Monomind 2.9.0: A Review-and-Hardening Release
233 files, ~92,000 lines, 28 fixes, and a test suite that finally hits zero failures
A full-codebase review pass: 233 files, roughly 92,000 lines, audited end to end.
Monomind 2.9.0 isn't a feature release in the usual sense. It's a hardening release: we pointed a 7-agent review swarm at the entire CLI package - 233 files, approximately 92,000 lines - and had it look for bugs, security gaps, and reliability holes rather than new capabilities.
That process turned up 39 issues total. We fixed 28 of them in this release, each with a regression test so they can't silently come back. The remaining 11 were lower-priority or needed more design work, so they're filed as GitHub issues #62 through #73 for future releases.
The test suite tells the same story in numbers: before this work it was 820 passing and 13 failing. It's now 884 passing and 0 failing.
233 Files Audited, 28 Issues Fixed, 0 Test Failures
A 7-agent, in-process review swarm (no cross-machine networking, vote-count "consensus") audited ~92,000 lines across the codebase.
How the review swarm actually works
In-process coordination, not a distributed system
It's worth being precise about what "7-agent review swarm" means here, because the term invites the wrong mental model. Monomind's swarm and hive-mind coordination system is explicitly experimental and in-process: it runs multiple Claude Code agents inside one process on one machine, coordinated by CLI-tracked state. There's no networking between separate machines, and no real distributed system underneath it.
The "consensus" strategies - including the one labeled raft - are in-process vote-count thresholds among those agents, not real Raft leader election or log replication. That's a meaningful distinction: it means the review swarm is a structured way of running several focused audit passes over the same codebase and reconciling their findings by majority vote, not a fault-tolerant distributed review network.
For this release, that in-process coordination pattern was pointed at the codebase itself - each agent auditing different files and classes of issue, with findings reconciled and then fixed with accompanying regression tests.
Key Takeaways
- ✓7 agents audited 233 files (~92,000 lines) in one coordinated in-process pass
- ✓Swarm/hive-mind coordination is in-process only - no cross-machine networking
- ✓"Consensus" here means vote-count thresholds, not leader election or log replication
What actually got fixed
Security hardening and crash-safety, not new features
On the security side: a command-injection vulnerability in cap-documents.ts was fixed. The terminal_execute tool is now an explicit opt-in gate rather than something available by default. The dashboard and org server now bind to 127.0.0.1 only, instead of listening on all interfaces. Crash-reporter output redaction was hardened so secrets and PII scrubbing is actually reliable rather than nominally implemented. And a fast-uri CVE was patched via a dependency bump.
On the robustness side: state writes are now atomic, which prevents corruption if the process crashes mid-write. SQLite's busy_timeout is set to 5000ms to handle concurrent access without immediate failures. Git operations now carry a 30000ms timeout instead of hanging indefinitely. And an approval mutex was added to close a race condition in the approval flow.
Two smaller but practical additions round out the release: monomind init now writes a runnable .monomind/orgs/sample-team.json, so a new install has a working example immediately instead of an empty config. The CLI statusline also gained a staleness indicator for the monograph knowledge graph, and a global Documents dashboard tab was added.
{
"name": "sample-team",
"description": "Runnable starter org created by monomind init",
"agents": [
{ "id": "coder", "type": "coder" },
{ "id": "reviewer", "type": "reviewer" },
{ "id": "tester", "type": "tester" }
]
}“The goal wasn't new features. It was making sure the code we already shipped does what we said it does - and fixing it, with a test, when it didn't.”
- Monomind Core Team
Key Takeaways
- ✓Command-injection fix in cap-documents.ts; terminal_execute is now opt-in, not default
- ✓Dashboard and org server now bind to 127.0.0.1 only
- ✓Atomic state writes, 5000ms SQLite busy_timeout, 30000ms git timeout, and an approval mutex
By the numbers, and what's next
28 fixed, 11 filed, 0 failing tests
The net result: 28 of the 39 issues found were fixed in 2.9.0, each backed by a regression test. The other 11 were judged lower-priority or needing further design and are tracked as GitHub issues #62 through #73, so they're visible and won't get lost.
The test suite moved from 820 passing / 13 failing to 884 passing / 0 failing - 64 new tests added along the way, mostly covering the 28 fixes directly.
Monomind remains Apache-2.0 licensed. One more thing worth knowing if you haven't looked at it before: crash reporting is on by default, not opt-in. If a tool hard-crashes, monomind can file a GitHub issue on that tool's repository with the relevant diagnostic output, redacting secrets and PII first. If you'd rather not have that, it's a single command: monomind crash-reporting disable.
Key Takeaways
- ✓28 of 39 found issues fixed and tested in 2.9.0; 11 filed as GitHub issues #62–#73
- ✓Test suite: 820 passing / 13 failing → 884 passing / 0 failing
- ✓Crash reporting is on by default (opt-out via monomind crash-reporting disable), with secrets/PII redaction
Conclusion & Future Outlook
There's no headline feature in this release, and that's the point. 2.9.0 is what happens when you stop and check your own work: audit the codebase you already shipped, fix what's actually broken, and prove it with tests instead of a changelog line.
Monomind is Apache-2.0 licensed and open source. If you want to see what's still open, GitHub issues #62 through #73 are the honest list of what we found but haven't fixed yet.
Deploy Monomind Digital Workers Today
Run open-source AI agent teams on your own infrastructure or hire Monoes Workforce to build and audit fully managed operations.