v1.2.32

Every change to production is one press, and an override waits for a person. 74 pull requests merged since 1.2.31. This release finishes what 1.2.31 started. Settings ▸ Databases now offers the changes switch and the owner sign-in as presses. A one-time data write shows its counts before you approve it. When you upgrade, the old needs-you items move onto their presses. An override at a merge is refused when a Claude Code session is above it, and a specialist's FAIL holds the merge. An epic runs on Waves like a sprint. A spent GitHub budget says so in one line. A Jira project's sprints reach FlowForge (not yet read on a live site). An interrupted update can no longer lock you out of your records. What is not done yet is listed at the end.

One press for every production change

• 🔴 Settings ▸ Databases offers the changes switch and the owner sign-in as presses, and "Last check" tells the truth. "Allow changes for production" asks for a window (1 hour, 1 day, or until you switch it off), a reason and the ticket. You approve it in Needs you; on a Mac, FlowForge Desktop asks for Touch ID or, without it, the Mac's login password, and on Linux the approval is unsigned, as in 1.2.31. Then FlowForge's own process raises the switch, and no terminal command raises it. "Save the owner sign-in" opens a secure field for the owner password. "Switch changes off" is yours alone. "Last check" used to read the newest statement anyone ran: one refused statement on a table the read-only login is kept out of flipped the whole database to "can't read". A refused statement on a working connection now counts as a working check, and "Check again" runs one real read (#8914).
• 🔴 A one-time data write (a backfill, a linker, a data fix) is one press that shows its dry run's counts before you approve it. fft-dba prepares it, you approve once, and FlowForge's own process runs it and reads it back. There is no script to paste and no owner key to hold. flowforge db dry-run reads the counts and says where it read them, production or a rehearsal copy. A dry run counts for 24 hours, and a write without a fresh, proven dry run is refused (#9087).
• 🔴 When you upgrade, the old needs-you items move onto their presses. Steps that are already done close with their evidence. Owed steps move onto the press that runs them. A step with no press yet names the ticket that will build one. flowforge install --global runs this on every upgrade, and flowforge founder-step migrate previews it. On a copy of the founder's own list, 52 items became 23, and the 42 old command-to-paste steps became none (#9077).
• An owed step closes by itself when the world proves it done. A bundle press closes the steps it carries out, and flowforge founder-step attach gives an owed step the evidence that closes it. A new step is asked for a way to tell it is done. flowforge db verify now exits 8 when its read-back is not true; before, it exited 0 whatever it read (#8905).
• An owner press fails on any unexpected change to a role's powers. Every role's powers are read before and after, so a change built at run time inside a DO block is caught (#8911).
• The platform door reads and switches on point-in-time recovery for a Supabase project. flowforge platform pitr read says whether it is on, its retention, and the earliest and latest restore point. Switching it on is one press: you approve it, and the platform agent runs it under a single-use grant of at most an hour (#8730).

An override waits for a person

• 🔴 An override at a merge needs a person proven from the machine's process table. A command with a Claude Code session above it is refused, whatever its environment says, and so is a process tree that cannot be read. The cockpit's Bypass press is a one-use token, bound to the cockpit that minted it. One route is still open: a planted startup file can relaunch the call in a detached terminal pane, and that pane passes as a person (#8953, #9127).
• Switching the review-provenance gate off counts as an override and needs a person too (#8954). The hands-free loop honours no override at all: each one is dropped, recorded and narrated (#8939).
• ACE's merge runs as its own call, and only your press grants it. ACE cannot pass an override or lift a freeze on your spoken order. flowforge doctor has a merge-permission row (#8874).
• An agent's reason added to your merge freeze is flattened to one plain line, capped at 200 characters, and every freeze is recorded (#8957).
• The guards read a flag before the subcommand the way the command line does, so flowforge review --repo x/y verdict 1 is no longer waved through on a worker session (#8970). The guard that stops an agent handing you a secret or a command to paste catches more shapes (#9012).
• A specialist's verdict holds the merge. A code GOLDEN no longer clears a head that a specialist failed (#8969). A specialist's clear counts only when FlowForge dispatched and recorded it with flowforge review specialist <pr> --agent <name> (#9028).
• A worker parks its PR for review only after its own pre-check passes the reviewer's rules. The pre-check finds no CRITICAL and no MAJOR at the head, and it is posted on the PR (#8472). A park or a pre-check counts only with its own PR comment, and a worker cannot write either record by hand (#8949).
• flowforge doctor has a permission-hygiene row. It names every allow rule that lets an agent run code of its own choosing without asking. It never prints a rule, and FlowForge never edits your rules (#8940).

Epics run on Waves

• 🔴 An epic (◉) starts and queues like a sprint. flowforge waves start --epic N starts it (--dry-run shows the plan and starts nothing), and flowforge waves queue add --epic N queues it. ACE can start, queue, pause and stop it. It runs beside other runs and is refused only where tickets overlap (#6166).
• It moves one wave after another as its tickets merge, and never starts a child whose blocker outside the epic is still open. Every act and every hold names the epic (#6167). Its own screen reads ◉ Epic #N · <title>, counts the children merged before it started, and never shows loading as empty (#6164). Board, Waves and Gantt read one typed scope (#6169).
• Waves fixes. A paused run reads paused on the cockpit band, and the line counts paused runs (#8936). Free slots no longer sit idle while waves wait on each other's floors: four waves and three free slots now start three (#8943). "Add to the queue" re-runs a finished sprint that new tickets reopened, and never names a hidden letter (#8929). "Start now" on a reopened sprint starts a new run (#8980).
• The Wave Screen guide is rewritten, in English and Portuguese (#6168).

GitHub's budget, said plainly

• When the shared GitHub budget is spent, Fleet and the Merge Queue say so in one line: paused, why, when it resumes and who spent it. For example: ⚠ GitHub budget spent — background reads paused to protect merges · resumes 05:12 (#8921).

Plans ship whole

• A plan must ship the whole package, or plans lint and plans fire refuse it. The package has four parts: how it is enforced, ACE's part, the migration of existing data, and a proof on the real state. Each part names the work that delivers it, or says "Not applicable" with a reason. The refusal comes once per problem, with its fix (#8913, #8988, #8994).
• Rule #39: prove it on the real state. A feature or bug ticket is refused without a Real-state Proof section, and the reviewer stamps the evidence at GOLDEN (#8908).

Releases for your own project

• The release verbs read the shape of the project they run in. A web project hears about its own release and never about FlowForge's. flowforge release cut --dry-run prints the FlowForge-only checks as "stands down", and release promote outside FlowForge's repository needs both --bucket and --alias (#8902).
• flowforge release tag tags a shipped customer version. The tag is annotated. --commit <sha> --evidence <text> backfills an older commit, a plain pull-request merge counts as a cut, --no-push stops before the push, and --github-release makes the GitHub release where no pipeline does. Every refusal is printed (#8901).

Jira: sprints arrive

• A Jira project's sprints now reach FlowForge. FlowForge finds the project's boards once per session and lists the open sprints of every board that has them. A sprint with dates reads as a sprint; one without dates reads as a milestone, and no date is invented. An issue's Sprint field becomes its milestone. On a project with several team boards, each sprint's name carries its board's name. A failed read is an error, never an empty list. This is checked against Jira Cloud's documented responses: no live Jira site has been read yet, and the board and War Room views on Jira come next (#7210).

Backups: the read ships, the job is not armed

• A read that says when a backup night is missed. flowforge platform backup status lists a registered backup stack's nightly and hourly copies and never reads a backup itself. It reports "missed" (no finished night in 26 hours), "small" (under half the median of up to seven earlier nights) or "unknown". The db-backup and db-pitr rows in flowforge doctor say the same, and a needs-you sentence reads, for example, "Your live database has not been backed up for 30 hours." A project with no backup stack shows nothing (#8732).
• FlowForge's own production database has its nightly backup job built, not armed. The job and its read-only role are written. Its storage and the storage's press user are written and not applied, and the two presses that arm the job are not built yet, so no night has run (see Not yet) (#8732, #9021, #9022).

Fixes

• 🔴 An interrupted update can no longer lock you out of your own records. Each update to your local audit store is now written together with its own check, so a crash, a kill or a busy disk between the two can no longer leave the store refusing every open, which stopped the ledger, rights, grants, Settings ▸ Databases and Touch ID approvals. A store already stuck that way repairs itself on the next open, but only when what it holds matches the update exactly; any other mismatch is still refused as tampering (#8870).
• A reviewed PR no longer waits on a worker that is only looping on its goal. When a worker has parked its PR and its branch is clean at the reviewed commit, the merge goes ahead even while the worker's session keeps running. Nobody has to clear the worker's goal by hand any more. A worker with unsaved changes, a commit not yet pushed, or a branch away from the reviewed commit still holds the merge until it pushes or discards that work (#8844, #8875, #8918).
• A worker's goal is met by the PR the review cleared and flipped ready (#8967). ACE can answer a worker's question that is not yours to decide with flowforge worker answer, and clear a parked goal with flowforge worker goal-clear. Every act is recorded (#8875).
• The daily loop's git-server calls move onto the GitLab seam: the merge, the down-merge, the branch backstop and the War Room's PR reads. GitHub answers as before. The contract probe on a GitLab instance is still owed (#7208, #6661).
• The site footer drops a LinkedIn icon that pointed at another company's page (#8015).

Studies, records and groundwork

None of these change what you run. Each one is listed only as what it is.

• FlowForge's own production database: the backup storage and the press user that arms it, written in the AWS account we already use and not applied (#9021, #9022); the backup design and its ADR amendment (#8732, #9020); the point-in-time recovery runbook (#8731); the restore drill's database half, proven on a rehearsal (#8733); the retention window carried onto this line (#7618); the press for one owed migration, with its brief and its rehearsal (#8909); the order of the 1.2.31 production migrations (#8818); and three safety fixes in the scripts that apply owner migrations: inherited database-routing variables are refused and each step runs from a hashed copy (#8876), the password goes through a private file and never on the command line (#8782), and Ctrl-C stops a step (#8932).
• Design briefs waiting for a decision: an edge-function deploy as one press (#9088), and two lists with two names (#8906).
• The console's release letter, walked the customer way: 17 steps, 16 gaps filed (#8881). The 1.3.0 roadmap page names sprint #257 (#8104).
• Checks kept green: the site and migration guards (#8995, #8974, #8966, #6169, #9167). The 1.2.31 promote is recorded (#8833).
• These release notes and the letter (#8917, #9181).

Agents — 53: three changed

No agent was added or removed. Three definitions changed:

• Changed fft-code-reviewer — stamps REAL-STATE-EVIDENCE at GOLDEN: a change that meets a real state needs a read-only run on that state, a fixture is not enough, and a FAIL blocks GOLDEN (#8908).
• Changed fft-dba — never raises the changes switch itself: it tells you the press in Settings ▸ Databases (#8914). It prepares a one-time data write as a move with its dry run, flowforge db dry-run, and the press shows you the counts (#9087).
• Changed fft-devops-agent — reads flowforge platform backup status through the platform door (#8732).

Not yet

• The cockpit's S on an epic board does not start the epic yet. Start or queue it through ACE, or with flowforge waves start --epic N (#9141).
• FlowForge's own nightly backup is built, not armed. Its storage is written and not applied, and the two presses that arm it, one that sets up the backup storage and one that turns on the backup login, are not built yet. Point-in-time recovery is not switched on yet (#8732, #9021, #9022, #8731).
• A real restore drill has not run. Only its database half is proven, on a rehearsal (#9048).

Update

• flowforge update on an existing install, or curl -fsSL https://get.flowforgesoft.com/install.sh | sh for a fresh one. Both write the same release binary to /usr/local/bin and ~/.flowforge/bin together. flowforge update --repair re-lays the installed assets without the network. Then quit and relaunch every open cockpit and FlowForge Desktop.