One crypto world. Mine it, hold it, forge it, trade it, sell it, play in it, predict on it, and build on it.

Almost every consumer crypto platform is an exchange with features bolted on. CloudsForge is the inverse: a set of things worth doing, funded by a currency you can produce yourself on a laptop, with the account, the wallet and the ledger shared across all of them.

The loop is the product. A CPU-mineable coin that is the actual funding rail for real products is the thing no one else can tell.

   mine EMBER on your own CPU            Hearth — Homefire PoW, no farms, no pools
              │
              ▼
   deposit into your wallet              custody mints the key, the indexer confirms it
              │
              ▼
   hold, convert, or reserve             one ledger, double-entry, one portfolio
              │
              ├──► forge a token or a brand      Forge Create
              ├──► run a strategy                Forge Trade
              ├──► play, earn, own               Forge Worlds
              ├──► sell it, buy someone else's   Forge Market
              ├──► stake on what happens next    Forge Foresight
              └──► build on all of it            Developer Platform
              │
              ▼
   withdraw back out on-chain, or to     one activity history, one set of
   your own external wallet              notifications

That last arrow is not decoration. A user can always leave with their assets is a stated principle, not a feature: private-key access for a wallet you own is a product requirement. The safeguards are ours to design; the right is not ours to withhold.

Everything else is spine — identity, the ledger, custody, the indexer, policy, activity, notifications, billing, the gateway, Lantern and Beacon. Spine never appears in a product grid as a peer, because an account is not something a person chooses; it is something they are given.

The test is not whether the products share a logo. It is whether these hold. This is the same scorecard the engineering log keeps, reproduced rather than summarised.

Three of these were true when the programme started.

Refusals, not gaps on a roadmap.

• We are not an exchange. No order book, no market making, no custody of anyone else's trading pairs. The other side of that line is a different company with a different regulatory posture.
• A game never sells an advantage. Cosmetics and seasons are entitlements. No creature is a token, and nothing you buy changes a stat.
• Product analytics is ours and pseudonymous by construction, never a third-party tag. Our frontend CI fails the build if a Google, Segment, Hotjar or Mixpanel tag appears in a bundle.
• No service holds money. Value moves as a double-entry ledger posting, and the ledger's database refuses an unbalanced journal — not the service, the database, so it holds even against a caller with a connection.

One repository per deployable, each with its own database and no access to anybody else's. Services talk over HTTP typed by published contracts, and events go Postgres outbox → signed HTTP → inbox. There is no message broker and no shared schema.

Every repository runs the same reusable CI: typecheck, its own suite against a real Postgres — a suite that skips its database tests fails the build — the estate rules that repository walls used to enforce for free, a container that must boot and answer /livez, and a secret-hygiene sweep.

The engineering log is public to the people who work here: twenty documents covering the architecture and security decisions, the domain model, the testing strategy, and a build ledger that records what is actually true rather than what was planned — including the defects found on the way and the ones deliberately left open.

One repository per deployable. Each service owns exactly one database and reads no other — the answer to needing another service's data is an HTTP call typed by a published contract, never a second connection string, and CI greps for that.

Every micro- link below is internal. Those repositories are private, so they open for members of this organisation and 404 for everybody else — the 404 means "not yours to read", not "not there". The public ones are hearth and the predecessors at the bottom.

A title is not a product. It registers with micro-worlds, shares one player profile, and sells nothing but cosmetics and seasons.

Customer-facing, but not products — the vision document is explicit that an account is not something a person chooses, and that Forge Pay stopped being a destination because nobody wakes up wanting to visit a payments product.

Never a product, and never in a product grid as a peer.

These do not exist yet — the links above are to repositories that do.

micro-mint-web, micro-trade-web, micro-worlds-web, micro-explorer-web, micro-network-site, micro-devportal-web.

platform, forge-pay, forge-keyvault, forge-mint, crucible, ninety-days-after, shared-libs, asset-forge, stack. Nothing was deleted, archived or renamed. They remain deployable and are the rollback target; the estate above was built beside them.

Hearth is money, and a consensus bug is not a defect report — it is a loss of funds. The disclosure policy lives with the chain: SECURITY.md. It covers the whole estate, not only the node.

Please report privately and give us time to fix it. Do not open a public issue for anything touching consensus, custody, the ledger, or authentication.

What we have already decided, so you know what you are looking at:

• The custody service has no key-reveal endpoint. Not guarded — deleted. There is no authenticated path to a private key.
• Signing shapes are closed. A custody key may produce a value transfer or a contract creation and nothing else; widening that would make the key a signing oracle.
• Money invariants live in the database. The ledger's deferred constraint refuses an unbalanced journal against a caller holding a connection, not merely against a caller using the service.
• The first admin is a manual database update, deliberately. A service that can mint its own first administrator is a service whose compromise grants the estate.

TypeScript on Node 22, ESM, strict — noUncheckedIndexedAccess and exactOptionalPropertyTypes everywhere. Postgres per service. node:test and nothing else. React 19 and Vite for the frontends, nginx for serving them, Traefik at the edge, and OpenTelemetry into Prometheus, Tempo, Loki and Grafana.

No message broker. No shared database. No ORM. Money is bigint; a float anywhere near an amount is a defect.

• The chain — hearth is public and is where the interesting cryptography is.
• The reasoning — micro-docs carries the architecture and security decisions with the alternatives that were rejected, and a build ledger recording the defects found on the way, including the ones deliberately left open.
• The shape of a service — micro-service-template is a working skeleton; every service is cut from it.

Pre-launch, and honest about it. Forty-eight repositories are built and tested — 383 test files, every service suite running against a real Postgres and failing the build if it skips them. Hearth runs on a testnet.

Forty-seven are green in CI. micro-sdk is red: a check that compares the OpenAPI description against the gateway's route map reads that map out of micro-deploy, and its workflow does not check that repository out as a sibling. The check is right and the workflow is wrong; it is being fixed rather than weakened. Red runs are never deleted here — the history of what failed is the only evidence that a suite ever had teeth.

Nothing is serving the public yet, and almost nothing is deployed. Two services have been run together against a real database to prove the seams; the rest exist as code that passes its own tests. Where a product page says a capability is in build, it means exactly that.

Most repositories are private while the estate settles. Hearth is public, takes outside contributors, and is where the interesting cryptography lives; the developer SDK becomes public with the API it describes.

Nothing here promises a return. Backtests describe the past. Mining yields depend on difficulty. A parimutuel payout depends on the pool at settlement. A coin with no mainnet has no price.