Versions

What is current, what changed across versions, and how to verify what you downloaded. This page is the public record for citing GMAA by version.

Advisory, 2026-08-24 (Claude line): adopters running any earlier Claude-line package should upgrade to gmaa-engine v2.5.7, which cures the genesis mint failure. Anyone staying on v2.5.6 can apply the one-line workaround in the changelog below, which is the same relocation the release ships.

How the engine implements the specification, every file with its trigger, is on the engine map.

v2.5.7 supersedes v2.5.6 (released 2026-08-19), which superseded v2.5.4.1 (released 2026-08-13). One release between them was sealed and held before publication: a review of its own gates found a merge-time gap in the spine census, and it was superseded rather than patched, because sealed bytes are never edited in place.

How versions work

Every version is cited on two axes together: the package version (the engine artifact) and the canon pin (the specification version the artifact ships and conforms to). Every content change is a new version, and nothing is ever rebuilt in place under an existing label. Verify every download against its fingerprints before use.

How it ships

One release, four loose files, one sealed engine.

Loose at the repository root, readable before you download anything: the README (the argument and the quick start), the license, the specification PDF (v1.6.1, CC BY 4.0), and SHA256SUMS, which fingerprints all of them plus the engine zip.

One sealed download, the engine. The machinery you run ships as a single sealed zip: the governance scripts, agent definitions, contracts, schema, the adopter entry documents (the adoption cover and the getting-started walkthrough), the operator guides, the changelog, the citation file, and, from this release, the specification itself under canon/, pinned v1.6.1. The zip carries its own MANIFEST.sha256 covering every file, including the canon, so the engine and the exact specification it conforms to travel and verify as one artifact.

The split follows the licensing. The specification is free under CC BY 4.0 and is the cite-by-version target, readable at the root as the PDF and at canon.html without downloading the engine. The engine is source-available under Apache 2.0 with the Commons Clause, which is not an OSI open-source license: free to use, modify, and redistribute, but not to sell or offer as a paid service. It is the one controlled artifact, and the in-zip canon is the copy it pins.

Upgrading. Holders of a v2.5.2, v2.5.3, v2.5.4, v2.5.4.1, or v2.5.6 blank package replace it in full and re-verify against SHA256SUMS. Instantiated projects upgrade only via the non-destructive adopter-update instrument. There is no patch path, deliberately: partial trees cannot be fingerprint-verified, and the absence of a hotfix vehicle is a governance statement, not a missing feature.

Version history

The public record begins at the initial release. Pre-release internal iteration does not appear here. The table grows by one row per released version, newest first.

Changelog

gmaa-engine v2.5.7 · canon pin v1.6.1, 2026-08-24 · Claude line

Fingerprints: zip sha256 915fc27be02cec8cd7f15495c4b521286b43718546772af335fac3c0e78f2f9c · package self-sha 42a2fbfebe0479cdd895e9470f56903038669fbd7562dcc665ad0e64e36b7cb5 · canon pin sha256 1b04522ac1870957c98720f3f67eefdc4987138a0584e3a431be221a52cd3c19 (unchanged) · 102 files, 101 manifest rows.

An errata release over v2.5.6. It is a composition cure and changes zero mechanism bytes. Both allocator scripts, pending-set.sh and ratify.sh, are byte-identical to sealed v2.5.6 by cmp.

The defect this cures. On a fresh instantiation, minting the first set failed with a shell arithmetic error. The allocators enumerate _ratification/ expecting only numbered packets, and the shipped packet template sat there under a letter name, so the count it produced was not a number. The mechanism was never at fault. Its neighborhood was.

The cure. The template moves to _ratification/templates/SET-NNNN.md, and a four-line header note names the home and the law it protects, that only allocator-minted files belong at the _ratification/ top level. Nothing reads the template by its old path. Adopters who already applied the advisory workaround are on exactly the layout this release ships.

The proof. The seeded-fault battery grows from 57 poles to 59. One new pole instantiates the shipped layout and requires the first set to mint at exit 0 and to re-mint idempotently. The other plants a template at the top level and requires the failure to be seen rather than assumed. Running the new battery against sealed v2.5.6 bytes scores 57 of 59 with exactly the two new poles red, which is the discrimination proof, and three seats reproduced it independently from the bytes.

Workaround for anyone staying on v2.5.6. Before your first mint, move the template into a templates subfolder under _ratification/ and commit. Nothing reads it by its old path, and this is the same relocation v2.5.7 ships.

Also in this release. The changelog carries the errata entry, the citation file and the adoption cover carry the v2.5.7 label and the seal date, and the manifest is regenerated. Nothing else moved.

gmaa-engine-grok v2.5.7 · canon pin v1.6.1, 2026-08-24 · Grok line

Fingerprints: engine zip sha256 23955abebdbf3950c7d8a422406548758a6d4053e0bae23fce934c78be264291 · plugin zip sha256 600fff2e26979011cabcb6ba89a388d530eb896043c9ad5ca5101b3677cb0052 · the full seven-file set is fingerprinted in grok/SHA256SUMS.

First release of the Grok line: the GMAA engine for xAI's Grok Build, published under grok/ in the same repository. The set ships two adoption routes. The terminal route follows the numbered README walk, with the Grok Build plugin installed from the folder. The Bot route hands Grok Bot the GROK-BOT.md file, and it serves as the chat architect only: it assesses fit, authors the instantiation fills on an explicit adopt, runs vanilla instantiate, and stops, and the operator launches every seat. Same specification, same gates: set-level authorization on top of per-change review, never instead of it. Engine version numbers run per line, and the Grok line begins at v2.5.7.

gmaa-engine v2.5.6 · canon pin v1.6.1, 2026-08-19

Fingerprints: zip sha256 ae2d946c9602b9888d3a6c7b265e800fb3d8eb0e1b9e33f472aa00c3233b612f · package self-sha 65a3cfa6a194677e47cdec030105a5e1c61f30998a741d4ab4215a78d89e2b2f · canon pin sha256 1b04522ac1870957c98720f3f67eefdc4987138a0584e3a431be221a52cd3c19 (unchanged) · 102 files, 101 manifest rows.

A correction release from a rules-first end-to-end trace of the published package: the governing rules were loaded first, then the launch and per-turn flow was traced against them. No new feature surface beyond the one mechanism the prior line had promised and not shipped. GMAA adds set-level authorization on top of per-change review, never instead of it. This release ships the machinery that enforces that model.

Set-level authorization ships whole. The mechanism the thesis names is now in the box, hardened in a live field program before being sourced back: a pending-set ledger and a set-identity registry; an assemble, assess, and ratify flow with a closed five-state decision taxonomy, a coverage gate, three-layer joint-edge detection, a required semantic-hunt step, and non-overridable per-member conformance; the foundation set-check wired into the pre-commit hook by path, not by an advisory message tag; a no-cherry-pick reap; the model contract; the set and member templates whose criteria are themselves the check; standing probes that pair every claim with its negative; and a seeded-fault battery. A new binding invariant states it in one line: set authorization is on top of per-change review, never instead of it.

Two defects corrected from v2.5.4.1. The launcher aborted silently under a strict shell when a project carried no project: stamp, so a fresh skeleton exited with no explanation. The project token is now a real stamped field and the launcher halts loud on an unfilled stamp and on a missing pre-commit hook, which is the boundary the spine-write gate depends on. And the spine census, which decides what counts as a protected path, was hand-maintained in each enforcer, so copies drifted and one merge-time gate stopped recognizing the set-authorization machinery's own files. The census is now single-sourced, and a standing probe drives every enforcer's own membership test against it so the copies cannot silently diverge again.

A cost brake ships. It reads the usage ledger and halts loud, at or over a cap and again when the ledger is unreadable or a cap is unfilled. It never assumes zero. The caps are an empty slot the adopting operator fills, and an unfilled cap on a metered path fails closed.

Honest labels, no false green. The source program's forced-merge hook is declared not shipped in this revision. A sentinel ships so a wiring tree composes, and the contract row states the gap. The context-lifecycle rule stays a stated discipline with no mechanism, by design, and says so. An engine-update runbook and its mechanical classifier ship so an adopter can take a new engine cut without a hand-merge, and a short "Upgrading" note appears in the reader documents.

Upgrading: holders of any prior blank package replace it in full and re-verify against SHA256SUMS. Instantiated projects use docs/ENGINE-UPDATE.md, which stops on any slot whose contract moved. There is no patch path, deliberately.

gmaa-engine v2.5.4.1 · canon pin v1.6.1, 2026-08-13, Errata

Fingerprints: zip sha256 473a20678ec6ef0ea4a7cb1d99edccbe52a6232e171bcf4f4acbccda7b64fc56 · package self-sha 1aff85f03a2d903ef466823ca76a958f59310a7f159a7240affe7153007ba8ce · 75 files · canon pin sha256 1b04522ac1870957c98720f3f67eefdc4987138a0584e3a431be221a52cd3c19.

Same-day errata to v2.5.4. Two shipped files, the hub seat definition and the coordination contract, misdescribed the communications model: they told the hub seat it had no inbox and implied the doorbell rings in one direction only. That contradicts the shipped substrate and would leave an adopter believing the seats cannot wake the hub, with the human filling the gap by hand. The corrected files state the reality: the hub has an inbox and runs the inbox check like every seat, the doorbell is bidirectional, and the hub additionally reaps module outboxes as a second inbound channel. GMAA adds set-level authorization on top of per-change review, never instead of it. Nothing in this errata changes that model.

Scope: exactly two content files changed, and every other file is byte-identical to v2.5.4. The version, fingerprints, checksum surfaces, and citation file move with the new identity, as they must: nothing is ever rebuilt in place under an existing label.

Upgrading: holders of the original v2.5.4, or of v2.5.2 or v2.5.3, replace in full and re-verify against SHA256SUMS. Instantiated projects use the non-destructive adopter-update instrument. There is no patch path, deliberately.

gmaa-engine v2.5.4 · canon pin v1.6.1, 2026-08-13, Superseded by v2.5.4.1

Fingerprints: zip sha256 764b1c3d3118edca8684da3bbd87e61336c167e59971e435407c14be84e6247b · package self-sha aeb2c4570c362080bce9eadc83712249be6443418fafe6a8182d2990a3e3cc72 · 75 files · canon pin sha256 1b04522ac1870957c98720f3f67eefdc4987138a0584e3a431be221a52cd3c19.

Errata and enforcement hardening, plus the canon re-pin. GMAA adds set-level authorization on top of per-change review, never instead of it. Nothing in this release changes that model. It hardens the machinery that enforces it.

Canon re-pinned v1.5 to v1.6.1, now carried in the engine zip under canon/: the specification travels with the engine and is covered by the same MANIFEST.sha256. v1.6.1 is errata over v1.6, which is superseded, do not cite. The coherence-session law is folded into the canon body as the fifth universal invariant, so the canon ships as a single document.

Launcher v3 hardening. launch-orc.sh reads the boot lane from the colon-form frontmatter (the prior form never matched, leaving the cross-check dead), adds a per-seat launch registry with per-seat model tier and a positional boot prompt for seats whose definition does not auto-fire. Folder-equals-lane, the project-qualified session namespace, the double-launch guard, and genesis are unchanged.

Boot-discipline enforcement gate. A new scripts/boot-check.sh (presence plus live currency) emits a mandatory boot-check line every boot, wired as a SessionStart hook so presence is harness-enforced. Currency is a live git delta anchored on a deliberate absorb marker, replacing the self-stamped date trigger that could read green while governance drifted.

Every shipped seat file carries the coherence line. The canon section 7.5 line lands verbatim, copied from the in-zip canon, in both charters, the operating contract, and all seven agent definitions, so the one-session-one-seat boundary is a substrate fact in every seat an adopter instantiates.

The citation file validates. CITATION.cff now passes CFF schema validation: the license is carried as a license URL pointing at LICENSE.md rather than a false bare SPDX claim, and schema validation is a standing seal check from this release forward.

Upgrading: blank-package holders replace in full and re-verify against SHA256SUMS. Instantiated projects use the non-destructive adopter-update instrument. There is no patch path, deliberately.

gmaa-engine v2.5.3 · canon pin v1.5, 2026-08-09

Fingerprints: zip sha256 438195bd097e1fccdd0ad65e16f010901bb3e3b4f391e0de6ac62cb215312651 · package self-sha e944cb745ca2073ac840a1e9dea4cea8c60f52d5c20daa7bde61fb8fbf3c1a51 · 65 files.

Restored the adopter-facing entry documents that were dropped when the package was reframed from evaluation package to engine at v2.5.0 and shipped missing through v2.5.1 and v2.5.2. ADOPTION-COVER.md is back (the read-first four-phase adoption flow: fit assessment, then your adoption gate, then instantiation fills, then implementation) and GETTING-STARTED-LINUX-MAC.md is back (the zero-to-running walkthrough). Both are modernized to the engine: canon v1.5, launch-orc.sh, folder-equals-lane (the foundation folder, with main as a branch), and Phase-3 output of docs/FOUNDATION.md plus seats.yaml. The README now points at the cover as read-first and states that the instantiation runbook is the canon's own section 12 checklist, not a shipped file.

Prevention: the MANIFEST and seal check now asserts the adopter-entry set is present, so a genericization reframe cannot silently drop it again. This is the completeness firewall (canon section 13) applied to the package itself.

Deferred: the Windows and WSL getting-started guide.

gmaa-engine v2.5.2 · canon pin v1.5, 2026-08-07, Initial release

Fingerprints: zip sha256 a3ba4117cf29c024c0019d20b04aef445c0baedd1681d1012c620d35be91a1c8 · package self-sha bcecbd286c8d9b4b0992f2af857533cf11563bd24deeeaeec84279844574e483 · 70 files plus manifest.

The first public release of the GMAA engine: a faithful generic extraction of a live production multi-agent architecture, independently reviewed pre-release by the production program it derives from.

In the box: - The complete governance machinery: lane resolution, launch, doorbell and inbox transport, sync, validation, audit hooks, standing probes, and the reaper, with per-file integrity (MANIFEST.sha256). - Seven agent definitions, including the orchestrator, the dispatch executor, and the optional code-substrate architect seat. - The portable contracts and schema slots, the operating contract, the standing disciplines with boot-creed trigger binding, and the project-foundation skeleton your architect instantiates. - The specification (canon v1.5) at canon/, also published at gmaa.ai/canon.html under CC BY 4.0. - First-launch genesis of all runtime-born state surfaces, a fresh installation boots clean, with every guard-checked file created and stamped at first launch. - Program-qualified session identity per spec §7.3 ({program}-{lane}, stamped at provisioning): multiple GMAA programs co-reside on one machine without collision, and the doorbell resolves exactly one target or halts. - scripts/preflight.sh, the substrate floor (Claude Code CLI, git with GitHub access, tmux; WSL2 on Windows) made testable: pass/fail per item, loud on any miss.

Known behavior on a fresh installation: the orchestration-freshness probe reads STALE until your program's first decision binds, it measures orchestration life, and a newborn installation has none yet. It self-clears at the first bound decision. It is a report, not a halt.

Companion artifacts (alongside the archive, not inside it): - The Operator's Guide, the human-side manual: the ferry, the doorbell, shutdown handshakes, restarts, and what to do when a seat halts.

Verify your download

Confirm the bytes are the bytes, the same discipline the engine itself teaches. The repository root publishes a SHA256SUMS file listing the sha256 of the sealed engine zip and of the specification. The Grok line publishes its own SHA256SUMS under grok/. Run the same check from inside that folder.

Verify the engine you run:

Confirm which specification version you have:

The in-zip canon is covered by MANIFEST.sha256, so a clean manifest check proves the specification inside the engine is the exact version this engine pins (v1.6.1). The loose PDF at the root verifies against SHA256SUMS.

The specification

The specification is versioned separately from the engine. Current: v1.6.1 (2026-08-11), published at canon.html and available as a PDF at the repository root, both under CC BY 4.0. The sealed engine v2.5.7 pins canon v1.6.1 and carries it in-zip under canon/, each engine version states which spec it pins, and both the loose PDF and the in-zip canon are fingerprinted so you can confirm the version you hold.

Spec licensed CC BY 4.0 · Engine Apache 2.0 with Commons Clause · Cite by version