Personal Project2026
Forma
AI-Native Delivery Platform · Personal Project
A software-delivery platform designed for the AI-agent era: describe what you want to build and get a real, runnable repository with generated Codex and Claude Code harnesses, then keep working inside a native project-management workspace — work items, dependencies, milestones, delivery health — that stays connected to those same agents over MCP for the life of the project. Designed and built solo, from the deterministic scaffold engine through the MCP agent channel.
Next.js
TypeScript
Fastify
PostgreSQL
Zod
MCP
OpenAI
Turborepo
Cloudflare R2Product Walkthrough
Plan, Board, and Work Detail Over One Canon
Planning stays in one surface: a readable List for capture, a status-led Board for movement, and a Roadmap that groups milestones and a dense timeline. Opening a work item slides a full-height detail panel in from the right — type, hierarchy, milestone, estimate, dates, assignees, dependencies, links, and comments — so the plan stays visible as context instead of being replaced by a separate issue page.
MCP Agent Channel
The standout piece: every generated repository can connect Codex or Claude Code directly back to its live Forma project — not a static export, an ongoing channel.
Scoped, Revocable Access
One token, one project, nothing else
Generated repositories connect back to their Forma project with a personal, project-scoped MCP token. Every tool call re-checks live project membership against the token on every request rather than trusting a cached snapshot, and no tool argument can reach another project.
Direct or Reviewed
Write mode decides how much an agent can touch
A token in direct mode lets an agent update work items through the same service the REST API uses. A token in suggest mode routes every change through a separate proposal table instead. A human has to accept it before it touches real state.
Rendered Views on Capable Hosts
MCP Apps views for the tools that need them
The work-item inspector, board snapshot, and delivery-health tools render as interactive views on MCP Apps-capable hosts instead of plain text, while the same server transparently serves both the current MCP protocol and the legacy 2025 spec from one endpoint.
Deterministic by Design
No LLM-Authored Code
The same spec always compiles the same way
Scaffold code comes from a versioned recipe and module system, not a language model: the same project specification always compiles to the same repository. AI is only ever used for optional, explicitly reviewed documentation drafts, never for the code itself.
Vendor-Neutral Harnesses
One role model, two compiled outputs
A canonical role, policy, and skill model compiles into a Codex AGENTS.md or a Claude Code CLAUDE.md, settings, commands, skills, and hooks, so switching which coding agent a team uses doesn't mean redoing the project's guardrails.
Project Management
A Forma project is the container for the whole delivery lifecycle, not just a repository request — so the planning side is a real product, not a placeholder. It runs a fixed workflow (backlog, ready, in progress, in review, done) where blocked is deliberately not a status but an orthogonal condition derived from unresolved dependencies or an explicit reason, so an item can stay honestly in progress while visibly stuck. Repository preparation and delivery state are two independent lifecycles, and what a member is responsible for is modelled separately from what they are permitted to do: functional roles never silently grant access.
A Real Jira Alternative
Backlog, board, and timeline over one canon
Work items, hierarchy, milestones, and dependencies — with cycle prevention — live as framework-free domain rules, projected into five views (backlog, list, Kanban, milestones, timeline) that all read the same underlying entities instead of drifting apart.
Progress Is Derived, Never Typed In
Nobody maintains a percentage by hand
Only done work counts as complete and cancelled work is excluded, so an item in progress never gets translated into an invented percentage. A milestone uses points when every assigned item is estimated and item count otherwise, and says which calculation it used.
GitHub Activity as Proof
GitHub activity becomes a reviewable suggestion
A GitHub App installation pushes the generated scaffold, syncs repository metadata, and turns matching pull-request and commit evidence into a work-status suggestion, never an automatic transition. A person still has to accept it.
Specific Reasons Behind Every Status
Delivery health that says why
Blocked, overdue, unowned, unscheduled, and in-review states are derived and orthogonal to workflow status, so a project's health reads as specific reasons instead of a single opaque score.
Skills and Hooks
Instruction files tell a coding agent what the project is. Skills tell it how to carry out a specific kind of task, and hooks decide what it may do while it does — both compiled from the same canonical harness model into whichever vendor the project selected.
Deterministic Skill Selection
A scaffold only gets the workflows it can use
Every repository starts from a universal workflow baseline — change planning, implement-and-test, root-cause debugging, review, secure engineering, validate-and-handoff — and the resolver then attaches capability skills from the actual modules: accessibility and performance for frontends, API contracts for services, database-change for Postgres, browser E2E only when Playwright is on. A React-only scaffold never receives database workflows.
Written for Implicit Discovery
Skills that the agent finds on its own
Each skill renders from one body into both .agents/skills and .claude/skills, and its description front-loads trigger language because Codex and Claude Code rank on that metadata before ever loading the body. Harness tests hold a static trigger contract over representative prompts so a reworded description can't quietly stop matching.
The Guarded Hook Profile
Policy that runs before the model does
Opting into guarded emits Node policy scripts wired into both vendors' lifecycles: a prompt gate that blocks likely credentials without ever echoing the detected value, a read guard over env files and private keys that still allows .env.example, and one operation policy covering destructive commands, dependency changes, and protected paths. Overriding it takes a human-created, digest-only approval that expires in 15 minutes and is consumed by a single retry.
Honest About the Limit
Developer guardrails, not enforcement
Hooks can be disabled, time out, or fail open in the host, and pattern detection both misses unknown formats and produces false positives. The generated policy file states this plainly: real enforcement still belongs to CI, server-side secret handling, branch protection, and repository secret scanning.
Sessions and Handoff
A coding-agent session is usually the one part of delivery that leaves no trace: the work lands, the reasoning evaporates. Forma records the coordination around that session — what it set out to do, what context it started from, and what it handed over — without hosting or recording the conversation itself.
Prepared Before the Agent Opens
Context is versioned, not pasted
An engineer prepares a session in Forma first. A schema-versioned launch manifest captures project identity and delivery state, the linked work item, approved document versions, and up to five recent handoff references, then hands back a token-free launch command that passes only a session ID into the coding-agent process.
A Lifecycle That Admits Interruption
Stopping isn't the same as finishing
Sessions move through prepared, active, interrupted, completed, and abandoned. SessionStart activates the record and asks the agent to load its context; SessionEnd marks unfinished work interrupted and never infers completion; the stop hook runs the project's validation sequence and asks for an explicit handoff, honoring stop_hook_active so it can't loop.
Summary-Only by Contract
There is no field for the raw prompt
The request trail stores short semantic intents; the contract has no raw-prompt field at all. Transcripts, hidden reasoning, credentials, and large code or terminal excerpts are excluded by policy, the prompt hook ignores the transcript path entirely, and a session can turn the trail off with the domain service enforcing that choice.
Beyond the Session
Agents that remember the last handoff
Completed handoffs and checkpoints become searchable project memory, so the next Codex or Claude Code session opens with the last one's conclusions instead of a cold start — and an engineer can read the trail in a dedicated Memory route. The whole path stays best-effort by design: a missing token or an unreachable Forma deployment never blocks the local agent.
