Engineering practice
How ForgeIEC is built — with gates every change has to pass and tests that check the shipped package. Every number on this page states when it was measured and where it comes from.
- 13quality gates per changetongs-core,
tools/qm.sh, counted 2026-10-22 - ≈ 96 %line coverage, gate at 90 %tongs-core,
cargo llvm-cov, measured 2026-10-22 - 5dependent repositories built on every pushbackward check,
.forgejo/workflows/qm.yml, 2026-10-22 - 18 + 10package slots in the Linux CI (runtime + Studio)
linux.ymlof anvil and the Studio, counted 2026-10-22
Thirteen gates, the same locally and in CI
The script tools/qm.sh in the core repository tongs-core runs every gate — on the developer's machine exactly as in CI on every push and pull request. All gates run; a red one does not hide the others. Whoever changes a gate changes it in the script, not in the workflow.
| Gate | What it checks |
|---|---|
| format | uniform formatting (cargo fmt --all --check) |
| clippy | static analysis, every warning is an error (-D warnings) |
| tests | all tests of the workspace with all features |
| docs | the API documentation builds, warnings are errors |
| deploy | deploy.sh and deploy.fish equal their templates |
| machete | no unused dependency |
| unsafe | every crate forbids unsafe; only the Anvil module of tongs-runtime may use it; plus a cargo geiger report |
| lock | all iceoryx2 packages in Cargo.lock have one version |
| audit | known vulnerabilities (RustSec); vulnerabilities fail |
| deny | licences, duplicate versions and sources of the dependencies (deny.toml) |
| msrv | the code builds with the promised minimum Rust version (1.88) |
| abdeckung | line coverage at least 90 % (cargo llvm-cov) |
| rueckwaerts | every Tongs (bus bridge) still builds against the new state of the core |
Source: tongs-core/tools/qm.sh and README.md, as of 2026-10-22. The two German gate names (coverage, backward) are the names in the script. The tools have pinned versions and come pre-installed in a container image in CI.
A change to the core breaks nothing silently
Five bus bridges build on tongs-core: Modbus TCP, Modbus RTU, EtherCAT, EtherNet/IP and PROFIBUS — each in its own repository. The core’s CI fetches all five and builds them against the state of the run (cargo check --locked). A broken API shows up in the core’s pull request, not days later in the next run of a bridge.
Checking that the tests check something
Coverage only says which lines a test touches. Mutation tests (cargo mutants) change the code on purpose and see whether a test notices. They are too slow for every push — about 1,400 mutants in the workspace — so they run weekly in the night to Sunday and by hand, as a report, not a gate.
Source: tongs-core/.forgejo/workflows/qm-nightly.yml, as of 2026-10-22.
What is tested is what is shipped
Unit tests check the code in the tree. The system test tools/system-test.sh checks the installed package: it starts the Anvil server (anvild) from the latest package of the apt repository with an example Tongs — isolated, with its own registry, storage and port, without touching a running service of the machine.
It checks that the master assigns an address, the Tongs comes online, a protocol without a binary is reported, status and process data follow the simulation — and that the Tongs ends by itself when the Anvil server is killed.
Example · tongs-core issue #26
A Tongs lived on after anvild was killed
- Found
- by the system test: after
kill -KILLof the Anvil server the Tongs process ran on for 15 seconds and more — without a bus. - Cause
- The log went through a pipe to the Anvil server. With the server gone the pipe was broken; the log line before terminating failed, and the task that should have ended the process died with it.
- Fix
- Act first, then log; a broken pipe is ignored.
- Since then
- the system test is its regression test. Issue closed.
Rules that carry the project
A project of this size stays manageable only if every decision can be found — also by someone who joins later.
Specifications with evidence
Protocols and models live in versioned papers (e.g. tongs-bus-v1, tongs-parameter-v1, diag-model-v1). Where the code differs, the measured state decides; the paper gets a corrections banner at the top and a correction note in place.
Audits with a finding format
Reviews of papers, contracts and architecture decisions follow a fixed format: fact (measured, with the command), assumption, impact and what is not the cause. A review on paper alone is not enough.
The wiki is the entry point
New developers start with the page “Architecture” of the core wiki: processes, repositories, the crate dependency tree, types and “Where do I change what?”. The wiki describes the current state only, without history.
English in code and process
Comments, commit messages, issues and wiki pages are in English, so that every developer can follow. The website is available in German and English.
One rule, one place
Every rule is written down exactly once: a quality gate is changed in qm.sh, not in the CI workflow; the licence boundary lives in LICENSING.md; tool versions in a single file.
Commits with reasons, bugs as issues
One commit per change, with the why in the message. Every bug found on the way becomes an issue at once — even if it is not fixed right away. Open on 2026-10-22: 65 issues in the Studio, 21 in anvil, 40 in hearth-studio, 3 in tongs-core.
Signed packages from an automated CI
The runtime (anvil) is built in 18 slots: Debian 12 and 13, Ubuntu 22.04 and 24.04, each for amd64, aarch64 and armhf, plus AlmaLinux, Rocky Linux and RHEL 8 and 9 for amd64. The Studio in 10 slots: Debian 12 and 13, Ubuntu 24.04, AlmaLinux 9 and Fedora 44, each for amd64 and aarch64. Packaged as .deb and .rpm.
The packages are signed and published to apt.forgeiec.io and rpm.forgeiec.io — see Download for installation. The Studio also has a Windows CI with its own Windows runner and an Inno Setup installer.
Source: .forgejo/workflows/linux.yml and windows.yml of anvil and the Studio, counted 2026-10-22.
Documented, not just claimed
For the EU Cyber Resilience Act (CRA) there is a public security page with a security.txt per RFC 9116 and a coordinated vulnerability disclosure policy.
The licence situation is measured: a provenance audit of 2026-10-22 checked 2,618 files line by line with git blame and records where the code comes from. On the Rust side the deny gate checks the licence of every dependency on every push.
Developed with AI assistance — and checked by measurement
ForgeIEC is developed with AI tools, and the history says so openly: most commits carry a Co-Authored-By line. In the Studio repository that is 91 % of the author’s own commits (1,821 of 1,999 commits by the author on the branch development since 2026-02-28, merges included; measured on 2026-10-22).
The author sets the direction, decides, and checks by measurement: quality gates, audits, system tests and reports with sources. What an AI tool contributes is treated like any other contribution — it has to pass the same gates.
More about the developer
Who is behind ForgeIEC and what kind of role he is looking for.