v0.109.2

[github-actions[bot]]

What

The second refusal, one layer down. v0.109.1 fixed the fossil envelope
in the release gates and died on both Linux builders one leg later:
[consent-run] exit=3 want=4 — since #889 (0.109.0) a workflow that
declares permits: refuses to START on a host with no sandbox backend
(NIKA-1710), and a GitHub Linux runner has no bubblewrap. The macOS
builders, where seatbelt exists, passed both gates confined. No asset
shipped under v0.109.1 either; the binaries were fine both times. This
patch is the same tree plus the second fix and is the version consumers
install.

Fixed

• The Linux release builders install bubblewrap before the gates run
  (release.yml). The Diamond CI tests-leg recipe (apt bubblewrap · detach
  ubuntu-24.04's AppArmor bwrap profile · keep unprivileged userns open) now
  runs on the two Linux builders, so the funnel e2e and the trust battery
  run CONFINED there exactly as they do on macOS — never a waiver. A gate
  that spends an exec under permits: proves the jail as a side effect;
  a host that cannot jail says so (NIKA-1710) instead of being waved
  through.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.109.2 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.109.2.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.109.2.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.109.2

Provenance

Built from tag v0.109.2 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix(nika-lsp): the capability advertises the graph format it serves · the for_each island inserts the block the parser admits by @ThibautMelen in fix(nika-lsp): the capability advertises the graph format it serves · the for_each island inserts the block the parser admits #980

Full Changelog: v0.109.1...v0.109.2

---

This discussion was created from the release v0.109.2.