Every change to production is one press, and an override waits for a person. 74 pull requests merged since 1.2.31. This release finishes what 1.2.31 started. Settings ▸ Databases now offers the changes switch and the owner sign-in as presses. A one-time data write shows its counts before you approve it. When you upgrade, the old needs-you items move onto their presses. An override at a merge is refused when a Claude Code session is above it, and a specialist's FAIL holds the merge. An epic runs on Waves like a sprint. A spent GitHub budget says so in one line. A Jira project's sprints reach FlowForge (not yet read on a live site). An interrupted update can no longer lock you out of your records. What is not done yet is listed at the end.
FlowForge
Releases
Releases
Every shipped version of FlowForge, newest first — what changed, when, and how much.
-
-
One press for what only a person may do, signed with Touch ID. 109 pull requests merged since 1.2.30. When an agent needs you, for a production change, a release or a letter, the cockpit now shows one chip,
needs you · N, and one key opens the list. Each row says in plain words what it changes and what evidence it rests on; one press approves it, and FlowForge's own process runs it, never an agent and never you at a terminal. On a Mac, a press that changes production or reaches the public is signed by FlowForge Desktop's Secure Enclave key and asks for Touch ID. The database and the cloud are reached through doors that plan, rehearse and read back. A GitHub host left idle no longer spends its hourly allowance. The groundwork for GitLab is in place, and team settings can come from your company's server. A brief ratified in Plan a Feature hands off again. What is not done yet is listed at the end. -
Numbers that say what they know, and Waves that fills every free slot. 113 pull requests merged since 1.2.29. The Stats screen is rebuilt. It puts your hours at the desk beside the hours your sessions delivered, shows this month's AI cost with how many sessions that figure covers, gives your hours by project, and says when GitHub was last read. A day FlowForge could not read now says so instead of drawing a zero. Time that no work backs is no longer billed: a session a machine closed bills to its last real event plus two minutes, and a closed session can no longer record more time than its own span. A Waves run now refills its slots as workers finish, a waiting sprint shows its plan, and an epic opens its own board across every sprint. On a busy machine, workers now leave the CPU to you first. The roster grows to 53 with
fft-lifecycle-marketer. What is not done yet is listed at the end, including the one 1.2.29 said this release would fix. -
Start, queue and run sprints side by side, from the cockpit. 95 pull requests merged, and this section covers all of them. On 1.2.28 the way to start a sprint as waves was on no screen, queueing from the cockpit did not work, a second start was refused without a word, back threw you out of Waves, and the waves widget counted only merged tickets and grew with every run. In 1.2.29 you can start a sprint as waves, queue one, or run a second beside the first: from the War Room, from Waves, or by telling ACE. Every Waves screen shows the next step, and when a key is refused, it says why and what to do, in place. Back takes you back. The waves widget shows what each run on it is doing, with the same symbols for one run or many, and turns its page instead of growing. Help on Waves and in the War Room is one short table of that screen's keys, and ACE can now stop or pause a run you name.
Fon a run fires its next wave now. The War Room and the Gantt lead with what is past due, each sprint's pace and how many tickets it closes a day. Keys that moved are listed at the end of the first section, each as what now works. The roster stays at 52; one specialist changed. What is not done yet is listed at the end, with the one limit the last check of this release found on the built binary. -
Ratify where you are, and let finished work close itself. 93 pull requests merged, and this section covers all of them. Every ratify door now completes a ratification where you are: the desktop preview, the cockpit's merge pop-up and ACE's rail. The Documents drawer shows a ratification wherever it was made. A sprint and its epic close themselves when their last ticket closes, however it was closed. You can connect a database and allow the database assistant to read it inside the product: three short steps and one press, with no terminal. The Workers pane stops calling a busy fleet blocked. Waves becomes a screen you can find: it is the first screen, one key from the War Room, with the queue's order and width on its face. The briefing module ships too. Before a play builds anything, it interviews you, drafts what it heard, and builds only on what you ratify. The roster stays at 52, and three specialists are re-cut. What needs one step from you, and what is not done yet, are listed at the end.
-
More work in flight, and a cockpit that tells you only what needs you. 323 pull requests merged in ten days, and this section covers all of them. Waves stop being one at a time — you choose how many run side by side, queue the rest, give an entry a start time, and the queue keeps moving with no cockpit open. ACE reads one recap of the whole fleet, and the actors behind it now deliver a review's findings and nudge a quiet worker by themselves. The Fleet screen and the Workers queue are rebuilt on one shared reading of every worker, with a legend for every symbol. The War Room's board tells the truth again and reads only what you ask for. Eight new specialists join the roster (44 → 52), and the first opt-in pack ships. Windows is supported through WSL2, the sign-in gets you in, and two weeks of one customer's field report are fixed, finding by finding. This is also the release we first built as v1.2.26 — that build's Linux desktop AppImage job died on a SIGPIPE in the release workflow, so it was tagged but never promoted; no tester has it. The fix below ships Linux and Windows staged, which is why this is v1.2.27, not a v1.2.26 promote. What needs one step from you, and what is not done yet, are stated plainly at the end.
-
More work in flight, and a cockpit that tells you only what needs you. 323 pull requests merged in ten days, and this section covers all of them. Waves stop being one at a time — you choose how many run side by side, queue the rest, give an entry a start time, and the queue keeps moving with no cockpit open. ACE reads one recap of the whole fleet, and the actors behind it now deliver a review's findings and nudge a quiet worker by themselves. The Fleet screen and the Workers queue are rebuilt on one shared reading of every worker, with a legend for every symbol. The War Room's board tells the truth again and reads only what you ask for. Eight new specialists join the roster (44 → 52), and the first opt-in pack ships. Windows is supported through WSL2, the sign-in gets you in, and two weeks of one customer's field report are fixed, finding by finding. What needs one step from you, and what is not done yet, are stated plainly at the end.
-
Sign in, update and repair without a terminal. A new customer could sign in to FlowForge, open the cockpit, spawn a worker — and watch it stop on a Claude Code sign-in screen whose only fix was a command typed into a terminal the desktop app does not have. An update signed you out of your own seat because the machine's fingerprint rode a hostname macOS rewrites. The cockpit's sign-in screen could render with no Email and no Password field. And
flowforge updatereturned the moment the versions matched, so the repair everyone reaches for never ran. Each of those is fixed here, along with the cockpit faults of the week: your own keystrokes painted on the ACE rail header, typing that got slower every hour, an idle cockpit burning CPU, and 522 dead processes nobody cleaned up. What needs one step from you, and what is not fixed yet, are each stated plainly below. -
The stability release. One cockpit killed and respawned the shared daemon every six to fourteen seconds, printed each kill over its own screen, and never reaped what it killed — until 5,242 dead processes filled the per-user process table. Opening ACE's inspection window started a second live ACE on the same conversation, and the two acted as controller side by side for hours. A binary promoted minutes earlier read "commits behind — cut a release". The site deploy cried "CHECKOUT IS DEAD" on every push to
mainwhile checkout was healthy. A GitHub hiccup at merge time read as a refusal only a human could clear. Six finished tickets drew as empty epics at 0%. Every one of those was hit in production in the last two days, and each is closed here. There is no new feature in this release, by design. What needs one step from you, and what is not fixed yet, are each stated plainly below. -
The release where FlowForge stops re-doing work it already finished. A ticket merged, and fifteen seconds later the pipeline spawned a new worker for it and started its timer — three times in two days. A review voided by a polishing push that nobody was told about. A hotfix that landed on
mainwhile the open release lane sat thirteen commits behind for eleven hours. A sprint with a due date and no begin date, which the audit passed. Each of those is closed here. Around them, the release carries the thing v1.2.22 promised: the release letter you are reading is now a pipeline you can point at your own product — a.emlwith zero configuration, and a send step when you configure one. What is live, what needs your own setup, and what does not run yet are each stated plainly below. -
The release that stops FlowForge reporting "I cannot tell" as a verdict. A job the platform never started, read as a failing build. A machine-written suggestion sitting in a text box, read as a human's unsent draft. A worker waiting on its own compile, read as a worker waiting on you. Each of those cost whole days, and each is closed here — along with the one that cost the most: work that finished, pushed the fix a review asked for, and then waited for a review nobody started. Around that, the release carries four things you can open: every ratified plan on one shelf, a Gantt that plans instead of drawing, a radio that plays on macOS and Linux, and a War Room that stopped repainting frames that had not changed. What is live, what needs one setup step, and what does not run yet are each stated plainly below.
-
The release that stops the cockpit shouting, and gives the Gantt something worth drawing. Two defects made a whole evening unworkable: a notification that paged the operator dozens of times for one event, and a timeline that drew every ticket in a sprint as the same bar. Both are closed here, and the second one closes with the tooling that stops it coming back.
-
The release that makes the path from a passing review to a merged PR run without a human standing on it. Every failure point on that path was mapped, and every one of them is closed here: a review that could not be dispatched, a verdict that never reached the worker who owned it, a merge the cockpit started and never finished, a lease held by a process that had already died. Forty-nine changes, and the shape of all of them is the same — the pipeline used to assume its own steps landed. Now it reads each one back.
-
The release that makes light themes real, and stops the merge queue lying about its own verdicts. Two seals in one day: every cockpit surface finally picks its own colours, and the path from a passing review to a merged PR stops refusing work it had already approved.
-
The release that stops the cockpit guessing. v1.2.17 made Linux a first-class citizen. This one makes the surfaces you actually type into fast, readable on every theme, and honest about what they know — with three P0s in the ACE composer, a War Room that opens 36× faster, and a sweep of the reader class that used to answer "I could not tell" as "no".
-
The release that makes Linux a first-class citizen. The desktop app painted a white window on Linux and found none of the machine's themes; three days on Omarchy turned that into a supported platform. Alongside it: a customer's Jira field mapping finally reaches the board, the workspace you are in is the workspace every screen shows, and the review pipeline stops reporting states it cannot see.
-
The release that lets a team reach their own workspace. v1.2.15 put a customer's tickets in FlowForge; this one lets their seats open them.
-
The release that carries a real customer onto FlowForge as their ticket system — and, getting there, finds that several things we believed were working had never been reachable, and that two "obvious" root causes were both wrong.
-
The release that opens the door between FlowForge and the web console — and, on the way, finds that several doors we believed were open never had been.
-
The release that renames the hierarchy and stops assuming you only work in one place. An aggregator is now an Initiative and an umbrella is now an Epic — so a Jira Epic finally imports into something called an Epic, and the words on your board mean what they mean everywhere else. Every FlowForge surface used to be bound to one repository, chosen once and never revisited — so a developer with work in three projects kept three cockpits open, and a company admin who registered a teammate on the console screen watched the board never learn about them. This cut closes that: a workspace is something you switch, with
Ctrl+K, from a screen that names exactly what it can and cannot reach — and the switch probes the target before it commits, so a workspace that cannot serve you refuses out loud instead of quietly showing you another company's data. Riding with it: Buckets, a second lens you draw across your tickets without touching the repository they live in; a cross-project company board and a "my work across repos" view; and the tenancy boundary closed at the database. ForgePlay 4 — go-to-market — ships as the fifth play. Alongside the new surfaces, the review pipeline stops forgetting its own history, the release lane's 42-run red streak is broken, and two half-second-per-keystroke stalls are gone from the cockpit. -
The release where the machine that ships the software got fixed. A board that ran ~40 PRs a day stalled for over a week, and the cause was never the code under review — it was three controls that had quietly stopped meaning anything: a round budget set below the measured average, a settings switch implemented in one layer and absent from the layer that decides, and completed reviews whose verdicts evaporated between the lanes and the ledger. Two of the three are closed here, along with the site rebuild that had been waiting behind them — and ACE itself, which had been unreachable for a release because its shortcut was bound to a chord terminals cannot transmit. The third — the round budget — is diagnosed but not yet shipped; the note below tells you what to set.
-
The release where "fixed" had to prove itself. A blink that four releases believed was solved turned out to be guarded by a comment claiming it was solved; the waves seal stopped being an announcement and became a mutation harness that names which clauses fail; the cockpit stopped exhausting its own GitHub budget in fourteen minutes; and the roster grew past engineering into the commercial half of a company.
-
-
The honesty patch. Every terminal state a worker row can show is now proof-gated: "merged" requires a real merge, "closed" requires a real close, and a parked worker can no longer be silently killed and stamped with an ending that never happened. Plus: a crash now always leaves an artifact, the ACE context gauge holds one baseline truth across Refresh, and the Jira-facing sync verb goes runnable.
-
The convergence seal. The review→merge pipeline can finally converge: a verdict is now a durable property of the exact bytes it judged, so the same commit is reviewed once and its answer sticks — no more oscillation between GOLDEN and NOT-GOLDEN on unchanged code, and no more earned-GOLDEN that never merges. Ships a per-(PR,SHA) binding-verdict ledger, replay-instead-of-re-review, a founder-visible round budget with an on-the-record --grant escalation, a Settings kill-switch that provably stops all review dispatch (with an audit log proving OFF = zero dispatches), and orphan-verdict adoption that survives a crash mid-review. This is the fix that ends the review treadmill.
-
The waves-seal release. The wave surface stops guessing and starts telling the truth: one read model feeds every wave widget, a stale engine can no longer paint dead numbers over a live run, the ratified centered pill is back, and the whole active surface is finally pinned by goldens at four breakpoints. Alongside it, a run of trust seals found by running FlowForge on FlowForge — work can no longer die silently in a worktree, a release lane in one project can no longer refuse another project's workers, and the merge chokepoint now actually honors the freeze wall it advertised.
-
The drain cut. One day after v1.2.5 sealed the reviewer's leases, this release makes the whole pipeline self-driving and honest end-to-end: Auto-merge ON now means merged no matter which process ran the verdict (a state-coupled reconciler over merge-readiness facts),
flowforge loop autofire --drainempties a board without waves or spawns, and every dispatch is rate-limit-aware — an exhausted GitHub quota HOLDs with a resume time instead of silently killing crews. The voice stack gains the guaranteed ⌃⌃/^L escape hatch born on the Volan stage, the War Room gains the full epic lifecycle and multi-select batch-assign, the cockpit stops leaking one project's agents into another, and the founder-ratified waves seal lands its first four lanes. -
The night the review pipeline stopped lying to itself. After a launch week in which PRs sat "in review" for hours behind the leases of dead crews — and the cockpit dutifully spawned a fresh reviewer every ten minutes on top of a live one — this cut seals the class: leases now carry holder-liveness and reap themselves, dispatch refuses to double-spawn, and crew width is governed with a visible queue. Riding with it: the company model's identity and sprint surfaces (CM-V5/V7), a data lane that never fabricates a number it doesn't know, and the lanes-only git-flow blueprint formally ratified with its cut contract sealed.
-
The same-day hardening cut, straight from the founder's first live walk of the War Room and the pilot-day fires. The company model grows its data spine (cross-project sprints, the aggregated company board seam, assignee-across-projects, fail-closed company-role RLS), the Linux desktop app renders again (the AppImage's WebKit hook was never sourced at runtime), macOS artifacts gain a smoke gate so a dead binary can never stage green, and the cockpit gets calmer and more honest: the background-agents band lives in exactly one place with the composer always reachable, the War Room fills its gaps (docs hotkey healed, the epic tier renders, a Reviewing filter, an honest health-band legend), and the merge dialog explains the real reason it refused.
-
The War Room release. The Milestones/Sprints ledger becomes THE Tickets Cockpit — the screen a delivery manager lives in: behind or ahead, what next, and why — one screen. Built as a ratified design bundle executed by a ten-worker wave in a single day, verified end-to-end by an integration walkthrough, and cut for the first customer pilot.
-
The Never Alone hotfix release. A launch-blocker found live the day of this cut — a second or switched-to project silently ran with no ACE of its own — is fixed and headlines the release; everything else already in flight rides along with it. The ledger grows a full epic → milestone → umbrella → child hierarchy with honest rollups, waves gets its full lifecycle seal, desktop sign-in gains real degrade states and silent renewal, and the first multi-provider legs — Jira and Notion — land behind the same agnostic seam that now also carries the Gantt board, the Stats overlay, the Kanban board, and ticket labels off hardcoded GitHub calls. The ACE rail itself gets calmer and faster to write in, the desktop app's menu bar finally reads like a native Mac app, and the self-driving merge pipeline closes a run of small honesty gaps found running it for real.
-
The post-1.2.0 hardening release — every issue from the first full live test of v1.2.0, fixed. It makes the new stream-json ACE rail feel finished: replies render cleanly and stay alive while ACE works, the composer matches Claude Code, ACE survives app restarts, and the context gauge no longer goes stale mid-turn. It also completes the desktop distribution (Intel Mac + Linux), ships the Epics screen, hardens the self-driving merge pipeline, and adds a first-class "never lock the user out" bypass.
-
-
-
-
-
The glyph hotfix. Hours after v1.1.2 shipped, a desktop cockpit came up with every brand glyph — the flame, the status dots, the frame ticks — drawn as a bare underscore. Not a font problem: the terminal multiplexer decides per client whether the screen can render UTF-8 by reading the client process's locale, and an app launched from the macOS Dock inherits no locale at all, so the whole cockpit was silently demoted to ASCII. This release closes that class for good.
-
The all-night hotfix. v1.1.1 went out on July 11; the founder then drove the cockpit hard for a real customer evaluation and filed everything that got in the way. This release is that list, closed: 25+ tickets sealed in roughly 24 hours, every one through an independent reviewer-vehicle GOLDEN, most through the self-driving merge pipeline end-to-end.
-
The 60-hour release. v1.1.0 launched publicly on July 9; this patch is everything the fornalha shipped in the ~60 hours after — 80+ pull requests, 75+ tickets, over 120,000 lines across code, tests, and documentation, every single one through green CI and an independent GOLDEN review. Four milestones went from open to zero: the s-flow gate revamp, the Gantt rework, the Moat automation loop, and the Product Manual. Never alone, never idle.
-
FlowForge 1.1 — the public launch. The biggest release in FlowForge's history: 210 commits and ~120 pull requests since 1.0.6 — every one of them through the same gates FlowForge sells: blueprint before code, an independent GOLDEN review, green CI, and a founder merge. Built by FlowForge, on FlowForge.
-
Spawn reliability, part two. Dropped the SEAL-4
taskpolicy -bUI throttle that could starve worker terminals on busy machines, and moved MCP/settings handoff to temp files so spawn no longer races the settings writer. Workers start faster and never inherit a half-written config. (#3066) -
-
Worker-spawn hotfix. New Claude Code releases (2.1.201) introduced an MCP-trust dialog that
--strict-mcp-configno longer bypasses — freshly spawned workers could park on the dialog instead of working. FlowForge now disables project-level.mcp.jsonservers by name at spawn, so every worker boots straight into its ticket. (#3061) -
-
-
-
FlowForge 1.0 — the first public release. A single developer, orchestrating a fleet of AI specialists, shipping production software with the discipline of a whole team — and getting paid for every minute of it. This is the launch.
-
Onboarding, billing, and release-awareness polish.
-
Docs reliability + canon reconciliation.
-
Install hardening.
-
Cockpit stability.
-
Update awareness — the surface this very screen builds on.
-
Voice continuity across updates.
-
macOS install portability.
-
The first public release candidate.