Outagesdon’tstart
wherethey hurt.
Checkout pages at 4 seconds. The cause was a connection pool three services upstream, eleven minutes earlier. Forge maps that chain the first time it happens — and recognises it the next time, before the page fires.
no agent to install · one webhook · 5-minute setup
Forty seconds, end to end.
From the alert firing to a written root cause — and to the memory that makes the next one shorter. No agent, no query language, no dashboard to babysit.
- t+0ms01
A signal arrives
Datadog, Sentry, a cron job with curl — anything that can POST JSON hits one signed endpoint. Nothing is deployed inside your cluster.
POST /ingest · 202 accepted - t+40ms02
Triage decides
The signal is scored, deduplicated against what's already open, and either escalated or suppressed. Suppressed does not mean deleted — every call stays on the record, labelled and reversible.
1,247 in · 3 escalated - t+38s03
The analysis is written
Forge walks the dependency graph backwards from the symptom, reads the evidence, and writes a causal chain with a severity call and a confidence number attached.
root cause · 91% confidence - after04
It becomes memory
The cascade strengthens your topology, the fix that worked is promoted in the runbook ranking, and the write-up is embedded for the copilot to cite. The next occurrence starts from here.
graph +1 edge · runbook rescored
Most of what pages you is not an incident.
Forge scores every signal on arrival, collapses the duplicates and opens an incident only for what survives. The suppressed ones are not deleted — they stay on the record, labelled and reviewable, because a filter nobody can inspect is a filter nobody can trust.
Every bar is a real signal. The three lit ones became incidents; the rest are one click away in the suppression audit.
Checkout latency above 4s at p99
A root cause you can argue with.
Every incident gets a written analysis: the causal chain, a severity call, and a confidence score attached to it. When Forge is unsure it says so, in a number — because a verdict you cannot challenge is worth less at 3am than an honest maybe.
The part that compounds.
Any tool can tell you something broke. What makes the second year quieter than the first is a system that remembers every failure it has already explained.
Topology
Failures are edges, not dots. Every cascade Forge sees strengthens the graph, until the single point of failure in your estate is something you can point at on a screen.
Knowledge
Runbooks, architecture notes and post-mortems — chunked, embedded, reranked. The copilot answers from your own documents, and cites which one.
Runbooks
Remediation steps scored and deduplicated across every analysis, so the fix that actually worked last time is the one at the top of the list.
Your telemetry is the most sensitive thing you own.
Forge is built to be trusted with production logs by teams who are not allowed to hand them over.
Evidence stays encrypted
Sensitive logs can be uploaded as TFHE ciphertext and scored homomorphically. The server never holds the plaintext — not in memory, not at rest.
Signed ingest, rotatable
Every payload carries an HMAC signature. Keys are scoped per organisation and rotate from the dashboard without redeploying anything.
Role-scoped access
Credentials, member management and destructive actions sit behind explicit role ranks, enforced server-side rather than hidden in the UI.
Nothing dropped silently
Every suppressed signal keeps its score and its reason. The triage threshold is calibrated against labelled outcomes you can audit and disagree with.
One endpoint. No agent.
Point anything that can POST JSON at a single signed URL — your existing alerting, a Lambda, a cron job with curl. Forge takes it from there. Nothing to deploy inside your cluster.
curl -X POST https://api.forge.dev/ingest \-H 'x-forge-signature: $FORGE_KEY' \-d '{"source": "datadog","service": "checkout-web","message": "p99 latency 4.2s","severity": "warning"}'
Your next outage is already in the graph.
Connect one alert source. Forge starts learning your failure modes on the very first incident.