v0.1.4 — the stub says so, and the action stopped pasting input into a shell

0.1.3 answered from the canned stub, unlabelled, whenever a config omitted model.mode — canned prose above a per-claim citation verdict block, which reads exactly like a real model declining for lack of sources. This release exists mainly to stop that.

Fixed

• ask and chamber_ask now render a stub disclosure above the answer, from one shared function, on stdout and inside the MCP tool result (KNOWN_LIMITATIONS 19). AskResult is a discriminated union, so an answer with no recorded author is unrepresentable rather than merely discouraged.
• The composite GitHub Action no longer interpolates caller-supplied inputs into run: shell text, and neither does its own selftest. An adversarial CI job now hands the action a payload and fails the build on a canary.
• The Docker image runs as node rather than root; ten uses: lines are pinned by commit digest; both workflows declare permissions: contents: read.

Removed

• vendor/xenova-transformers/ — 11k lines of Apache-2.0 code nothing imported, with an unidentified upstream revision, invisible to npm audit, Dependabot and SBOM tooling.

Gates

Two new ones: probes/harness_declaration_guards.ts, plus subprocess tests driving the real CLI and MCP surfaces rather than the function behind them. The harness had been silently dropping async tests declared after its drain loop while still printing N/N passed, exit 0.

374 tests · 6 probes · typecheck · lint · demos. Verified from the packed tarball at a neutral cwd, not from the repo.