v0.118.7

[github-actions[bot]]

What

Fixed

• File journals refuse bytes beyond the verifier's existing bounds.
  Check final encoded lines and cumulative bytes, including newlines,
  before writing. A refusal stops that journal and reports lost evidence
  while preserving the primary output and runtime settlement. This does
  not provide complete proofs for oversized runs or resolve trace verify refuses the sealed journal of a successful ~17k-item fan-out: the per-item terminal frame crosses the 1 MiB line bound #1458.
• Hash arguments agree across check and execution. Literal null content and invalid algorithm or encoding choices are refused before execution; omitted options keep their defaults, and accepted content keeps its original digest. Tool schemas expose the same closed choices. Gemini tool declarations carry the canonical JSON Schema through parametersJsonSchema.
• Incomplete trace diagnostics describe evidence, not runtime failure.
  A missing terminal frame and an unheld writer lease no longer claim a
  crash or an unsettled run. An invalid final line also does not exclude
  intentional modification. A file journal can stop while the primary
  run still succeeds; verification tiers and exit codes are unchanged.
• Agent guidance reflects readiness and effect evidence. The four skills preserve existing execution authorization and distinguish missing decisions from check readiness. Authoring uses examples for unfamiliar structures; debugging explains resume eligibility, uncertain remote effects and the upstream tasks included by --task. Operating guidance preserves secret host boundaries and separates definition pins from trust in a server. Plugin descriptions now state the limits of metered budgets and trace delivery.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.118.7 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.118.7.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.118.7.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.118.7

Provenance

Built from tag v0.118.7 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix: align hash contracts and bounded journal evidence by @ThibautMelen in fix: align hash contracts and bounded journal evidence #1490

Full Changelog: v0.118.6...v0.118.7

---

This discussion was created from the release v0.118.7.