v1.2.31

One press for what only a person may do, signed with Touch ID. 109 pull requests merged since 1.2.30. When an agent needs you, for a production change, a release or a letter, the cockpit now shows one chip, needs you · N, and one key opens the list. Each row says in plain words what it changes and what evidence it rests on; one press approves it, and FlowForge's own process runs it, never an agent and never you at a terminal. On a Mac, a press that changes production or reaches the public is signed by FlowForge Desktop's Secure Enclave key and asks for Touch ID. The database and the cloud are reached through doors that plan, rehearse and read back. A GitHub host left idle no longer spends its hourly allowance. The groundwork for GitLab is in place, and team settings can come from your company's server. A brief ratified in Plan a Feature hands off again. What is not done yet is listed at the end.

One press for what only a person may do

• 🔴 One chip, one list, one key per row. The cockpit shows needs you · N; F opens the list it advertises, every step in plain words and never a command in the log. A row is granted or left for now with one key, and a done row leaves (#8417, #8413).
• 🔴 FlowForge Desktop shows the same list, with the same words. A press on either surface closes the row on both (#8418), and the desktop's press button names the operation before it asks for Touch ID (#8642).
• 🔴 One press runs the step. The evidence is read again at the press, the approval is bound to it, and the outcome is written by whoever ran it (#8421). An irreversible run is one informed press, and FlowForge's own process runs it, never an agent (#8431).
• A step names what you hold, and FlowForge refuses one an agent could run itself (#8415). One record carries everything a step needs: who runs it, what it holds, the exact operation and a press bound to its evidence (#8414). Steps that are already done close themselves (#8416).
• If an agent wrote it, an agent runs it. ACE and every worker carry that rule on every install (#8419), and flowforge founder-touch-audit, with its doctor row, flags any session that handed a person a command to type (#8423).
• Promote is one press with the release evidence on it (#8437). "Update to version X" is one press, and the agent proves both installed copies identical (#8438). A letter or notice is one press: the agent prepares the images, the preflight and the seed, and the row shows the evidence (#8439).
• FlowForge says by itself when production is behind the release line (#8427). A missing build package is rebuilt, checked against the live one, and said in one sentence (#8444).
• Steps run from their own pinned copy, the shared lane checkout is held only while a run is open, and removable worktrees go without a prompt for each tree (#8441). Projects nobody has touched in two weeks go quiet by themselves (#8443), and the daemon says when it cannot read a project (#8442).

Touch ID signs every production or public press

• 🔴 On a Mac, a press that changes production or reaches the public must carry a Touch ID signature from FlowForge Desktop's Secure Enclave key. The key never leaves the enclave, so no agent on the machine can produce one. The door checks the signature before it writes the approval and again before every run under it; a signature copied onto another project, operation or version does not verify (#8445).
• Open FlowForge Desktop once to enroll the key. The first key is pinned, and flowforge presence status and the presence doctor row say whether this machine is enrolled, pinned and backed by a Secure Enclave (#8445, #8548).
• On Linux the press stays unsigned, as before, and says so on every surface (#8445).

The database and the cloud, through doors

• The database door reaches production through the session pooler, and its registry changes by one press (#8424). Migrations declare their order, and a merged migration stays owed until a step names it (#8425); flowforge db owed shows how far a live database is behind the release line.
• An owner-class set of migrations is one press: FlowForge's own process applies the ordered set with the owner's right, lent once, and a different agent reads each one back (#8428). The door accepts the real PostgreSQL 17 rehearsal from CI, and a failed rehearsal exits non-zero (#8426). An online index build is a normal change, and a long data move is paced by the door (#8430). The read-only role reads non-personal telemetry, so reads never need a person (#8429).
• The platform door asks the grant ledger, and a stack is registered by one press outside the repository (#8432). It plans from a reviewed commit, builds what the stack declares, summarises the plan in its own words and refuses a known-bad change (#8433). One press applies exactly the plan you saw, and generated secrets are written without anyone seeing them (#8435).
• Owner and admin credentials leave every agent's reach (#8422). A secret goes into FlowForge's secure key box, never a shell (#8440). Scoped cloud roles and a door principal replace the admin key, and secrets leave the Terraform state (#8434). The four release writes the release engineer needs join the standing allow (#8436).
• The site stack refuses the plans that would break checkout, including one that makes the checkout function callable by anything but the site (#8398, #8736).

GitHub's hourly allowance, kept

• 🔴 An idle host no longer spends GitHub's 5,000 calls an hour. A held merge is re-checked only when it changes, a ready pull request is never flipped again, and the repository's name is asked once an hour (#8608). The merge gates read a pull request once a pass, through the budget governor (#8625).
• The budget keeps one reading and refuses one from GitHub's other meter, so background reads no longer see headroom near a floor that is not there (#8625). The wave queue reads the governor honestly (#8377), and a token read that went around it now goes through it (#8753).

GitLab: the groundwork

• One seam for every git server: a registry of kinds, five faces, an opaque repository reference, one error taxonomy and capabilities (#7198). The GitHub adapter behind it runs today's commands, byte for byte (#7199), and merge records are keyed by forge, repository and number (#7200).
• A GitLab client: the REST v4 transport with the token read from the keychain by name (#7202), merge requests (#7203), checks, pipelines and merge-request notes (#7204), and the lane guard's GitLab vocabulary, tested against recorded fixtures (#7201). Where the forge choice is read: an override, the company's repository row, the machine, then GitHub (#7206).
• flowforge gitlab token set|rotate|status|verify|remove keeps each developer's own token in their keychain: judged at the instance before it is stored, read scopes only, 90 days at most, a reminder 14 days before it expires, and an audit row for every act (#7207). flowforge doctor --forge-contract probes a remote's contract; it is measured on GitHub and Gitea (#6661).

Team settings from your company's server

• The app learns who the team admin is from the server, never from an environment variable (#8695).
• The team's policy values live on the server, and an admin's value wins over the machine's. Settings shows "Team value — set by on " and refuses a local edit (#8697).

Plan a Feature

• 🔴 A ratified brief hands off again. The hand-off check compared the page's render time, so a brief presented, ratified and polished in different minutes was always refused; in Portuguese and Spanish it refused even inside one minute. The render time and the ratification stamp are no longer read as claims, and a changed paragraph is still refused (#8797).

Merges and the cut

• 🔴 No merge leaves work behind: one hold at every door, and every merge retires its worktree, archive first (#8363).
• A closed pull request never reaches a merge gate or GitHub, and a founder approval given for one pull request releases only that one (#8735). A flipped pull request never replays its flip over a review that said NOT-GOLDEN (#8376).
• The cut never pays for the lane proof twice: main's push reuses it when the trees match (#8374), and the 1.2.31 lane's gating suites no longer include the lane proof itself (#8803).

Steadier under the hood

• One identity per machine: a random machine id under ~/.flowforge, sent by the exporter (#7617). The per-process telemetry identities collapse onto their machine (#5187), and every session the cockpit drives has its sessions row (#5942).
• Help ▸ Symbols keeps one meaning column per block at 80 and 120 columns (#8378); the Workers & Fleet decoder describes the rows as they render (#8379); run-coloured text is bold where the colour misses contrast, and the kanban names a run while the queue holds it (#8380).
• The cost and saldo groundwork on the server: the billable call key (#6090), cost by the base event's day (#6092), the coverage denominator (#6093), the day queue (#6095), background jobs that mark what changed within page and time budgets (#7619), event vocabularies as tables (#7620), the three team-read indexes (#7613), the raw heaps partitioned by month (#7614), the hardening batch (#7612), the health lane (#7611), the doctor's database group (#7621), the owed migrations in one rehearsed order (#8401, #7609, #7610), and the console's saldo-engine bodies adopted (#8772).
• Our own 1.3.0 roadmap page is built by flowforge roadmap page build (#8104); it reads its sprints from the release and explains every drop (#8465, #8737), and its refresh build runs outside the host budget (#8770).
• The old manual tells the truth: the install line, the update verb, prerequisites, sign-in and where to get Desktop (#8222). The privacy page says visits are counted per link, campaign and referring site, never per person (#8147).

Studies, records and groundwork

None of these change what you run. Each one is listed only as what it is.

• The one-press study and its fireable plan (#8404), the rights-lane amendment (#8420), the security-key study and its work units (#8553), the security-key spike (#8643), which keys move on the founder's machine (#8422), and the fresh-Mac walkthrough's script and scorer (#8446).
• The database records: ADR-0126 revision 1 (#7615), the migration numbering rule (#7623), the step-down read at day 10 (#7624), and the console's three settings twins as a plan (#7110).
• The login-candidates door prepared for its production apply (#8711). The 1.3.0 ticket scope written down (#8727), the archive branches classified (#8364), and the channel posture's rules for X (#7847).
• These release notes and the letter (#8809).

Agents — 53: three changed

No agent was added or removed. Three definitions changed with the one-press doors:

• Changed fft-dba — reads flowforge db owed to see how far a live database is behind the release line, rehearses a chain migration on CI's PostgreSQL 17 run, and prepares an owner-class set with flowforge db manifest; your one press lends the owner's right, FlowForge's own process applies the set, and it reads each member back. It still never holds the owner credential (#8428, #8426, #8427).
• Changed fft-devops-agent — plans through the platform door against stacks you registered with one press, asks for exactly the plan it gated, rotates a secret without seeing its value, and leaves the verification to a different agent (#8432, #8433, #8434, #8435).
• Changed fft-release-engineer — prepares the promote as one press with its evidence, records the candidate rehearsal's verdict, and asks you to press "Update" instead of handing you a command (#8437, #8438).

One setup step

• Open FlowForge Desktop once on each Mac after you update, so it enrolls its Touch ID key. Until it does, a press that changes production or reaches the public waits on that machine and says why (#8445).

Not yet

• A lost Touch ID key fails closed. If the pinned key is gone (a reinstalled Mac, a new machine), production and public presses on that project are refused; recovering the key is not in this release (#8550).
• GitLab cannot drive a project end to end yet. This release lays the seam, the client, merge requests, checks and token custody; the contract probe is measured on GitHub and Gitea, not on GitLab (#6661).
• Team admin and team policy from the server wait on FlowForge's server. The server changes are merged and are applied to FlowForge's production database as their own step; until they are, the app reads your machine's own settings, as in 1.2.30 (#8695, #8697). The same holds for the server-side cost and saldo work listed above.

Update

• flowforge update on an existing install, or curl -fsSL https://get.flowforgesoft.com/install.sh | sh for a fresh one. Both write the same release binary to /usr/local/bin and ~/.flowforge/bin together. flowforge update --repair re-lays the installed assets without the network. Then quit and relaunch every open cockpit and FlowForge Desktop.