v0.113.0

[github-actions[bot]]

What

The couture release. The judge already knew; the agent can now see.
Error codes and nika explain ride MCP, CLI JSON and wasm as one well.
Pipelines are judged per segment. Four missing authoring forms have
skeletons. Zero breaking changes since v0.112.0, so pre-1.0 real semver
puts this at a minor bump.

Added

• nika check now judges every native shell segment, not only the head.
  Pipelines, env wrappers, redirections, groups, if/while prefixes and
  newlines each surface their own native-first hint. Comments stay comments.
• Four form-first skeletons join nika new. classify-and-route,
  corpus-qa, document-to-fields and evaluate-and-optimize ship with their
  golden and their refusing neighbour, pinned to spec d40fe6ac.
• The MCP oracle now carries instructions and a structured example index.
  A dirty report keeps its NIKA-* code on the agent channel; nika_examples
  without a slug returns recoverable rows instead of a bare list.
• A green MCP check carries the contract, not just the word clean.
• The tightest permits boundary is offered, and only when it is knowable.
• The arm ledger is the firing truth; the workspace admits the arm custody
  library.

Changed

• The engine carries one compile-time identity for its version, build,
  language pin and remote API axis. nika-runtime now owns the typed
  EngineIdentity consumed by trace prologues, nika check --json and the CLI
  version surface. The embedded language pack is re-vendored from that exact
  SPEC_PIN, records the same commit in pack/SPEC_SHA, and the build refuses
  split identity.

Fixed

• A NIKA-PARSE-* finding is a PARSE row, including when the analyzer
  emitted it. Missing nika: / tasks: no longer wear the CONFORM
  ladder on nika check, --json findings[], wasm, or MCP — the spec
  family is the gate the agent explains from.
• Wasm parse-fatal rows stay PARSE regardless of code, matching CLI
  parse_fatal_json (a NIKA-DAG-005 unknown after predicate is PARSE
  on both assemblies).
• --fix cannot rewrite a digest-pinned registry cache, a symlink into
  that cache, stdin, or a device/FIFO. The footer teaches a copy into the
  workspace; a project path that merely looks like .nika/registry stays a
  normal file.
• The pinned conformance clock includes Agent Skills and current trace
  witnesses. The harness now exercises the spec's skill lane with exact
  AGENT, AUTH and SEC refusal codes, recognizes the entropy/jitter law,
  and replays every current runtime-trace verdict. The heal workflow advances
  the pin and pack together on an immutable PR branch; Diamond CI independently
  re-vendors every mapped byte.
• Reference dry-run, AUTH advice, repair and mock seats tell the truth.
• The clone says when its own enforcement is not armed.
• The plan projection API is locked.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.113.0 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.113.0.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.113.0.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.113.0

Provenance

Built from tag v0.113.0 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• test(hygiene): the comment stops quoting the token it explains by @ThibautMelen in test(hygiene): the comment stops quoting the token it explains #1089
• feat(arm): make the ledger the firing truth (replacement) by @ThibautMelen in feat(arm): make the ledger the firing truth (replacement) #1079
• fix(engine): bind runtime and pack to one spec identity by @ThibautMelen in fix(engine): bind runtime and pack to one spec identity #1091
• docs(serve): ratify the network trust boundary by @ThibautMelen in docs(serve): ratify the network trust boundary #1092
• fix(estate): the manifest stops conflicting, because a merged one is a lie by @ThibautMelen in fix(estate): the manifest stops conflicting, because a merged one is a lie #1087
• feat(mcp): a green answer carries the contract, not just the word clean by @ThibautMelen in feat(mcp): a green answer carries the contract, not just the word clean #1057
• fix(onboard): the brief carries one complete task, because prose is not a contract by @ThibautMelen in fix(onboard): the brief carries one complete task, because prose is not a contract #1032
• test(nika-pack): the template surface is asserted by name, not a typed count by @ThibautMelen in test(nika-pack): the template surface is asserted by name, not a typed count #1094
• feat(check): the tightest boundary is offered, and only when it is knowable by @ThibautMelen in feat(check): the tightest boundary is offered, and only when it is knowable #1062
• fix(ci): quatre gates ne resolvaient pas leur bibliotheque, et le Dockerfile bloquait tout push by @ThibautMelen in fix(ci): quatre gates ne resolvaient pas leur bibliotheque, et le Dockerfile bloquait tout push #984
• test(nika-catalog-codegen): four ISO-date mutants die on single-broken-clause probes by @ThibautMelen in test(nika-catalog-codegen): four ISO-date mutants die on single-broken-clause probes #989
• fix(hygiene): the clone says when its own enforcement is not armed by @ThibautMelen in fix(hygiene): the clone says when its own enforcement is not armed #1096
• feat(check): every shell segment is judged, and four missing forms now have a skeleton by @ThibautMelen in feat(check): every shell segment is judged, and four missing forms now have a skeleton #1095
• fix(reference): make repair and mock seats tell the truth by @ThibautMelen in fix(reference): make repair and mock seats tell the truth #1098
• fix(reference): make dry-run and AUTH advice tell the truth by @ThibautMelen in fix(reference): make dry-run and AUTH advice tell the truth #1099
• fix(check): lock the plan projection API by @ThibautMelen in fix(check): lock the plan projection API #1100
• fix(check): parse-family findings wear the parse gate by @ThibautMelen in fix(check): parse-family findings wear the parse gate #1101
• feat(workspace): admit the arm custody library by @ThibautMelen in feat(workspace): admit the arm custody library #1097
• fix(check): parse-fatal wasm rows stay PARSE regardless of code by @ThibautMelen in fix(check): parse-fatal wasm rows stay PARSE regardless of code #1102
• chore(release): 0.113.0 by @ThibautMelen in chore(release): 0.113.0 #1103

Full Changelog: v0.112.0...v0.113.0

---

This discussion was created from the release v0.113.0.