Thoughts on Wagoe, Clojure full-stack development and FC/IS architecture.
2026-10-27
Release candidate: v1.1.0-rc-1 — permissions, roles and scopes
Wagoe 1.1.0-rc-1 is the first release candidate for 1.1. It adds route authorization with permissions, roles and scopes, an admin to manage them, outbound webhooks and a test kit. 1.0.1 stays the stable release.
Wagoe 1.0: ship your Clojure app, not the plumbing around it
Why Wagoe exists: one enforced architecture rule, 28 application libraries that all follow it, AI scaffolding that doesn't have to guess, and an honest account of what 1.0 does and doesn't promise.
Wagoe 1.0.1 is a bugfix release. The first run on the homepage failed with a missing JWT_SECRET, a fresh my-app project failed bb check, and error codes still carried the old BND- prefix.
Release: v1.0.0 — stable, and what that promises you
Wagoe 1.0.0. From here a breaking change to the public surface needs a major version, and a removal is deprecated first for at least one minor release and 90 days. Eight libraries are marked incubating and sit outside that promise. This release also gives every JSON error one shape and makes a refused unique or foreign key a 409 on the field.
Release: v1.0.0-rc-4 — closed by default, and prod refuses what only works in dev
The fourth release candidate. Routes and the workflow API need a login unless you open them, secrets stay out of your logs, a prod boot refuses mock payments and a localhost Redis, and the scaffolder turns a status into a workflow. Twenty breaking changes, each with its fix.
Release: v1.0.0-rc-3 — scaffold a relation, and a workflow that lets the right people through
The third release candidate. A foreign key is a field flag now, multi-word entities get their underscores back, and a workflow transition with required permissions stops refusing everyone who has them.
Release: v1.0.0-rc-2 — the admin writes, the installer stops asking for sudo
The second release candidate. Admin updates that answered 200 and wrote nothing now write or say why, the installer no longer asks for a sudo password it cannot be given, and scaffolded money is a decimal instead of a float.
Release: v1.0.0-rc-1 — the release candidate, and the breaking list is closed
The release candidate for 1.0.0. Three breaking changes, and that is the whole list — nothing further lands as breaking before the tag. Two ways local storage could be abused are closed, nine modules you could enable but not run now run, and Java 21 is the baseline everywhere.
Release: v1.0.0-beta-8 — what bb setup switches on, it now ships
bb setup could enable an AI provider or a SQL database the generated project did not depend on, and (go) threw. This release ships those libraries, closes setup with what the chosen provider needs, gives bb repl a prompt, and corrects two versions the docs got wrong.
Release: v1.0.0-beta-7 — the version pins a generated project actually gets
beta-6 fixed bb scaffold and then handed it a release-old CLI. This release gates the pins it injects, tells a GitHub rate limit apart from a broken connection, lets bb setup configure Replicate, and runs the smoke against the published tag every night.
Release: v1.0.0-beta-6 — a generated project works end to end
The first commands a new project told you to run did not work. Forty-two fixes on that path, a JWT authentication bypass closed, and two breaking changes — Reitit route data, and web routes under /web.
Release: v1.0.0-beta-5 — running as more than one process
Modules can now run in separate processes and talk over HTTP or an event bus, with a shared circuit breaker — plus twenty-one adapter divergences found by holding cache and jobs to one contract.
Release: v1.0.0-beta-3 — the documented first run now works
A fix release that makes the advertised install path true — install.sh failed three ways on clean Linux, and a new project could not complete its own quickstart. New projects now default to SQLite.
The framework is renamed from Boundary to Wagoe and enters beta — a broad Framework Quality pass with security hardening, observability, storage and email adapters, durable jobs, deployment packaging, and a large performance and architecture cleanup.