Skip to content
Release Notes

What’s new in each version of Massu

Long-form release logs covering what shipped, why, and how the audit gates kept it honest. For a terse per-version diff, see the changelog.

All Releases

Newest first. Each entry links to the full release log.

v1.15.0June 2, 2026

**Enterprise auto-learning governance + signed audit export (`plan-2026-06-01-enterprise-governance-audit-export`)**.

**Enterprise auto-learning governance + signed audit export (`plan-2026-06-01-enterprise-governance-audit-export`)**. Generalizes the Phase-3 per-rule two-operator review into an org-level governance policy enforced at the server promotion chokepoint + role-aware RLS, and adds a cryptographically-signed compliance e...

Read release notes
v1.14.0June 2, 2026

**Curated Rule Packs — versioned, installable, actually-enforced (`plan-2026-06-01-curated-rule-packs`)**.

**Curated Rule Packs — versioned, installable, actually-enforced (`plan-2026-06-01-curated-rule-packs`)**. Closes the inert-marketplace bug class: the rule-pack marketplace existed but enforced nothing — installing a pack flattened its rules into `org_rules`, which no core enforcement path ever read. Now an installe...

Read release notes
v1.13.1May 20, 2026

**PreToolUse dispatcher SSOT promotion + hook docs drift closure**.

**PreToolUse dispatcher SSOT promotion + hook docs drift closure**. Closes a customer-blocking regression introduced in 1.13.0: every fresh `npx -y @massu/core@1.13.0 init` wrote `npx -y @massu/core@1.13.0 hook-runner pre-tool-use-gate` into `.claude/settings.local.json` (the consolidated PreToolUse hook landed by P...

Read release notes
v1.13.0May 20, 2026

**v0.2 Interactive Rule-Approval (`plan-v0.2-interactive-rule-approval`)**.

**v0.2 Interactive Rule-Approval (`plan-v0.2-interactive-rule-approval`)**. Closes the silent-self-attestation bug class in Massu's auto-learning system. v0.1 (`auto-learning.md:35-46`) was a protocol obligation the model self-enforces at `/massu-loop` end, audited post-hoc by `/massu-learning-audit`. v0.2 adds real...

Read release notes
v1.12.2May 18, 2026

**Security MEDIUM sweep (`plan-2026-05-18-security-medium-sweep`)**.

**Security MEDIUM sweep (`plan-2026-05-18-security-medium-sweep`)**. Closes the 5 MEDIUM findings from the post-1.12.0 `massu-security-reviewer` audit-loop with structural drift-guards for each. M-1 IP_HASH_PEPPER consistency (silent-fallback vs throw class), M-2 webhook POST schema symmetry, M-3 Lemon Squeezy webho...

Read release notes
v1.12.1May 18, 2026

**Pre-push ↔ CI parity (`plan-2026-05-18-pre-push-ci-parity`)**.

**Pre-push ↔ CI parity (`plan-2026-05-18-pre-push-ci-parity`)**. Closes the structural drift class surfaced 2026-05-18 when SHA `b26fbb1` passed `pre-push-light` locally but failed CI on 4 distinct gates spread across 3 separate workflow YAMLs (`@massu/types/dist` missing → `ci.yml`, `eslint-rules/` missing from `PU...

Read release notes
v1.10.4May 18, 2026

Massu v1.10.4

**Stage C FINAL RELEASE** — pre-launch audit HIGH-severity sub-stages C.7 (architecture, 1 of 3 items) + C.8 (production-live, 2 of 2 items) + C.9 (UX consistency, 4 of 4 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 7 items shipped this release; 2 C.7 items (P-H032...

Read release notes
v1.10.3May 18, 2026

Massu v1.10.3

Stage C Release 3 — pre-launch audit HIGH-severity sub-stages C.4 (revenue path, 4 items) + C.6 (auth/billing, 4 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 8 items shipped.

Read release notes
v1.10.2May 18, 2026

Massu v1.10.2

Stage C Release 2 — pre-launch audit HIGH-severity sub-stages C.3 (schema/DB, 4 items) + C.5 (security defense-in-depth, 5 of 7 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 9 items shipped this release. Two C.5 items (P-H019 Ed25519 license signing + P-H022 nonce-b...

Read release notes
v1.10.1May 18, 2026

Hotfix release for Stage C `plan-stage-c-high-batch` Release 1 — closes the **wider P-H008 marketing-count drift class** caught by post-deploy smoke testing of 1.10.0.

Hotfix release for Stage C `plan-stage-c-high-batch` Release 1 — closes the **wider P-H008 marketing-count drift class** caught by post-deploy smoke testing of 1.10.0. The 1.10.0 P-H008 fix scope was narrow (just `installation.mdx` + `stats.ts`); post-deploy curl of `https://massu.ai/docs/getting-started/installatio...

Read release notes
v1.10.0May 18, 2026

Massu v1.10.0

Stage C Release 1 — pre-launch audit HIGH-severity sub-stages C.1 (hooks + doctor parity, 8 items) and C.2 (MCP tools, 2 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 10 P-H items shipped; 28 remain across 1.10.1 / 1.10.2 / 1.10.3 per the operator-revised release pl...

Read release notes
v1.12.0May 17, 2026

**Stage E — LOW + INFO sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-e-low-info-sweep`)**.

**Stage E — LOW + INFO sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-e-low-info-sweep`)**. Closes the 14-agent pre-launch audit by addressing the residual 71 LOW + INFO items not handled in Stages A–D. Stage E ships ~25 actionable items + 2 mandatory CR-46 drift-guards + 5 deferred-idea/...

Read release notes
v1.11.1May 17, 2026

**Stage D — second half (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**.

**Stage D — second half (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**. Bundles D.5 (live + docs medium, 6 items) + D.6 (UX medium, 8 items) + 2 structural drift-guards (mass-assignment prevention + workflow filename uniqueness extension) = 16 deliverables. Combined with 1.11...

Read release notes
v1.11.0May 17, 2026

**Stage D — MEDIUM-severity sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**.

**Stage D — MEDIUM-severity sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**. First of the two Stage D patch releases. Bundles D.1 (DB lifecycle, 10 items), D.2 (API webhook hygiene, 14 items), D.3 (revenue + cron, 6 items), D.4 (architecture cleanup, 7 items), and the SQ...

Read release notes
v1.10.8May 17, 2026

**P-H033 — Adapter-pattern tool gating (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**.

**P-H033 — Adapter-pattern tool gating (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**. This is the FINAL Stage C deferred-item release. With 1.10.5 (Ed25519 license signing), 1.10.6 (CSP hardening), 1.10.7 (config-driven SQL table names), and now 1.10.8, all 4 Stage C deferred ...

Read release notes
v1.10.7May 17, 2026

**P-H032 — Config-driven SQL table names (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**.

**P-H032 — Config-driven SQL table names (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**. 207 SQL string substitutions across 21 source files migrated from hardcoded `'massu_<table>'` literals to `${t('<table>')}` template-literal substitutions resolving through a new `lib/sql-t...

Read release notes
v1.10.6May 17, 2026

**P-H022 partial advance — CSP hardening (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**.

**P-H022 partial advance — CSP hardening (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**. The full nonce-based CSP migration (per-request middleware nonce + Next.js consumption pattern + per-page smoke testing) requires multi-day operator-coordinated work and is tracked as the e...

Read release notes
v1.10.5May 17, 2026

**P-H019 Ed25519 license signing** — closes the deferred follow-up from Stage C (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`).

**P-H019 Ed25519 license signing** — closes the deferred follow-up from Stage C (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`). Pre-fix `packages/core/src/license.ts:280-318` accepted ANY `{valid:true,plan:'enterprise'}` JSON over HTTPS from whatever `config.cloud?.endpoint` poin...

Read release notes
v1.9.5May 16, 2026

Massu v1.9.5

Pre-launch comprehensive audit remediation — combined Stage A + Stage B release covering all 22 CRITICAL findings from the 14-agent adversarial audit fleet (`docs/plans/2026-05-16-prelaunch-audit-remediation.md`, plan token `plan-2026-05-16-prelaunch-audit`). Every fix is structural — paired with a vitest drift-guar...

Read release notes
v1.9.3May 15, 2026

Bug-fix release.

Bug-fix release. Closes upstream issue [massu-ai/massu#4](https://github.com/massu-ai/massu/issues/4) — `tools/list` emitted a non-standard top-level `tier` field on every Tool object, which Claude Code 2.1.143 (released 2026-05-15) silently rejects, causing all 67 `mcp__massu__*` tools to disappear from the deferre...

Read release notes
v1.9.2May 15, 2026

Plan `plan-1.9.2-deploy-smoke-test-production-host` — `/massu-deploy` smoke tests now target the canonical production host (`https://massu.ai`) instead of the per-deploy Vercel preview URL.

Plan `plan-1.9.2-deploy-smoke-test-production-host` — `/massu-deploy` smoke tests now target the canonical production host (`https://massu.ai`) instead of the per-deploy Vercel preview URL. Closes the structural bug discovered 2026-05-15 during the 1.9.1 ceremony where every smoke test on `/`, `/docs`, `/changelog`,...

Read release notes
v1.9.1May 15, 2026

Bug-fix release.

Bug-fix release. Closes the structural rendering bug discovered 2026-05-15 in the auto-derived `/releases/<version>` path shipped in 1.9.0 (CR-46 consolidation). Each section's bullet items were pushed as separate elements of the `parts` array and joined with `\n\n`, so the blank lines between consecutive `- foo` ma...

Read release notes
v1.8.0May 14, 2026

Massu 1.8.0: MCP permission seeding suite — install-commands extension + permissions <sub> CLI cluster

install-commands now seeds the canonical mcp__massu__* glob into .claude/settings.local.json and propagates global defaultMode into the project-local file (closing an empirically-observed settings-merge trap). New massu permissions install|verify|check-drift CLI cluster + pre-push drift detection.

Read release notes
v1.9.0May 14, 2026

Massu 1.9.0: Plan-token-aware CHANGELOG batcher — release-boundary generator + pre-tag gate

New massu changelog generate|verify CLI cluster auto-drafts CHANGELOG entries by grouping commits by (plan-<token>) paren-notation and pulling each plan's ## Changelog Summary section. New pre-push step 11/11 BLOCKS pushes when version drifts from tag without a matching changelog entry.

Read release notes
v1.5.x → 1.6.0May 11, 2026

Massu 1.5.x → 1.6.0: structural drift-guards + workspace adapter publish

Two minors in 36 hours: 1.5.8 ships the plan-status structural drift-guard (CR-40) and 1.6.0 publishes the workspace adapter packages (Phase 9b). Soak verdict: PASS. Includes patches through @massu/core@1.7.0 (cohesive cleanup).

Read release notes
v1.7.0May 11, 2026

Massu 1.7.0: cohesive cleanup — stats SoT + monorepo domain-inferrer + npm dist-tag hygiene

Cohesive minor release bundling three structural-quality fixes in one ceremony: stats-vs-source-truth drift-guard for the homepage, monorepo domain-inferrer fix for non-src/ layouts, and removal of the stale `next: 1.2.1` npm dist-tag with policy documented in CLAUDE.md.

Read release notes
v1.6.3May 11, 2026

Massu v1.6.3

Plan `plan-1.6.3-website-feature-discoverability` — Website + scanner patch eliminating two structural drift classes surfaced 2026-05-11 when the user asked "where do these changelogs show up on the website?": (a) public page added without nav link discoverable only via direct URL; (b) website code shipped to npm + ...

Read release notes
v1.6.2May 10, 2026

Plan `plan-1.6.2-server-lazy-db-deps` — Daemon-code patch eliminating the structural bug where every MCP tool/call eagerly opened both CodeGraph + Data SQLite DBs at the top-level dispatcher.

Plan `plan-1.6.2-server-lazy-db-deps` — Daemon-code patch eliminating the structural bug where every MCP tool/call eagerly opened both CodeGraph + Data SQLite DBs at the top-level dispatcher. In any repo without `.codegraph/codegraph.db`, ALL tools failed — even memory/audit/knowledge tools with no logical codegraph...

Read release notes
v1.6.1May 10, 2026

Plan `plan-changelog-sot` — Website changelog now renders from `CHANGELOG.md` source-of-truth at build time.

Plan `plan-changelog-sot` — Website changelog now renders from `CHANGELOG.md` source-of-truth at build time. The hardcoded `ChangelogEntry[]` array on `website/src/app/changelog/page.tsx` (stale by 5+ major releases, last entry `0.6.3`, mismatched `0.x` scheme vs npm's `1.x`) and the orphaned `website/content/change...

Read release notes
v1.6.0May 9, 2026

Plan 3c Phase 9b — workspace adapter publish (`plan-3c-phase9b`).

Plan 3c Phase 9b — workspace adapter publish (`plan-3c-phase9b`). Closes the 1.5.0 Infrastructure note ("5 workspace placeholder packages remain at `0.0.0-prework`") by shipping the 5 first-party AST adapters as standalone npm packages alongside `@massu/core@1.6.0`. Architecture is **Z+II**: workspace package source...

Read release notes
v1.5.8May 9, 2026

Plan-status drift-guard release.

Plan-status drift-guard release. Closes the recurring "manual refresh of stale plan-Status headers" pattern with three structural layers: schema validator, commit-link drift scanner, and a vitest drift-guard test. Adds a canonical `**Plan Token**:` field to all 55 plans so commits can be cross-referenced bidirection...

Read release notes
v1.5.7May 8, 2026

Test infrastructure release.

Test infrastructure release. Closes the two follow-ons documented in 1.5.5 and 1.5.6 CHANGELOGs as the structural drift-prevention against the class of bug that produced both hotfixes (FIRST_PARTY_ADAPTERS divergence + bundle-vs-source CI gap).

Read release notes
v1.5.6May 8, 2026

Hotfix on 1.5.5.

Hotfix on 1.5.5. 1.5.5 added the 6 Phase 7 adapters to `FIRST_PARTY_ADAPTERS` correctly, but the bundled `dist/cli.js` inlined `web-tree-sitter` while its companion `tree-sitter.wasm` runtime artifact was NOT copied to `dist/`. R-011 evidence (live test against published 1.5.5):

Read release notes
v1.5.5May 8, 2026

Hotfix on 1.5.4 (published ~10 min earlier same day).

Hotfix on 1.5.4 (published ~10 min earlier same day). 1.5.4 shipped the file sampler + introspect piping correctly but `codebase-introspector.ts:FIRST_PARTY_ADAPTERS` only listed the 4 original Plan-3b adapters. Phase 7 adapters (`rails`, `phoenix`, `aspnet`, `spring`, `go-chi`, `python-flask`) were committed Phase ...

Read release notes
v1.5.4May 8, 2026

Closes Plan 1.5.1 §3 item #4 (the explicitly-deferred AST adapter output piping).

Closes Plan 1.5.1 §3 item #4 (the explicitly-deferred AST adapter output piping). Pre-1.5.4 `introspectAsync()` handed AST adapters `SourceFile[] = []` because of a placeholder at `codebase-introspector.ts:160-170`. Adapters always worked (verified by `adapter-grammar-strict.test.ts` 10/10 fixtures with `'high'` con...

Read release notes
v1.5.3May 8, 2026

Test infrastructure release that closes the source-vs-bundle gap demonstrated by 1.5.1 → 1.5.2 hotfix.

Test infrastructure release that closes the source-vs-bundle gap demonstrated by 1.5.1 → 1.5.2 hotfix. Pre-1.5.3, `init-end-to-end.test.ts` ran against TS source via vitest where `__dirname` resolves at `src/commands/`-depth; production `dist/cli.js` has different depth and was failing the same scenarios despite the...

Read release notes
v1.5.2May 8, 2026

Hotfix on 1.5.1 (published ~30 min earlier same day).

Hotfix on 1.5.1 (published ~30 min earlier same day). 1.5.1's variant-template merge was structurally correct but `resolveTemplatesDir()` had a long-standing path-resolution bug that returned `null` from the bundled `dist/cli.js` — so `applyVariantTemplate` always bailed at its first guard, leaving `framework.router...

Read release notes
v1.5.1May 8, 2026

Patch release closing two CR-39 violations discovered via end-to-end fixture verification of `npx massu init` against all six Phase 7 frameworks.

Patch release closing two CR-39 violations discovered via end-to-end fixture verification of `npx massu init` against all six Phase 7 frameworks. Phoenix and ASP.NET projects could not previously install Massu (`error: no languages detected`); Rails / Spring / Go-chi installed but emitted generic configs missing the...

Read release notes
v1.5.0May 7, 2026

Plan 3c (adapter registry + framework coverage).

Plan 3c (adapter registry + framework coverage). Registry infrastructure (`registry.massu.ai`) is live and signed; six new first-party AST adapters bring supported framework count from 4 to 10 (rails, phoenix, aspnet, spring, flask, go-chi added on top of the 1.4.0 baseline of fastapi, django, nextjs-trpc, swiftui)....

Read release notes
v1.4.0May 7, 2026

Promotes the `1.4.0-soak.0` build (in soak since 2026-05-02) to `latest`.

Promotes the `1.4.0-soak.0` build (in soak since 2026-05-02) to `latest`. Soak-check verdict on 2026-05-07 09:00 PDT: **PASS** (samples=188, rss_p99=290 MB / budget 700, cpu_load=0.044 / budget 50, alive_pct=100, errors=0, slope=-11.35 MB/hr).

Read release notes
v1.3.0April 26, 2026

Stack-aware command templates with per-stack variant resolution.

Stack-aware command templates with per-stack variant resolution. Local-edit protection via 3-hash manifest. (Retroactive entry: not previously logged in CHANGELOG; corresponds to npm-published version `1.3.0` from 2026-04-26.)

Read release notes
v1.2.1April 20, 2026

`@massu/core init --ci` no longer rolls back on fresh monorepo installs (turbo, nx, pnpm workspaces, lerna, rush, generic).

`@massu/core init --ci` no longer rolls back on fresh monorepo installs (turbo, nx, pnpm workspaces, lerna, rush, generic). Fixes the 2026-04-20 monorepo `paths.source` rollback regression.

Read release notes
v1.2.0April 20, 2026

`config upgrade` and `config refresh` no longer silently drop user-authored config data.

`config upgrade` and `config refresh` no longer silently drop user-authored config data. Fixes the 2026-04-19 HIGH-severity config-data-loss regression.

Read release notes
v1.1.0April 19, 2026

`massu config` CLI surface + drift detection runtime.

`massu config` CLI surface + drift detection runtime. Unblocks the config-migration workflow for downstream repos. Additive only — no breaking changes.

Read release notes
v1.0.0April 19, 2026

Auto-detect on install; zero manual config; migration via `migrateV1ToV2()`.

Auto-detect on install; zero manual config; migration via `migrateV1ToV2()`.

Read release notes
v0.3.0February 25, 2026

Massu v0.3.0

Release v0.3.0.

Read release notes

Try the latest release

Install Massu and start governing your AI development today.