description: Review firefly forge release changes, runtime requirements and the verification boundaries of each published version.

firefly forge release notes

0.2.42

An explicitly reviewed remote-completion request can confirm a saved local checkpoint after an uncertain push or draft-review outcome. It retains the original unknown request, exact AI-written review text and local checkpoint; a new finite consent grants remote completion only. The execution owner checks current authority, source, credentials and the exact expected branch before any write. A newly confirmed receipt records recovery provenance rather than claiming the original write succeeded. A later unmatched intent remains visible as uncertain even when an earlier draft was confirmed.

Final checkpoint cleanliness uses the same generated-path exclusions as source staging and rechecks them afterward. Natural status reads verified checkpoint and remote facts and refreshes them when execution state changes during the provider response or final lock wait. These observations grant no execution or additional budget.

On Darwin, diff cleanup distinguishes an exited, unreaped owned child from a live process whose signal was denied. A bounded reap is accepted only after the process group is proven absent; genuine denial and surviving groups remain errors. The separately qualified v9 source-only profile pairs fresh native tool-boundary evidence with same-source SQL budget and lease measurements. Its admitted lifetime read-file limit is 20 and canonical activation ceiling is 6; shared tool, command and final-check limits remain unchanged. Historical v8 evidence remains unchanged. These controlled proofs do not establish completed CRM delivery or general live-provider acceptance.

0.2.41

Large source changes use private chunked artifacts, hash-backed file indexes and bounded content pages. Project storage and time budgets are separate from response and preview sizes. Studio, the API, the typed Python SDK, the operator CLI and read-only MCP tools can inspect the exact retained run or checkpoint diff. See Inspect large source changes for configuration, integrity checks and remaining whole-repository scaling boundaries.

A natural GitHub checkpoint request can review current source, including untracked files, without requiring an automatic pause checkpoint. The read-only candidate preserves the index and HEAD. The native execution owner later checks that exact source and current permissions before saving a commit. A failed legacy unit has a separate one-use administrator adoption flow that retains its failed status and marks its checkpoint as unverified partial work. These operations do not add coding budget or declare QA complete.

A separately authorized test or maintain run can select an exact saved checkpoint while preserving its original repository, project and component. Both require publication to be disabled, a fresh native creation request and a confirmed remote receipt. Admission observes the branch reference without fetching the repository; execution checks the selected commit and tree after cloning. Maintain mode is included in the resolved source digest and starts an ordinary work unit with current configuration, its own session and counters. The original failed run, spent budgets, questions and grants remain unchanged. Existing test-source digests retain their default representation. Selection is refused if the checkpoint branch has advanced; read-only issue lineage grants no answer, resume or new launch authority.

Automatic worker verification prepares source identity through a streamed catalog outside database writer units. Hashing and sorting run off the runtime loop, with current-authority callbacks and cancellation cleanup. Command and subsequent provider admissions retain that source cut under exclusive workspace ownership. Explicit adoption, review archives and other transports retain separate scaling boundaries.

Provider activity presents completed native summaries and usage as readable records, with retained structured details available for inspection. The updated walkthrough uses controlled desktop/mobile light/dark fixtures. Native budget readmission accepts the exact currently qualified parent seal or strict older profile provenance; fresh dependency closure and v8 measurements remain required before adoption, and spent counters and prior grants remain unchanged. Host and visual checks do not establish completed CRM delivery or a live remote draft review.

0.2.40

Projects can configure development checkpoints for completed implementation rounds and safe worker pauses. A run records its schedule and original Git baseline; each checkpoint extends its last confirmed factory commit. GitHub and GitLab adapters can update one retained draft review, then mark that same review ready after final verification and approval. Remote updates compare the exact expected branch revision and preserve fast-forward ancestry. Changed review identity and unknown outcomes stop further writes. Checkpoints remain disabled until configured, and disabling the project policy stops further checkpoints for existing runs without removing saved commits.

Studio adds a workflow form and saved-progress history, with complete commit and source-tree identifiers on desktop and mobile. Six API, SDK, CLI and MCP operations expose configuration, checkpoint requests, receipts and read-only observation under current project permissions. The development workflow guide illustrates the portal with controlled fixtures and explains what a draft checkpoint establishes.

Implementation handoffs now read bounded, authenticated question-and-answer history rather than only the latest answer. Historical diagnostics remain labeled and confer no authority. The report schema also expresses the existing requirement that a blocked or clarification response include a typed question; invalid reports retain a fixed error without echoing their contents. GitHub polling projects a bounded candidate descriptor before credential admission, keeping full conversation content in its original inbox records.

An explicit known-completed-output review can admit the next finite source-only activation after a completed native turn returned an invalid implementation report. It binds the retained dispatch, output, tool history, unchanged Git index and freshly reviewed source. It does not fabricate a question, treat output as successful implementation, reset budgets or replay the failed dispatch. This path requires its separately measured v7 native profile; historical profiles remain unchanged. See source-budget recovery.

Controlled host, browser and native qualification have separate evidence boundaries. These features do not establish completed CRM delivery, live remote draft acceptance or a successful external deployment.

0.2.39

A paused source-only task can continue through separately reviewed human-answer or completed-output admission. The review retains the original run, source, command budget and uncertain effects; it does not replay an old request. Completed-output observation binds the retained stdout descriptors and accepts only the exact pinned pre-turn CLI notice. It does not infer process exit or implementation success from a completed turn.

Pending native worker questions now have their own durable publication outbox. The factory checks current issue, identity, repository and polling authority before the configured AI writer and before posting. Confirmed publications support ordinary human replies in the same issue, including after the original source grant expires. Saving an answer grants no execution or additional budget. Renewing the same account's read consent preserves a confirmed question's exact historical proof; current scope, identity and respond permission are still required. Unknown remote outcomes remain held; a definite local refusal before dispatch can retain the same draft for a later authorized attempt.

An administrator can review an explicit finite source-read allowance through the API, SDK or CLI. The measured v6 Codex 0.163 Darwin arm64 profile supports a lifetime read-file limit of 20 and canonical activation ceiling of 5 for that separately admitted continuation. Existing tool rows and spent counters remain intact, the shared tool ceiling stays 30, and the original command allowance and final verification checks remain unchanged. Ordinary source limits remain 10 reads and four activations. Final allowance writes use the physical execution-lease connection and roll back when ownership is lost before commit.

Natural question selection supports grounded cross-language answers using the exact offered question and human spans. GitHub App reads and feedback share bounded, persistent provider cooldowns. A known local no-dispatch hold retains one intent and draft across restart; an uncertain dispatched write still requires reconciliation.

The prompt catalog adds a versioned source-continuation resource while preserving existing resource bytes. Historical v5 profile evidence remains immutable alongside the new profile. Studio keeps the published 0.2.38 interface and refreshes its controlled walkthrough for the 0.2.39 stamp. Controlled native transport and PostgreSQL evidence cover their stated boundaries; actual model behavior, completed CRM delivery and generated-product acceptance remain separate.

0.2.38

Natural replies to a confirmed pending worker question no longer load unrelated provider and tool output from the whole execution journal. The lookup selects the exact run and question ancestry, enforcing its row and byte limits in one SQL statement snapshot before returning payloads. A large retained diagnostic history therefore cannot hide a small current question; changed or ambiguous question evidence still refuses answer application.

The source-control guide starts with ordinary issue conversation and replies without copied command identifiers. Typed commands remain available as an advanced compatibility path. Tool documentation distinguishes the conditional native registry from ordinary CLI permissions and the separately qualified source-only profile. This release does not introduce owner-note delivery, repeated restricted source readmission or a new model allowance.

0.2.37

GitHub conversations accept ordinary language for product requests, status and answers. A reply to a confirmed pending question can omit the mention when its issue, author and question binding are unambiguous. The factory retains the original text and question provenance across restarts. Ambiguous references ask for clarification rather than guessing a run or requiring a command. See the conversation guide.

Conversation authority does not authorize execution. A late answer remains available after execution consent expires; continuing the original ProductAssistant session or worker task requires fresh bounded native authority for that exact context. Product requests use the existing functional assistant, knowledge and configured task route. Proposals remain unreviewed. The selected Agentic or Bridge communication route uses Humanizer instructions, with one correction for a confirmed invalid response and no automatic replay of an unknown provider outcome.

The package includes a measured source-only Codex 0.163 Darwin arm64 capability profile. Its tool, loader, runtime and filesystem evidence is specific to that profile. MCP resources accept bounded standard progress metadata and return correlated errors without broadening tool arguments or resource access. Source reconciliation preserves the original intent and spent command budget; an explicitly reviewed generated index entry can be sanitized without discarding source changes. See the recovery guide.

Studio makes retained worker questions, recorded answers and continuation state visible with responsive evidence. The complete controlled walkthrough is regenerated for version 0.2.37. Host, browser, native PostgreSQL and finite no-model protocol proofs cover their stated boundaries; actual CRM completion, external model behavior and generated-product acceptance remain separate.

Known limitations: a restricted source-only grant admits one implementation attempt. A saved human answer does not grant the next attempt; dedicated human/source readmission is being implemented in a separate successor. The generic native conversation proofs do not establish that restricted resume. Retained verification context can also be clipped and omit the root error; scoped retained-diagnostics retrieval is being corrected separately. Preserve the paused request and its evidence while these boundaries remain held.

0.2.36

A GitHub issue can host a separately authorized functional conversation. A native administrator reviews the exact API-observed account, project, repository, issue and named assistant profile, then records a finite allowance. Start and status do not invoke a model; each turn reserves one of at most three assistant model turns before entering the product provider. The same issue-bound conversation can receive a natural message addressed to @forge. Unknown outcomes retain their original request and allowance instead of triggering an automatic retry. See the functional GitHub dialogue guide.

Grant review reports the mapped native user's readiness for each action. Status requires an enabled account with current project read membership; start and turn require edit membership. The administrator's own role does not grant the mapped person those permissions. Active consent is refused before a grant or allowance ledger is written when the membership is insufficient, and admission checks it again under the existing native transaction locks.

Feedback uses confirmed assistant facts rather than inventing an execution state. Status distinguishes the latest attempted turn from an earlier completed response, keeps the original reply and questions, and places turn references in a collapsed section. It retains the sanitized reply and questions, including slash-separated prose and line breaks, while keeping any proposed product definition unreviewed. A selected AI communication profile still uses the separate full-candidate classifier and one final correction within the existing three-request ceiling. Material failures hold the response without a substitute message. Changed outcomes, revoked authority and later operator decisions fence stale replies before publication.

Source-only activation has its own versioned command and native administrator consent. It binds the original issue, repository, run, task, source candidate, qualified native profile and SCM caller provenance. The administrator remains the sealed authority; the SCM caller retains its own identity. This route preserves the existing run and command budget, including the reserved final checks. It refuses activation when no matching native capability has been qualified. This release does not add a production native profile or establish completed native CLI isolation, live GitHub execution or generated-product acceptance.

GitHub polling accepts the provider's canonical numeric repository pagination path only when it matches the verified repository, API origin, resource and exact query. The existing page ceiling, cursor and immutable consent remain in force.

The prompt catalog contains 301 versioned resources and preserves all previous prompt bytes. Studio adds a functional-consent walkthrough and exact-receipt recovery guidance. The source also retains the published read-only patch-index fix and its ordinary and source-only regressions, plus the two-tab final-allowance reservation test. Controlled host, browser and PostgreSQL fixtures qualify the recorded transitions; actual provider and product acceptance remain separate.

0.2.35

Studio keeps your place on the production floor. Choose a project, switch to Board and select a manufacturing run; after Inspect or a visit to another page, returning to Factory restores those choices. The selection stays in memory for the current session. Switching the signed-in user or factory API, or disconnecting, resets it. A project or run that disappears from the accessible list no longer supplies the selected plan.

The Factory view and selected run also keep loaded records bound to the current user and factory API. Retained records remain hidden while the identity check is pending or has failed. A new user triggers a fresh read, and late replies from the previous user or API cannot replace the current records or alter current run feedback. This includes a publication response that finishes after the user changes.

On phones, Project and Manufacturing run each use a full row, keeping the selected run label readable. Shorter guidance leaves room for the production scene above the footer after a run opens. The walkthrough captures carry the 0.2.35 version stamp. Controlled two-project browser cases cover navigation, removed records, delayed identity checks and stale responses. These fixtures do not establish live provider behavior or generated-product acceptance.

0.2.34

When an administrator selects an AI communication profile, the factory asks it to write the proposed pull request's complete title and description before pushing its implementation branch. The writer uses admitted recorded facts, versioned YAML/Jinja prompts and the existing Humanizer instructions. A separate AI request classifies the candidate; unsupported or uncertain wording receives one final correction within the existing three-request ceiling and shared profile deadline. The prompt catalog contains 289 resources, preserving all previous resource bytes.

The exact title, body, hashes, profile and review evidence are saved in PostgreSQL before the publication journal intent or push. Current source, checkpoint, communication profile and release-actor authority are checked again before each outbound effect. The admitted context excludes the brief, source files and raw logs; the bounded worker summary must pass credential admission before it reaches the writer or retained public draft. In both AI and recorded modes, missing or invalid publication facts hold publication before any model call, separately from a selected provider failure. See AI communication profiles.

With AI selected, provider failure, invalid output or failed native checks holds publication without a substitute template. A failure before push records empty public text only while the original execution owner and expected publication state remain current. A stale owner leaves later drafts, actors, status and pull request URLs untouched. Revoked authority after a push prevents creation of the pull request. An uncertain remote response retains the original draft and intent for observation instead of generating another draft or automatically repeating publication. Explicit recorded mode remains available when no AI communication profile is selected.

Controlled model and provider transports verify the existing GitHub, GitLab and Bitbucket adapters. Native PostgreSQL cases verify committed Store/Journal custody, current membership, source changes, credential refusal, execution-owner takeover and unknown-outcome holds. These checks do not establish external model quality, live SCM delivery, native CLI isolation or generated-product acceptance.

0.2.33

Studio's development and test toolchain pins Vitest and its associated locked packages to 4.1.12. This version fixes the manual mock code-injection issue GHSA-qxg6-89mg-rqv8 and the Windows redirect path-traversal issue GHSA-xp26-3454-mjgp in @vitest/mocker. Other locked dependencies retain their existing versions.

Source developers should install from the updated lockfile and run the full dependency audit described in Studio development tools. The development server retains its loopback listener. Factory execution behavior and runtime dependency requirements are unchanged; the Studio footer and canonical walkthrough captures carry the 0.2.33 version stamp.

0.2.32

A mapped person with current project read access can ask a bounded status question directly in a GitHub issue or pull request: @forge, how is this going? or @forge, ¿cómo va el CRM?. Signed comments and separately configured polling use the same ticket-scoped context rules. @forge is a native address alias, not a GitHub account or App rename. The configured technical App slug remains compatible. See ticket status conversations.

The factory resolves an execution from that exact ticket's native links or earlier authenticated receipts. Several active executions require clarification; an absent link does not select the latest repository run. A terminal ticket uses its latest explicit context receipt. Original source verification stays intact, and current comment, account, project and read consent are checked again before the reply. Status wording grants no execution permission or new provider attempt.

With an AI communication profile selected, the writer handles English and Spanish responses for selected, missing, ambiguous and clarification contexts. Typed selection facts contain no raw comment instructions or fabricated run. New central language and system instructions bring the catalog to 286 resources while retaining existing versions. A separate AI classification can trigger one correction, followed by the response through native framing and authority checks. The three-request ceiling and shared profile deadline remain unchanged. The original review applies only to the original candidate; a corrected response retains its own digest. Material failures hold configured AI delivery without a generic substitute or automatic repeated calls.

Studio can display a retained agent question's raster evidence in an authenticated preview, with zoom and the full recorded context and choices. Image reads require current project access and use private, non-cacheable responses. The runtime uses pyfly 26.10.7, which preserves a single authoritative security-header value. Studio shows one question action and keeps resume and provider handoff unavailable while an answer is pending. Answering records the decision; resuming remains a separate authorized action. A direct run link or currently available reply command guides the person to the recorded question. Communication profile selection and routing use an optional current-revision seal to detect concurrent changes.

The empty Studio assistant offers Start conversation after task selection. Creating a conversation prepares the dialogue; the model runs when you send a message.

Agentic request checkpoints support Pydantic AI 2.58 telemetry fields by retaining known string sets in a deterministic order. Unsupported values stay rejected, and the original request, runtime and replay checks remain in force.

Retained environment continuations with unmetered official-CLI activity are refused before admission, filesystem changes or provider launch. The refusal reports observed CLI calls, governed runner calls and required final checks; missing, conflicting or incomplete archives also hold. These observations are not native runner receipts, and the guard does not preventively enforce a combined command limit inside the CLI. See legacy workspace reconciliation.

Controlled model outputs and native PostgreSQL/API cases qualify context, authority, exact receipts, one-correction publication and replay behavior. They do not establish external model inference, the quality of an actual App response or generated-product acceptance.

0.2.31

Initial and ordinarily resumed Codex, Claude, Bridge and native Agentic implementers receive the run's frozen verification commands with their exact argument boundaries and timeouts. The read-only contract also identifies separate policy checks and the existing final-verification ceiling. It grants no tools, credentials, execution permission or network access; a separately authorized configured-check channel retains its own authority and limits. Exact checkpoint restoration preserves its original bound instructions. The versioned prompt catalog contains 276 resources.

An answered implementation question can continue a zero-repair run after an authenticated operator explicitly resumes it. The immutable resume record binds the original question and authenticated answer, and each answer admits its next ordinary implementation attempt once. The run's frozen request bound remains at most three; ordinary implementation remains capped at four attempts. Already-spent calls, usage and the repair budget stay recorded. Missing or ambiguous answers, changed bindings, cancellation, revoked authority and active provider recovery keep continuation held. Other roles keep their existing resume behavior without added implementation capacity. See worker feedback.

Issue and pull-request updates can use AI wording when an administrator explicitly selects an Agentic or Bridge communication profile. The agent writes the complete title and explanation from bounded recorded facts, with the pinned Humanizer adaptation and a 1,400-token output ceiling. A separate structured AI request classifies that candidate against the same facts. Unsupported claims or uncertainty trigger one final AI correction, followed by the response through native framing and current-authority checks. There is no second semantic veto. Supported responses use two model requests; a correction uses three, with SDK retries disabled. All requests share the selected profile's total deadline, capped at 120 seconds with a 60-second default when absent. A shorter configured timeout remains in force.

The AI-authored card preserves a pending human decision's bounded public question, context and ordered choices exactly. Trusted references remain separate from generated prose. Native checks enforce structure, citation identities, exact quotations and current authority; the AI classifies meaning without keyword lists. Its review is bound to the original candidate, and a corrected response retains a separate digest without being labeled independently approved. An allowlisted source-guard report is not an independent security diagnosis; raw errors and command output stay outside the fact packet.

With an AI profile selected, provider failure, exhausted quota, malformed output, changed facts or failed native checks hold delivery with a retained reason and no remote comment. Repeated ticks do not automatically repeat a held request. A new explicit request can try again. Recorded updates without an AI profile remain a separate configuration mode. The receipt retains the exact body, facts, prompts, profile, skill revision and original review. AI classification remains fallible and does not establish product acceptance.

Newly prepared source snapshots also exclude untracked .venv, node_modules and vendor dependencies when they are symlinks. Already tracked private paths remain rejected, and existing retained workspace metadata is not rewritten.

An administrator can explicitly reconcile a known failed retained workspace whose historical dependency exclusions used older directory-only rules. Review the current candidate and exact preparation changes before admission; the versioned receipt preserves the failed record, source binding and original request. An uncertain filesystem effect stays held for exact readback. This operation resets no budget and grants no additional provider recovery. See workspace reconciliation.

An environment continuation with retained unmetered official-CLI activity is refused before admission, filesystem intent and provider launch. The refusal reports observed CLI calls, governed runner calls and required final checks; missing, conflicting or incomplete archives also hold. CLI observations are not native runner receipts. Counting them afterward does not preventively enforce a combined limit inside the CLI, and this operation grants no additional calls or budget reset.

This continuation does not authorize a fifth ordinary dispatch or a sixth attempt after the separate native final allowance. Controlled screenshots show the current Studio version; protocol tests and those fixtures do not establish completed CRM, live provider or generated-product acceptance.

0.2.30

Studio now shows observed Codex MCP activity as a readable tool card: server, tool, reported status and a bounded text preview. The known configured-check call is labeled Run configured project check, with its exact identity under Tool identity. Unknown tools keep their bounded server and tool names. A provider-reported completion or exit code remains separate from native runner receipts and independent final verification.

Unsupported arguments and structured result objects stay in the full retained event. Reading that event still requires an explicit action and the existing current-access, integrity and archive-budget checks. Historical events are not backfilled. See the evidence guide.

Repository feedback now labels verification retained from an earlier attempt before showing its totals. Results matched to the recovery attempt are labeled separately; incomplete attempt identity stays unconfirmed. Queueing a recovery does not turn earlier checks into current success. Existing delivered comments, fingerprints and uncertain-write holds stay unchanged. See repository replies.

The new walkthrough uses actual redacted messages from an official Codex 0.163 finite, model-free client check inside controlled API wrappers. Those messages and display tests do not establish paid provider inference or generated-product acceptance. No execution budget, recovery authority or MCP tool grant changes in this release.

0.2.29

An administrator can grant an eligible official-CLI recovery access to selected checks already retained on the run. The separate coding MCP channel exposes only run_configured_check(command_index, request_id). Arguments, timeout, runner policy and shared budget come from the original run; the coding agent cannot submit a new command. A host runner still uses the worker's service account and does not provide filesystem or network isolation.

Studio separates check review, the explicit grant, mitigation review and final reservation. Before the grant POST it retains both the exact body and the future recovery request ID. It then confirms the original receipt and current revision, opaque receipt fingerprint and expiry. The final reservation uses that same recovery identity and grant ID. Lost responses permit exact reads, not replacement POSTs. Missing browser state and an existing server grant hold the wizard for review. See the guided recovery journey.

Each new check call uses current native authority, lease, grant and source checks before runner effects. Known results retain their source and exact request; unknown effects require reconciliation. A bounded rerun after an implementation edit does not reuse an earlier source's success. Independent final verification capacity remains separate, and neither the grant nor a check result establishes product acceptance. Legacy CLI-only recovery keeps its four-attempt bound, and the final allowance still permits one fifth dispatch with no sixth or budget reset.

The SDK and forge coding-check-grants group provide explicit candidate, grant, receipt, current-status and revocation operations. Codex and Claude adapters use an invocation-scoped, loopback-only channel with a short-lived token and fixed tool selection. Tokens stay out of command arguments and retained activity. The 162 operator MCP tools remain separate; the versioned Agentic catalog now contains 260 resources. See the execution boundary and client operations.

forge serve explicitly uses the stdlib asyncio event loop. A known uvloop host with a finite POSIX file-size limit is refused before trusted CLI dispatch intent or process creation, since the verified uvloop subprocess path resets an inherited ignored SIGXFSZ. External ASGI hosts must select asyncio too. The kernel limit and all spent tasks and reservations remain unchanged. This correction establishes no generated-product acceptance; see file-size failure recovery.

Native PostgreSQL/API/runner fixtures, cross-language reader checks and controlled Studio captures qualify these contracts. They do not by themselves establish live official-CLI MCP execution or a completed CRM. The walkthrough screenshots are labeled fixtures.

0.2.28

A current native factory administrator can reserve one final fifth Codex or Claude dispatch after a known fourth-attempt process failure. The process must have terminated, drained its streams and left no process group. Reservation seals the allowance, linked admission and implementation intent in one WAL transaction. It spends the allowance immediately, even when the response is lost or dispatch never starts. Changed source, executable or current authority prevents launch; this contract provides no sixth attempt.

The original four-attempt recovery and worker-feedback contracts stay strict. Fifth-attempt feedback uses a distinct native allowance-bound variant, and a worker cannot grant its own allowance. The SDK provides separate candidate, reservation and exact-receipt methods. Studio guides the administrator through the failed attempt, mitigation and final confirmation, saves the original request before sending it once, and provides read-only recovery when browser storage is lost. See final allowance recovery and the Studio guide.

The mitigation fingerprint records the administrator's attestation. It does not establish that forge ran those tests, that the mitigation resolves the failure or that the generated product passed QA. The original source, WAL prefix, model, repair budget and spent verification grants remain attached to the same run. Controlled UI fixtures illustrate the wizard and receipt states; real provider recovery and generated-product acceptance require their own execution evidence.

Source-control writes that begin under acquired execution ownership retain that requirement across token preparation and the final authority callback. A released lease, disconnected ownership session or draining owner stops the POST, including when the Engine poller has stopped. Ownership acquired during those waits is checked too. Existing unowned manual writes retain their authorization path; these checks cannot make a remote provider write atomic with PostgreSQL. See feedback authorization.

0.2.27

Trusted Codex and Claude CLI launches on POSIX preserve an inherited ignored SIGXFSZ when the parent has a finite soft file-size limit. An oversized write can then return EFBIG while the kernel limit remains enforced. Unlimited parents, default SIGXFSZ dispositions and the separate untrusted command executor retain subprocess defaults. This branch also inherits other ignored signals, including SIGPIPE, through Python's shared restoration switch. Process-group cleanup, stream draining and typed outcome checks remain in place. See the execution boundary and failure recovery.

Bounded native and CLI comparisons qualify this launch mitigation. The original offending write and file remain unidentified. The change grants no additional attempt or budget reset and does not establish successful same-run recovery or generated-product acceptance. The 0.2.27 release refreshed the explicitly labeled Studio fixtures.

0.2.26

Studio displays Claude stream-json activity as bounded text, tool requests, reported tool results and final provider reports. Mixed messages show their omitted-block count. Unknown structured output has a generic card and an explicit reader when complete sanitized content was retained. The existing byte/hash descriptor, archive limits and current access checks stay intact. Tool requests and provider reports establish no command receipt or final factory verification. See provider activity.

A factory administrator can separately authorize a mapped GitHub account to request continuation of an answered clarification through REST issue polling. Project access guides Mapping, Scope and Review, retains one request before Save permission, and confirms its exact receipt. A lost response or conflict keeps the original request held for readback. Each new continuation still checks current application, account, project and execution authority. Saving consent starts no work. See the walkthrough and polling continuation.

The HTTP, SDK, CLI and MCP contracts share this separate transport-bound consent. The factory now exposes 162 MCP tools and 258 versioned prompt resources. Local controlled fixtures illustrate the UI and admission boundaries; they do not establish a live GitHub continuation, provider recovery or completed CRM.

0.2.25

New provider stdout and stderr records keep a bounded index and complete sanitized content within explicit per-event and per-run limits. Studio presents recognized commands, output previews and known exit codes. Read full recorded event reads and verifies the retained bytes before exposing the full content. HTTP, SDK, CLI and MCP use the same current access checks and exact descriptor. Existing activity remains readable; historical content is not reconstructed. See complete provider activity.

Source-control milestone feedback distinguishes separate admitted recovery attempts, including failures that end with the same run status. Existing runs without a recovery retain their original fingerprint. Current authority, bounded dispatch and unknown-write holds remain required. A provider's check result does not become final factory QA.

For GitHub polling feedback, forge repeats the exact comment and author-access checks after preparing the issue token, then checks native authority again before the POST. A changed source or withdrawn permission stops the reply and retains the unresolved write for review. Repeated ticks do not resend it. Remote GitHub changes and the local transaction remain separate boundaries. See polling feedback.

Execution shutdown protects an effect already draining after lease loss from a second cancellation. An expired shutdown deadline retains the storage fence until the effect finishes; it does not authorize a standby to repeat an uncertain command. See worker takeover.

These changes preserve observed activity and recovery decisions. They do not establish successful live provider recovery or a completed generated product.

0.2.24

An administrator can explicitly adopt the currently configured official CLI executable for one admitted failed-run recovery. The server binds its canonical path, file identity and SHA-256 to the reserved implementation task, then checks it again before dispatch, immediately before process creation and before accepting the result. Changed or inaccessible executable metadata refuses continuation. The original model, timeout, permissions, budgets and snapshot remain frozen; later normal repairs use the original executable configuration. Default recovery keeps its frozen executable. See adopt an updated CLI.

This admission identifies the entrypoint file. Its dependencies and installation still require administrator qualification, and a path-based operating-system launch is not atomic. Controlled host and native recovery tests remain separate from successful live provider inference and generated-product acceptance.

0.2.23

Typed verification requests can use a frozen grant to run the approved checks through forge's authorized runner. Known results enter the WAL before factory-attributed feedback permits one default coding continuation. The configurable maximum is three, within the existing four-attempt ceiling and separate from the repair budget. Unknown effects stay held. Older paused runs require explicit adoption of their current source, commands, policy and selected provider. Studio distinguishes these checks from questions requiring a person. See verification recovery.

Source-control conversations receive milestone updates from recorded run facts, with known checks and a confirmed pull-request link reported separately. Fourteen centralized Agentic templates format the messages without another model call. Current access checks, retained delivery identities and unresolved-write holds still apply. See factory verification and feedback.

An eligible failed official Codex or Claude process can receive one explicitly admitted replacement dispatch in its original run and workspace. Current administrator authority, source, Git history, provider and policy are rechecked before launch. Native process evidence is retained separately from provider output; historical failures require a labeled administrator attestation. Unknown outcomes remain held. Every implementation reservation counts toward the four-dispatch limit, preserving the repair budget, spent verification grants and prior receipts. Recovery is available through the HTTP API; Studio, CLI and SDK shortcuts remain separate work. See failed official CLI recovery.

Studio keeps recovery panels under distinct React identities when run data refreshes, and terminal run states stop active machinery. The verification tab separates checks supplied during an agent handoff from final acceptance results. The timeline presents bounded command, output and provider-event views. Native tests cover recovery admission, source refusal and API authority with substituted external inference and command execution. These controls do not establish successful live provider recovery or complete generated-product acceptance.

Functional wireframes show each journey's linked behaviors, failure paths and acceptance criteria. Long content retains its complete contract metadata and identifies any continuation beyond the reference canvas. API-only process maps keep their workflow acceptance links. Reference rastering parses validated SVG as XML, preserving embedded logo namespaces. These functional references still require human review; they are not generated application screens. See design review.

Wizards that request a page-flow layout now use it explicitly. On short screens, their action rows follow the form instead of covering a focused field.

Product owners can review the impact of an incremental feature or integration change before saving it. Studio retains the exact original request and receipt when a response is lost, keeps later drafts separate and requires a deliberate decision before discarding them. See incremental product changes.

The optional structured analytics explorer binds one project to an existing flyquery scope. Factory administrators use a three-step wizard; current project readers can inspect a catalog, table or known schema object. Configuration changes retain immutable receipts and compare the observed revision. The bounded final-disable path remains available when ordinary history is full. Query execution and factory snapshot export are outside this adapter.

A separately opted-in, verified GitHub conversation can create a first project and product through /forge intake. The existing native administrator must explicitly consent to that repository. Intake rechecks current application, connection, signing-key and actor authority before committing its atomic product receipt or authorizing feedback. Existing project-change consent does not grant this new capability. See repository intake.

Managed knowledge pins flycanon 26.10.5. Generated pyfly projects and the bundled framework manuals target the released 26.10.6 contract through a versioned Agentic YAML prompt. These pins do not establish a generated product or live-provider acceptance by themselves.

Long product briefs now respect flycanon's 2,000-character retrieval-query limit. Project and framework searches use the same bound for platform keys and scoped agent tokens, including the lookup used to cite verified memory. The original brief, frozen product contract and published memory body remain complete. See knowledge scope.

0.2.22

A saved, clean AI-assisted product definition shows AI-assisted · human-edited when the server records edited: true. A false or missing flag keeps the neutral label. Further edits return the form to draft review state, with the original AI source available from the same header. See product definitions.

The SDK, CLI and MCP expose seven explicit recovery operations: submit or read an original run request, cancel it or read its decision, inspect checkpoint candidates, request a restore and read its exact ticket. Callers retain the original IDs, input, scope and digests. The adapters make one operation per call, without automatic retries, replacement IDs or readback after a write. Restore admission may queue continuation; it does not prove execution success. See the client contracts.

Recovery controls and Bridge settings use readable labels and responsive layouts. Architecture diagrams now reflect 157 factory MCP tools. Controlled host and browser fixtures do not establish live provider inference or customer acceptance.

0.2.21

Loopback bearer access and browser login now establish the same persistent local operator identity. API tooling can admit work without first opening a browser session. A suspended or mismatched identity remains blocked; authenticating again does not restore it. See local bootstrap.

Start a run records an original submission identity before sending it. If the response is lost, Studio keeps that identity and offers an exact check or retry. An unresolved request blocks a replacement. A verified cancellation allows a new submission; a run admitted before cancellation keeps its original receipt. Browser tabs coordinate those decisions, and successful admission clears only the form version that produced that request. See run creation and recovery.

Cancellation and admission share a database decision boundary. Preparation reads an immutable configuration cut, then rechecks current authority before committing a run. Pending reservations are bounded per user. Additive migrations preserve existing receipts and reject changes to retained decisions. See the recovery contract.

An operator can opt into original-result continuation for a Bridge implementation task that uses the supported static file tools. Forge commits the saved Agentic checkpoint and original request before submission. After verifying the original result and current authority, one-use consumption commits before the native SDK parser receives the original result. Studio provides inspection and deliberate continuation, retaining an uncertain operator request for exact readback. Other stages, dynamic tools, command tools, direct API providers and media remain outside this recovery path. See agent lifecycle and architecture.

The browser walkthroughs use controlled API responses. Native recovery tests exercise PostgreSQL and the real Agentic SDK with fixed worker results. These checks do not establish live provider inference or a complete product delivery.

0.2.20

Product-definition drafts retain their form fields, wizard step and AI source while you move between products or Studio pages. Drafts belong to the current user and factory connection. Reloading or signing out clears them; Discard edits asks for confirmation and affects only the selected product. See working drafts.

Start a run also retains its fields, selected source, step and policy choices while you navigate. An explicit launch from a repository card selects that repository and preserves the draft. Successful submission clears only the submitted version; later edits remain. This retention does not reconcile a lost run-creation response.

Studio saves product definitions through a conditional endpoint that checks the expected revision and digest under the repository lock. An uncertain response retains the original submission. Inspect the current definition or explicitly retry that same submission; Studio does not resend automatically. A stale original request cannot overwrite a later revision. The legacy unconditional endpoint keeps its existing behavior. See conditional save and recovery.

Worker feedback and answers can use the full existing 80-character message identifier. Journal keys that would exceed the storage column use a deterministic digest of the message kind and identifier. Existing short keys, payload identifiers and replay checks remain unchanged. No database migration is required.

0.2.19

An administrator can configure GitHub App issue polling when GitHub cannot reach a local webhook. After the baseline and separate account consent, status reads an existing scoped run and respond answers its exact pending question. The answer records the mapped native user and historical consent while leaving the run paused. Current project permissions, App access and local policy remain required. Polling does not create a product or run, resume work or provide full GitFlow. Follow the six-step polling guide.

Signed source-control ingress can separately admit reviewed changes to an existing product definition. The saved request binds the original base revision, permitted component scope and explicit change; replay reads its retained result. The Studio consent wizard keeps actions stacked on narrow screens. Product-change consent has its own contract and does not grant polling authority.

Operators can query and export run evidence under current access checks. The reader binds activity, tasks, WAL and tool output to a consistent, bounded cut. An explicitly granted implementation-stage Agentic tool can read a small page from its own run; it cannot choose another actor or run, execute tools or resolve an unknown operation.

Required-mode Bridge completion recovery commits an original-request identity before submission and retains read-only observations of that original job. The local integration journey uses actual Bridge HTTP/SQLite, forge PostgreSQL and the real SDK with one deliberately fictional worker result. It verifies a single submission across a timeout and pending/terminal reads. It does not establish live provider inference or restore an Agentic checkpoint. Resume, handoff and retry remain blocked by the original graph-continuation hold.

Managed knowledge bootstrap supports verified local HTTPS and preserves existing credentials and admitted run snapshots. Required retrieval stays enabled; a server package alone does not establish that embeddings, indexing and cited retrieval work in an installation. Complete the knowledge setup and checks.

0.2.18

Administrators can record separate consent for a mapped source-control user to request continuation after answering an agent's question. A three-step review covers the mapping, component scope and consent. On short screens, the full review scrolls so its text and action buttons remain reachable at increased zoom. Studio retains the original request before one POST and confirms it through its exact receipt; a lost response or missing receipt blocks a replacement request. Consent alone does not resume work. Signed ingress still checks the answered question, current permissions, original execution identity, frozen plan and WAL before admitting continuation of the same run. See source-control consent and SDK, CLI and MCP operations.

Bridge inference calls no longer use the SDK's automatic retries. A structured quota limit or context pause requires deliberate recovery. An ambiguous transport or completion outcome keeps the original intent for reconciliation. Cancellation while a submission is unfinished also retains that hold: stopping the local agent does not establish what happened at the bridge. Resume, handoff and Retry run refuse the unresolved outcome, including after cancellation or interruption. Automatic recovery of the same Bridge job remains separate work. See agent failure and recovery.

Explicit manual continuation preserves the original retry-counter shape, including when the run has no counter. Automatic retries still increment their counter. This keeps the run consistent with the source-control consent review.

The factory overview uses a compact heading and responsive production scene. Select a project and run to inspect recorded stages; open How stages work for the full guide. The camera starts with the whole floor. Focus selected stage and Show full floor let you change the view without changing the selected stage. Stage details remain reachable through the page on a phone.

0.2.17

Studio connects an agent’s pending question to a Markdown answer editor, review and recorded-response recovery. It retains the full API, user, project, repository, run, question and normalized answer binding before sending. A changed or unresolved marker blocks another answer. Reload and missing readback preserve the original identity without resubmitting it. Sending an answer leaves the run paused; resume remains a separate decision. See answer an agent’s question.

New worker replies require a current authenticated operator with an enabled matching identity, execute access and release access when the run publishes. Membership, identity and run locks protect admission through commit. Journal and conversation reads check current access and credentials again before returning the initial immutable snapshot. New events retain the authenticated responding_actor separately from the caller’s actor label; legacy events remain unchanged. Internal calls must run outside an active caller transaction. A signed source-control actor label alone cannot create a new reply. Administrator-reviewed delegation binds that asserted account to an existing Forge user, repository components and allowed actions; each action still requires current native authority and application access. See worker feedback.

Studio exposes delegation review under Project access, with account, person/component scope and trust review steps. It retains a minimal request marker before one save and confirms the exact receipt. A conflict or missing receipt preserves the original request without resetting or retrying it. Historical answer attribution verifies the original active admission and remains readable after later revocation; it does not claim personal OAuth. Follow the illustrated delegation walkthrough. Its controlled fixtures do not establish a live inbound webhook or outbound feedback acceptance.

The reporting-plan wizard organizes an admitted campaign into waves and milestones, validates its frozen component graph and saves an explicit revision. Progress uses a selected immutable report archive and the exact plan receipt. Lost delivery, denied access and missing receipts retain the original request. Reporting criteria do not schedule execution or enforce prelaunch admission. Follow the reporting-plan guide.

Built-in model instructions and MCP descriptions now use packaged, versioned YAML resources rendered by Firefly Agentic's native Jinja2 templates. The catalog validates source digests, declared variables and exact versions before rendering. Existing message text, priority and user input remain unchanged. Maintainers can follow model instructions to edit resources and run the golden contract checks. This organization does not add a historical model-call receipt or grant tool authority.

0.2.16

Campaign operators can save immutable reporting plans with ordered waves, named milestones and explicit conditions against the admitted component graph. A progress read compares one selected plan with one exact saved report, retaining current run/task attempts and their receipts. Unknown evidence remains unknown. Plans declare criteria_binding: reporting_only_post_admission and enforced_at_admission: false; they organize retained evidence after admission. Execution-wave orchestration and Studio plan editing remain separate work. The SDK, CLI and factory MCP expose save, history, exact read and progress through the authenticated API. See reporting milestones and waves.

The optional profile_php tool measures a PHP or larafly workload inside the frozen, network-isolated Docker runner. It requires explicit profiling and command grants, rechecks the selected source bytes and retains exact execution and cleanup references. The runtime recipe reports wall time, user/system CPU and peak PHP memory. A separate Xdebug recipe requires its extension and POSIX file-limit support to be present before execution; missing prerequisites refuse the workload. Neither recipe installs a runtime or application dependencies. See PHP profiling.

Activity and WAL views show PHP metrics with their units, the workload exit and the diagnostic report's completion state. Original output and command details remain available in disclosures. The optional Xdebug table shows bounded exclusive function costs, with keyboard scrolling on narrow screens. Diagnostics remain project-reported observations and do not establish delivery acceptance. A complete Laravel application still needs its normal bootstrap and dependencies; framework-module profiling alone does not prove that application starts.

The full development gate now checks for an existing PHP 8.3+ CLI before executing PHP recipe fixtures. FORGE_TEST_PHP_FIXTURE selects an executable, including paths containing spaces or literal dollar signs. The prerequisite check never installs PHP or Xdebug. Follow the development gate.

0.2.15

An authorized product operator can save a selected campaign report and read its exact result later. The immutable receipt retains the report, source boundary, historical repository scope and original actor. Saving requires the displayed report digest and a caller-retained request identity. Reusing that identity reads its original outcome; a lost response, missing receipt or conflict does not authorize another request. Later campaign changes leave the saved report intact. See saved report history.

The SDK, CLI and factory MCP expose explicit save, bounded history and exact readback. Every return checks current project and historical repository access; a stored receipt does not grant access. History is limited to 100 reports per campaign and 50 metadata entries per page, with byte limits checked before loading bodies. prepared_at records database preparation time, not commit time or live evidence freshness. The native PostgreSQL migration adds immutable archive storage without rewriting campaign execution journals or changing the existing report contract.

Studio adds a report-and-review wizard, saved summaries and exact receipt inspection. It checks canonical digests and retains a small request reference in browser storage before the write, without tokens or report bodies. Lost delivery, reload or an initial missing receipt keeps the original identity; recovery reads it without repeating the save. Current access and the complete original marker binding remain required before another explicit save. Follow the illustrated save and recovery journey.

The concepts and factory journeys guide explains product definitions, components, projects, campaigns and their execution evidence. Repository guides use the actual connection controls and distinguish signed ingress, retained operations and outbound feedback from Git mirroring. Existing-source guidance explains monorepo and multiple-repository scope, inspection coverage and owner review; Studio now displays the backend's numeric skipped-file count correctly.

0.2.14

SDK, CLI and MCP clients can inspect the original commands available for a continuation review. Use ForgeClient.runner_continuation_candidates(run_id), forge runner-continuation-candidates RUN_ID or get_runner_continuation_candidates(identifier). Each performs one authenticated read and preserves the server's unavailable or empty result. Inspection does not allocate a request, claim a command or dispatch work; the original leader still authorizes a separate explicit continuation. See runner continuation.

Health and authenticated metrics now share the native supervision service's readiness calculation. forge_admission_ready describes local admission, while forge_execution_ready describes local execution. A healthy API-only process can accept authorized requests without running local jobs, so Studio no longer tells its operator to restart execution. Degraded health and explicit diagnostics remain visible. Remote worker availability remains unknown. See runtime roles.

The generic runner queue leaves explicitly continued commands reserved. An expired lease, a refused decision or a change of Factory ownership cannot silently restart or cancel that original command. A durable continuation event also preserves the reservation when its mutable marker is missing. Other queued commands retain their normal admission and capacity checks. This correction does not authorize another continuation or recover an interrupted worker. See continuation boundaries.

0.2.13

Studio can request continuation of an original queued runner command. Open the run's Plan tab, choose the exact command, review its identity and acknowledge the leader's final admission check. The browser saves the original request before submitting it. After a lost response or reload, Check original request reads that same receipt. A missing receipt keeps the request unresolved. The local candidate preview does not claim or dispatch work. See the illustrated continuation guide.

Product projects now include a campaign report with component states, task and check receipts, recorded source, checkpoints and prior attempts. Load campaigns and View report perform explicit reads. The backend uses one bounded, read-only PostgreSQL snapshot and checks current access to the product and its repositories. It examines the current task attempt's durable intent and receipt even when mutable task state says queued or failed. An unresolved or failed remote operation cannot establish verified delivery. When the snapshot cannot establish bounded evidence, counts remain unavailable. See campaign reports.

The SDK, CLI and factory MCP expose the same campaign report. Its digest identifies the returned snapshot; it does not create persisted report history. SCM freshness is not observed, and milestones and waves remain unconfigured. The existing continuation boundary still covers one controller replacement while the original Factory worker waits. Multi-host placement, repeated controller losses and interrupted-worker recovery require separate work.

Container acceptance also tolerates a process disappearing while its procfs record is read. Permission and other I/O errors still fail the check, and a persistent zombie still fails the bounded reaping test.

0.2.12

An authorized operator can explicitly continue one original queued pool command after replacing its controller, while the Factory worker still owns and waits for that command. The persisted request retains the original execution identity, actor, stage, source, admission and WAL fence. API replicas record the request; only the current Factory leader can deliver it. The replacement controller checks current authority and quotas before claiming that exact command. Reads, repeated request identities and startup do not start other queued work.

The SDK, CLI and factory MCP expose admission and exact readback. Save the request identity before submitting it; after a lost response, inspect that same request. An accepted continuation is not evidence of command success or publication. The shared pending-request limit uses the same database admission lock as other worker requests, including concurrent admissions from different runs. See queued command continuation.

This flow covers one controller replacement before any uncertain create/start effect. It does not recover a second controller loss, revive an interrupted Factory worker, add a command budget, automatically replay unknown work or provide Kubernetes/multi-host execution. Studio continuation controls remain a separate follow-up.

0.2.11

Existing-source verification now retains a durable attempt before checking local admission. When an exact server receipt proves that no flycanon request was dispatched, Studio offers Review and start a new verification. It rechecks current access and the saved target, preserves the refusal history, and requires confirmation of a fresh request. Unconfirmed source text is replaced by a fingerprint in pending browser storage and the local attempt record.

An unknown, preparing or dispatched attempt blocks a fresh identity for the same learning record. Repeated calls with the original identity only read its outcome. A verified attempt must match its immutable observation event and original scope. Legacy pending requests keep their original recovery flow; a missing receipt or an error message cannot authorize correction. The SDK, CLI and factory MCP expose the same strict attempt and readback contracts. See source verification and operator integrations.

Verification jobs run concurrently while the required aggregate still blocks packaging unless Python, Studio, documentation and container acceptance all succeed. Tag publication reuses those checks, then binds its downloaded distributions to the publishing source and rebuilt Studio before release.

0.2.10

Studio can verify an existing indexed flycanon source through a source-and-review wizard. The factory checks the source and its citations against the saved projection, then retains the original actor, request and immutable observation event. It does not create a source or trigger ingestion. A lost response keeps the original request; reload and explicit recovery read that exact receipt without repeating the observation. Current project authority and credential checks also apply to receipt readback. See existing-source verification.

The SDK, CLI and factory MCP expose the same exact observation receipt. Source identifiers are checked against the current credential registry before any flycanon request. Verification checks the returned source, content and admitted projection again before recording the event. Remote indexing and the local transaction remain separate operations.

The optional trace_python tool reports bounded line-hit counts for one admitted Python file in a network-isolated Docker runner. It requires explicit tracing and command grants, verifies the selected source bytes and preserves execution and cleanup receipts. Imported and dynamically compiled code are outside its observation scope. Project code can disable or spoof tracing; these reports are diagnostic evidence, not a coverage or acceptance gate. See agent tools and tool prerequisites.

0.2.9

Knowledge invalidation retains an exact receipt with its original actor, reason, request and journal event. SDK, CLI and the factory MCP can read that receipt under current project review authority. A missing receipt means the operation has not been observed; it does not permit replay. Legacy records without actor evidence remain explicitly unknown. See learning invalidation.

Studio adds a reason-and-review flow for invalidating saved evidence, with its original request retained in the current tab before submission. A response, record refresh or missing receipt cannot clear an uncertain decision or authorize replay. The exact receipt must match the original context and actor. Confirmation stays available when the active filter excludes the updated record, with an explicit close action. Follow the illustrated learning journey.

The optional profile_python agent tool runs bounded stdlib cProfile in an admitted, network-isolated Docker workspace. It requires both command and profiling grants, verifies the selected Python source bytes inside the container and returns a bounded report with execution and cleanup receipts. Profiling does not approve the code, retry an uncertain execution or enable host/pool fallback. See agent tools and tool prerequisites.

0.2.8

Local command-pool supervisors reap adopted children while a command runs. After the command exits, they terminate and reap remaining descendants before returning a completion receipt, including processes that started a separate session. The original deadline and command exit status remain in force. This prevents a successful result from racing a still-running project writer; it does not undo external effects. See local command pools.

Retained pool artifacts and command output are checked against the current credential registry before being returned. A value newly recognized as a credential blocks the read and requires reconciliation without altering the original artifact or receipt or resubmitting the command. Unregistered secrets still require review.

Runner admission rechecks current execution authority and cancellation after capacity waits and at the host/Docker dispatch boundaries. Revocation or cancellation observed at these checks refuses dispatch. Retained reads use the same admission, and owned-resource cleanup remains available under its existing ownership checks. See dispatch admission.

The existing-product, feature-change and proposed analytics diagrams read from left to right. Long sequences use phases; narrow screens retain readable labels in keyboard-accessible scroll regions. Existing-product review explicitly precedes frozen assistant context, and admission to flycanon remains optional. Compact navigation also keeps the forge name lowercase and preserves canonical Firefly artwork for the bridge.

These changes retain the trusted local command-pool boundary. Kubernetes, multi-host placement, browser pools and complete coding-provider isolation require separate qualification.

0.2.7

Knowledge > Learning records lists saved evidence for the selected authorized repository. Operators can inspect its source, verification receipts, dates and saved flycanon projection without submitting or replaying a write. The desktop selector stays reachable while long provenance scrolls; narrow windows use the normal vertical flow. A saved verified state does not establish current reuse eligibility. See record inspection.

After actual failed QA, the captured learning policy can hold the next same-run repair proposal when identical native evidence has reached its limit. The journal retains the decision and original checks. Current authority and unresolved effects are checked before dispatch; retrying the same proposal does not count the verification twice. The limit never relaxes the existing two-round no-progress stop. Verification, intentional RED tests and test-only runs remain available. Cross-run failure classification and sharing between projects remain separate.

Project commands receive a fresh Python cache namespace so normal imports check current source, including same-size edits that could previously reuse stale bytecode and produce incorrect QA results. Host commands clean up their own temporary namespace; container runners use their existing ephemeral filesystem. Project caches remain intact. See Python verification and its limits.

The runtime uses public pyfly 26.10.6, fireflyframework-agentic 26.10.1 and flycanon SDK 26.10.4. Managed knowledge installs the checksummed flycanon 26.10.4 service in its separate framework environment. Existing admitted runs retain their captured settings. Studio record inspection is read-only; lifecycle writes still require their reviewed operator and reconciliation contracts.

SDK, CLI and factory MCP clients add six reads for global and repository role lifecycle, registered users, eligible project members, identity administration and retained identity operations. Each request uses the existing server permission and redaction boundary. Five existing identity writes also gain client bindings for enable/suspend, provisioning, invitation, reconciliation and owner-stopped recovery. They preserve native administrator checks and durable receipts, without new grants or automatic retries. Four further bindings read public authentication configuration, current authenticated identity and project members, and explicitly set or revoke a registered user’s membership. OAuth configuration adds optional revision comparison in CLI/MCP while preserving no-revision calls. Current owner/admin checks, revocation and the last-owner safeguard remain server-owned. The MCP catalog has 123 tools: 118 earlier contracts are unchanged, one adds only optional expected_revision, and four are new. See operator integrations.

0.2.6

Administrators can configure verified learning through Administration > Learning. The wizard separates knowledge selection, retrieval limits and review. It preserves saved preferences when learning is disabled and requires a read of saved settings after an uncertain write. New runs capture the revised policy; existing runs retain theirs. See learning and knowledge-first execution.

Verified learning projections can be read from flycanon when a new run explicitly permits it. The record must match the current project, repository, framework and dependencies. Source identity and citation checks precede admission; current local authority and freshness are checked again before new or cached results are returned. An unavailable optional projection leaves ordinary source retrieval and local evidence checks intact. Cross-project promotion and automatic repair circuits remain separate work.

The locked runtime adopts public pyfly 26.10.6 and flycanon SDK 26.10.3. Managed knowledge installs the separately checksummed flycanon 26.10.3 service in its own framework environment. Existing private configuration, corpora and queued revisions are preserved. Canon and Query keep their separately qualified framework event contracts.

0.2.5

Native model execution now uses the public fireflyframework-agentic 26.10.1 release. The dependency lock also consumes pyfly 26.10.4 and flycanon SDK 26.10.2. Managed knowledge installs the checksummed flycanon 26.10.2 server, configuration and migration archive in its separate runtime. Existing knowledge configuration and queued revisions retain their original state. The factory keeps its journal-controlled retry and handoff boundaries; upgrading the model framework does not authorize replay of an uncertain external effect. See coding providers and agent tools.

The product design assistant uses a compact drawer in windows below 480 pixels high. Its recorded response remains readable while the message field, file picker and send action stay reachable. The short-window checks cover light and dark themes, conversation scrolling, keyboard navigation and focus restoration.

Agentic 26.10.1 includes dependency compatibility corrections and namespace-safe PostgreSQL vector updates. Optional Ragas and Chroma dependencies retain known upstream advisories; review the Agentic security guidance before enabling those extras. This release does not establish hosted vendor access or production cluster acceptance.

0.2.4

Connected accounts now provides an administrator flow for the owned local repository service: admit its fixed policy, register a client and project, complete browser consent, inspect state, request refresh and disconnect locally. The native foundation uses public pyfly 26.10.3 OAuth client and S256 PKCE APIs. Different literal factory/provider hosts protect browser cookies; a same-host policy is rejected before provider contact. See connected-account setup.

PostgreSQL retains encrypted registration/grant context, stable request identities and token-effect receipts. Unknown exchange or rotating-refresh responses block replay. Historical credential evidence reserves its bounded custody capacity before dispatch. Scoped resource use and cached tool receipts recheck current policy, grant family, expiry and project authority. Schema discovery, exact review, repository/tool grants and the worker capability remain separate admissions. The supported local adapter has four fixed repository-read tools; GitHub, Figma, Sentry, Grafana and external Playwright OAuth remain at their vendor prerequisites.

Native runtime composition uses FactoryConfiguration, typed controllers/repositories and injected service collaborators. The architecture guide documents knowledge, OAuth resource custody, the ledger and write-ahead boundaries without claiming every domain construction path is container-owned. The Studio walkthrough retains 228 fixture captures tied to its exact frontend and package version. Native OAuth captures keep their own source identities and local qualification scope.

The authoritative flycanon repository and the optional flyquery repository are now under fireflyframework. Forge's SDK and managed server installation use the canonical flycanon release URLs. Required flycanon retrieval and canonical verified memory remain implemented; structured analytics documents a proposed snapshot-based flyquery integration, its assessed safety gaps and admission checks. Forge has no flyquery adapter or managed service.

The native local qualification exercised actual Studio forms, a stock public pyfly authorization/MCP service, token refresh, disconnect, scoped resource calls and retained WAL. MCP linking, discovery, review and project grants used native API requests; resource dispatch used the native in-process broker. This evidence does not establish hosted vendor accounts, production identity federation, paid models, cluster deployment or complete factory acceptance. Release packaging and exact-source CI have their own checks.

0.2.3

Repository-scoped learning records retain their question, source tree, checks and review evidence in PostgreSQL. Native knowledge-first tools can reuse an exact eligible local outcome. Cached reuse holds a shared lock on the selected record and rechecks its policy, expiry and current execution authority before returning it. Explicit invalidation preserves the historical receipt. Submission to flycanon is a separate, single-dispatch action; uncertain submission requires observation rather than another write. Automatic retrieval from projected learning namespaces, classified repair controls and sharing between projects remain open. See learning.

Administrators can opt into an authenticated local command controller with immutable profiles, project quotas and bounded Docker execution. Component bundles transfer sanitized source and a minimum Git snapshot. The controller retains command results and returned artifacts; concurrent source edits reject publication without losing either version. Cached results still require current task ownership and authority. This release's qualification covers a trusted Factory host and local command containers. Browser pools, complete coding-provider isolation, Kubernetes and multi-host placement require further qualification. See runner setup.

The external-tool wizard separates saving a connection, requesting discovery, reviewing exact schemas and granting project access. GitHub repository-read tools remain the first executable external adapter. Figma, Sentry and Grafana guides show prerequisites and their blocked state. The walkthrough joins the Studio and search guides in a gallery of 228 source-bound light/dark desktop/phone captures. Their fixtures are identified in the guides.

SCM credential custody refuses silent reuse when a confidential client or provider host changes. A retained refresh-dispatch marker blocks reuse after an uncertain rotating-token exchange. Approved MCP calls recheck current authority before returning persisted or cached results. The package uses public pyfly 26.10.2 with explicit web, data, PostgreSQL, security and OAuth client dependencies. The separate general-provider OAuth foundation is outside this release.

Documentation now renders Mermaid through Material's native runtime. The product lifecycle and AS-IS handoff diagrams use readable vertical layouts on desktop and phones. Local browser checks use a loopback documentation server that admits gallery asset bursts and retain the exact SVG snapshot inspected during theme changes.

0.2.2

Administrators can configure internet search through a three-step Studio wizard. Existing provider settings remain selected; changing providers requires a new write-only key. Saving and making a potentially billable connection test are separate actions. Desktop and mobile screenshots are tied to the current frontend source and package version.

Agent search and approved external MCP calls now retain a PostgreSQL intent before dispatch and a bounded receipt afterwards. Project, repository, role, source and configuration snapshots define the invocation. Unknown outcomes block source consolidation and require explicit reconciliation. The first external adapter supports reviewed GitHub repository-read tools; other connector templates state their unmet prerequisites.

Campaigns freeze their tool catalog after capturing the repository's MCP grants and reject settings changed during admission. Native FireflyAgent tool errors retain quota, authentication and rate-limit pauses or the need for reconciliation. Internal whole-run retries are disabled so the journaled supervisor controls continuation.

0.2.1

Standalone packages now retain the Flycanon SDK release URL in their dependency metadata. The package check rejects wheels that would require an unavailable registry package. The v0.2.0 tag records the initial qualification; its publication was stopped when a clean installation exposed this issue.

This release brings product definition, coding, verification and delivery into one pyfly application with a PostgreSQL execution ledger. Teams can start with a new product or analyze an existing project, work across one or several repositories, and follow the same retained task history through interruptions and provider handoffs.

Studio presents that work through guided forms, a project flow board and an operational production floor. Its machines animate recorded active tasks. Paused work stops the scene; stage controls remain available without WebGL or animation.

What changed

Native pyfly dependency injection, REST controllers, repositories and transaction management with PostgreSQL persistence.
Immutable plan revisions, append-only intents and receipts, source checkpoints, bounded rate-limit retries and explicit provider handoffs.
Separate project workspaces and fair dispatch, with one active run per project and a configurable global concurrency limit.
Wizard flows for product work, coding providers, repository applications, knowledge and deployment targets.
GitHub Apps, GitLab OAuth with PKCE and Bitbucket OAuth consumers, with repository grants checked before transport.
A versioned central policy catalog, project defaults and frozen run selections. Recommendations guide coding; quality gates run commands.
Real flycanon SDK indexing, cited retrieval and verified project memory in separate project scopes.
Explicit deployment and rollback commands, mandatory health checks, frozen target settings and durable external-effect records.
Shared brand-kit typography, grid and light/dark/system themes, with a distinct lowercase forge mark.
CLI, Python client and MCP access to plans, journals, handoffs, knowledge and delivery.
Journey-based product definitions, feature changes, architecture choices, project design tokens, brand imports and reviewable design evidence. API-only products can omit frontend work.
An AI design assistant with retained conversations, Markdown, document and image attachments, source receipts and proposals that remain drafts until the product owner reviews them.
Responsive editor and assistant panels with a shared header, reachable actions and a drawer on narrow or short windows. Application frames use the available width while prose retains readable line lengths.
Keycloak sign-in, durable encrypted server sessions, project memberships and guided user administration. API replicas and a single headless execution worker have separate runtime roles.
Isolated command and browser runners with bounded resources, retained outputs, DOM checks and screenshot evidence. Community skills and agent responsibilities are configurable through the factory's policy and agent catalogs.
Reconciliation of uncertain publication and delivery against immutable server receipts. A matching task, attempt and source is required before recording an outcome; reconciliation does not repeat an external write.

Storage upgrade

PostgreSQL is required. Configure FORGE_DATABASE_URL and retain the private data directory for credentials, policy revisions and run workspaces. This version does not silently import a previous SQLite database. Existing 0.1.0 deployments should back up their state and follow installation before starting the new runtime.

Acceptance boundaries

The local runtime has exercised both released pyfly and larafly example products with their actual test commands. Current source-only factory runs passed 40 pyfly tests and 32 larafly tests with 94 assertions. Those runs retained valid write-ahead journals and left the saved product definition unchanged. They verify existing source without calling a coding model.

Separate live Codex acceptance covers a retained design conversation with a document and an image. Its response identified facts from both original files; completed replies survive service restart and cannot be recovered as unfinished work. Native Docker and browser acceptance exercised resource limits, cancellation, command output, JavaScript/DOM interactions and screenshots against pinned local images.

A local deployment used a real command and an independent verification command. Flycanon acceptance includes real 768-dimensional Ollama embeddings, source and memory retrieval, separate-project isolation and a verified execution journal. The server scanner correction has been merged and released; strict PII rejection is retained. This does not establish access to every hosted Flycanon workspace.

Application adapter tests do not prove that an external organization has registered or granted a GitHub, GitLab or Bitbucket application. Cloud recipes cover AWS, Azure, Google Compute Engine, DigitalOcean, VPS and on-premises hosts; recipe validation is separate from provisioning each provider. Live model execution depends on the server account's subscription, login, credits and selected model. Java, Rust and .NET remain additional profiles without claimed end-to-end product acceptance.

The private Firefly Agent Bridge is distributed separately. Local subscription execution requires the official CLI's account login and an authorized connection; a hosted factory does not automatically tunnel to a developer's machine. Distributed execution worker pools and automatic external identity-provider federation are outside this release.

0.1.0: Earlier release

firefly forge introduces Firefly's software factory: a product brief becomes an
isolated Git implementation with real verification, retained source evidence
and explicit pull-request publication. pyfly and larafly are the primary backend
profiles. Angular, React, Next.js and Vue are selectable frontend contracts.

Included in this version

A pyfly API, local durable run store, CLI, Python client and MCP tools.
Studio for repository registration, product briefs, provider connections,
progress, diffs, check results, artifact downloads and explicit publication.
Official signed-in Codex and Claude Code execution, native Firefly Agentic,
and a client for an authorized internal Firefly Agent Bridge.
Generic Git sources and GitHub, GitLab, Bitbucket Cloud, Azure DevOps and
Gitea pull-request adapters.
A bounded automatic repair loop that returns all failed-check evidence to
the provider and preserves each attempt's results.
Final passing verification tied to a source-tree snapshot, checked again
before publication, plus exclusive service ownership of each data directory.
Token protection across the forge API, with native management/admin/actuator
surfaces disabled in the packaged pyfly configuration.
Firefly branding, self-hosted typography, accessible SVG diagrams and
task-based installation, product, integration and operations guides.

Verification recorded during preparation

The configured factory gate covers Python tests, lint, formatting and types;
Studio types, lint, formatting, unit tests, browser journeys and production
build; and strict MkDocs compilation.

Studio was also exercised against the real authenticated forge API: connection,
repository and run creation, cancellation, run diff and verification evidence,
an actual ZIP download and the product form. Direct browser review covered 1440,
640, 390 and 360 pixel widths without
browser console errors.

Specific live product checks recorded so far:

Journey	Evidence	Remaining boundary
Native Firefly Agentic through an authorized bridge, pyfly service	Nine behavior tests, lint, types and package build	Bounded service fixture, not every pyfly capability
Native Firefly Agentic through an authorized bridge, larafly service	Fourteen actual PHP checks and a fresh Composer install using official larafly 26.10.1	Bounded service fixture, not the complete larafly plus frontend journey
Codex full factory run, pyfly plus React	40 backend tests, 17 frontend tests, lint, types and production builds; automatic repair corrected startup and browser CSRF integration	Actual browser create/reserve/conflict flows, mobile layout and keyboard focus verified
Codex full factory run, larafly plus React	32 backend tests with 94 assertions, 23 frontend tests, PHPStan, Pint, lint, types and production builds	Actual browser create/reserve/conflict flows, mobile layout and keyboard focus verified

Both primary browser products created eight units of stock, reserved three,
showed five remaining, and rejected an over-reservation without changing stock.
Their 390 pixel layouts had no horizontal overflow and their browsers reported
no application exceptions.

The GitHub publication connector was exercised against the real repository:
isolated clone, source snapshot, passing check, branch push and draft pull-request
creation. The temporary pull request was closed without merging. The MCP stdio
transport completed a real handshake and an authenticated repository tool call.
Release archives passed the private-file boundary check, and a fresh wheel
installation served Studio and the authenticated API with its packaged runtime
configuration.

Java, Rust and .NET
profiles have upstream source contracts inspected; they have no claimed live
full-product acceptance here. Frontend profile availability does not establish
acceptance of every generated framework combination. Pull-request adapter tests
do not establish successful publication on every provider account.

Operating boundaries

This version serves trusted development operators on a dedicated macOS or Linux
host. Git workspace isolation is not host sandboxing or tenant isolation.
Provider configuration readiness is separate from real model execution.
Publication is explicit and does not merge, release or deploy a generated
product. Read capabilities and security before
operating the service remotely.

Firefly Agent Bridge is now a separate public Apache-2.0 project for local development and testing.
The factory's bridge guide explains its client integration and the production-use limitations.

firefly forge v0.2.42