discover`, or when discovery proves an applicable boundary.

- Every repository audit
- A changed monorepo layout or deployment model

## When not to activate

- A report-only replay with an unchanged, still-valid profile

## Automated support

Relevant discovery inputs are:

- repository root
- version-control status
- package and workspace manifests

Deterministic support, bounded evidence only:

- `detect-stack`
- `discover-project`
- `inspect-env-template`
- `inspect-platform-skills`

## Agent inspection procedure

1. Enumerate workspace manifests, lockfiles, and entry points, and record every application root with its package manager and language evidence.
2. Map executable surfaces: HTTP routes, background workers, scheduled jobs, CLIs, and build outputs, each with a file citation.
3. Identify data boundaries: databases, ORMs, migrations, caches, queues, object storage, and external providers from configuration and dependency evidence.
4. Identify identity boundaries: authentication providers, session mechanisms, roles, and tenant markers, distinguishing declared dependencies from wired code paths.
5. Write `.forge/project-profile.json` and `.forge/architecture-map.md` with a confidence level and file evidence for every detection, and flag low-confidence guesses for manual confirmation.

Manual inspection requirements:

- Confirm ambiguous service boundaries and critical user workflows
- Compare detected deployment topology with operator documentation

Stack-specific guidance:

- Prefer native workspace commands and manifest semantics for the detected package manager

## Evidence to collect

Standards used as criteria:

- Agent Skills Specification
- C4 model concepts

## Common production failures

- Detect languages, frameworks, package managers, applications, data stores, queues, providers, tests, CI, and deployment files
- Map public, private, admin, tenant, upload, payment, and AI boundaries with file evidence
- Record a confidence level and evidence list for every detected capability

## Missing-control checks

Each item needs direct evidence or one reasoned status.

- Languages
- Frameworks
- Monorepo layout
- Package managers
- Frontend applications
- Backend applications
- Mobile applications
- Desktop applications
- Databases
- ORMs
- Authentication provider
- Session implementation
- Hosting platform
- Object storage
- File-upload pipeline
- Caching and Redis
- Queues
- Scheduled jobs
- Tests
- CI/CD
- Observability
- External integrations
- AI providers
- Payment providers
- Public routes
- Private routes
- Admin routes
- User roles
- Tenant boundaries
- Critical workflows
- Environment templates
- Deployment configuration
- Confidence and file evidence for every detected technology
- Current .forge/project-profile.json and .forge/architecture-map.md outputs

## Commands and tools

- Run `forge discover audit --json` or `fullstack-forge discover audit --json` when
  an explicit audit is requested and the CLI is installed. Normal feature work does not require it.

## Safe fixes

- Create missing local .forge report directories
- Normalize a stale generated profile after discovery

## Approval-required changes

- Changing application boundaries or deployment topology
- Enabling a provider inferred only from dormant code

## Verification

- Validate project-profile.json against its schema
- Trace every architecture-map node back to profile evidence

## Completion contract

Follow `fullstack-forge/references/shared/completion.md` and the limitations below.

## Known limitations

- Runtime-only infrastructure may remain NOT_VERIFIED without operator access