FlowForge v1.2.31 — the founder's letter, October 2026

SHEET 1/1 · REV v1.2.31 · DATE 2026-10 · DRAWN BY Alex

Where it is in our power to act it is also in our power not to act.

— Aristotle, Nicomachean Ethics, III.5 (1113b; tr. W. D. Ross)

A press you can give is a press you can withhold. This release makes the press that changes production, or reaches the public, one that only you can give.

Hi,

When an agent needs you for a production change, a release or a letter, the step should stop with one row and one press. It should never reach you as a command to type. This release is about that. The cockpit now shows one chip, needs you · N, and F opens the list behind it. Each row says in plain words what it changes. One press approves it, and FlowForge's own process runs it, never an agent. On a Mac, a press that changes production or reaches the public is also signed with Touch ID. Start with the list.

Two more things from the week. An idle FlowForge host no longer spends GitHub's 5,000 calls an hour (#8608). And the one break reported to me this week is fixed: in Plan a Feature, a ratified brief hands off again (#8797). The hand-off check had been reading the page's render time as a claim, so a brief presented, ratified and polished in different minutes was always refused.

Please try three things: press F to open the needs-you list; open FlowForge Desktop once, so it enrolls your Touch ID key; and press S, then go to the Databases tab. Then quit and relaunch every open cockpit and FlowForge Desktop. Before you start, read Not yet at the end of this letter: three limits are open. If anything breaks, or simply reads wrong, reply and tell me. I read every one.

All the best,
Alex

THIS RELEASE, IN NUMBERS

This release, in numbers

109 pull requests

merged.

207,527 lines added

— code 102,804 · tests 83,685 · docs 21,038.

Delivery mix

— feature 53% · bug 21% · docs 14% (the three largest).

Merged in four days. You are the first to run it.

This is one part of a bigger week. Since 2026-10-09, 415 issues were closed across the project, and 292 commits landed on the 1.3.0 line. Those 292 commits ship with 1.3.0, not with this release. What 1.3.0 holds comes in its own letter.

Read the full release notes →

The cockpit's needs-you list, as its test draws it from fixture data. The header reads "⏸ needs you · 3 — A plan waits for you to read and ratify it. · F open". The card reads "⏸ Needs you · 3" and "3 things wait on you. Nothing runs until you choose." The selected row reads "▸ A plan waits for you to read and ratify it. Only you can ratify it. Your press is bound to the version on screen." with the keys "n Not now" and "a Read and ratify". Two more rows wait: "⏸ Your live database gets 8 changes from version 1.2.31." and "⏸ Allow FlowForge to read your Documents folder." One done row reads "✓ Approved on your desktop 2 min ago — Your live database gets 8 changes from version…". The footer reads "↑/↓ move between rows · esc, enter or F close".

One press for what only you may do

When an agent needs you, the cockpit shows needs you · N, and F opens the list. Each row says in plain words what it changes and what evidence it rests on. One press approves it: the evidence is read again at that press, the approval is bound to it, and FlowForge's own process runs the step. FlowForge Desktop shows the same list in the same words, and a press on either surface closes the row on both.

ALSO IN THIS RELEASE

Touch ID signs every production or public press

A drawing of the press, in five steps. Your press on your Mac. FlowForge Desktop asks for Touch ID. The Secure Enclave key signs the operation. The door checks the signature, before the approval and before every run. FlowForge's own process runs it. Under the drawing: "On Linux the press stays unsigned, and says so."

On a Mac, a press that changes production or reaches the public must carry a Touch ID signature from FlowForge Desktop's Secure Enclave key. The key never leaves the enclave, so no agent on the machine can produce one. The door checks the signature before it writes the approval, and again before every run under it. A signature copied onto another project, operation or version does not verify.

On Linux the press stays unsigned, as before, and says so on every surface.

ALSO IN THIS RELEASE

A door that refuses a known-bad plan

A needs-you row for a refused plan, as its test draws it from fixture data. "▸ Danger. The plan would replace your checkout's secret with a placeholder, which would stop every purchase. ACE is rebuilding the plan." Then "Your website's hosting changes: 1 new, 2 changed, 0 removed." Then "Only you can ratify it. Your press is bound to the version on screen." Then "This cannot be undone." Then "FlowForge won't offer this plan for approval. ACE is rebuilding it." The only key offered is "n Not now".

The database and the cloud are now reached through doors that plan, rehearse and read back. The platform door plans from a reviewed commit, summarises the plan in its own words, and refuses a known-bad change. The site stack refuses the plans that would break checkout. One press then applies exactly the plan you saw.

THE ROSTER

53 specialists: three changed

No agent was added or removed. Three definitions changed with the one-press doors.

`fft-dba`

fft-dba reads flowforge db owed to see how far a live database is behind the release line, rehearses a chain migration on CI's PostgreSQL 17 run, and prepares an owner-class set. Your one press lends the owner's right, FlowForge's own process applies the set, and fft-dba reads each member back. It still never holds the owner credential.

`fft-devops-agent`

fft-devops-agent plans through the platform door against stacks you registered with one press, and asks for exactly the plan it gated. It rotates a secret without seeing its value, and it leaves the verification to a different agent.

`fft-release-engineer`

fft-release-engineer prepares the promote as one press with its evidence, records the candidate rehearsal's verdict, and asks you to press "Update" instead of handing you a command.

AGENT PAIR SPOTLIGHT

The database pair: one plans, one operates

Two agents split the work on your data: one decides the model on paper, and the other is the only one that touches a live database.

`fft-database-architect`

fft-database-architect decides your data model on paper: which store, the tables and their indexes, who may read and write what, and the migration plan step by step with its way back. It writes the schema brief, and it never opens a connection.

`fft-dba`

fft-dba is the only agent that connects to a live database, and only through FlowForge's door. It rehearses a migration, reads production read-only, and reads every change back. It hands its report back to the architect, who judges it against the brief.

What changes:

• A new migration. Before: a plan on paper. After: fft-database-architect writes the schema brief, and fft-dba rehearses it on CI's PostgreSQL 17 run. A failed rehearsal exits non-zero.

• "How far behind is production?" Before: a question to chase by hand. After: flowforge db owed shows how far a live database is behind the release line, and a merged migration stays owed until a step names it.

• A change that needs the owner's right. Before: the right belongs to whoever holds the credential. After: your one press lends the owner's right once, FlowForge's own process applies the set, and a different agent reads each member back.

Ask ACE, or name fft-database-architect for the data model and fft-dba for anything that needs a running database.

DID YOU KNOW?

Connecting a database, from Settings

Connecting a database takes one tab. Press S on the cockpit to open Settings, then go to the Databases tab. On a narrow strip the tab reads "Data". Choose Connect a database, and the flow has three steps: where the database is, its sign-in, and a review.

In the sign-in step you give a user and password, paste a connection link, or use a sign-in already saved on your Mac. The password is typed in a masked field. The review ends in one press that records the read-only permission, and each database shows four facts: Listed, Sign-in saved, Reading allowed and Last check. Reading is all that press allows: changing data is switched off by default.

The cockpit's Databases tab, as its test draws it from fixture data. The Settings screen is titled "what the database assistant may read", with the tab strip ending in "Data". One database is listed: "production — Live database: read-only". Its facts read "Listed ✓ yes · Sign-in saved ✓ yes · Reading allowed ✗ no · Last check — not run yet", and the line below says "The sign-in for production is saved, but reading it hasn't been allowed yet." The selected button reads "Allow reading". Under it sits "+ Connect a database". The footer reads "↑/↓ move · Enter select · Tab switch tab · Esc back to tabs".

Once a database is connected and reading is allowed, fft-dba can work on it.

ONE SETUP STEP

Open FlowForge Desktop once on each Mac

A drawing of the press: your press on your Mac, FlowForge Desktop asking for Touch ID, the Secure Enclave key signing the operation, the door checking the signature before the approval and before every run, and FlowForge's own process running it. Under it: "On Linux the press stays unsigned, and says so."

After you update, open FlowForge Desktop once on each Mac, so it enrolls its Touch ID key. Until it does, a press that changes production or reaches the public waits on that machine and says why. The first key is pinned. flowforge presence status, and the presence row in flowforge doctor, say whether this machine is enrolled, pinned and backed by a Secure Enclave.

NOT YET

Not yet

A plain drawing of three open limits. One: a lost Touch ID key fails closed, and recovering it is not in this release (#8550). Two: GitLab cannot drive a project end to end yet (#6661). Three: team admin and team policy from the server wait on FlowForge's server (#8695, #8697).

A lost Touch ID key fails closed. If the pinned key is gone, as after a reinstalled Mac or on a new machine, production and public presses on that project are refused. Recovering the key is not in this release (#8550).

GitLab cannot drive a project end to end yet. This release lays the seam, the client, merge requests, checks and token custody. The contract probe is measured on GitHub and Gitea, not on GitLab (#6661).

Team admin and team policy from the server wait on FlowForge's server. The server changes are merged and are applied to FlowForge's production database as their own step. Until then, the app reads your machine's own settings, as in 1.2.30 (#8695, #8697).

HOW THIS LETTER REACHES YOU

How this letter reaches you

This letter comes out of FlowForge's own release pack: the same tooling keeps the release notes, the release page and this letter derived from one committed source. Release letters go to FlowForge accounts. The FlowForge Monthly is a separate letter, with its own page at flowforgesoft.com/newsletter.

Made with FlowForge — 109 PRs · 207,527 lines · 4 days.

Alex — FlowForge · alex@flowforgesoft.com

You are receiving this because you subscribed at flowforgesoft.com, or because you have a FlowForge account or subscription.

This is a marketing e-mail from FlowForgeSoft, LLC, 2810 N Church St STE 88527, Wilmington, DE 19802, USA. Contact: alex@flowforgesoft.com.

Unsubscribe in one click — no login needed, and the link keeps working for at least 60 days.

Read this letter on the web

Update: flowforge update → see how

FlowForge · v1.2.31 · sheet 1/1