huqan v0.11.1

npm install -g huqan now serves 0.11.1. The previous release on this page was v0.10.0 — v0.10.1 and v0.11.0 were tagged but never reached the registry, so everything under those headings ships here for the first time.

Added

• fractal-learn (#1714). New huqan.fractal-learn MCP tool running a bounded recursive knowledge-synthesis loop: it chains kernel.dream rounds (hypothesis generation admitted through the mutation gate) and stops when the per-round entropy gain saturates (exhausted / saturated / maxRounds). Every write is receipted and the tool is gated mutating_requires_review, so the graph never grows silently.
• autoTune (#1716). huqan.fractal-learn gains a one-way autoTune mode: after each round it reads review feedback and tightens minScore / entropyFloor, but never loosens them automatically. Tightening is recorded per round; loosening always requires human approval.
• Graph health scoring and threshold tuning advice. huqan fitness scores graph health (coverage, precision, connectivity, consistency → A–F grade); huqan tuning turns review feedback into a threshold proposal — advice only, it never applies a change.
• Graceful shutdown on SIGTERM/SIGINT (#1697). server.js stops accepting connections and drains the HTTP server before closing observability timers, viewer state, approval storage, external-client resources and the kernel graph. A five-second fail-safe exits non-zero if the drain does not finish, so a container stop no longer severs in-flight requests silently.

Fixed

• Mutation journal replay tracking (#1671). Journal sections are null-prototype maps. On a plain object operations['__proto__'] = entry re-points the prototype instead of creating an own property, so a completed mutation left no record and the same operationId ran a second time; constructor and toString failed the other way, reading an inherited value back as a journal row. Persisted records keep own-property semantics across a JSON round trip.
• External client transport (#1672). scripts/external-client.js requires HTTPS for any bearer-authenticated destination that is not loopback. It previously sent authorization: Bearer <HUQAN_API_KEY> in the clear to whatever URL it was given. Plain HTTP survives only for 127.0.0.0/8, [::1] and localhost, where the request never reaches a network interface, and the check runs before the credential is read.
• Release authority (#1673). publish.yml checks the ref for every trigger, not only for tag pushes. A manual workflow_dispatch could reach npm publish from any ref, skipping the tag/version binding entirely. A publish now requires an immutable v<version> tag matching the manifest whose commit is an ancestor of the default branch, and the job runs in the npm-publish environment.
• Publishing from a release tag (#1745). The live Git guard in scripts/agent-context.js knew two shapes — sitting on the baseline branch, or working on a branch that already contains it. publish.yml checks out an immutable v<version> tag, which is deliberately behind origin/main by however many commits landed since the release, so the guard read a reviewed, merged commit as an unrebased feature branch and failed closed. A release checkout is now a third recognised state, admitted only on all three of: a detached HEAD, a v* tag at that commit, and reachability from origin/main. A detached HEAD without a tag, and a tag outside canonical ancestry, both still fail closed.

Note on this artifact

This tarball was uploaded by hand rather than by the release workflow, so it carries no npm provenance attestation — it cannot be cryptographically traced back to this tag. The source it was built from is ffbe070, the commit this tag points at.

The publish pipeline has since been moved off stored npm tokens onto GitHub OIDC trusted publishing (#1690), which attests every upload automatically. Releases from the next tag onward will carry provenance.