Who are you? Pick one to get your briefing and actions.
Focus mode is on. Less relevant sections are hidden.
Why Forge, why now
Getting a simple internal site live today takes weeks of handoffs: a DNS ticket, certificate request, security review, hosting setup and monitoring onboarding. Each app team re-solves the same problem, differently.
Problem
Handoffs, tickets and bespoke setups make even static sites slow, inconsistent and hard to audit.
Objective
A governed path where pushing code produces a secured, monitored, rollback-able company URL in minutes.
Not in V1
No portal, no IDP or Backstage, no Kubernetes, no multi-cloud abstraction, no AI agent.
Business value
Fewer handoffs and tickets, inherited security, faster onboarding, measurable developer productivity.
Current state (estimates, pending the D11 baseline) vs V1 target across six delivery dimensions.
Platform strategy
GitHub is the common front door and Terraform is the source of truth. Runtimes sit underneath, chosen by workload requirements, not preference.
Cloudflare
Simple and edge
Static sites, internal portals, docs, light stateless APIs. Lowest friction and marginal cost.
V1Azure
Full enterprise
Private networking, containers, large relational DBs, enterprise integration, complex runtimes.
Later pathDatabricks
Data and AI
Pipelines, analytics, ML training and serving where lakehouse data gravity dominates.
Later path| Requirement | Cloudflare | Azure | Databricks |
|---|---|---|---|
| Static site / SPA | Best fit | Possible | No |
| Stateless API | Tier 2 | Yes | No |
| Private network / VNet | No | Best fit | Possible |
| Containers, long-running | No | Best fit | No |
| Large relational data | No | Best fit | Analytical |
| ML training / pipelines | No | Possible | Best fit |
Which runtime fits your workload?
Answer five questions to get a recommendation you can share.
V1 architecture
Solid boxes are built in V1. Dashed boxes are later tiers or other runtimes.
forge.yaml (V1, fixed schema)
name: team-docs
owner: team-platform-docs # GitHub team
runtime: cloudflare-static
build: { command: "npm run build", output: "dist" }
classification: internal # public | internalWhere portability ends
- Portable Static HTML/CSS/JS, build commands, forge.yaml
- Light coupling Pages config, headers file, Access policies
- Coupled Workers bindings (KV, D1, Durable Objects). Tier 2+, flagged in review
Escape path: the same build output deploys to Azure Static Web Apps by switching the runtime module.
| Automated by Terraform | In GitHub workflows | Stays centrally managed |
|---|---|---|
| Pages project, DNS record, headers, WAF rules, Access app (later) | Build, scan, plan, approve, apply, deploy, smoke test, rollback | Zone ownership, account settings, IdP config, token issuance, org policy |
V1 vs North Star
The Forge vision (portal, control plane, add-on catalogue) is the destination. V1 earns the right to build it with evidence.
| Capability | V1 (30 days) | North Star |
|---|
30-day plan
| ID | Item | Week | Owner | Validation |
|---|
Prerequisites & access
| Prerequisite | When | Owner | Validate by | Can block |
|---|
Access requests
| Stage | Request | Scope | Ask |
|---|
Discovery tracker
Unknowns are questions, not assumptions. Track answers here and export them as markdown.
Security & reliability baselines
Security
Reliability
Operating model & RACI
Platform owns the path
Template, module, workflow, DNS/TLS, baseline controls, path-wide incidents (P1).
App teams own the app
Code, content, app incidents, first-line response, using rollback.
Rollback
Redeploy the previous build via workflow dispatch or the Pages rollback API. Target under 5 minutes.
Signals
Synthetic uptime alerts go to the app owner, with platform copied on path failures. Logs go to the agreed destination (D6).
Your column is highlighted when a role is selected.
Measurement & Time to First Deploy
| Metric | Definition | Target |
|---|
TTFD calculator: where do the minutes go?
Cost & TCO
Indicative monthly cost for 20 static internal apps. Replace with contract data (D10).
| Option | Run / month | Ops toil | Notes |
|---|---|---|---|
| Cloudflare Pages (V1) | ~$0–25 | Low | Often inside existing contract; Access seats may apply |
| Azure Static Web Apps | ~$180 (Std) | Low–Med | Good escape path; Entra native |
| Azure App Service | ~$1,100+ | Medium | Over-provisioned for static |
| Status quo (bespoke) | Varies | High | Tickets and handoffs dominate cost |
Risk heatmap
Select a risk
Click a risk ID in the heatmap to see its mitigation, owner and trigger.
Objections & answers
Tell us whether each answer works for you. Shared concerns shape the plan.
Decisions (ADRs)
Proposed decisions. Record your position; concerns are routed to the ADR review.
Gates & expansion
Tick the evidence as it lands. The heat rail at the top follows these gates.
When to expand beyond static
| Tier | Trigger | Likely path |
|---|
Leadership demo
A rehearsal timer for the Day 25 demo. Press Start, then Next at each step to capture real timings.
Target: under 8 minutes end to end, measured live.
Your voice & sign-off
Support, conditions and concerns all move the plan. Your name is optional.