v0.106.1

What

The browser release. The checker takes the seat the spec reserved for it
(07-conformance Level 2 · « custom engines for specialized environments »):
the parse + conformance half of nika check compiled to WebAssembly, admitted
through the full 12-gate ceremony (ADR-107) — including a three-leg adversarial
review that found a real engine bug before any browser saw it (a jq nesting
bomb that killed the checking instance for good; the guard now refuses at
depth 128 on every surface). The artifact debuts on npm as
@supernovae-st/nika-check-wasm, packed by this release train itself:
manifest projected from cargo metadata, host paths remapped out of the bytes,
the tarball attached to this release + attested whether or not the registry
credential exists. In-band honesty rides every verdict — wasm: true and a
closed legs: list, so the browser half can never be mistaken for the full
binary. Around it the ladder keeps tightening: when:/for_each: stop
admitting the loop locals (the runtime pin collected its own documented
sunset), and the audited card stops calling a ceiling a floor.

✨ Features

• catalog — The pricing provenance is produced by the engine it feeds (a30080600)
• check — A prompt with no default names its headless cost (acdb032ab)
• check — A structured capture nobody branches on names what it swallows (5ea8cf2dd)
• check-wasm — Admit the browser half of nika check (ADR-107 · 12 gates) (3a8e2e843)
• cli — Nika lsp accepts the host convention flags as no-ops (a3c4950e2)
• mcp — The five slash commands reach every client, not three (e7f1f5284)
• mcp — The agent-facing oracle stops handing back a green the run gate refuses (62ba2406e)
• plugin — The codex manifest carries its public listing card (56d6dc3e5)

🐛 Bug Fixes

• check — when: and for_each: stop admitting the loop locals (f7b680366)
• check — Every surface that judges for the author judges like the run gate (74d230254)
• check — The audited card stops calling a ceiling a floor (a77078707)
• kit — The plugin taught a syntax the engine refuses (0b362db42)
• mcp — The read-only oracle says so on the wire (a6bdf3e54)

🔨 Refactors

• check — Scan_task stops building its contexts by hand (16bb12b97)
• check — The traversal half of the hint lane earns its own file (12add44a3)

📚 Documentation

• kit — The kit teaches the whole language, not a third of it (a94360f2c)
• kit — Composition was a whole chapter the kit never mentioned (9cc9d6002)
• kit — The native-first law gains the recipe it was missing (0b5040ca1)
• plans — The false-green class, six findings and their law (2aaa80881)
• plans — The resource algebra — what a workflow costs and what check can prove (71c67da3f)
• plans — The cost ceiling is unsound on agent loops, and the reason is a theorem (1ca813fbb)
• plans — The resource-vector research corrects four of my own rows (a7cd93b28)
• plans — The DAG width is measured, and it closes the hypothesis T1 rests on (9b172979e)
• plans — An adversarial pass killed 17 of 33 claims — the corrections lead the document (b40839d16)

🧪 Tests

• check — The ledger fixture goes on one line, and says why (14a14b1d5)

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.106.1 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.106.1.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.106.1.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.106.1

Provenance

Built from tag v0.106.1 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• feat(check-wasm): admit the browser half of nika check (ADR-107 · 12 gates sealed) by @ThibautMelen in #735
• chore(release): v0.106.1 · the browser release by @ThibautMelen in #736

Full Changelog: v0.106.0...v0.106.1