# Forge Ready

> Get a Jira or Confluence app through Atlassian Marketplace review. Paste your Forge app's manifest.yml (and the
> previous version's) and get scopes, egress, Connect leftovers, licensing and the major-version consequences checked
> against Atlassian Marketplace rules, then the submission plan or the fixes for a returned ticket.
> Built on the SkillSafe skill @samber/atlassian-marketplace-playbook, from samber/developer-platform-skills (MIT), by
> Samuel Berthe.
> Not affiliated with or endorsed by Atlassian.
> Scope: a vendor's Jira, Confluence or JSM app going through Atlassian Marketplace approval, or a listed app shipping a
> new version - not listing copy or search rank, not Forge code, not internal-only apps, not Bitbucket, Compass or
> Trello apps, not buyers vetting apps.

https://forge-ready.skillsafe.ai/

## What is free
- Parsing: manifest.yml as YAML (a careful subset - nested maps, lists of scalars and of maps, quoted strings, block scalars, comments, keys such as jira:issuePanel) or JSON, with the line number of every parse error: app.id, app.runtime, app.licensing.enabled, app.connect (key, remote, authentication), app.storage entities, modules (Forge and Connect), connectModules, resources, remotes (key, baseUrl, operations, auth, inScopeEUD), permissions.scopes, permissions.external.fetch backend and client (strings or address, category, inScopeEUD), permissions.content and providers.auth.
- The scope table: every scope with its kind from a fixed set, classed by syntax only - classic (read:jira-work), granular (read:issue:jira), Connect (read:connect-jira), Rovo (read:chat:rovo), app storage and data (storage:app, report:personal-data), admin (manage:*) or other - and its feature note or "needs a feature note".
- The egress list with wildcards ("*", "*.domain") and inScopeEUD flags, the remotes and the auth providers.
- The checks, each with an id, the skill's rule and pass, fix, fail, note or n/a: connect_only (rule 1); connect_leftovers and first_forge_version (Connect migration); payment_vendor and free_value (rule 2); revenue_licensing and licensing_free (rule 3); api_tokens (rule 6); scope_features and broad_scopes (scopes against features); egress_wildcard and egress_eud (egress); major_version (rule 5); app_name; ecohelp, kyc, questionnaire, privacy_policy, end_user_terms, dpa and test_credentials (prerequisites - fail when "no" once submitted or returned, a fix earlier); residency_egress and security_review (buyers); timeline; upkeep (listed apps).
- The major-version diff against the previous manifest: every added scope, egress domain, remote or auth provider, an inScopeEUD false -> true flip, a changed egress category, a changed or removed auth provider and a licensing toggle is a major; removing egress is minor; removing a scope is still major; a moved remote baseUrl counts as new egress; removing a remote is left unclassified. When the previous manifest carries app.connect.key, a moved Connect baseUrl, a changed auth provider or a licensing toggle fails the first-Forge-version rule.
- The architecture ladder (Forge UI + remotes > 3LO listing, moved only when the manifest declares no UI module and buyers run no security review), the payment resolution (Free for a connector, Paid via Atlassian for revenue from the app itself, the grace-period rule for an app already listed Free) and the trust ladder (Privacy & Security tab > bug bounty > AEC, AEC promoted when buyers run a vendor security review), each naming the answer that moved it.
- The review timeline counted from today by the browser clock: three weeks per round† plus one returned round, or 5-10 business days† for a listed app's major; a launch before the planned approval is flagged.
- Exports: the scope and egress table (.csv, its justification column filled from a plan reply when one exists), the checks (.csv), the major-version change list with a release-notes draft for site admins (.md), everything (.json), and the fixed manifest (manifest.fixed.yml or .json, in the format pasted): licensing enabled when revenue_licensing fails; from a plan result it also removes the scopes the plan drops and replaces a wildcard egress only with concrete domains the plan names that the input already contains - it never invents a domain.
- Saved apps keep a compact snapshot of the checks: reopening one, or pasting an app of the same name, shows what changed since it was saved (checks fixed, checks newly failing, scopes and egress removed or added, the fail count). "Mark as resubmitted" logs the date and whether it went in as a major; the next fixes run then carries the previous round's fixes with the plan.
- Every Atlassian figure the skill quotes carries a dagger: 31 Jan 2027†, 5-10 business days†, 10 times monthly†, 60 days†, 83%†, 75%†, 100% until $1M lifetime Forge revenue†, three weeks per round† (one week to 15 business days†), Critical 10 days†, High 4 weeks†, 15 days†, 90 days†, 24 hours†, 18 months†. † verify against current Atlassian developer docs, because Atlassian changed its framework, badge and revenue-share rules within one year.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (plan or fixes), `app`, `manifest`, `previous` (the previous manifest as read, or empty), `features`, `ticket` (fixes only: the returned ticket text), `carry` (fixes only: the plan's decision, scope table, egress and fixes, plus the previous round's fixes once a resubmission is logged) and `facts`.
- `plan` replies with `summary`, `decision` (`architecture` forge_remotes or oauth_3lo, `payment` free or pva, `why`), `scopes` (`scope`, `justification`, `action` keep or drop), `egress` (`address`, `inScopeEUD`, `why`), `irreversibles` (`item` framework, payment model, licensing, scopes, egress or app name, `decision`, `owner`, `by`), `fixes` (`check`, `change`), `timeline` (`step`, `wait`), `footnote` and `caveats`.
- `fixes` replies with `summary`, `points` (`n`, `ticket`, `fix`, `check`), `resubmit` (`major` true or false, `effect`, `when`), `reply`, `footnote` and `caveats`.
A reply stays on the page when the form changes after it ran, under an out-of-date banner, and its downloads and copies keep working; the plan's scope table copies one bare justification per row, and the fixes export a resubmission checklist (.md).
The page holds every reply to its own facts: the plan keeps the page's architecture and payment model (a moved decision is put back), gives every manifest scope and every declared egress address exactly one row and invents none, writes "needs a feature note" for a scope with no note, never repeats one justification for two scopes, covers all six irreversibles with an owner and no invented date, and carries every fail check as a fix; the fixes answer at least as many points as the ticket numbers, keep the page's major-version verdict when both manifests are pasted, and answer the reviewer in numbered lines that never argue and never ask to expedite; both carry the dagger on every Atlassian figure, the footnote, no URL with a scheme, no backticks and no implied Atlassian endorsement.

## Links
- API tutorial: https://forge-ready.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/atlassian-marketplace-playbook
- Source repository: https://github.com/samber/developer-platform-skills