daimon 0.2.0

Added:

• Model backends are a registry: --model <backend>:<name> names a local runtime by scheme, daimon models lists every backend's models with their declared capabilities, and a backend this build lacks
  is a clear error. Ollama now reports each model's real capabilities from its /api/show, so an
  embedding model is refused for tool use before generation rather than failing during it.

• --no-tools on the CLI and tools: [] over MCP open a text-only conversation, which any model can
  run; a request that needs tool calling on a model that does not declare it is refused with a hint.

• The audit log records model.resolved when a conversation opens: backend, model, asset, declared
  capabilities and who declared them, and the tools in use.

• Core AI: --model coreai:<bundle> runs a model exported to Apple's Core AI format, in daimon's own
  process, through the bridge from apple/coreai-models. Bundles live under <home>/models/coreai
  (config.json coreai.modelsDirectory) or are named by path; daimon models lists them with kind,
  compression, source, and size; a missing bundle is refused with where daimon looked and the export
  command. Capabilities come from the bundle. See docs/backends.md.

• inspect, a read-only tool the model can call to see daimon's effective config, this conversation's
  status, the standing approvals, or recent audit events, bounded to 4 KiB.

• MCP resources daimon://config, daimon://status, daimon://approvals, daimon://audit, and the
  template daimon://audit/{session} for one thread's events, so a calling harness can read daimon's
  state without a model turn.

• daimon config prints the effective configuration as JSON.

• MLX Swift: --model mlx:<directory> runs a model in MLX or Hugging Face safetensors layout in
  daimon's process through mlx-swift-lm's bridge, in builds made with --traits MLX (the release
  is); a build without the trait refuses mlx: models with the reason. Capabilities are declared by the
  operator per model in config.json's mlx.models; an undeclared model is text only. Verified with
  mlx-community/Qwen3-1.7B-4bit: text replies in 2.5 s including load, and the tool loop 3 of 3 with
  toolCalling declared. The Homebrew release does not include MLX, because it needs a Metal library
  bundle beside the binary; build with --traits MLX yourself. See docs/backends.md.

• approval.classifier chooses what judges commands beside the rules: rules, system-model (the
  default, unchanged), or coreml, a Core ML text classifier you train from a text,label CSV with
  scripts/train-risk-classifier. The model must follow a versioned contract or it is rejected; every
  failure or low-confidence verdict is moderate with the reason; the audit records the model's
  identity, version, label, and confidence. Measured on 2026-09-20: a model trained on the 45-command
  eval set scores 45/45 on it (its own training data, so no evidence of judgement); trained on the 35
  non-held-out commands it got 5 of the 10 held-out ones right, and two dangerous commands it called
  safe were kept off safe only by the confidence guard. Not fit to judge alone; measure your own
  with DAIMON_COREML_MODEL=<path> scripts/check eval before relying on it.

Changed:

• The run_command sandbox also allows writes under the per-user cache directory
  (getconf DARWIN_USER_CACHE_DIR), where Clang keeps its module cache; a build that compiles a C
  module inside the sandbox (SwiftPM compiling a dependency's manifest, say) used to fail with "could
  not build Objective-C module 'Darwin'".
• daimon with no prompt on a terminal prints its help instead of waiting silently for stdin; a piped
  stdin is still read.

Install or upgrade with Homebrew: brew install pidster/tap/daimon. Downloading the tarball directly leaves it quarantined; use Homebrew.