Releases
Per-release notes across the federation. Hand-seeded from forge-biz's ROADMAP.md Landed entries until the taskmaster federation API lands (TL-M2/M3).
September 2026
forge-biz v0.2.0-beta.1 (closed design-partner beta)
Closed design-partner beta of the federation control/business apex. MCP host live, BIZ_API_TOKEN window closure, boardroom reads project verdicts. Targets ≤3 partner orgs ahead of the Phase 3 public waitlist.
BIZ_API_TOKEN window closure (OPS-PROJECT-TOKENS)
The legacy `BIZ_API_TOKEN` window is closed. `BIZ_API_TOKENS` now carries 7 per-workspace entries (live, sandbox, demo, sim, marketing-os, smoke, probe-unauth); legacy store row deleted. Verified live: legacy bearer 401, per-workspace 200, cross-workspace 401, unlisted 403. PM7 portfolio read stays green with only the per-ws client token.
MCP host live + boardroom reads project verdicts
`mcp-server` became the third workspace member in blueforge.config.json; mcp.app.forge-biz.blueforge.studio answers with /health 200 and POST /mcp 401 (bearer). `tools/call forge_biz_score_strategy` returns a StrategyOutcome over SSE with FORGE_BIZ_MCP_TOKEN. Board meeting reads project portfolios: `board-meeting.mjs --project-ws=` surfaces them, Open in projects links the runs page (never narrates the transcript).
ChessMate rebrand shipped (strategy-4-kids → chessmate)
Repo renamed on forge-git (blueforge-studio/strategy-4-kids → chessmate), local origin URLs updated across the operator's clones, all 3 deployed_apps rows now carry `repo: chessmate`. Live at chessmate.blueforge.studio.
Resend contact notifications wired through service-email
POST /api/contact now hands off to Resend via the new service-email@0.3.x client injection; vault + BLUEFORGE_DEPLOY_TOKEN wired so the adapter resolves at boot.
Newsletter signup wired (service-newsletter + NEWSLETTER_URL)
/api/send delegates to @blueforge-studio/service-newsletter with HMAC signing; durable inbox write first, best-effort delivery after.
Federation runtime-config convention ratified
data/<purpose>.yml + Zod-validated reader + env-var fallback. Three migrations live: forge-auth data/plans.yml, blueforge data/storage.yml, blueforge data/error-tracker.yml.
Prod-audit v0.1.0 (Phase 1 + 2)
@blueforge-studio/prod-audit ships with per-step JSONL persistence, 12 public routes + per-product walker + interactions probe. 1086 findings flagged across the catalog on first run.
Sidecar walker v0.1.0 (Phase A + D)
blueforge/scripts/sidecar-walker.mjs validates every repo's sidecars + config + package.json across the federation. Daily CI workflow surfaces V2→V3 schema drift, deprecated deps, missing flow files.
Sidecar walker Phase B staged (forge-git consumer)
--source forge-git + --forge-git-url flags added; ready to consume GET /api/repos/{owner}/{repo}/sidecars once the v2 wrap env has the GITEA_TOKEN wired.
Operator-actionable: NEWSLETTER_SECRET vault fix
landscape-os flagged a missing NEWSLETTER_SECRET on blueforge's project vault; /api/send HMAC signing was failing silently. Fixed by the operator's vault one-liner; the next blueforge deploy picks it up.
Operator-actionable: vault7 brand copy sweep (PR #199)
GameVault → Vault7 in catalog + ecosystem copy per game-asset-platform PR #46 spec. Frozen identifiers (`id: vault7`, aliases) untouched. PR #199 in watcher.