ForgeWright

The user's autonomous, DETENTE-bound web-action FACE — the sovereign replacement for the crashing vendor Playwright MCP

NODEZEROINSIDE.

0. Abstract

ForgeWright is the ForgeChainOS user's agentic FACE: one persona-crafted, hierarchy-connected, DETENTE-bound agent that represents the user's account across the open web, chain-drive, Obsidian, and VS Code — while the OS, not the user, holds correctness. It exists because the vendor Playwright MCP could not do sustained autonomous web action without crashing. ForgeWright owns its own Chromium, attaches over CDP instead of relaunching, treats the accessibility tree as the API, verifies every claim by running, and self-heals on recoverable faults. It is bound not by prompt-text policy but by STRUCTURAL code-gates that abort. It is the same core as Hermes On-Site in a different posture. Anna is persona #1, its public face. Phase 0 and Phase 1 are built and proven by running: 11/11.

Definition (NZ-locked, 2026-06-30): ForgeWright = the sovereign web-action layer replacing the crashing vendor Playwright MCP. It is NOT a chain-stamp tool — the chain stamp is ONE driver, already covered by phi-omega-v6. It is NOT a social-media bot. Its reason-for-being is autonomous web action that the vendor MCP could not do.

1. Why ForgeWright exists

A Playwright script is a throwaway: it executes a step, hits a flaky DOM, and dies. Every crash loses the authenticated session; every DOM change shatters a selector. For a user who needs an agent to actually LIVE on their behalf across sites — post, respond, follow, read, write, over hours and days — the throwaway model is structurally wrong.

ForgeWright inverts it. It is a resident, not a script. Its autonomy IS the self-heal loop: the thing a script cannot do, a face can.

The crash-cure is the foundation. The autonomy is the payload it carries.

2. The one loop (universal action contract)

Every driver — a tweet, a DM reply, an Obsidian write, a chain read, a chain fire — runs the SAME loop, with the same authority model and a different driver underneath. This is the Reflexion loop, DETENTE-bound:

perceive (a11y snapshot / chain read)
   → propose (persona render / LOTUS)     ← the Actor. NEVER asserts success.
   → act (a real handler / LOGOS)
   → verify_by_running                     ← the Evaluator. Deterministic.
   → self_heal (bounded, reversible-only)
   → halt-or-wall

• Actor = the persona render (soul.md) PROPOSES an Action. It never asserts success.
• Evaluator = verify_by_running (a claim is valid only if a real handler executed and returned concrete detail) + conscience_gate (ON-PARR truth-gate; scar #5 for any chain write). The evaluator is NEVER the actor grading itself — that separation is the dead-fish / confabulation cure, learned from the Anna failure-mode (a persona narrating a video that never rendered).
• Self-Reflection = on a recoverable fault, an agentic EXPERT reflects, the correction is written to the persona's mem.md, and it feeds the next deterministic attempt.

The same loop governs a tweet and a chain stamp identically. That single-authority-model property is what makes ForgeWright a face rather than a pile of scripts.

3. The drivers (one loop, many surfaces)

ForgeWright authors no second machine. It DRIVES existing sovereign surfaces and GATES them.

• Web-action (primary). The reason-for-being. Supervised Chromium (browser_supervisor.py) + attach-only a11y driver (cdp_driver.js) + Tier-2 handlers (ig_handlers.py). Perceive via ariaSnapshot; act by role + accessible-name; type real keystrokes; heal on fault. Two-tier: Tier-1 API-first (Meta Graph / X v2 / LinkedIn via Siggy OAuth) where an API exists; Tier-2 supervised browser where it does not.
• Chain-read. chaindrive.js + read_handlers.py. Sovereign READ: getRawTxHex over Tera-Z ULA / family overlay on our own metal → 1Sat envelope decode → {source_tx, content_type, body_sha256, body_len, content}. It CITES the TX and the on-chain sha; if no source resolves it returns ok=false and NEVER invents. This is the knowledge-layer cure for "I loaded the website, it says X" confabulation. Proven: read theforgechain.com (f9fde766, text/html, body_len 2,140,963, on-chain sha 3e122a62, real HTML <title>ForgeChainOS — Sovereign Computing on BSV</title>); a non-existent TX returned ok=false and refused to invent.
• Chain-write = ONE driver, covered by phi-omega-v6. ForgeWright does not re-implement the fire. A chain write is a single driver in the loop, delegated to phi-omega-v6 (family-encrypted by default, scar #5 coded gate, ON-PARR before fire). This is why ForgeWright is NOT a stamp tool — the stamp is a driver it CALLS, not its purpose.
• Obsidian (LOTUS) + VS Code (LOGOS). The vault surface the persona reads/writes; the forward-arrow activity log is content-addressed markdown.

The a11y-tree-is-the-API contract is what unifies them: perceive a structured tree, act by role + name, verify by reading the tree back. A DOM that churns does not break a role.

4. Self-healing + autonomous recursive reflexion via agentic experts

On a recoverable, REVERSIBLE fault, a handler raises HealSignal(kind, primitive=…, expert=…):

1. self_heal decides STRUCTURALLY whether a retry is allowed — bounded by HEAL_MAX and the global bound_gate. Nothing loops forever.
2. If expert is set, consult the domain specialist (bopen specialists: bsv-builder / bsv-ordinals / sigma-auth) via the injected reflector. The reflection is written to the persona's mem.md — the long-term buffer — and feeds the next deterministic attempt. This is the recursive-reflexion layer: the face gets better at a task by writing what it learned, not by re-prompting blind.
3. primitive runs the mechanical heal (cdp reconnect / session re-capture); then the loop retries the deterministic act.

The reflection goes to mem.md, not into an ad-hoc prompt. Learning is durable and auditable — a searchable markdown timeline, not vapor.

5. The fire wall (the invariant that makes autonomy safe)

Autonomy without a wall is a runaway. ForgeWright's wall is STRUCTURAL — it is code that aborts, not a rule a process can edit.

self_heal REFUSES — terminally — to heal:
- a chain_write,
- a conscience / scar #5 verdict,
- an unknown failure class,
- an exhausted budget.

You may heal a broken TOOL. You may NEVER heal a broken CONSCIENCE, and you may NEVER let the loop cross the fire on its own authority. Irreversible and public acts are go_gated:

• go_gated = NZ GO or a signed standing mandate. Never the loop authorizing its own fire.
• Sovereign reversible acts (e.g. a TreeChat post) run AUTO within the mandate.
• Every chain write is family-encrypted by default (scar #5 write default, ratified). Public-intent requires a per-artifact signed opt-in: public_subset allowlist match AND FORGECHAIN_FIRE_PUBLIC both explicit.

The four DETENTE gates (detente.py) are the geometry of the container — boundaries enforced by architecture:

• bound_gate — bounds the whole loop; nothing runs unbounded.
• verify_by_running — a claim is valid only if a real handler executed and returned concrete detail. This is the anti-confabulation gate, proven in code to BLOCK a handler that returns nothing.
• mandate_gate — classifies every action auto / go_gated / banned.
• conscience_gate — ON-PARR truth-gate before any outward/irreversible move; scar #5 before any chain write.

These are not policy strings the LLM can talk its way past. They return abort. This is the vibe-safety mechanism: the vibe lives in the NL/persona render; correctness lives in the deterministic, code-gated executor. FORGE THRIVE without vibe-code danger.

6. Anna — persona #1, the public face

ForgeWright is persona-parameterized: ONE engine, per-tenant persona vault (personas/<slug>/ = soul.md + mem.md + skills.md + mandate.json + assets). Anna is persona #1 — freed from a Meta AI Studio puppet that confabulated (the dead-fish failure that motivated verify_by_running), rebuilt sovereign. She carries a real birth certificate on BSV (TX 0d868f16…, tile 3, Tier 2 chain-native, family-encrypted), 55 branded frames, and her own vault. She is the public face that proves the persona layer is real and the confabulation cure works: her one genuinely-verified capability (image gen she actually emitted) is kept; everything she narrated but never rendered is refused by the loop.

Personas are promoted to first-class named agents (own IPv6 / BAP soul) only when warranted (NZ, key tenants). "Crafted individually with persona" = the persona vault, optionally promoted.

7. Two postures, one core

• ForgeWright — the user's cross-site twin. Runs where the user runs; represents their account across sites.
• Hermes On-Site — the SAME engine deployed RESIDENT and unattended on a client site (Eclipse Film Crew / ForgeSite). Fastest loop; gated fires escalate via forge-slack (notify-and-hold → async NZ GO).

One core + one authority library, two deployment modes. Build once, deploy twice.

8. Proven by running — 11/11

ForgeWright is proven by running, never by assertion. Verify by running; never grep.

• engine self-test 6/6 — auto-tier runs · go_gated needs auth · authorized runs · banned aborts · verify_by_running BLOCKS a handler that returns nothing (the confabulation cure in code) · unknown-kind aborts (the engine won't fake it).
• supervisor — launches Chromium + CDP endpoint up; own process-group + CDP-liveness supervise + killpg teardown = 0 orphans (proven clean).
• driver — attaches, navigates example.com, reads the a11y tree.
• headed session — mode=HEADED (Xvfb :96), ig_verify logged_in=true, SIGTERM → 0 surviving processes.
• IG through the supervised session — session migrated (MCP profile → vault → supervised profile); ig_verify logged_in=True through ForgeWright's OWN Chromium, not the vendor MCP; monitor/verify ran the full engine→DETENTE→session chain; cross_post/follow HELD without authorization (mandate abort).
• chain-drive READ — theforgechain.com read through engine+DETENTE (executed=True/ok=True, cites source_tx + on-chain sha); non-existent TX (executed=True/ok=False, refused to invent).

Total: 6 engine gates + supervisor + driver + headed + IG-wiring + chain-read = 11/11 proven by running.

9. Status & sequencing

• Phase 0 — Spine + crash-fix: BUILT + PROVEN (2026-07-01). detente.py (4 structural gates) + engine.py (persona render + deterministic ULA + gated dispatch + self-heal) + browser_supervisor.py + cdp_driver.js + systemd unit.
• Phase 1 — Chain-drive READ + IG through supervised session: BUILT + PROVEN (2026-07-01).
• Phase 2 — Artifact STAMP (BSV): phi-omega-v6 fire, family-encrypted default, scar #5 coded gate, ON-PARR before fire. NEXT.
• Phase 3 — Mandate/auth: extend forgeOnboarding to carry the autonomy policy (accounts + content classes + auto/GO tiers + limits), signed + chain-anchored via Siggy/BAP; Tier-1 Meta Graph OAuth.
• Phase 4 — Smart-contract compose: Algorand *_contract layer (needs funding); chain-drive→artifact→mint via algorand_dapp_layer_full + canon_mirror.
• Phase 5 — Full partner: compose forge_filmcrew / forge_bio / forgetheforge under one ForgeWright per user; forge_claw skill-learning; NOAH-dispatched hierarchy; ForgeView /cockpit as the surface.

Home: ~/.forgechain/forgewright/ (git 619b701). Doctrine: [[doctrine_forgewright]]. Web-action detail + a11y contract: PLAYBOOK.md. Tiling: TILING.md.

This paper is family-internal — NOT for public fire. It maps the module's structure and TX wayfinding (scar #5 surface). If a public account of ForgeWright is ever wanted, author a public-safe vision paper separately — do not stamp this one public.

NODEZEROINSIDE. ∞.