Breaking

Fuga Gates Its App Swap Behind a Thirty-Case Offline Replay of the Current Build

September 16, 2026 at 15:06 EDT

Software Dev & Coding
AI Agents
Security

Fuga spent the last day wiring a release gate that will not let the desktop agent orchestrator replace itself unless a thirty-case offline replay of the current build has already passed. The change is visible in the local swap verifier, which now refuses a candidate build outright unless it carries a machine-checkable receipt describing that replay.

2026-09-17 · FUGA · LOCAL DEVELOPMENT

The app cannot replace itself until thirty recorded runs have been judged

A new release gate refuses any candidate build whose receipt does not declare a passed thirty-case offline replay, bound by digest to the exact source revision being installed.

runs that must be asserted

unresolved runs tolerated

assertion families per case

digest fields checked in the receipt

Judged is not the same as finished

The receipt must assert every one of the thirty cases, but the same predicate only requires two of them to be marked completed.

asserted runs required

completed runs required

Same unit on both columns: replay runs out of the same set of thirty.

From recording to installed build

1 · ISOLATE

Live network blocked, signals to real processes trapped, risky version-control subcommands refused

→

2 · REPLAY

Recorded responses are fed to the current build through its real entry point

→

3 · JUDGE

Eight assertion families grade each case; weak evidence downgrades to unverified

→

4 · GATE

The swap verifier matches the receipt against the candidate revision and version, or throws

WHAT THE EVIDENCE SHOWS

Committed source in which the gate, the isolation rules and the audit summary all exist and reference each other by digest.

WHAT IT DOES NOT SHOW

No released build, no executed gate run, and one committed exception path that waives the thirty-case predicate for a single version.

THE DESIGN RULE

A weaker signal is never allowed to stand in for a stronger one.

An unrecorded process exit marks a run unverified, because semantic completion is not exit evidence
A request matched only by worker lane order counts as diagnostic, not as proof of identity
A recorded prefix can pass the specification check without passing the task check

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.