v0.10.2

Fugaro v0.10.2

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.10.2
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• fugaro watch --keep and --keep-count now cover failed runs. Before, a longer window kept successes on screen for longer but a failed run still left the list after three minutes, so raising the window made a failure less visible than a success.
• A run is no longer falsely refused by the workflow guard. The guard that keeps agents out of .github/workflows now drops an unreadable base on its own instead of dropping every base, so a run is not blamed for a workflow file that a base branch it merged in already carried. A run's own workflow edit is still refused when both bases are in play, and a test pins that.
• fugaro plan graph refuses what it used to guess at. A document from a schema version this build does not read is refused, --done "" is refused, and a refusal names the file you passed rather than the path written inside it.
• The security page says what the credentials service's account can do. Its database role can read and write the whole installation database, including the stop switches and the policy, because database access by role has no path scope; the service's audit trail also records the one refusal it used to leave unrecorded.

For operators

1. Per machine — upgrade the CLI on every machine that runs Fugaro: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade, which pins the plugin to this release and refreshes the repository's job images.
3. Nothing in your cloud project changes by upgrading alone.

Known limits

• A graft file written by an agent can still get past the workflow guard's file list. Git honours a graft file even with replace objects switched off; GitHub's missing workflows permission still stops the push, and the guard closes this in the next patch.
• The release script's signal test fails on macOS. It passes in CI on Linux; it only affects someone running the script's own tests on a Mac.
• The credentials service stays dormant until an owner opts in, and its live checks (94 to 96 and 99) have not been run.

Changelog

• release notes: v0.10.2 highlights and end-user summary (#984)
• website: the fugaro.dev redesign (home reorganised, ornaments removed, Why GCP under Project) (#983)
• console: the Part C WSL tests follow Part D's distribution-name rule (#982)
• 0.10.2: the workflow guard's bounds drop one at a time, with the two-bound refusal pinned (#975)
• console L5b: the Spend screen's by-person view, from runs stats --json (#956)
• console on Windows via WSL, Part D: paths (T-D1…T-D6) (#979)
• mobile P4.1 T4: the ledger, the restart and the dedupe (#980)
• console on Windows, Part E: the credential boundary (#976)
• console: 0.10.2 review cleanups — a heading in one text run, corpora the CLI could print, and comments that say what the code does (#978)
• mobile P4.1 T2a: the outbound signature — a reply and a heartbeat are signed before they land (#977)
• 0.10.2: the credentials service's cleanups from the 0.10.1 reviews (#974)
• watch: --keep and --keep-count reach failed runs (0.10.2, #950) (#971)
• plan graph: refuse a foreign schema_version in Analyze, name the caller's path, and refuse --done "" (#973)
• mobile-release: on a failed identity read also print the token's account login and the variable NAMES EAS returns (never values) (#970)
• mobile-release: the mask step prints eas env:exec's own error text when the read fails (#969)
• console: the console releases from its own console-vX.Y.Z tag (#966)
• website: the v0.10.1 summary carries no backticks (the changelog page prints them literally) (#968)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-history:0.10.2 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
• ghcr.io/dimipaun/fugaro-base:0.10.2 and ghcr.io/dimipaun/fugaro-base:0 (one index for linux/amd64 and linux/arm64; per-architecture tags 0.10.2-amd64 and 0.10.2-arm64)
• ghcr.io/dimipaun/fugaro-credentials:0.10.2 and ghcr.io/dimipaun/fugaro-credentials:0 (the credentials service's image, linux/amd64; signed, with the nightly-immune 0.10.2-pinned tag fugaro update --provision-credentials resolves and verifies)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64 (and, for fugaro-base, linux/arm64); each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.

v0.10.1

Fugaro v0.10.1

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.10.1
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• The credentials service is wired end to end. An installation that opted in with fugaro update --provision-credentials now has the service's address recorded in its project config and put on every per-repository job it launches, so a cascade run asks the service for its model credential and a GitHub run asks it for its installation token instead of minting in the job. The service itself stays dormant: it is off until an owner opts in, and an installation that has not opted in gets nothing new.
• The service can read the installation's database. The installation root now creates the service account's own database role, fugaroCredentialsDatabase (firebasedatabase.instances.get and .update, the database's two data permissions, and no instance lifecycle), and binds it to that account alone, so once applied a call's reads and its own marks and leases are admitted rather than refused state_unavailable.
• fugaro watch is easier to read. Each job shows the last four characters of its id (the first characters repeat across runs started in the same minute), a "Started by" column names the person, finished jobs leave the list three minutes after they finish, X dismisses any finished job at once and A shows them all again.
• fugaro update --forget is safe on a managed installation. It is refused before anything on disk is touched, with a message that names the next step; 0.10.0 shipped with a warning not to run it.
• A run's review and its writeback judge the same diff. A follow-up on a pull request whose base is an integration branch, or a run started from another branch, is no longer measured against main, and the guard that keeps agents out of .github/workflows knows both bases.
• A cascade run's notional dollars are never counted as billed. runs stats, budget preview and the halt reasons all split a run's dollars on model_notional_usd, and a test keeps a new reader from asking the old question.
• The price catalog is refreshed (a few DeepSeek prices moved, and the Kimi K3 output price rose), and the base image's downloads retry on a transient network error instead of failing the build.
• A teammate's machine needs fugaro update after the opt-in if it has its own local config. The address travels in the published shared config, but a machine whose own local config lacks it launches with no address — a cascade run then fails closed at bootstrap — until it runs fugaro update.

For operators

1. Per machine — upgrade the CLI on every machine that runs Fugaro: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade, which pins the plugin to this release and refreshes the repository's job images.
3. Per installation, only if you mean to turn the service on — fugaro update --provision-credentials deploys it, its database role and that role's binding, and records its address; before you expect a GitHub run to work, write the App's key into the service's bundle with fugaro creds set github-app-key, because a mint that finds no key is a refusal and never a fall back to the job's own copy. Nothing in your cloud project changes by upgrading alone.

Known limits

• The service is wired for cascade workflows, and the other auth modes are not. The opt-in removes a per-repository job's own model credentials whatever its agent.auth, while only a cascade run's calls go through the service, so an oauth or api-key workflow of a repository that has opted in has no model credential of its own and nothing yet to replace it: run such a project's workflows with agent.auth: cascade.
• The GitHub App key does not leave the job in this release. A job of an opted-in installation still mounts github-app-key and still holds its accessor on it, while the runner no longer reads the key and mints at the service instead; the grant and the mount are taken away in the release after the owner's live check proves the deployed service mints.
• The service issues only what its bundle holds. No Terraform fills the bundle; fugaro creds set is its only writer, so a call against an empty bundle is refused, never served from the job's own copy.
• None of this has been proven live yet. The owner-run Checks 94, 95, 96 and 99 are not run.
• The service ships with its own known limits, stated in SECURITY.md: a refusal answered before the caller's identity is verified carries no audit line, and a model call's issuance line is written before the answer streams, with a second line when the stream then fails.
• A cascade launch is legal on the published policy switch, not on the service: a project that publishes routing.claude: {via: cascade} without a service launches a run that fails at bootstrap rather than one refused at launch. agent.auth: cascade also needs a published budget.allowed_models.
• A managed installation has no rollback: fugaro update --forget is refused for one, which is what settles 0.10.0's note not to run it there. The rollback's second phase removes every address from Terraform's state, and an installation's addresses include the managed deployer's fence — the seven scoped roles and their seven conditioned bindings — so the fence would stay live in the project with nothing accounting for it, and a later converge could not put it back. The refusal is decided before anything touches the installation (no plan, no state removal, and not one file of its settings rewritten) and it does not lift when the project's managed marks come off, because the fence is the installation's and not a mode of the project. What is left is the owner's own work in the project; the repositories' rollback, fugaro update --repo --forget, is not refused and is the step to run first (docs/gcp-setup.md, "Rolling back").
• fugaro watch --keep and --keep-count do not reach failed runs yet: a failed run leaves the list three minutes after it finishes whatever the flag says, so raising the window makes a failure less visible than a success; the next patch fixes it.
• The guard that keeps agents out of .github/workflows can refuse a run it should not, in the rare case where a run's two bases differ and one of them moved on after the run's last fetch; it fails closed, and a re-run clears it.

Changelog

• terraform: fmt the credentials role and its test (the terraform CI job's fmt -check) (#964)
• release notes: v0.10.1 highlights and end-user summary (#963)
• 0.10.1: an installation that holds the managed deployer's fence has no fugaro update --forget, and the command refuses instead of orphaning the fence (#958)
• credentials: the service account's database role, and its own principal kind (#951)
• 0.10.1: mobile gets its own release stream (mobile-vX.Y.Z tag, own notes, names) (#947)
• runner: one matrix proving the review stage and the writeback diff against the same base (it found the guard's, fixed) (#948)

• Task: 0.10.1 credentials service C1.24: set FUGARO_CREDENTIALS_SERVIC… (#955)

• 0.10.1: every reader of a run's dollars splits on model_notional_usd, and a gate holds it (#954)
• console on Windows, Part C: the resolver, the wrapper and the distribution (#957)
• console: re-record the darwin goldens against the styled tree (Task 6.6) (#961)
• console: the five injected registries carry shared/launcher.js (#959)
• website: the reach rule records the console's own link as its exception (#943)
• 0.10.1 docs: the three release-procedure fixes the 0.10.0 release taught (#953)
• watch: the run id's last four characters, a Started-by column, a three-minute window, and x dismisses any finished run (#950)
• catalog: regenerate the price catalog and its snapshots (checked 2026-10-23) (#949)
• 0.10.1 docs: Check 96 and the register rows it contradicts say what the code does (#952)
• credsvc C1.13: the audit gaps from #902, closed and tested (#945)
• console L3: the console gets its own release stream (console-vX.Y.Z tag, own version line, own notes) (#935)
• images/base: every base-image download retries, and falls back to HTTP/1.1 (#946)
• mobileauth: the allowlist entry, its roles and the resolution rule (#918)
• console: the picker's ~ is the app's own environment home, not Electron's answer (#944)
• mobile/voice-session: the state machine, as a pure reducer over the spec's event stream (VS0.1–VS0.3) (#921)
• console: the two leftover open items — a dev CLI build in the handshake, and Dependabot's watch over console/ staged for the owner (#932)
• console: a "Started by" column on Live, Projects and Run (#938)
• console: the golden specs assert the computed ground, and a golden failure names the re-record command (Task 6.6, agent half) (#936)
• plan: readiness, levels and the critical path in fugaro plan graph --json (V2.2.3) (#934)
• plugin: teach the parallelism skill the plan graph format (V2.8.1) (#933)
• console: the Live screen draws the review inbox, and builds no link from a pr_url (V2.7.1) (#937)
• console-windows Part A: the seam and the fake wsl.exe, and the owner's approval of the build (#806)
• console: the first run needs no configuration (installations discovered, binary resolved, onboarding pages) (#751)
• console: package.json names a homepage and an author, which electron-builder needs for the .deb (the Linux check failed without them) (#931)
• console: build, verify and attach the Linux artifacts (apply console-linux.yml and console-release-linux.yml) (#930)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-history:0.10.1 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
• ghcr.io/dimipaun/fugaro-base:0.10.1 and ghcr.io/dimipaun/fugaro-base:0 (o...

Fugaro Console 0.10.1

The Fugaro desktop console built from the CLI's v0.10.1 tag (the same commit, the same release gate, the same pinned packer and the same Electron fuses on both platforms). The macOS build is signed with a Developer ID certificate, notarised and stapled; console-verification.txt records the checks run on those exact files. The Linux build is unsigned: an AppImage is not code-signed and this project has no Linux signing key, so the AppImage and the .deb for x64 carry no signature of their own -- their integrity claim is the SHA-256 in console-sha256sums.txt, which covers every file here and is itself signed keyless with Sigstore (console-sha256sums.txt.sigstore.json, verify with cosign verify-blob). console-linux-verification.txt records the commands run on those exact files, including a read-back of the Electron fuse wire from the executable inside each artifact.

v0.10.0

Fugaro v0.10.0

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.10.0
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• fugaro setup asks everything first, then applies. The wizard collects every answer before it changes anything: the project's name, a GCP project id that defaults to fugaro-<name>, the region, and a pick from the billing accounts you can use (listed at a terminal only), and it asks whether to onboard the checkout's repository.
• fugaro update brings an existing installation up to date, with its own stages, its refusals and a non-interactive contract; --yes covers every ordinary step, and creating a project, linking billing and typing a secret still need you at a terminal.
• fugaro init is gone. It prints which of the two commands replaces it; the README, the setup skill, the website and every message now say fugaro setup and fugaro update.
• A missing Cloud Billing API is explained, not cryptic. When the quota project has the API disabled, setup says so, names the project, and offers to enable it behind a typed confirmation that --yes never covers.
• Several accounts or models can share a run's work through the credentials service, an opt-in service that keeps the model credentials out of the job (the GitHub App key too, once it is wired): fugaro creds set and fugaro creds ls manage its one bundle, agent.auth: cascade selects it, and a run records which credential answered and what was subscription work rather than billed.
• Running on Cloud Batch got safer to read: a Spot-preempted run is shown as failed, the reaper has its own command, and validate and doctor check a Batch setup.
• Managed projects are available: fugaro setup --create-project --managed, fugaro managed apply and fugaro restore no longer refuse. A managed project is one Fugaro created (or that its owner flagged), where a coding agent's session may apply the project's own root because the plan runs as a deployer account fenced to fmgd- names — opt-in per project, and the fence's live measurement follows this release (Known limits).

For operators

1. Per machine — upgrade the CLI on every machine that runs Fugaro: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade (pins the plugin to this release, updates it in Claude Code and refreshes the repository's job images). Replace any script or CI step that runs fugaro init with fugaro setup (first run) or fugaro update (every later one).
3. Per installation — run fugaro update once. The credentials service is off and stays off until you turn it on; nothing changes in your cloud project unless you do.

Known limits

• The credentials service ships dormant and is not wired end to end. No job is given the service's address yet, the service's account has no realtime-database role yet, and opting in with --provision-credentials removes a per-repository job's own model credentials with nothing replacing them: do not opt in until 0.10.1, which wires it. agent.auth: cascade also needs a published budget.allowed_models.
• The service's audit trail is partial: identity and pairing refusals before a call is admitted are not audited, and the audit line is written before the answer streams.
• Some run-dollar readers still split on the model basis (runs stats, the budget preview, the halt text) rather than on the notional part, which only matters once the service carries subscription work.
• The base image's tool downloads do not retry, so a flaky network can fail an image build; rerun it.
• Cloud Batch stays opt-in and owner-run (--provision-batch), and its owner-run live checks have not been run.
• The live checks written for this release have not been run: 27, 68, 91, 92, 94, 95, 96, 99 and 111 are owner-run and follow the release; what they find is fixed in 0.10.1.
• The managed deployer's IAM fence has not been measured live, and Check 68 is what measures it: it is owner-run after this release. If IAM rejects one of the seven conditioned bindings, the managed stage fails at apply for anyone who tries it — the installation apply that creates the binding stops there; if IAM accepts a binding but does not honour resource.name for that service, its role grants nothing (fail-closed, and no fence). So the fence's real protection is unverified until Check 68 passes, and managed stays opt-in per project: an installation that never asks for managed plans none of it.
• Do not run fugaro update --forget on an installation that uses managed projects: the paths that rewrite the installation's settings drop the managed scope, so the plan would list the deployer's seven roles and their bindings for destruction (it asks before it applies). Fixed in 0.10.1.

Changelog

• plugin: the setup skill is back under its byte budget (the 0.10.0 version stamps added two bytes) (#929)
• runner: the cascade notional tests publish a model allow-list (the launch and bootstrap refuse a cascade run without one, #898/#901) (#927)
• mobile P6.10: the offline gate, rebuilt on main — the reviews' BLOCKER, M1 and M2, and the second review's five findings, fixed (#919)
• mobile P4.1 T3: the lease on heartbeat by ETag CAS (#914)
• voice: the spoken confirmation and the routing in the voice screen (P6.12) (#915)
• managed: the gate is open in 0.10.0, and the fence's measurement is what remains (#913)
• mailbox: the MAC function, the keychain read and the inbound gate (mobile P4.1 T2) (#916)
• mobile docs: the EAS signing runbook refreshed against the tree (P4.4, supersedes #609) (#924)
• console: a path is not a token, and the run's pull request is a line (#819)
• console: commit the darwin e2e golden baselines (#629)
• credsvc C2.4: the docs and Check 96 written — GitHub tokens through the service, and nothing claimed that the tree does not do (#906)
• release: the 0.10.0 highlights and the end-user summary (#912)
• website: the link card has a picture (og:image, 1200x630) and is a large card (#909)
• runner: account tier A as notional, log the switches, lock the record it saves, and split money from notional in every reader (#904)
• SECURITY.md, docs: the credentials service, the cascade and the outage runbook, stated exactly (D148, Q6) (#900)
• cli: serve no longer sets credsvc.Config.Audit (#902 made the server's own auditor the only one); the integration branch builds again (#908)
• credentials service C1.23: Checks 94, 95 and 99 written (docs) (#905)
• credentials service: serve is configured end to end (the seven names, and the audience init fills) (#903)
• credsvc C1.11: every issuance and refusal on the answer path is audited (#902)
• cli, runner: refuse a cascade run whose project publishes no model allow-list (#901)
• github, runner: installation tokens from the service; the job reads no App key (C2.2) (#896)
• credentials service C1.5: Check 92 written (docs) — the rules deployed, written and NOT RUN (#875)
• credsvc C1.14: the serve command, its real host and image, and the workflow staged (supersedes #872) (#899)
• credsvc: the service refuses a project that publishes no model allow-list (#898)
• runner: wire agent.auth cascade — the service upstream, the policy switch (O2), the record (#893)
• credsvc, gateway: an upstream's X-Fugaro-* answer headers are not copied on, and the agent never sees the probed tiers (#897)
• credsvc C1.16: per-call accounting — tier A notional, B/C real, the by-tier split, and the switch log (#894)
• setup-wizard W2.6 follow-up: the census sees the bare init --<flag>, the live tree names the doors, and no refusal prescribes the retired verb (#891)
• cli: owner-run fugaro creds set and fugaro creds ls over the one bundle secret (Q6) (#886)
• credsvc: probe a backed-off credential before routing work to it (C1.12, D153) (#889)
• credsvc: the GitHub mint endpoint (C2.1, D145) (#885)
• e2e: the install-and-onboard tests are the update tests (#890)
• credsvc: refuse a request the gateway would refuse, before the bundle loads (#887)
• W5.1: fugaro update's stage set, its refusals and its non-interactive contract (#878)
• credsvc: the audit log — one structured line per issuance and per probe, names only (C1.13) (#865)
• gateway, runner: the service upstream — the job's ID token to the credentials service, and a halt when it is unreachable (C1.15) (#830)
• cli: the wizard asks every question before the loop applies anything (#884)
• docs, README and the plugin skills: fugaro setup and fugaro update replace fugaro init (#849)

• Task: credentials service C1.11: the service's forward and the cascad… (#867)

• cli: setup asks whether to onboard the checkout's repository (W3.4) (#873)
• check91: absence is an empty list, not an error string (the real gcloud says "Cannot find service") (#881)
• website: the four levels are the boards' own PNGs, and AWS and Azure are no longer claimed as wanted (README, FAQ, Why GCP) (#882)
• cli, preflight: the Cloud Billing API's refusal, its typed offer, and the project number it names (W4.4) (#877)
• website: the four zoom diagrams are the owner's approved boards, drawn as the site's SVG (#874)
• website: /why-gcp/, the claims file behind it, the FAQ's seventh answer and the D249 framing gate (#866)
• skills: look at a run when it passes half its per-run cap (#880)
• setup wizard W4.5: the comments say what the billing list may do now, and keep what it still never does (#876)
• check 68: the workdir is keyed by the GCP project id, not the installation name (#879)
• cli: the wizard lists the open billing accounts to pick from, at a real terminal only (#853)
• website design-ref: the four owner-approved zoom diagram boards (2026-10-22) (#869)
• website: the phone app's page, its claims and its menu item (zoom plan Part 3) (#863)
• website feedback D: visible ...

Fugaro Console 0.10.0

The Fugaro desktop console built from the CLI's v0.10.0 tag (the same commit and the same release gate). Signed with a Developer ID certificate, notarised and stapled; console-verification.txt records the checks run on these exact files, and console-sha256sums.txt their SHA-256.

v0.9.7

Fugaro v0.9.7

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.9.7
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• The job images publish again: the 0.9.6 release could not publish them, because their vulnerability scan stopped on a Python library bundled inside two copies of pip that nothing in the image uses, and 0.9.7 removes those copies, so the scan passes and the cheaper review stage of 0.9.6 reaches cloud runs once a repository refreshes its images.

For operators

1. Per machine — upgrade the CLI on every machine that runs Fugaro: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade: it pins the plugin to this release, updates it in Claude Code and refreshes the repository's job images from this release's base image, which is what carries the cheaper review stage to your runs; it builds images, which costs money (--yes confirms each build). Do not run it against 0.9.6: that release published no job images.
3. Everything else in 0.9.6's notes (fugaro setup and fugaro update replacing fugaro init) applies unchanged; this release changes no cloud resource by itself.

Known limits

• The 0.9.6 job images do not exist. Its tag stays as the CLI-only release it is; its base image was never published, so a repository cannot refresh its images from 0.9.6.
• The scan still lists HIGH findings that do not stop a release: the Go standard library inside the bundled gcloud helper, crush, docker, gh and yq, and one in fugaro itself; they gate nothing today and are tracked for the next release.

Changelog

• images(base): drop the unused pip from the private Pythons (v0.9.6 Trivy CRITICAL) (#858)
• website: the v0.9.6 summary carries no backticks (the changelog test renders plain text) (#857)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-history:0.9.7 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
• ghcr.io/dimipaun/fugaro-base:0.9.7 and ghcr.io/dimipaun/fugaro-base:0 (one index for linux/amd64 and linux/arm64; per-architecture tags 0.9.7-amd64 and 0.9.7-arm64)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64 (and, for fugaro-base, linux/arm64); each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.

v0.9.6

Fugaro v0.9.6

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.9.6
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• fugaro setup and fugaro update replace fugaro init: setup is the first run, which creates the installation or adopts one that already exists, and update re-converges an installation after a CLI upgrade; fugaro init now only says which of the two to run.
• fugaro setup asks its questions once, in a fixed order, each with a suggestion that Enter takes and a flag that answers it (the GCP project's ID, the region, whether to create the project or adopt an existing one, and the project's name), and a run nobody can ask names every missing flag in one error instead of one at a time.
• A cloud run's review stage now compares the branch with the base the run actually works on instead of with main, so a run on a long-lived branch no longer reads the whole branch against main, a follow-up uses the pull request's current base, binary files reach the reviewer as one line each, and a very large diff is flagged to the reviewer up front; runs on such branches cost a fraction of what they did.
• fugaro --version and fugaro -v print the version, like fugaro version.
• The working and parallelism skills warn about the review cost of runs on long-lived branches and teach a daily look at the most expensive runs.

For operators

1. Per machine — upgrade the CLI on every machine that runs Fugaro: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade: it pins the plugin to this release, updates it in Claude Code and refreshes the repository's job images. The cheaper review stage reaches your runs only after this refresh, because the runner that does the review is the one in the job image; it builds images, which costs money (--yes confirms each build).
3. Per installation — wherever a document or a script of yours says fugaro init, say fugaro setup for a first run and fugaro update after an upgrade; fugaro update --help lists the flags, and it refuses by name the flags that only setup takes. This release changes no cloud resource by itself.

Known limits

• The setup wizard is not finished. fugaro setup and fugaro update work as described, but the questions that suggest a project ID, pick a region apart from the Firestore location, find your billing accounts and ask for a first repository belong to the next release, so for now the flags the old command took keep their names and still have to be typed.
• fugaro init no longer does anything. It refuses and names the two commands that replaced it, so a script or a CI job that calls it fails until it is changed.
• The credentials service, the managed deployer and the Batch backend are not in this release. They are built on their own branch and ship with the next one.
• Cloud runs on branches other than main keep their old review cost until step 2 above has run for the repository, because the images still carry the previous runner.

Changelog

• website: the security drawing is one picture in two layouts, and every "Also true of a run" fact carries a bullet (owner's feedback C) (#843)

• Task: setup wizard W1.3: setup is the wizard (the create/adopt ques… (#835)

• website: the owner's 2026-10-21 feedback — the spark, Home in the menu, and the slider (#842)
• runner: the review stage diffs against the run's real base, not main (#840)
• website console: the screenshots slider counts, clicks and advances; the download cards stand in one row; the shasum line comes out (#841)
• skills: a run on a long-lived branch names its base, and says what its review costs (#839)
• cli: every fugaro init line names the door the reader is at (setup-wizard W2.1) (#832)
• website console: the four screenshots are on the page (#818)
• cli: W1.2's four review leftovers, and the two red tests on main they hid behind (#834)
• W2.2: the strings outside internal/cli name fugaro update or fugaro setup, not fugaro init (#833)
• cli: fugaro setup and fugaro update replace fugaro init; init is a tombstone naming both (#789)
• website: the run drawing is painted again, and the paint is a gate (#816)
• fix forward: main's ci job test is red on four tests — the rigor-modes census figure, the rename census's frozen list, the ignored-output coverage, and the copy-in proof they break (#815)
• FAQ: the empty "How Fugaro compares" section comes out (#817)
• review: the reviewer may not read a binary, and the marker's name is always quoted (#814)

• Task: the Fugaro CLI on Windows, Slice 1: compile, start, and read th… (#763)

• review: the reviewer is handed the diff as text, binary files as one line (#807)
• console: the bold redesign — the hero, the screenshot frame, per-OS download cards, the facts (#805)
• setup-wizard W0.2: the fugaro init rename census, pinned as a test (#772)
• leftover minors before the 0.10.0 tag: mobile leftovers: #666 #695 (#785)
• website leftovers before 0.10.0: #739's two closed, #678/#705/#726 verified already landed (#786)
• website: the privacy page wears the bold look (redesign P1) (#809)
• website: the caps-and-costs page in the bold look (#804)
• website: the community page in the bold look (redesign P1) (#803)
• website: the security page in the bold look (redesign P4) (#801)
• website docs: the bold look on the docs hub, from the site's own shapes (#800)
• website: the getting-started page rebuilt from the owner's board (redesign P4/P5) (#799)
• website: the changelog page in the bold look, pinned by five cases (#797)
• website: the bold look on the FAQ page (#795)
• website: how-it-works takes the bold look (redesign P8, board HowItWorksV3) (#802)
• cli: fugaro --version and fugaro -v print the version, like fugaro version (#794)
• website: the bold look, and the home page rebuilt from the owner's board (redesign P1) (#779)
• console: all five ledger leftovers (#694 #701 #709 #713 #717) are already closed at HEAD (#792)
• mobile: the Android launch crash, its cause, and a guarded startup that shows the next one (#790)
• console: a one-command, fixture-only screenshot run for the website's Console page (#768)
• mobile: the app wears the Fugaro logo on both platforms (#791)
• The 0.10.0 leftovers: #764 and #761 fixed, #742 already closed at the head (#784)
• setup wizard W4.2: gcloud billing accounts list as the fallback for the billing client (#781)
• website: the owner-approved bold design boards, kept as a read-only reference (#778)
• setup wizard W1.1: initflow stops naming a command (the stage engine) (#765)
• billing: list the open billing accounts a user can use, ids and display names only (#769)
• cli: pin the confirmation matrix both front doors must pass (setup wizard W0.1) (#770)
• console: a Linux build (AppImage and .deb, unsigned) for 0.10.0 (#758)
• terraform, schema and the example config: the descriptions name fugaro setup or fugaro update (W2.5) (#766)
• docs/mobile/voice-session: the owner's spec for a hands-free voice session, reconciled against the tree (#761)
• website: "Why Fugaro?" heading, the security drawing's cards, and budget re-derivation only on request (#762)
• website: retire the orphaned four-step flow and give its gates to what the pages show now (#756)
• mobile: record the App Store Connect app id in the submit profile, and the submit path in the README (#759)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-history:0.9.6 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
• ghcr.io/dimipaun/fugaro-base:0.9.6 and ghcr.io/dimipaun/fugaro-base:0 (one index for linux/amd64 and linux/arm64; per-architecture tags 0.9.6-amd64 and 0.9.6-arm64)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64 (and, for fugaro-base, linux/arm64); each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.

Fugaro Console 0.9.7

The Fugaro desktop console built from the CLI's v0.9.7 tag (the same commit and the same release gate). Signed with a Developer ID certificate, notarised and stapled; console-verification.txt records the checks run on these exact files, and console-sha256sums.txt their SHA-256.

Fugaro Console 0.9.6

The Fugaro desktop console built from the CLI's v0.9.6 tag (the same commit and the same release gate). Signed with a Developer ID certificate, notarised and stapled; console-verification.txt records the checks run on these exact files, and console-sha256sums.txt their SHA-256.

v0.9.5

Fugaro v0.9.5

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.9.5
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• The desktop console has its new look: one dark stylesheet bundled into the app, a two-column layout with an installation rail beside the screens, styled Live, Spend, Projects and Run screens, keyboard navigation (the arrow keys through the navigation and the rail, Command+digit on macOS or Control+digit elsewhere for a rail row) and the website's mark as its icon; it stays read only and is published for this release as its own download, console-v0.9.5.
• fugaro budget set, fugaro budget kill and fugaro budget resume take --repo with no value to mean the repository this checkout belongs to, so fugaro budget set --repo --daily 150 sets the caps of the repository you are standing in, and the bare form is refused outside a checkout whose origin names a repository rather than guessed.
• fugaro project repos ls lists the project's allow-list against the repositories that have actually run there (read from the runs bucket and the daily spend records rather than from the runs in flight), marks each one admitted or not, and says so plainly when a repository's name cannot be recovered.
• fugaro project sync is new: it asks GitHub which repositories the project's GitHub App is installed on and offers the ones the allow-list does not admit yet as one list confirmed once, only ever adding names (reading the App's private key needs --github-app-key, which is refused in a coding agent's session).
• fugaro init --provision-batch is turned back on, with the reaper's role reduced to the five permissions Google defines (batch.jobs.cancel, which is not a permission Google has, is gone, so the role can be created), and fugaro backends ls lists the compute backends a project config may name and which one it uses; both are groundwork, since no run can use the Batch backend yet.
• The provider price catalog was checked on 2026-10-20 and carries 5 models over 95 endpoints (75 ZDR-eligible).

For operators

Only the database rules move in this release, so the order is short: upgrade the CLIs first, because a 0.9.0 fugaro doctor reads this release's rules as a skew and prescribes the redeploy that would undo them.

1. Per machine — upgrade the CLI on every machine that runs fugaro doctor or fugaro init against the installation: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade --local, so the plugin pin follows the CLI (the setup and working skills changed) without a cloud call.
3. Per installation, in your own terminal, outside any repository checkout — run fugaro init --firebase <gcp-project>. It deploys this release's database rules (the credentials service's groundwork: the creds/ node denied to every run token, and new optional children only a credentials-cascade run writes) and records their generation at config/limits/credsRules; it prints what it changes before it applies anything. Until it runs, this release's fugaro doctor reports policy-rules-skew as a warning, and nothing else behaves differently. In a checkout it would also pin this release's base image and move the shared jobs onto it, which this release does not need.

Nothing else is required: no policy republish, no fugaro init --repo and no image rebuild. The runner's changes are the wording of one error and fields only a credentials-cascade run writes, and no launch check asks for a 0.9.5 base image. When you do move a repository's images with fugaro upgrade (its cloud step) or fugaro image refresh, the shared jobs follow only on a later fugaro init --firebase <gcp-project>, per installation, run on that machine, as in 0.9.0.

Known limits

• The Batch backend is still disabled. backend: cloud-batch is refused by this build, so no run can use it, and once it is enabled a run with a sealed budget token will be refused on it by design (the seal's key cannot be kept out of a Batch job's definition). fugaro init --provision-batch creates billable, lasting resources (a Cloud NAT and router, a boot image rebuilt on a schedule) that nothing uses yet, and its apply has not been run against a live project: the owner-run Check 57b of docs/gcp-live-checklist.md is NOT RUN. Run it only to try the groundwork.
• The credentials service is not usable. This release carries only its groundwork (the database rules above, the policy's credentials block and per-repository admissions); there is no service to deploy. routing.claude.via: cascade is accepted in a routing block but changes nothing yet (a Claude call still goes direct), and publishing it with fugaro project policy publish makes every older CLI refuse each launch and publish of the project and every older runner halt its runs, which the publish's own diff warns about, so do not publish it.
• An older CLI can undo this release's rules. Once step 3 has run, a 0.9.0 fugaro doctor reports policy-rules-skew and prescribes fugaro init --firebase; run with that older CLI, it redeploys the older document and takes the credentials children away. Upgrade that machine's CLI instead: this release's fugaro doctor then reports the older document as policy-rules-skew in its turn, and its fugaro init --firebase puts this release's rules back.
• The price catalog has no Claude rows. A Claude model named in a route (the anthropic/<id> a provider route claims) must be priced under model_prices in the project config; the catalog prices none of them.
• Managed projects stay disabled, exactly as in 0.9.0. Every command that would create a managed project or act as its deployer still refuses before any cloud call, and the deployer's redesign is not in this release.
• The console still asks for each installation by hand. Its installations window takes a project name you type and a fugaro binary, a config file and a checkout you choose; finding them by itself is planned for 0.9.6.
• The live checks have not been run, and only you can run them. Every owner-run, sandbox-only check in docs/gcp-live-checklist.md that this release's changes touch is still NOT RUN, Check 57b among them, and fugaro project sync has not been run against a live GitHub App.

Changelog

• release 0.9.5: the two docs that name the released CLI say 0.9.5, and the checklist says to move them before the bump (#755)
• release prep: price catalog regenerated, pricing checkedAt, managed-deployer release label (0.9.5) (#744)
• brand: the owner's 2048 px logo is the new source; derived icons regenerated (#740)
• mobile: declare the export-compliance answer in the build's config (#745)
• mobile: declare the Expo SDK 58 dependencies, so eas build can find an SDK (#738)
• website how-it-works: close the nine findings the diagram rounds' reviews left (#739)
• release notes: v0.9.5 highlights and the end-user summary (#743)
• website how-it-works: one diagram with arrows, and the run in words under it (#726)

• Task: fugaro budget set --repo with no value means this checkout's … (#668)

• compute: Task 9 follow-ups — the socket gid's field, the reaper pin's name, Task 10's gid gate, and the plan-only rebuild (#725)
• compute: batch.image's path grammar, and a shared-config claim the reader does not make (Task 8 follow-up) (#724)
• compute: the provisioning that completes — the reaper's five permissions, the recorded socket gid, and --provision-batch (Task 9) (#703)
• console: Task 6.5's four leftovers — three rows on the physical key, and a log told straight (#723)
• console: the app icon is the website's mark (#722)
• compute: the Batch opener, its configuration, fugaro backends ls and the seam's call sites (Task 8, first half) (#702)
• website home page: the Benefits points bigger, bolder, with an icon each (#718)
• console: the window paints its ground first, and the nav and the rail take the keyboard (#717)
• project sync and project repos: enrollment as data (plan task 4.1) (#662)

• Task: credentials service Task C1.3: the rules (creds/ denied, the ru… (#671)

• console: the Task 6.4 leftovers — two tones, a guard that read the design, and no count of the theme's files (#720)
• compute: Task 14 — the seal's carrier on Batch is refused, and the refusal is the answer (#704)
• console: the screen rules, and the fifth number hook (Task 6.4) (#714)
• C1.2: the cascade's credentials block, the per-repository admissions and via: cascade (0.9.5) (#670)
• console: Task 6.3 follow-up — the two stale docstrings from #709 (#713)
• mailbox P4.1 T1: the message binding and the schema vectors (SECURITY-SENSITIVE) (#695)
• website privacy gate follow-up: the two-tools clause is held to its sentence, and P4's amendment says the always-on truth (#712)
• console: Task 6.3 — the layout, and the installation rail (#709)
• website: the stacking gate's two follow-up gaps (#678 review) (#710)
• console: the Task 6.2 follow-up's two open review leftovers (#708)
• website privacy statement: the app's analytics and crash reporting are always on (owner ruling) (#705)
• website: the console downloads follow console 0.9.0, and the build holds the tag prefix (#707)
• website: the header paints above the page's blocks, so the mobile menu is never covered (#678)
• console: the stylesheet step's review minors and nits (Task 6.2 follow-up) (#701)

• Task: Cloud Batch / compute backend: the implementation plan (0.9.5) (#673)

• mobile P3.5: the voice screen — the interrupt switch, the queue, the offline refusal, the lease (#677)
• mobile: demo mode — "Try the demo" on the first screen, for Google Play review (#696)
• console: the stylesheet is bundled, served and linked (Task 6.2) (#694)
• mobile: the job list (P3.3) — numbers and states only (#666)
• mobile: the text screen (P6.9) — the same pipe...