v0.5.0 — parallel lane reads, memory-aware wave sizing, lanes outside the host repo

• ⚡ Lane status reads in parallel — 140 lanes in 10s against 63s
  serial, with the JSON, its lane order and its exit codes identical at every
  worker count (FLEETFLOW_STATUS_WORKERS, default nproc capped at 8)
  (ADR-039).
• 🧠 Waves are sized from memory, not just cores. ff doctor reports
  how many concurrent lanes the machine's commit headroom supports —
  commit, not free RAM, because a box can wedge with 28 GB of RAM idle.
  Advisory: it sizes the next wave, it never gates a spawn
  (ADR-041).
• 🏠 Lane worktrees can live outside the host repo. Lanes sit inside
  it by default, so any dev server serving that repo crawls every one of them.
  ff doctor and ff plan lint now warn when a registered watcher has no
  .fleetflow ignore, and FLEETFLOW_LANES_ROOT removes the hazard outright
  (ADR-038,
  ADR-040).
• 📏 Fleet-wide rules reach every provider. claude -p lanes load
  ~/.claude/rules/*.md implicitly and no other harness does, so identical
  packets produced very different code. Rules named in FLEETFLOW_FLEET_RULES
  now ride the guard preamble, and the doctor fails when one is missing
  (ADR-037).
• 🗂️ Lane cards report outcome, not just effort. Each card lifts
  the worker's own final reply: tests passed/failed, files touched, landed
  against unmerged commits, cache share, and a partial verdict beside a green
  done. A run's elapsed is now its wall-clock span, not its longest lane.
• 🔑 One expired token no longer kills every Anthropic lane.
  Claude-family lanes share the host auth store, so one expired session took out
  a whole tier mid-run. ff spawn --config-dir <dir> routes a lane elsewhere and
  ff doctor --live names healthy profiles — it points, it never picks
  (ADR-036).
• 🧪 A fast lane for the test suite. --only, --skip, --quick
  and --list cut the edit-run loop from ~11 minutes to seconds, over a
  dependency map derived from the file rather than hand-written. The no-flag run
  is unchanged and stays the only thing that lands.
• 🐛 Three checks that reported success while doing nothing.
  ff-status overflowed jq's command line past ~37 lanes and emitted nothing
  while exiting 0, so the dashboard drew its largest runs as empty cards. The
  plan lint's ADR gate and wave triage's escalation both read a usage error as
  "tool missing" and reported disarmed. All three now fail loudly.

---

Journal/record schema FF_VERSION moves 1.2.0 → 1.3.0: a started record may now carry a worktree field (ADR-040). Additive and optional — no reader breaks — but ff-aggregate mixes the version into its cache key, so the first aggregate after upgrading is a cold rebuild.

Full changelog: CHANGELOG.md · v0.4.0...v0.5.0

v0.4.0 — The orchestrator seat opens up

The orchestrator seat opens up, and codex lanes commit their own work.

• 🎯 The orchestrator seat is no longer Claude Code's alone. Any agent that can run the scripts and judge their output may hold it; the host conveniences — dashboard pane, chat widget, chips, ACP steering — are optional surfaces, not requirements. Verified with opencode 1.18 and pi 0.83 each driving plan draft → lint end to end, unmodified (ADR-033).
• 🛡️ Codex lanes self-commit, reversing ADR-006's "never". The sandbox gets four scoped git grants — the lane's worktree metadata, the object store, and the lane branch's ref and reflog. .git/config (core.hooksPath is code execution), hooks/, and refs/heads/main stay outside the cage, proven with an adversarial config-write probe (ADR-034).
• 🔌 Gemini and OpenRouter lanes, verified end to end: the Pi wildcard seat now has tested routes to google (Gemini 3.6 and 3.8 Flash) and openrouter (any listed model), each running a full lane — self-commit, collect gate, main clean. Pi accepts a model id newer than its own catalogue, so a launch-day model needs no fleetflow change.
• 🧭 ff doctor --for MODEL[,MODEL…]: preflight scoped to the models a run actually spawns. A missing harness for a requested model escalates advisory→fail, and claude is required only for claude-family, glm, and chip lanes — so a claude-less fleet can be blessed.
• 🔍 The preflight stopped lying: rounds of cross-model review closed false greens in ff-doctor — a logged-out codex that matched "Logged in", a glm child whose nonzero exit was masked by a pipeline, requested seats blessed with no verifiable key. What cannot be verified now fails closed.
• 🐛 Codex lanes run again on codex-cli 0.153, which rejects the --approve-for-me plus -s workspace-write pair fleetflow had passed since 0.144 — every codex lane died at spawn with rc=2. The launch line now passes --approve-for-me alone, which implies the same sandbox.

Upgrading

No breaking changes. If your codex lanes have been dying at spawn with rc=2, this release is the fix — re-spawn them with --force, since the journal caches the failed result under the same key.

525 hermetic assertions, ADR lint inside the gate.

Full changelog: v0.3.0...v0.4.0

v0.1.0 — heterogeneous agent fleets from one session

First public release. Extracted from the claude-mods skills tree with full history; highlights: the full run lifecycle (ff-doctor → ff-clean), post-build wave pipeline with findings ledger (ADR-018), machine-wide housekeeping with live-computed verdicts and a measured 16× sweep speedup (ADR-020/024), chips as first-class lanes (ADR-021), opt-in raven-bus telemetry and steerable ACP lanes (ADR-022/023), honest cross-provider cost estimation (ADR-010/015), and a 389-assertion hermetic test gate with ADR lint. Default GLM worker is GLM-5.3, verified live at release.