MOMM 1.17.3

MOMM 1.17.3 — release notes

Released 6 October 2026. The signed tag momm-1.17.3
names commit 507e5f778110755be91eebc03ef4309538414857, the exact sealed candidate tree
squash-merged from pull request 51. Do not install an unsigned branch as a signed release.

The immutable signed tag retains the pre-publication notes (publication pending) and
the version-notes history entry that were sealed before release. This post-release
document and the live release page are the publication record; the signed payload is
not retagged or resealed merely to change its historical notes.

Release evidence: exact-main CI, 15/15,
signed checkpoint,
six hosted lifecycle cells, 13/13 steps each,
and stable signing and update smoke.
Every lifecycle cell exercised recovery from interrupted upgrades from both 1.17.2 and 1.17.1.
Fresh-clone verification validated the Git signature, Rekor entry, expected certificate claims
and sealed payload; an intentionally wrong signing identity was refused.

1.17.3 is a patch for updating MOMM. Nothing changes in how a review runs. One writer, read-only
reviewers, account logins only and automatic updates off: none of that changes.

What was wrong

• On 6 October 2026 an update from 1.17.1 to 1.17.2 on the maintainer's Windows machine stopped twice
  with Harness replay did not verify momm for gemini, and its automatic recovery reported
  Automatic recovery incomplete.
• After the checkout the updater runs the installer for each harness in the install receipt. The
  installer decided whether a harness command exists by running <command> --version with a
  five-second limit, and treated any failure, a timeout included, as "not installed".
• The Gemini CLI was installed and on PATH, but took between 5.5 and 7.7 seconds to print its version
  in four timed runs, while other sessions were busy on the machine. So the installer reported
  gemini command not installed, which was false, the updater saw no verified link for a harness its
  receipt lists, and refused. The recovery replays the same harnesses and stopped the same way.
• The retained rollback command, run by hand, worked whenever the command happened to answer in time.
  The same update had worked two days earlier, when it did.

Anyone whose receipt lists a harness whose command takes more than five seconds to print its version
could be stopped this way. Reviews themselves were not affected.

What changes

• The installer finds a harness command on PATH instead of timing it. This holds for gemini,
  claude and agy alike, in both copies of the installer.
• --version is still asked once, with a limit of 30 seconds. A command that is found but gives no
  answer in that time still counts as installed, and the installer says that it did not answer. Claude
  Code and Antigravity are then linked by their folder links. Gemini is linked by its own
  gemini skills link: if that command gives no answer within 30 seconds either, the skill is not
  linked, the installer names the command and does not start it again, and an update stops.
• A command that is not on PATH is skipped as before, and nothing is created for it. A command that is
  found but whose --version reports a failure is not linked, as before, and the installer says what
  failed. The words "not installed" are gone.
• When a harness cannot be verified, the updater gives the installer's own reason after Harness replay did not verify, and after Installer replay failed when the installer itself reported a
  failure. It still stops, still claims nothing it could not verify, and still leaves the recovery
  command. When a harness was linked although its command did not print its version, the updater
  says so in a line that begins Note:.
• A version check that is ended by a signal is reported as failed (killed by <signal>).
• Onboarding's --link gives the installer 180 seconds instead of 45, so a harness command that
  answers nothing ends with the installer's whole reason and not with a stopped installer.
• updating.md has a section on what those messages mean, with a table of the outcomes and what to
  check.

Updating to 1.17.3 from 1.17.2 or earlier
The updater that runs is the installed one, but it replays the installer of the release it has checked
out, so the installer fix applies during this update. Its messages are still the old ones. If this
update stops for another reason, the automatic recovery replays the older installer and can stop the
old way: run the retained rollback command again when the machine is less busy. The retained recovery
copy stays the older updater until the update after this one.

Known limits. A harness command that answers every call, but only after 18 to 30 seconds each,
can still exceed the updater's 180 seconds for one harness when many skills are linked through
gemini skills link; onboarding's --link has the same 180 seconds. Preflight and --doctor still
give a reviewer CLI five seconds to print its version; a slower one is reported as "Version check
inconclusive" and not ready, never as not installed. The updater does not check whether a review is
running from the installed copy while it updates it: do not update while one is. The new code paths
for macOS and Linux were first run on the hosted matrix; the whole pack was run by the maintainer's
harness on Windows only. The limits listed in the 1.17.2 notes stand.

Details: gate record and finding · updating

MOMM 1.17.2

MOMM 1.17.2 — release notes

Released 5 October 2026. The signed tag momm-1.17.2
names commit 80685113372a1f2a93d08a218801995a28ac2baa, the exact sealed candidate tree
squash-merged from pull request 47. Do not install an unsigned branch as a signed release.

The immutable signed tag retains the pre-publication notes (publication pending) and
the version-notes history entry that were sealed before release. This post-release
document and the live release page are the publication record; the signed payload is
not retagged or resealed merely to change its historical notes.

Release evidence: exact-main CI, 15/15,
signed checkpoint,
six hosted lifecycle cells, 13/13 steps each,
and stable signing and update smoke.
Every lifecycle cell exercised recovery from interrupted upgrades from both 1.17.1 and 1.17.0.
Fresh-clone verification validated the Git signature, Rekor entry, expected certificate claims
and sealed payload; an intentionally wrong signing identity was refused.

1.17.2 is a patch for people who test MOMM and for anyone who keeps evidence outside their projects.
Nothing changes in how a review runs. One writer, read-only reviewers, account logins only and
automatic updates off: none of that changes.

What was wrong

• With MOMM_EVIDENCE_HOME set, 23 of the 97 commands of the suite pack failed on 1.17.1. That
  variable is the documented way to keep evidence, and the suite runner's saved report, outside a
  checkout. An independent tester found it on the day 1.17.1 was released: 74 of 97 suites, exit
  status 1. Every pre-release run of the pack had been made with the variable unset.
• The suites build small fixture projects with their own evidence folder. MOMM, as designed, looked
  in the external home instead, did not find the fixture's evidence, and the suites failed.
• setup-ui.mjs --self-test and ledger.mjs --self-test failed the same way, so someone with an
  evidence home was told that a working installation was broken.
• The runner's --evidence-home option, new in 1.17.1, had the same effect as the variable.
• A pack run with a real evidence home left folders for those fixture projects in that home.
• On 1.17.0 only six commands were tried: five suites and setup-ui.mjs --self-test. Each passed with
  the variable unset and failed with it set. The whole 1.17.0 pack was never run with the variable set,
  so there is no count for that release.

Reviews themselves were not affected: with an evidence home they worked before and work now.

What changes

• The suite runner starts every suite without MOMM_EVIDENCE_HOME, whether it came from your
  environment or from --evidence-home. Its own saved report still goes to the external home.
• Every suite drops the variable as its first statement, so a suite you start by hand passes too. A
  check holds that line in place in every suite, and a new suite starts other suites by hand under an
  inherited evidence home on every hosted operating system and Node version.
• The Setup Center and ledger self-tests no longer depend on your evidence home. A real Setup Center
  and a real ledger build still follow it.

If you ran the 1.17.1 pack with a real evidence home
It left one folder per fixture project under that home: 58 in one measured run on Windows. Whether
the 1.17.0 pack does the same was not measured; the check below serves for either. Every project
folder in an evidence home holds a project.json whose project is the path of the project the
folder belongs to. A folder is a fixture's only if all three of these hold:

• that path lies inside your temporary directory;
• the first folder name below the temporary directory is a prefix the suites use, then exactly six
  random letters and digits, as in momm-governor-test-Ab3dE9. The prefix is momm probes tests-,
  or momm- and one or more words of lower-case letters and digits, each followed by a hyphen. So
  the six characters come straight after a hyphen, and momm-draft1 is not such a name. The suites
  name their temporary projects that way, and all 58 folders of the measured run were of this kind;
• the project.json was written while the pack was running.

Such a folder may be deleted. Leave every other folder. A path that no longer exists does not make a
folder a fixture's: a project of your own that you reviewed from a temporary folder and deleted
afterwards names a missing path there too, and its folder is your evidence. If you are unsure about
a folder, leave it.

Testing 1.17.2
The pack is expected to pass in three ways: with nothing set, with MOMM_EVIDENCE_HOME set to a
private folder outside the checkout, and with `--save-report --commit --evidence-home

`. After the second and third the evidence home should hold nothing but the runner's own run folder (nothing at all without `--save-report`). The three self-tests are expected to pass with the variable set or unset: `node momm/scripts/multi-review.mjs --self-test` (the dispatcher's, which passed with the variable set on 1.17.1 too), `node momm/scripts/setup-ui.mjs --self-test` and `node momm/scripts/ledger.mjs --self-test`. Report in the [testing discussion](https://github.com/marroccofella/skills/discussions/32): your operating system and Node version, which of the three ways you ran, and the last three lines the runner printed.

Known limits. The tester's original result on 1.17.1, 74 of 97 with exit status 1, stands as the
record for that release; this patch does not relabel it. The hosted matrix does not run the whole pack
under an inherited evidence home: it runs the runner's own tests for it, the Setup Center and ledger
self-tests and a suite that starts a fixed set of suites by hand. The whole pack in the three ways was run by the
maintainer's harness on Windows only. The check that holds the line in every suite reads text: it
cannot see a module that would read the variable while it is being imported (none does today). The
limits listed in the 1.17.1 notes stand.

Details: gate record and finding · reviewer pack

Updating can stop on a slow harness command: fixed in 1.17.3

Found on 6 October 2026 while installing this release: an update to it stopped with Harness replay did not verify momm for gemini, and the automatic recovery reported Automatic recovery incomplete. The installers up to and including 1.17.2 decide whether a harness command exists by running <command> --version with a five-second limit, and report a slower command as "not installed". Reviews themselves were not affected. It is fixed in MOMM 1.17.3, released 6 October 2026. If an update or a rollback to 1.17.2 or earlier stops this way, run the retained recovery command again when the machine is less busy: what the messages mean.

MOMM 1.17.1

MOMM 1.17.1 — release notes

Released 4 October 2026. The signed tag momm-1.17.1
names commit 06e8d5ad7be9748928a6e8159106bfb86afa582a, the exact sealed candidate tree
squash-merged from pull request 44. Do not install an unsigned branch as a signed release.

The immutable signed tag retains the pre-publication notes (publication pending) and
the version-notes history entry that were sealed before release. This post-release
document and the live release page are the publication record; the signed payload is
not retagged or resealed merely to change its historical notes.

Release evidence: exact-main CI, 15/15,
signed checkpoint,
six hosted lifecycle cells, 13/13 steps each,
and stable signing and update smoke.
Every lifecycle cell exercised recovery from interrupted upgrades from both 1.17.0 and 1.16.1.
Fresh-clone verification validated the Git signature, Rekor entry, expected certificate claims
and sealed payload; an intentionally wrong signing identity was refused.

1.17.1 makes Copilot reviews work again on recent Copilot CLI versions and makes failures explain
themselves. It does not make every route work: a reviewer CLI that is too old for its configured model
is flagged at the next preflight, and you still have to update it. The release began as a fix for the
Copilot reviewer and carries twenty reliability improvements, each found by using 1.17.0 for real.
One writer, read-only reviewers, account logins only and automatic updates off: none of that changes.

Reviewers that work

• Copilot reviews were refused on recent Copilot CLI versions (captured on 1.0.91; 1.0.90 failed
  the same way). Those CLIs add two events to the output MOMM reads, and MOMM refused every answer as
  "unrecognized event type". Both events are now recognised; neither is ever treated as an answer, and
  a model call that does not report success is refused. If you do not use the Copilot route, or your
  Copilot CLI is older, you were not affected.
• A fenced answer is unwrapped, not refused. Copilot sometimes returns its answer inside one
  Markdown code fence, and sometimes writes a sentence before it. An answer that holds exactly one
  fenced block is now unwrapped and checked as strictly as before, on Copilot and Antigravity alike, by
  one shared rule; narration before or after that one block is ignored. Still refused: a second fenced
  block, any other line that starts with a fence, an unclosed fence, a tilde fence, another language
  tag, narration around a bare answer or broken JSON inside. Text beside the block that is itself JSON
  is refused too. Claude, Codex, Gemini and Grok already read such answers and are unchanged.
• A CLI that is too old for its configured model is flagged before you spend allowance. When a
  review ends with a CLI/model compatibility error, MOMM remembers it on this machine and the next
  --preflight and the next review say so, with the official update command. It makes no model call to
  find out, changes no setting, and forgets the record when the CLI or the model changes or the route
  next succeeds. The Setup Center shows "CLI update needed" on that reviewer's card, never "Sign in".

Failures that explain themselves

• A refusal for an unrecognised CLI event names the event (plain names only).
• When an answer is refused as not JSON, the private attempt record keeps its shape: length, whether it
  starts and ends with a fence, the parser's error position and the first 80 characters of the answer
  after redaction. The shape holds no more of the answer than that, and not the parser's message.
• When a route has failed the same way in its last three recorded runs in a project, the report says so
  and names the likely cause. A notice only; nothing is routed on it.
• A diff file passed as --input gets a notice that its findings cannot receive a completion receipt
  for project files, and names --range.
• A refused evidence location prints one plain line: what was refused, why, and what to do. A refused
  .ensemble_reviews also names the evidence-home alternative, quoted for the shell it is shown for.

Updates

• An update stops before it changes anything when a Git lock is present in the skills clone. It names
  the lock and its age, says that age does not prove a lock is stale, and tells you how to check and
  remove it yourself. MOMM never removes a lock.
• When a release changes the protocol, the updater prints a short summary (files, and the headings
  that changed in SKILL.md) before the full diff. --accept-protocol is still required.
• A Setup Center left running across an update says which version it is running and which is now
  installed, and asks you to choose Close Setup Center and start it again. If a later refresh fails
  without checking the versions again, the notice stays and says it was not checked again. Quick Setup
  no longer verifies a reviewer whose card reads "CLI update needed".

Testing MOMM itself

• scripts/run-ci-suites.mjs refuses an unknown or misspelled option, checks report storage before
  the first suite, and ends with three separate statements: suites passed, report saved, exit status.
  A report that cannot be saved at the end can be recovered to a private folder without rerunning. A
  saved report records the actual HEAD and whether the tree was clean beside the label you supplied.
• A versioned fixture matrix runs each reviewer adapter against the output shapes of the CLI versions
  MOMM supports, error cases included. Adding a CLI version is adding a folder.
• The source-hygiene suite fails locally on machine home paths and credential-looking literals, so the
  publish scanner is no longer the first to see them.
• The README and the site home carry one generated status line: the stable version and, when there is
  one, the candidate under test.

If a reviewer still fails after updating

• invalid_output naming an unrecognised event type: the CLI is newer than this MOMM. Report the named
  event in a GitHub issue; do not edit the list locally.
• A Codex "CLI/model compatibility" error: update the Codex CLI with
  npm install -g @openai/codex@latest. MOMM never changes your Codex settings.
• quota: an account allowance, not a login problem and not a MOMM fault. Wait for it to reset.

Known limits. No independent tester has run the suites on a personal macOS or Linux machine; Unix
coverage is hosted CI. Codex picture generation still loads your Codex configuration. The compatibility
record has no expiry: it clears when the CLI, the model or the outcome changes. The temp-path rule in
the hygiene suite is narrow and sees one line at a time; the shared helper is the real protection. The
other limits listed in the 1.17.0 notes stand.

Details: plan · gate record and findings ·
Copilot adapter notes

Post-release independent testing

An independent Windows/Node 24.19 run at the released commit reported 74/97 suites passed, 23 failed, process exit 1. Its original private report was preserved. A separate attempts-suite rerun passed with the inherited MOMM_EVIDENCE_HOME setting removed from that child process; this suggests an evidence-environment/fixture interaction, but does not explain all 23 failures or replace the original result. Successful hosted CI and drills remain separate evidence. See the full report and Discussion #32 follow-up. Do not weaken privacy checks.

Fixed in 1.17.2

The result above was reproduced exactly on a fresh clone of this tag (74 of 97, the same 23 commands), and its cause is fixed in MOMM 1.17.2, released 5 October 2026. The suite runner handed MOMM_EVIDENCE_HOME to every suite it started, and the suites' fixture projects were not isolated from it; setup-ui.mjs --self-test and ledger.mjs --self-test failed the same way. Reviews themselves were not affected. The 74 of 97 result stands as the record for 1.17.1. If you ran the 1.17.1 pack with a real evidence home, the 1.17.2 notes say how to recognise the fixture folders it left there.

MOMM 1.17.0

MOMM 1.17.0 — release notes

Released 3 October 2026. The signed tag momm-1.17.0
names commit 5a3385468011bafabcddc719264783f23d71602e, the exact sealed candidate tree
squash-merged from PR31. Do not install an unsigned branch as a signed release.

The immutable signed tag retains the pre-publication notes (publication pending) and
the version-notes history entry that were sealed before release. This post-release
document and the live release page are the publication record; the signed payload is
not retagged or resealed merely to change its historical notes.

Release evidence: exact-main CI, 15/15,
signed checkpoint,
six hosted lifecycle cells, 13/13 steps each,
and stable signing and update smoke.
Every lifecycle cell exercised recovery from interrupted upgrades from both 1.16.1 and 1.16.0.
Fresh-clone verification validated the Git signature, Rekor entry, expected certificate claims
and sealed payload; an intentionally wrong signing identity was refused.

1.17 keeps one writer and makes everything around it harder to fool. Reviewers stay read-only; the
governor is the only writer; account logins only; automatic updates stay off.

Safer by default

• On macOS and Linux, MOMM now launches a reviewer CLI or Git only from a PATH folder outside the project
  you are reviewing, as it already did on Windows. A CLI installed only inside that project is reported as
  not installed. The updater, probes and the Setup Center's helpers follow the same rule. A command
  given as an absolute path is launched only by its real path, and only when both the path as named and
  the real path lie outside the project.
• A .reviewrules file that arrives with a cloned repository is ignored until you trust its exact hash.
  MOMM prints the hash and the one command to trust it. (1.16 applied it for one release with a warning.)
• Codex reviews no longer load your Codex MCP servers, global instructions or skills. Your model and
  effort are read from your Codex settings, never changed, and passed explicitly.
• Grok reviews, probes and picture generation all run isolated from your Claude Code and Cursor setup.
• Capability probes are tied to the exact command that earned them, so 1.16.1 never uses evidence it
  cannot act on.
• Optional: set MOMM_EVIDENCE_HOME to keep review evidence under your own profile, one folder per
  project, instead of inside the project. Useful on drives whose defaults grant other accounts access.

Reviews that finish, and say what happened

• Reports show real reviewer versions again: the readiness check finishes before reviews start.
• Splitting never separates removed lines from the lines that replace them; with Grok reviewing, pieces
  are capped at 20 KB, and Grok's output streams, so a timeout still records what arrived.
• When a reviewer’s quotation fails the exact-text rule, the private attempt record keeps a short
  diagnostic (the failing quote’s hash, length and first 80 characters after redaction).
• A quotation that is exactly inside one side of one diff hunk now counts when it is copied without the
  diff's line markers; a quote that mixes removed and added lines, or spans two hunks, is still refused.
• In an image review, reviewers may cite what they saw by the attachment's hash and a pixel region.
• Findings may carry a claim type (DEFECT, RISK, QUESTION, IDEA, NOISE). Severity still decides
  what needs reproduction.
• --cover lets another requested route cover a reviewer role that failed, never after a login or
  allowance failure, with at most two attempts per piece and role, and never a double vote.
• --second-look asks one other route to confirm or refute one disputed claim; the original report is
  never changed.
• Reviewer roles are versioned files with a review date; the adversary role carries a short loophole
  checklist.

A stricter completion check

• A decision marked "style" is checked against the actual bytes: commenting out code, editing a tool
  directive or re-indenting Python is not style. A gate review of 1.17 itself found and closed five
  ways code could pass as style (see the gate record).
• An optional mutation record shows a test fails when its fix is reverted.
• The completion validator says when a review is stale because MOMM, its contract or your guidance
  changed since.
• The scorecard adds a roster per route and role, labelled as your project's own decisions.

Pictures

• generation-rounds.mjs asks every image-capable route for a picture, asks you before each round with
  its cost, sends your words unchanged, has the governor critique the pictures blind against a checklist
  you confirmed, and shows everything in a private local gallery. The ledger now shows generated pictures.
• Grok image generation works: MOMM grants exactly the image tool headless Grok needs.

Updates and recovery

• If an update is interrupted, the refusal message prints the exact command to release the stale claim
  (update.mjs --release-claim <token>) before --rollback --yes. The lifecycle drills now interrupt an
  upgrade on every cell and recover it. Releasing a claim can never remove a newer claim that replaced
  it meanwhile.
• When an evidence folder cannot be verified, the printed repair command is quoted for the shell it
  names (PowerShell or cmd.exe) and includes your evidence home when one is set.

Known limits. Blind picture copies keep any provider metadata inside the image file. Model identity
and attachment bytes are reported as unknown in the stale check. Grok video generation is refused while
your Grok account has zero data retention on. Codex picture generation keeps its 1.16.1 command
(--sandbox workspace-write, without the review's --ignore-user-config --ignore-rules), so it still loads
your Codex configuration; the new isolation covers Codex reviews and the probes that certify them.
A project at a drive or filesystem root cannot complete a review receipt (the check refuses, safely).
If the privacy check fails after picture makers have answered, that generation must be started again.
On a volume without hard links (FAT, exFAT) releasing a stale update claim uses an exclusive copy; that
path is unit-tested but was not run on such a volume. A gate review should be a --range review: a
review of a diff file given as --input cannot receive a completion receipt for findings that cite
project files.

Testing and saved-evidence limits. Independent final-candidate retesting was native Windows;
macOS/Linux suite and lifecycle evidence comes from GitHub-hosted runners, not an outside Unix reviewer
or a long-used personal Unix machine. No independent Unix review is claimed.
A separate Windows/Node24.19 original run
passed all 93 suites but exited 1 at final saved-report replacement in a OneDrive-synchronized workspace.
That invocation remains a failed process-level run; it is not relabelled as exit 0. Its sync/file-locking
cause is unproven. Report saving fails closed, and linked/non-private evidence storage remains refused.
Use the existing external private MOMM_EVIDENCE_HOME option rather than weakening privacy checks;
keep incomplete persistence separate from suite totals. Better persistence diagnostics remain follow-up
work, not a fix in this signed tag. Copilot CLI 1.0.91 can emit an event outside the adapter's closed
vocabulary and be refused as invalid_output; it was not counted toward the final 3 October reviews.

Details: plan · gate record · reviewer pack ·
long-form notes

MOMM 1.16.1

MOMM 1.16.1 — release notes

Released 28 September 2026 as the signed tag momm-1.16.1 (commit c381c95, release workflow run
36362233567: signature, Rekor entry and certificate claims validated; CI matrix run 36360716500).

The patch strengthens existing review and update behavior: content-based media checks, explicit
capability expiry, separate retry evidence, failed-work accounting, tool-produced verification
records and active-installation conflict reporting. Reviewers remain read-only; the governor
is the only writer. Account logins remain required. Automatic updates remain off.

Media identification checks bounded container structure, not decoded perceptual correctness,
malware safety or every possible encoding. Unsupported/unbounded containers fail closed.
Successful probes expire after seven days; an expired cell stays blocked until a deliberate
re-probe. Success on one modality does not prove another.
Unknown usage/cost is not zero. Matching evidence hashes do not prove the adequacy of a test.

The existing installation inventory, dirty-clone guidance, effectiveness scorecard and optional
training export are retained. Scorecards reflect governor rulings, not objective model quality.
Private evidence and project content are not published automatically. Rolling back from 1.16.1 to an
earlier release completes its installation check (the inventory helper is kept with the recovery copy).

The scope-audit follow-up clears stale update success after a failure and verifies
training-export destinations with the native privacy checker, on Windows as well
as POSIX. A new dedicated destination can be created privately; an existing unsafe
directory or companion file is refused, even with --force. Existing permissions
are not changed. The current acceptance guide
adds the missing retry and ledger-ticket steps.

Reviewer routes: MOMM now tells you when a reviewer CLI is behind its latest release, after preflight
and at the end of a review, with its update command, an off-by-default automatic option and the Setup
Center for guidance. Grok runs isolated from your Claude Code and Cursor setup (no imported
instructions, skills, MCP servers or memory; every tool denied) and uses its faster serving when your
account has it: 194 to 308 s in three measured runs, inside its 360 s budget. A Codex "model is not supported" failure now
says to update the Codex CLI rather than change the model it shares with the Codex desktop app, and
Codex no longer reads the reviewed project's AGENTS.md or runs your hooks, plugins, apps or
multi-agent tools during a review; its model, effort and MCP servers stay as you set them. A failed
route never stores what MOMM sent it. A reviewer's quotation of the reviewed text now counts when it
differs only by typographic look-alikes (curly or straight quotes, dash variants, non-breaking
spaces) or whitespace, which models often retype; any other changed character is still refused.

A reviewed project can no longer choose the executable MOMM runs on Windows, or the Git that
verifies a committed range on any platform. Known limitation: on macOS and Linux, reviewer CLIs
are still found through PATH, so a PATH folder inside the reviewed project could supply one.
Review untrusted projects from a shell whose PATH contains no folder inside them; the fix is due in 1.17.

Verified before sealing (details in the gate record): every offline CI job on the
candidate; an independent bounded review with no candidate defect found; two full-range self-reviews
with every finding ruled (the completion receipt was waived by the owner); and the live image review,
where the review team caught the planted error and passed the correct image, though not every route
caught it every time. Signed install, upgrade and rollback drills on Windows, macOS and Linux run
against the signed checkpoint before publication.

Broader workflow checkpoints, managed paid reviewers, new installation-management interfaces,
website films and new modalities are not quietly included in this reliability patch.

MOMM 1.16.0

MOMM 1.16.0 — measurement, ratings, guidance, throughput, upkeep

Status: released 19 September 2026 as the signed tag momm-1.16.0 (commit cbd5570, release
workflow run 35462410210: signature, Rekor entry and certificate claims validated; genuine signed
preview and apply passed). Built from 1.15.1 starting 2026-09-13. The consolidated
candidate and its gate record are on PR #7;
the independent-audit conversation is on PR #4
and the audit repairs came from PR #6 and
PR #8.
A version string never establishes a release; the signed momm-1.16.0 tag does. The text below
the summary is the dated record as it was written, so it speaks of a candidate.
Plan: plan-1.16.0.md.

In short

• Every review reports what it cost: tokens and cost per reviewer where the provider reports
  them, in the report, the private ledger and the Setup Center.
• Reviewers get a report card: rate a review after triage; the ledger shows ratings from five
  runs up and 30-day route reliability from ten runs up.
• Big diffs no longer time out: --split cuts a diff into pieces, judges quorum per piece,
  and hands anything too large to the governor to check directly. Nothing is dropped.
• Standing guidance behind a trust gate: project guidance is sent only after you trust that
  exact file by its hash.
• Media goes only where it can be read: a capability registry records which route accepts
  images, audio or video; an expired capability is blocked until re-probed; probes send synthetic
  material only and need consent. MOMM checks initial media types by filename extension, not file
  contents. Malformed or mislabelled files may still proceed; downstream rejection is not guaranteed.
• Windows is safer: the evidence folder is created private, and a git.exe or taskkill.exe
  planted in the project under review is never started, on any supported Node version: MOMM
  resolves every tool to an absolute path itself.
• Updates stay yours: update --check-all, an event-driven update clock, and an
  automatic-update setting that is off by default and that an agent never turns on.
• --retry-invalid (opt-in): a reviewer answer rejected as invalid output is asked for once
  more; validation is never loosened and every retry is written into the report.

Details are under What a user notices and
E7.

Upgrading from 1.15

• Use the installation and upgrade prompt;
  the signed-tag preview and explicit apply are unchanged. Logins, other skills and private
  ledgers are preserved.
• Windows: run node "<installed-momm>/scripts/multi-review.mjs" evidence --status in each
  existing project; where the evidence folder is reported as not private, the owner runs
  evidence --protect once. An agent never runs it for you.
• Automatic updates remain off unless you turn them on in the Setup Center.

How it was verified, and what was not

The candidate reviewed itself in nine gate runs through its own dispatcher (Codex, Antigravity
and Grok, two-review quorum per piece). All 1,376 findings and suggestions were ruled on and
logged; 42 findings were deferred and are listed by name. Every piece
of the candidate against main reached quorum cumulatively over reruns, not in one run, and
the reports cannot show which piece passed on which attempt. Two independent reviewers reported
the candidate ready on Windows; a third passed every offline check and was stopped at the live
step by a provider quota.

What this release did not prove. The ten-job CI matrix was reported green on the reviewed
head, but on the Windows Node 18 and 20 jobs one failing test was hidden by how a CI step reported
results, and the defect it guarded (a planted git.exe being started on those runtimes) was found
and fixed only after the go-ahead, before the tag. Install, upgrade, rollback and re-upgrade were
exercised by the release workflow's isolated drill, not on real machines. Media types are checked
by filename extension only. These are the debts 1.16.1 exists to pay. The
sections below are the dated record, in full, including what went wrong along the way.

Independent retest follow-up (18 September 2026)

• Reopening a valid private Setup Center launch link in the same tab now reloads
  through the ordinary authenticated bootstrap. It does not mint a session or
  bypass server authorization. Unrelated and malformed fragments do not reload.
• Private ledger tables retain readable column widths inside labelled,
  keyboard-focusable horizontal scroll regions. Short values stay together;
  prose can wrap. Page containment alone is not treated as proof of readability.
• Attachment regression failures retain child status, signal, error code, elapsed
  time, unchanged timeout and output byte counts before parsing; raw diagnostics,
  capability values and local paths are not printed by that failure summary.
• Media regression progress explicitly marks each completed case PASS or FAIL;
  an END marker alone is no longer ambiguous. These are diagnostic improvements,
  not a claim that BAB's native suite timeouts are resolved. Local passes do not
  invalidate her failures; bounded independent retesting remains required.

These changes remain candidate repairs pending exact-source peer review,
cross-platform CI and the signed release/install lifecycle.

Independent-audit repair pass (17 September 2026)

Credit: Bab PA (the independent reviewing personal agent) used controlled tests
to distinguish product defects from unavailable accounts and test-host limitations.
See the independent test report
for its exact environment, revision and limits. The following repairs still require final
source review, independent retest and the release gates below.

• An inconclusive CLI version check stays unknown, rather than reporting that the
  CLI is absent and suggesting reinstall or login.
• Served ledgers revalidate on reload and return an explicit unavailable response
  when rebuilding fails, rather than serving an old validation page as current.
  Damaged records and missing modern reports are visible integrity warnings;
  valid records remain available. Evidence tables have their own keyboard-focusable
  horizontal scroll region on narrow screens.
  Follow-up concurrency controls cover both scheduled/on-demand timer orders and
  requests arriving after an older rebuild has already read its inputs. Those
  later requests await a fresh rebuild, not merely the older run's completion.
  A subsequent real-HTTP regression also covers the serving layer: late readers
  queue behind a started rebuild rather than bypassing the watcher's barrier by
  sharing the earlier HTTP promise. Three failure/success orderings failed before
  the repair and passed afterward in scripts/ledger-serving.test.mjs.
  Setup Center reviewer-card headings and status badges wrap at narrow widths.
• Metadata-only update commands allow natural shutdown after output flush, with
  a bounded fallback. Review and mutating-command termination are unchanged.
  Bab PA's matched Windows controls passed on da7c0ab for the previously observed
  native assertion (12 native cases across Node 24.18 and 24.19; linked report above).
  Related repository checks are scripts/information-shutdown.test.mjs and
  momm/scripts/shutdown.test.mjs. This is scoped independent evidence, not a
  universal crash-free claim or closure of the separate modality-suite timeout.
• Missing or malformed package seals refuse before expensive package hashing.
  This is not a valid-seal hashing performance improvement or signed-release proof.
• Release test, 18 September (fresh clone, Windows 11): the permission check below made the
  candidate unusable on the test machine. .ensemble_reviews was created with a plain mkdir, which
  inherits the parent's access list, and then had to be private; every project on a data drive
  inherits access for other local accounts, and the profile temp and Documents folders carried
  groups added by a desktop sandbox, so no directory could run a review and every existing
  evidence folder was refused. CI stayed green because the suites injected a fake inspector.
  Fixed: on Windows a folder MOMM creates itself now gets its private access list at creation
  (the same CreateDirectoryW path the scratch folders use); an existing folder is still only
  inspected, and the refusal now names the reason in words and the owner's remedy. A new explicit,
  owner-invoked multi-review.mjs evidence (--status | --protect) restricts an existing
  .ensemble_reviews (Access section only, no ownership change, never any other directory).
  Native tests now run the real inspector against a MOMM-created folder under a broadly
  readable project and against the protect action; eight synthetic checks cover the decisions.
  Upgrade note for Windows: after moving from 1.15, run evidence --protect once in each
  existing project whose evidence folder is reported as not private.
• Release gate, 18 September (run rev_20260918172020_ehti, the 392 KB delta since the last gated
  tree through the candidate's own dispatcher with --split, Codex, Antigravity and Grok, two-review
  quorum per piece): quorum on 9 of 12 pieces, 31 findings and 67 suggestions, every one ruled on and
  logged. Real and fixed, each with a failing test first: evidence --protect would have changed the
  access list of a hard-linked file at its other location too (reproduced on Windows), so it now
  surveys the whole tree first and ref...

MOMM 1.15.1

MOMM 1.15.1 — signed updater staging correction

This patch retains the 1.15.0 improvements and corrects an
updater defect found by the fresh GitHub installation test after publication.
The original signed 1.15.0 tag is unchanged.

What failed and what changed

The updater fetched signed objects into a bare Git repository. The pinned
gitsign 0.17.1 verifier could not discover that repository and returned
repository does not exist. It failed closed before changing the installation.

Staging now uses a normal empty repository with a .git directory. Candidate
files are still not checked out or executed before signature and package-hash
verification. No signature, source-sharing or protocol-consent gate is relaxed.

Verification

• A real signed-tag comparison reproduced the bare-repository failure and passed
  with normal empty staging using the same tag, verifier and trust policy.
• The offline updater suite checks repository discovery and verifies no candidate
  files exist outside .git when the signature gate runs.
• Stable publication now runs a genuine signed preview and apply, using the
  actual verifier, in an isolated installation before pushing the release tags.
  The release record and workflow must succeed before these notes prove a release.

Upgrading from 1.15.0

The old updater cannot repair itself because its signature-preview step fails.
Use the installation and upgrade prompt
for an explicitly approved bootstrap: fetch the latest signed tag into a separate
normal clone, verify its signature and package hash before executing its code,
then invoke that verified updater with --repo pointing at the existing clean
skills clone. Preview the saved harness scopes and policy diff, then explicitly
apply. Preserve logins, other skills and private ledgers. Never fall back to an
unsigned checkout, rewrite the old tag, or claim matching version strings prove
matching installed files.

MOMM 1.15.0

MOMM 1.15.0 — explicit updates and clearer evidence

Final compatibility fixes preserve existing CSV download columns, deduplicate
identical decisions imported from overlapping evidence stores, and retain keyboard
focus and accurate report-derived titles in the public ledger. Malformed shared
fragments and legacy orphan entries have explicit regression coverage.

Updater receipt writes now share the update exclusion claim. Rollback retains
harness scopes explicitly added after an update; an implicit stable-channel
downgrade is refused and requires an explicit version choice instead.

These notes were prepared for the release candidate. Publication is complete only
after the safety matrix, privacy review and signed-tag verification. Check the
canonical release record
and signature before installing; this file is not proof that the tag exists.

Changes

• First-class update command: manifest/changelog check; verified staged dry run;
  explicit apply; previous-installation rollback and an out-of-checkout recovery runner.
• Per-harness installation scopes in momm.lock; both installers require a
  target, and mixed MOMM-only/collection installs retain their original scope.
• Stable, pinned and signed-development-checkpoint channels. No automatic update.
• Full policy diff in the preview and a separate --accept-protocol gate that
  --yes cannot override. Setup Center no longer bypasses this with git pull.
• Exact release-workflow signature identity and package SHA-256 verification.
  Actual dispatcher, updater and protocol hashes are recorded in new reports.
• Daily opt-outs including DO_NOT_TRACK; a notice is not update authorization.
• Five focused information pages; corrected project working-directory guidance;
  one deterministic renderer for public evidence, tables, downloads and hashes.
• A source-linked version archive separates published releases, historical tags
  and public code milestones. A shared new/existing-user prompt covers installation, saved
  installation receipts and explicitly approved legacy bootstrap; it never
  instructs an agent to bypass signature or protocol-consent checks.
• Full-ancestry update transfers and promoted-reference/integrity checks cover
  releases with intervening commits. Adding a harness preserves matching verified
  provenance. Receipt reads and journal checks occur under the update claim;
  existing claims are never automatically stolen based on a dead PID.
• The hub version comes from the manifest. The sitemap includes generated pages
  without invented modification dates; historical evidence retains its real date.
• Governor commands use quoted absolute installed paths. Reviewed file locations
  accept line suffixes only within the captured scope. A failed dashboard rebuild
  returns exit 5 and no current dashboard link even if its receipt was recorded.
• Interrupted daily-check recovery, ignored-file transition protection, matching
  signed-tag reuse on publication retry, and a main-checkpoint-only signing mode.
• Local-only public read-aloud refuses browser-default or remote voices. Review
  parsing prefers final envelopes; an unmet quorum cannot be labeled complete.
• Completed-review contract with quoted scope and strict pre-normalization
  validation; incomplete, malformed and oversized replies never silently qualify.
• Offline governor completion command: unique item decisions, original seals,
  reproduction/refutation records and final source/test/output hashes. A receipt
  is separate from the original report; later edits invalidate current completion.
• Growing append-only logs are streamed and fully hashed instead of failing at
  the individual-evidence-file size limit. Records and selected-run data remain
  bounded; malformed records and concurrent log changes fail closed.
• Stabilisation: visible partial-installer results, skill-list whitespace handling,
  actionable torn-claim and malformed-policy errors, source-snapshot race checks,
  explicit root guidance and accurate a/b path binding. Dirty checkouts cannot pass
  the release seal. Signing dependencies and successful-run lookup are hardened.
• Preview redirects/error handling, copy-feedback races and restored harness
  selections are covered by offline tests. Grok uses explicit tool denies instead
  of an ineffective empty tools argument, with a bounded four-turn final-response
  budget; this is CLI policy, not an OS sandbox or a universal reliability claim.

Evidence corrections

The existing 2026-09-04 public snapshot remains the source—not a fresh run:
153 run records, 139 stored reports, 366 successful log responses versus 343
stored responses (23 summary-only), and 570 decision records. Those decisions
are 302 applied, 251 rejected, 8 deferred and 9 historical unclassified rows.
31 coalition/multiple-route decisions are kept separate from individual routes.
These are this project's development records, not an independent benchmark.

Public report hashes now cover canonical sanitized JSON. The older stored-file
hash is explicitly labeled private-source provenance, not public-byte verification.
Malformed imports and conflicting duplicate run IDs fail visibly.

Verification and limitations

Updater fixtures use disposable real Git repositories and actual installers.
They cover manifest-only behavior, non-mutating preview, protocol refusal,
unsigned-tag rejection, bad hashes, dirty files, pinning, failed relinking,
per-harness scope, wrong post-relink commits, helper-code provenance, offline
recovery, opt-outs, stale claims, changed ignore rules, trust-environment overrides
and archive installation. Browser checks cover desktop/mobile layout and actual
ledger rendering; fake speech tests confirm missing/remote voices never play.
Positive transaction fixtures replace the signature service deliberately;
the release workflow and final live verification must exercise the real signer.

The updater does not claim recovery from deleted repositories, missing Git objects,
damaged storage or missing harness prerequisites. It refuses local edits and an
existing update claim; after a crash, independently confirm no updater is running
before removing only that claim and retrying recovery. It also refuses an
unrelated concurrent checkout. Legacy unsigned releases require an explicit
bootstrap; they are not update targets or retroactively signed.

The controlled lifecycle test runs real authored failing/passing tests with
synthetic peer replies, without provider calls. It is not proof that every harness
obeys the protocol. Record validation cannot establish that an observation is
truthful or a chosen test adequate; no peer snippet is executed automatically.
This release does not solve every reviewer reliability issue. See the maintained
roadmap for large-input route failures, independently detached processes and unsupported
source/media lifecycle binding. No API-key support,
repository split, telemetry collection or marketing outreach was added.

MOMM 1.14.1 — second round of page feedback

MOMM 1.14.1 — second round of feedback on the page

Released 2026-09-04, a patch on 1.14.0 after a second external read of the rewritten page.

Done

• FAQ answers are visible without clicking. They were inside collapsed <details> elements, which read as empty headings in a text paste. They are now plain question-and-answer blocks, with the CI answer corrected: there is no token or API-key path, so a headless runner without an authenticated CLI session cannot review — run it pre-push locally with --tier quick.
• ANSI and OSC escape sequences are stripped before the JSON parse boundary. A CLI that believes it is on a TTY can wrap its reply in colour or title sequences; those no longer misfile a valid reply as invalid_output. Self-test ansi_wrapped_json_still_parses. (This is hygiene, not the Antigravity fix: its diagnosed failure is an empty response above roughly 30 KB of input, still on the roadmap.)
• The route table is also published as Markdown (docs/momm/data/routes.md) and shown beside the static HTML table, so it copies cleanly into a terminal or text browser.
• Footer reordered: the 42.uk house motto is mentioned mid-paragraph; the page ends on the licence.

Declined, again with the reason

• Auto-executing a reviewer-supplied repro_assertion. Running a snippet authored by an untrusted reviewer — even in a sandbox, even to save the driver tokens — is exactly the instruction-following the protocol forbids, and a sandbox escape would be a code-execution primitive handed to whichever vendor is wrong that day. Reviewers already return test_suggestion; the driver rewrites and runs its own reproduction.
• "Automated reproduction gate" in the header. The gate is mandatory by protocol and enforced by the driving agent, not automated by the dispatcher; the honest word stays "reproduction gate".

Verification

Dispatcher self-test 65/65, ledger, Setup Center, myskills health contract, myrepo offline self-test; page audit on the live URL; the Windows/macOS/Linux × Node 18/20/22 Actions matrix.

MOMM 1.14.0 — the critique release

MOMM 1.14.0 — the critique release

Released 2026-09-04, hours after 1.13.0, in response to an external review of the public page that was mostly right. What it said, and what changed.

The page oversold the workflow

The 1.13.0 page described a local multi-CLI review script with a reproduction gate as a coalition, a journal and a measured scientific instrument. The page is rewritten to say what the tool is. Specifically:

• "Precision" is the governor's acceptance rate. applied ÷ (applied + rejected) measures agreement with one agent's later triage on this project, not precision against a labeled ground truth. --stats, the report's insights.track_record_note, the ledger panel and the page now say so. It remains an attention prior only.
• The ledger is self-review, not an external evaluation. Every run in the public export is this project reviewing itself. The page states that in the first sentence of the numbers section.
• Route failures are stated, not admired. The flagship run had two of five routes fail. The page says so up front, and the terminal UI now ends with the routes that did not review.
• The privacy question is answered in one sentence. Yes: each live route sends the redacted, metadata-stripped input to that vendor over your own login. "Zero API keys" is an implementation detail, not a privacy property. "Nothing leaves the machine" was only ever true of the voice generation and is now said only there.
• The install is explicit. install.mjs refuses to run without --target; the headline command links one harness and previews with --dry-run. --target all still exists, but you have to type it.
• The numbers are copyable. Every chart has a static HTML table beside it and a CSV under docs/momm/data/, regenerated by the exporter with the evidence and its digest.
• The peer-review analogy is demoted to what it is: a workflow shape that happens to match, on a synthetic specimen whose planted defects a single frontier model would also catch.
• The creator's academic title is removed from the page pending a verifiable source; the profile links remain.

What changed in the dispatcher

• Prose corroboration. When the input is not a diff, location keys are ignored — asked for a line_range on prose, reviewers invent one (prompt.txt:49, §2.3 Analysis:11, 2. Methods:3 for the same sentence in the live re-run) — and a finding merges with another reviewer's finding that shares a run of six normalized words: two readers quoting the same sentence are citing the same defect. The same reviewer's findings never merge this way; diff inputs keep the line-range rules. Replayed on the two sealed specimen runs: 26 raw → 10 defects, 9 corroborated (0.90) and 14 raw → 7 defects, 5 corroborated (0.71), where 1.13.0 scored 0 on both. Five self-tests.
• --tier quick|deep. Quick runs the two fastest routes by ledger median (copilot, antigravity) with a 60-second budget for staged commits; deep runs the pool with quorum 2 for release gates. Explicit --reviewers, --timeout and --min-success always win. Recorded as tier in the report.
• invalid_output is diagnosable. The detail now records the failure class (empty stdout, prose instead of JSON, JSON without findings[]), byte counts, whether the output limit was hit, and a sanitized 200-character sample.
• Redaction covers more token shapes (gho_, ghu_, ghs_, github_pat_, AWS AKIA…, bare sk-…), with a self-test proving template strings and process.env lookups survive untouched.
• Terminal output ends with the useful part: material findings with file and line anchors, the reviewer's own reproduction idea, and the routes that failed.

What was not done, and why

• Automatic execution of reviewer-supplied reproduction snippets was declined. Reviewer output is untrusted by protocol; running it, even sandboxed, is exactly the instruction-following the protocol forbids. test_suggestion stays a suggestion the governor rewrites and runs itself.
• Renaming the project is a decision for its owner. The expansion "Mixture of Model Modality" is dropped from the page; the name MOMM stays.
• POSIX process-group termination is on the roadmap: it needs a POSIX machine to verify and the Actions matrix to drill it.

Verification

Dispatcher self-test 61/61 (eight new), ledger 15/15, Setup Center 20/20, myskills health contract, myrepo offline self-test, installer refuses a missing --target; specimen re-run live with the new merge; the Windows/macOS/Linux × Node 18/20/22 Actions matrix.