feat(forge): bridge Slack to full DocForge engine via DocumentRouter

Unify draft routing across the full template catalog, wire charts and engine
telemetry into confirm/delivery surfaces, and add marketplace install, explicit
document commands, postmortem routing, and layout repair for judges.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: pugstro

.env.sample

@@ -1,11 +1,38 @@
 # Slack — socket mode (local: slack run or npm run slack)
 SLACK_BOT_TOKEN=xoxb-your-bot-token
 SLACK_APP_TOKEN=xapp-your-app-token
+# SLACK_LOG_LEVEL=info
 
 # Slack — HTTP mode (deploy). Set SLACK_SOCKET_MODE=false and omit SLACK_APP_TOKEN.
 # SLACK_SOCKET_MODE=false
 # SLACK_SIGNING_SECRET=your-signing-secret
 # PORT=3000
 
-# DocForge workspace (optional; defaults under .data/)
+# DocForge runtime (optional; defaults shown in README)
 # DOCFORGE_DATA_ROOT=/var/forge/data
+# DOCFORGE_TYPST_PATH=typst
+# DOCFORGE_TYPST_PACKAGE_PATH=/absolute/path/to/vendor/typst-packages
+# DOCFORGE_TYPST_PACKAGE_CACHE_PATH=/tmp/typst-package-cache
+# DOCFORGE_COMPILE_TIMEOUT_MS=30000
+# DOCFORGE_DOCUMENT_TTL_MS=86400000
+# DOCFORGE_TEMPLATE_SOURCE_DIRS=/absolute/path/to/custom/templates
+
+# Runtime limits
+# DOCFORGE_MAX_DATA_BYTES=5242880
+# DOCFORGE_MAX_CSV_BYTES=1048576
+# DOCFORGE_MAX_ASSET_BYTES=10485760
+
+# Forge MCP bridge
+# FORGE_MCP=on
+# FORGE_MCP_SERVER_ENTRY=/absolute/path/to/dist/index.js
+
+# QA / local scripts
+# DOCFORGE_VISUAL_THRESHOLD=0.02
+# TYPST_VERSION_PIN=0.14.2
+# POLL_MESSAGE_LIMIT=30
+# POLL_OUTPUT=/tmp/forge-slack-poll.txt
+# SEED_DELAY_MS=400
+# SEED_INCIDENT_CHANNEL=incident-api-gateway
+# SEED_SALES_CHANNEL=sales-northstar
+# SEED_STATUS_CHANNEL=team-eng
+# SEED_GENERAL_CHANNEL=general

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  TYPST_VERSION: "0.14.2"
+  TYPST_LINUX_X64_SHA256: "a6044cbad2a954deb921167e257e120ac0a16b20339ec01121194ff9d394996d"
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -19,10 +23,18 @@ jobs:
 
       - name: Install Typst
         run: |
-          curl -fsSL https://github.com/typst/typst/releases/download/v0.14.2/typst-x86_64-unknown-linux-musl.tar.xz | tar -xJ
+          curl -fsSL -o typst.tar.xz "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz"
+          echo "${TYPST_LINUX_X64_SHA256}  typst.tar.xz" | sha256sum -c -
+          tar -xJf typst.tar.xz
           sudo mv typst-x86_64-unknown-linux-musl/typst /usr/local/bin/typst
           typst --version
 
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Dependency audit
+        run: npm audit --audit-level=moderate
+
       - name: Verify Typst version pin
         run: node scripts/check-typst-version.mjs
 
@@ -32,12 +44,12 @@ jobs:
       - name: Vendored offline package check
         run: node scripts/check-vendored-packages.mjs
 
-      - name: Install dependencies
-        run: npm ci
-
       - name: Lint
         run: npm run lint
 
+      - name: Script syntax check
+        run: npm run check:scripts
+
       - name: Format check
         run: npm run format:check
 
@@ -47,5 +59,14 @@ jobs:
       - name: Unit & integration tests
         run: npm test
 
+      - name: Forge smoke
+        run: npm run forge:smoke
+
       - name: Visual regression
         run: npm run test:visual
+
+      - name: Package contents check
+        run: npm run pack:check
+
+      - name: Docker build
+        run: docker build --build-arg TYPST_SHA256="${TYPST_LINUX_X64_SHA256}" -t forge-ci .

.gitignore

@@ -7,6 +7,7 @@ dist/
 .cache/
 .golden-build/
 .visual-regression/
+tmp/
 *.log
 *.sqlite
 

DELIVERY.md

@@ -12,14 +12,15 @@
 Do **not** wire Slack until the headless pipeline works.
 
 ```text
-Step 0: src/forge/pipeline.ts + npm run forge:smoke  (3 PDFs from existing helpers)
+Step 0: src/forge/pipeline.ts + npm run forge:smoke  (5 PDFs from shipped workflows)
 Step 1: Slack scaffold + @forge help
 Step 2: incident_report workflow (history API only)
 Step 3: sales_proposal + pricing confirm
 Step 4: kpi_report + CSV upload
-Step 5: RTS on proposal workflow
-Step 6: Deploy HTTP + seed review workspace
-Step 7: Product walkthrough + review package
+Step 5: project_status + draft PDF workflows
+Step 6: RTS on proposal/status/incident enrichment paths
+Step 7: Deploy HTTP + seed review workspace
+Step 8: Product walkthrough + review package
 ```
 
 Details in [FORGE.md §11](./FORGE.md#11-implementation-order-with-test-gates).
@@ -32,8 +33,8 @@ Details in [FORGE.md §11](./FORGE.md#11-implementation-order-with-test-gates).
 | -------------------------------- | ---------------------------------------------------------------------- |
 | Slack **agent**                  | `@forge` in workspace — not MCP-only                                   |
 | **MCP integration**              | DocForge MCP (`npm start`); agent uses same `service.ts` logic         |
-| **RTS API**                      | `assistant.search.context` on proposal workflow (+ history fallback)   |
-| Product walkthrough video ~3 min | 3 workflows, all in Slack                                              |
+| **RTS API**                      | `assistant.search.context` on proposal + enrichment paths (+ fallback) |
+| Product walkthrough video ~3 min | Five workflows, all in Slack                                           |
 | Architecture diagram             | See §6                                                                 |
 | Review access                    | Dedicated Slack workspace with seeded channels and pinned instructions |
 
@@ -49,7 +50,7 @@ Details in [FORGE.md §11](./FORGE.md#11-implementation-order-with-test-gates).
 
 ### Tagline
 
-`Finish proposal, incident, and board-pack workflows in Slack — schema-validated PDFs via DocForge MCP and Real-Time Search.`
+`Finish draft, proposal, incident, board-pack, and status PDFs in Slack — schema-validated through DocForge MCP and Real-Time Search.`
 
 ### Track
 
@@ -60,29 +61,31 @@ Details in [FORGE.md §11](./FORGE.md#11-implementation-order-with-test-gates).
 ```markdown
 ## Problem
 
-Discovery, incidents, and board prep happen in Slack. The deliverable — client proposal, incident report, board KPI pack — is usually rebuilt manually elsewhere.
+Discovery, incidents, status updates, draft notes, and board prep happen in Slack. The deliverable — client proposal, incident report, weekly status, memo, or board KPI pack — is usually rebuilt manually elsewhere.
 
 ## Solution
 
-**Forge** completes three document workflows inside Slack:
+**Forge** completes five document workflows inside Slack:
 
 | Command                                             | Deliverable         |
 | --------------------------------------------------- | ------------------- |
 | `@forge proposal for Northstar`                     | Sales proposal PDF  |
 | `@forge incident report from #incident-api-gateway` | Incident report PDF |
 | `@forge board pack for Q3 operating review` + CSV   | KPI board pack PDF  |
+| `@forge status for #team-eng`                       | RAG status PDF      |
+| `@forge draft <notes>`                              | Inferred draft PDF  |
 
-Forge gathers context (Real-Time Search + channel history), maps to validated JSON via workflow helpers, runs DocForge (schema → compile → lint → export), and uploads the PDF after you confirm.
+Forge gathers context (Real-Time Search + channel history where useful), maps to validated JSON via workflow helpers, runs DocForge through MCP (schema → compile → lint → export), and uploads the PDF after you confirm.
 
 ## Technologies
 
-- **Slack Agent** — Bolt for JavaScript, assistant status streaming, Block Kit confirm
+- **Slack Agent** — Bolt for JavaScript, App Home, assistant prompts/status streaming, Block Kit confirm
 - **Real-Time Search API** — `assistant.search.context` with `action_token`
 - **MCP** — DocForge custom MCP server (Typst-backed document production)
 
 ## Differentiation
 
-Agents that summarize chat are common. Forge ships **outbound documents** with lint gates — not chat pasted into a template. Pricing and KPIs come from user input, not hallucination.
+Agents that summarize chat are common. Forge ships **outbound documents** with lint gates — not chat pasted into a template. Pricing, KPIs, RAG status, and severities come from Slack/user data, not hallucination.
 
 ## Repository
 
@@ -124,15 +127,17 @@ Monorepo: Slack agent + DocForge engine.
 
 ---
 
-## 5. Product walkthrough video script (~2:50)
+## 5. Product walkthrough video script (~3:00)
 
 | Time      | Action                                                                               |
 | --------- | ------------------------------------------------------------------------------------ |
-| 0:00–0:20 | Hook: "The proposal already exists in Slack — Forge finishes it."                    |
-| 0:20–1:05 | `#sales-northstar` → `@forge proposal for Northstar` → paste pricing → confirm → PDF |
-| 1:05–1:45 | `#incident-api-gateway` → `@forge incident report` → confirm → PDF                   |
-| 1:45–2:25 | DM + CSV attach → `@forge board pack for Q3 operating review` → PDF                  |
-| 2:25–2:50 | Architecture: Slack → Forge → DocForge → PDF; mention MCP + RTS                      |
+| 0:00–0:18 | Hook: "The proposal already exists in Slack — Forge finishes it."                    |
+| 0:18–0:58 | `#sales-northstar` → `@forge proposal for Northstar` → paste pricing → confirm → PDF |
+| 0:58–1:28 | `#incident-api-gateway` → `@forge incident report` → confirm → PDF                   |
+| 1:28–1:52 | `#team-eng` → `@forge status for #team-eng` → preview/confirm → PDF                  |
+| 1:52–2:18 | DM + CSV attach → `@forge board pack for Q3 operating review` → PDF                  |
+| 2:18–2:38 | Paste notes → `@forge draft ...` → inferred template confirm → PDF                   |
+| 2:38–3:00 | Architecture: Slack → Forge → DocForge MCP → PDF; mention RTS + history fallback     |
 
 **Rules:** Slack UI only in recording. Show status text during compile wait. Open PDF briefly.
 
@@ -197,6 +202,10 @@ Chronological incident (use the incident workflow fixture from `tests/workflow-e
 
 Add impact discussion (12% sessions, ~47 min). Final message from lead confirming root cause.
 
+### `#team-eng`
+
+7–10 messages: weekly platform progress with mixed RAG signal. Include one shipped/on-track item, one explicit blocker, one critical failing test, and one explicit next step. The seed script posts this by default.
+
 ### Board pack CSV
 
 ```csv
@@ -211,16 +220,20 @@ Gross margin,72,70,up,percent
 
 ```text
 Forge workflow commands
+• @forge draft Weekly update: pipeline improved, onboarding risk remains, recommendation is a setup wizard.
 • @forge proposal for Northstar — see #sales-northstar, paste pricing when asked
 • @forge incident report from #incident-api-gateway
 • DM @forge with CSV attached: board pack for Q3 operating review
+• @forge status for #team-eng
 ```
 
 ### Reviewer commands (exact)
 
 1. `@forge proposal for Northstar` → paste pricing from FORGE.md W1 when prompted
 2. `@forge incident report from #incident-api-gateway`
 3. DM: attach CSV + `@forge board pack for Q3 operating review`
+4. `@forge status for #team-eng`
+5. `@forge draft Weekly update: pipeline improved, onboarding risk remains, recommendation is a setup wizard.`
 
 ---
 
@@ -230,7 +243,7 @@ Run as someone other than the author. **All must pass.**
 
 ### Global
 
-- [ ] `@forge help` lists 3 workflows + example commands
+- [ ] `@forge help` lists Draft PDF plus proposal, incident, board, and status examples
 - [ ] `@forge summarize this thread` → text only, **no PDF**
 - [ ] Status updates visible during compile (not silent >30s)
 - [ ] Cancel on confirm → no upload
@@ -254,9 +267,21 @@ Run as someone other than the author. **All must pass.**
 - [ ] KPI names/values match uploaded CSV
 - [ ] No invented metrics
 
+### Status report
+
+- [ ] `@forge status for #team-eng` reads channel history
+- [ ] Workstreams, blockers, and next steps are grounded in messages
+- [ ] Status confirm card offers Preview, Generate PDF, and Cancel
+
+### Draft PDF
+
+- [ ] `@forge draft <notes>` infers a safe template
+- [ ] Ambiguous notes ask the user to pick a document shape
+- [ ] Bot command / `@forge` text does not leak into the PDF
+
 ### Headless (before Slack)
 
-- [ ] `npm run forge:smoke` → 3 PDF files on disk
+- [ ] `npm run forge:smoke` → 5 non-empty PDF files on disk
 
 ---
 
@@ -306,7 +331,7 @@ Reviewers test **Jul 14 – Aug 6**. Laptop `slack run` is insufficient.
 ### Agent / Assistant
 
 - Agents & AI Apps enabled
-- Assistant overview (≤25 words): `Ship proposal, incident, and board PDFs from Slack context.`
+- Assistant overview (≤25 words): `Ship draft, proposal, incident, board, and status PDFs from Slack context.`
 - MCP toggle on if using Slack MCP later (optional for v1)
 
 ### RTS
@@ -318,14 +343,14 @@ Reviewers test **Jul 14 – Aug 6**. Laptop `slack run` is insufficient.
 
 ## 11. Timeline
 
-| When               | Milestone                                    |
-| ------------------ | -------------------------------------------- |
-| Week 1             | Step 0–2: pipeline smoke + incident in Slack |
-| Week 2             | Step 3–4: proposal + board pack              |
-| Week 3             | Step 5–6: RTS + deploy + seed + QA           |
-| Jul 5              | Record video                                 |
-| Jul 10             | Freeze workspace, send invites               |
-| **Jul 13 5pm PDT** | **Release review package**                   |
+| When               | Milestone                                     |
+| ------------------ | --------------------------------------------- |
+| Week 1             | Step 0–2: pipeline smoke + incident in Slack  |
+| Week 2             | Step 3–5: proposal, board pack, status, draft |
+| Week 3             | Step 6–7: RTS + deploy + seed + QA            |
+| Jul 5              | Record video                                  |
+| Jul 10             | Freeze workspace, send invites                |
+| **Jul 13 5pm PDT** | **Release review package**                    |
 
 ---
 

Dockerfile

@@ -28,14 +28,16 @@ ENV NODE_ENV=production
 
 # Pinned Typst (same version/asset as CI).
 ARG TYPST_VERSION=0.14.2
+ARG TYPST_SHA256=a6044cbad2a954deb921167e257e120ac0a16b20339ec01121194ff9d394996d
 RUN apt-get update \
  && apt-get install -y --no-install-recommends curl xz-utils ca-certificates \
- && curl -fsSL "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz" \
-    | tar -xJ -C /tmp \
+ && curl -fsSL -o /tmp/typst.tar.xz "https://github.com/typst/typst/releases/download/v${TYPST_VERSION}/typst-x86_64-unknown-linux-musl.tar.xz" \
+ && echo "${TYPST_SHA256}  /tmp/typst.tar.xz" | sha256sum -c - \
+ && tar -xJf /tmp/typst.tar.xz -C /tmp \
  && mv /tmp/typst-x86_64-unknown-linux-musl/typst /usr/local/bin/typst \
  && chmod +x /usr/local/bin/typst \
  && apt-get purge -y curl xz-utils && apt-get autoremove -y \
- && rm -rf /var/lib/apt/lists/* /tmp/typst-* \
+ && rm -rf /var/lib/apt/lists/* /tmp/typst-* /tmp/typst.tar.xz \
  && typst --version
 
 # Production dependencies only.