v0.107.0

What

The trust release. An outside audit measured the experience instead of
the feature list — five waves, seventy-two receipts, twenty-two P0s — and
the arc closed every one: welcome gates its run CTA on the exact file's
verdict, a non-affirmative consent fires zero effects (NIKA-SEC-014, minted
spec-first with its conformance fixtures), the hooks' judge moved into the
binary (nika guard, fail-visible, bypass matrix in test), autonomy is
graded before it is colored (the risk rung never renders green past
Supervised),
the data journey names sources, destinations and secrets before the run,
and redaction works by provenance — a one-byte secret dies the same death
as a long one. Around the core the doors multiplied honestly: one client
matrix asserts the coverage of thirty-one hosts, nika wire previews and
never rewrites unasked, and every probed host gets a capability receipt
that separates oracle-only from integrated. The discipline held on the
inside too: the host plane descended to nika-cli-host at the 15k wall
(ADR-110 — one unit, two members, zero call-site churn), and the wall
itself grew a descent window, the crate-size vector warning at eighty
percent instead of ambushing the push.

The night train (Jul 31 → Aug 1). The teaching grammar collapsed to
three doors and the whole surface followed: nika try is the showroom
(bare lists · a slug runs the mock rehearsal offline by default — no
--model mock/echo incantation left to teach · --model self keeps
the example's own seat), nika new takes ONE positional gesture
(an example slug lands verbatim WITH its ingredients · plain words
BM25-route across the whole catalog · a lone <name>.nika.yaml names
a destination and gets the wizard), nika init founds. The examples
verb tree died; evidence and receipt moved under the run's dossier
as nika trace evidence / nika trace receipt explain. The same
night, four replayable persona waves judged the result end-to-end and
the last taught-line breaks fell before morning.

The three doors (V5)

• nika try [slug] — see it work, own nothing (#796). Offline by
  default: the rehearsal seat law lives in one place and is pinned;
  the shelf, the take and the founding read as one grammar. Every
  teaching surface (welcome START block · lazy door · rescue tips ·
  recipes · briefs/AGENTS scaffold · kit skills · README · funnel e2e)
  speaks the new forms in the same release.
• nika new routes the WHOLE catalog (#778): the 26 human-worded
  jobs are visible to the one surface that takes human words — a routed
  example lands verbatim with its fixtures beside it (one shared
  materializer for every taking door), a routed skeleton instantiates,
  and below the confidence bar the clarify names facets + each entry's
  own description line.
• The MCP oracle walks the same door (#797 · RAMS-11): a
  plain-words miss on nika_examples/nika_template routes through
  the CLI's router — the interpretation is SAID in a leading
  # routed: comment, single tokens keep the unknown-key contract,
  and the adversarial-keys pin holds verbatim.
• Every taught line survives the paste-back (#798): the clarify
  hint is facet-aware (a skeleton carries its <dest>.nika.yaml, an
  example lands bare) and a spaced intent is re-echoed shell-quoted —
  the gauntlet's teach-a-command-that-breaks class, closed the night
  it was measured.

The honest machine (the tier-B wave)

• A dead local server stops the run in seconds, named (#786): the
  B-5 liveness gate dials the local endpoint BEFORE any wire call —
  silent (nothing listens) and mute (accepts, never speaks) refuse
  fast with the exact repair (ollama serve, or rehearse with
  mock/echo); a keyed cloud seat, mock, or a failed probe never
  block.
• The models rung consults the catalog before saying resolves
  (#784) · the local route stops teaching what this binary cannot
  do (#788) · a healthy machine reads calm — doctor's advisory
  noise folds (#789).
• One machine-truth (#781): every provider count names its facet
  (38 catalog entries · 15 wired in this build · 10 take a key) from
  a single projection, pinned end-to-end on the rendered surfaces.
• mock is a proven zero (#785): the check's floor and the run card
  say the same $0.00, and the exec-floor hint drops its phantom route.
• The fan says its tally (#793 · V7-1): a for_each with
  recovered items renders N/M ok · K recovered — the silent fan
  class dies at ITEM level.
• The closer never promises more than the judge checked (#795):
  explain's canon-row closer is per-class — SEC-004 teaches the
  literal/computed split (a green PERMITS is not the RUN's promise) —
  and the C-9 lessons (#787) speak one voice across CLI and MCP.
• A closed pipe dies clean (#783): nika run | head ends with the
  screen silent and the honest 141, never a Rust panic dump.
• A UTF-8 BOM parses (#791) · examples run/copy history:
  the pack resyncs landed the fanout-trap fix, the write carve-out and
  the measured-truth corpus (#782 · #790).

Added

• nika init writes the two project MCP doors. The root .mcp.json
  (the standard mcpServers stanza FOUR agent surfaces read natively:
  Claude Code project scope · Grok Build via its Claude compat · GitHub
  Copilot CLI · Warp) and .agents/mcp_config.json (Antigravity CLI's
  workspace file, beside the authoring skill under the cross-vendor
  .agents/ convention). One shared body, seventeen scaffold targets —
  a repo equipped by nika init now hands the read-only oracle to six
  clients with zero machine wiring.

• nika wire copilot + nika wire amp — the wave-3 doors, shapes taken
  from the clients' own writers. Copilot CLI gets ~/.copilot/ mcp-config.json with the exact {tools: ["*"], type: "local"} entry its
  own copilot mcp add writes (a copilot-added entry reads · current,
  never churns); Amp gets the literal dotted key "amp.mcpServers" in
  ~/.config/amp/settings.json — JSONC settings get the snippet,
  byte-identical (the Zed contract). wire all covers twenty-one targets.

• nika wire grows four client doors: grok · antigravity · kimi · kiro.
  Grok Build gets the Codex-shaped [mcp_servers.nika] table in
  ~/.grok/config.toml (comments preserved · idempotent — its Claude
  compat already merges the project .mcp.json, the native table survives
  a [compat.claude] toggle); Antigravity CLI (agy, the gemini-cli
  successor) gets the standalone mcpServers entry in
  ~/.gemini/config/mcp_config.json per Google's migration contract;
  Kimi Code CLI gets ~/.kimi-code/mcp.json per its two-level contract;
  Kiro CLI (the Amazon Q rebrand) gets ~/.kiro/settings/mcp.json.
  wire all covers all four.

• nika doctor speaks the kit↔binary handshake. Installed plugin kits
  get one row each, probed at the rung their sessions actually load
  (Cursor local drop · Claude Code install of record · Codex per-version
  cache — marketplace clones as fallback): green on the binary's release
  train, ⚠ with the
  exact per-client refresh command when a kit lags (Claude Code names BOTH
  rungs — the half-climbed ladder is the proven trap), ⚠ with brew upgrade nika when a kit rides ahead. Patch drift is not a finding (kits are cut
  per train). The session-context hook grows the same two probes client-side:
  a missing binary teaches the install line, a train divergence names the
  direction-aware align command. nika welcome's machine mirror names
  train drift in one line and routes to doctor — aligned or absent kits
  stay silent (carry information, never a lecture).

• A green run names its fruit and stops lying. The run card says
  what the run actually produced, and a run whose green hid an untruth
  says so out loud — the run-comprehension surface's honesty pass
  (A-2 of the first-run-truth arc · the 19-persona gauntlet).

Fixed

• The permits stop punishing honesty. The trifecta explains its
  dominance rule (the dominating gate named · the bypassing data edge
  named · the taught fix provably flips the verdict green), a
  workspace-escaping path earns no machine fix but the taught narrow
  way, and an exec grant reads "exec outside the fs bounds" — never a
  default-deny misread (A-1 · Nina's BLOCKER).

• nika examples copy brings the recipe's ingredients. Every
  examples/fixtures/… file the copied body reads now lands beside it at
  the exact relative path the yaml names (existing files are kept, never
  clobbered) — the copied recipe's own taught offline run used to die
  NIKA-BUILTIN-READ-001 on the missing fixture (the one rage-quit of the
  19-persona gauntlet, 2026-07-31).

• Bare nika greets in a pipe too, exit 0. The pipe used to get clap
  usage at exit 2 — an agent's first contact read as breakage, and spec §4
  reserves 2 for file findings. Both worlds now get the welcome mirror;
  --help stays the reference card.

• The agent's request order is the author's tools: order. The tool
  list used to ride catalog order with loop-owned intrinsics appended last,
  so nika:done could never come first — and the offline rehearsal
  (mock M1 invokes the first granted tool) died at turn 1 on any fs-scoped
  loop, refused by the boundary it could not satisfy. Listing nika:done
  first now closes the loop cleanly offline; real models are unaffected (a
  whitelist has no ranking semantics).

• nika explain NIKA-BUILTIN-READ-001 teaches the contract — paths
  resolve from the RUN's working directory, with the three exits (look ·
  cd-and-run · examples copy lands the ingredients) — instead of the
  namespace boilerplate.

• The taught mock rehearsal says its limit on writing workflows. The
  mock swaps the model, not the effects: a mock re-run after a real one
  overwrites the real artifacts (a gauntlet persona lost a real
  CHANGELOG.md that way). The explain <file> rehearsal line on a
  writing workflow now says file writes STILL land — rehearse before the real run, not after.

• nika model teaches an ungated starter id. The suggested
  Qwen/…-GGUF repo answers 401 without a token; the taught id is now the
  public unsloth/Qwen3-4B-Instruct-2507-GGUF mirror (verified 200).

• NIKA-SEC-014 names the real defect. The finding said the route
  « never consumes the answer » — a route that binds the answer but never
  gates on it read that as false; it now says « never gates on the
  answer ».

• A human gate can no longer kill a first run. A nika:prompt with no
  default: used to die NIKA-BUILTIN-PROMPT-001 in milliseconds on every
  text-mode run — a pipe, CI, an agent, even a human at a terminal (the
  ADR-099 durable pause was armed on the --json output flag, and the
  promised TTY prompter had never shipped). The rider is now armed on every
  lane: unattended runs pause durably (exit 4 · workflow_paused
  journaled · never a failure frame), and at a terminal the gate asks you
  directly (confirm [y/N] · choice by value or index · input verbatim),
  binding the answer through the same attested resume path as a manual
  --resume --answer. Walking away (Ctrl-D) leaves the paused trace and
  its taught resume line.

• The paused run teaches its exact next move. Every lane prints a
  paste-able resume: nika run <file> … --resume <trace> --answer <task>=<value> line that now carries the run's own --var/--model
  (a required-input workflow refused the taught line without them). The
  frame renders the pause honestly: the gate row turns ◇ amber and the
  paused card names the awaiting task.

• Fallout counts beside the root cause. One failed gate cancelling 22
  downstream tasks used to read 23/23 done · 1 failed — the meter now
  says 1 failed · 22 blocked.

• nika explain NIKA-BUILTIN-PROMPT-001 teaches the contract, not the
  namespace boilerplate: the cause and all four exits (--answer at
  launch · resume · default: · the terminal ask). The nika check
  headless-prompt hint teaches the same working recipes.

✨ Features

• catalog — Pricing carries upstream truth with provenance (95af0984a)
• catalog — The schema learns energy · data policy · effect hints (814df726c)
• catalog — The sourced facts enter and the refresh learns to keep them (b4f5df37f)
• catalog — Two price catalogs face each other and nobody wins (88f98fc39)
• catalog — The one door opens (03ab16f5b)
• catalog — Sixteen measured energy rows from the public leaderboard (2e2813368)
• check — The energy reading joins the report (NEP-0018 · the 15k descent) (136e3ed93)
• check — The judge-night lane lands — judged defaults, energy aggregate, adversarial greens (b176a344d) (#768)
• check — One verdict everywhere · a risk grade names the unbounded (631940a45)
• check — The consent lane grades the gate, never the position (6d1f68243)
• check — The exec floor is predicted · the gate must be affirmative (1511b2be2)
• check — False fires exactly zero effects — NIKA-SEC-014 (1c0f708c5)
• check — The data journey names every flow before the run (5cc366dd8)
• cli — Welcome gates the run cta on the exact file's verdict (1a7053554)
• cli — Nika guard — the hook's judge lives in the binary (50ce7a452)
• cli — The context envelope resolves the workspace once (fd143d214)
• cli — The adoption ladder greets each rung with its own line (72e892e42)
• cli — A failed latest run opens on the repair, never the re-run (44847b275)
• cli — Doctor names each host's honest capability level (c21ef94c8)
• cli — Welcome resolves its context through the envelope (202395c66)
• cli — Doctor hands every host a capability receipt (8c66e48a5)
• cli — Wire previews, detects, and never rewrites unasked (7ffe07e68)
• cli — The binary reads the one client matrix (a59df6a32)
• cli — Ascii means ascii · metrics stay local and content-free (b81060688)
• cli — The host plane descends to its own member · nika-cli rejoins the 15k wall (bb231b8bc)
• display — The consent refusal prints its rung (779d3d7f1)
• estate — The mirror stops being a convention and becomes a gate (fc3f7aa8e)
• hooks — The session seed probes the binary and names version drift (dd377a268)
• hygiene — The crate-size wall gains its descent window (83ca64a44)
• init — The project grows two MCP doors · one stanza, six clients (e8b1930c4)
• kit — The doctor command makes coherence a one-slash gesture (23c22463a)
• kit — The codex page opens with three doors, not three verbs (24e9335f6)
• lot-3 — The thin laws (F-P13..F-P23 · NEP-0014) (#753) (472c704b4) (#753)
• media — The hero gains the window chrome · the dead slug class dies (bd915b85f)
• nika-cli — Doctor probes the installed kits and names their drift (b20e9b338)
• nika-cli — Welcome names kit train drift and routes to doctor (c38ce446a)
• nika-cli — The energy rung — cost honesty in watt-hours (NEP-0018) (e92570786)
• nika-store — The signed-memory substrate (F-P8 · lot 2) (#755) (62728587b) (#755)
• onboard — The intent shapes the workflow before the template (1ea784404)
• providers — Readiness is a ladder · local is a place (96da9aeb9)
• registry — The provenance ladder + the operator admission floor (F-P27 · NEP-0016) (#751) (51f170bb5) (#751)
• runtime — Preview-commit · the judged request is the fired request (F-P6) (#749) (d5b411b36) (#749)
• runtime — Nika test runs on a simulated effects plane (871460cbd)
• runtime,check — Human approval is a bounded, attested ticket (F-P4 · NEP-0013) (#744) (bee82f9b1) (#744)
• runtime,check — The thin-laws lot 3a (F-P13 · F-P15 · F-P16 · F-P21 · NEP-0014) (#752) (5ed027cb1) (#752)
• wire — Grok and antigravity become wire targets · the toml family is born (34bb14833)
• wire — Kimi and kiro join the doors · the estate learns the index lesson (155bd53b6)
• wire — Copilot and amp complete the wave · shapes from the clients' own writers (837671c86)
• workspace — The corpus is indexed by what it teaches, not by an invented tier (6988af52f)

🐛 Bug Fixes

• agent,infer — Fail closed when a priced backend omits token usage (R3-F1) (aa669fd2e)
• audit — Wave A — the general adversarial audit's law+security findings (#764) (a12deff69) (#764)
• builtin — Shadow jaq's scan to the jq-global semantics (7fa3e535c)
• check — Two verdict lines stop claiming more than they cover (7fc837571)
• check — --infer-permits stops contradicting the check that reads it (e624bc452)
• check — Recover the decidable conjunct the dynamic argument was taking with it (d8ae2d933)
• check — The hint and the cost line narrow to what they cover (c3fc10256)
• check — Price composed children into the cost ceiling with call multipliers (b8eba5125)
• check — The secrets fix ladder names the layer that failed (R4-F1) (4b8e815a2)
• check — The exec net-fit judges literal argv URLs like an invoke (D1) (f318566d5)
• check — The types verdict names its unshaped-output blind spot, aliases included (F3) (f8f2326e5)
• check — The coded VAR-003 walk adopts the locked strict-binding law (bde2ae3cc)
• check — Retried non-idempotent builtins earn the retry-effects hint (4861589ad)
• ci — The two lanes meet · the gate fixture obeys the law it crossed (549719e18)
• cli — Claim neither bound in unbounded cost renders (de4c459ca)
• dap — Refuse a required anchor on an unsealed journal (73e3af6d3)
• dap — A seal with lines after it is tampering, and an absent key is not forgery (9a16ecd70)
• dap — A truncated inventory never renders as zero (a5592f07c)
• dap,cli — The lot-1 review's fixpack (terminal hygiene · fuzz ci · journal bound · otel class) (#740) (9118b1f99) (#740)
• dco — Exempt bot-authored commits by author name too (770b8d412)
• docs,tests — The spell gate passes (plural-of-child repaired · ATTACH-ed) (#759) (f19e9c928) (#759)
• drift — Model glob walk roots and multipart parts as reads; exec poisons fs sets (34f248180)
• drift — The drift pass counts exec argv urls like the net-fit (D1 coherence) (3f56c5f19)
• estate — The mirror gate watches pushes, not only pull requests (2f1f2e277)
• estate — The mirror carries the mode, and the rules stop tripping the linter (c7fdcd71c)
• estate — The noqa actually ships (93b503b73)
• exec — The eval floor parses per interpreter, never per prefix (b54e95a17)
• hooks — The edit hook names the oracle that answered (778664fea)
• hooks — The path is the oracle identity, the version is only a tag (ce6ab031a)
• hooks — Derive commit scopes from the crate list, and stop citing a file that does not exist (b3f50713b)
• hooks — Check-on-edit judges with the tree build by default, not the PATH (F14) (50bd19f5d)
• hooks — Derive the script surfaces too, since the gate named its own gap (48a90712d)
• hygiene — Vector 9 tracks the living city, not a frozen snapshot of it (23113342b)
• hygiene — The lan seam declares its bypass · rustdoc links qualify (5e6d26e45)
• kit — Session-context never inherits the process cwd (4405ba678)
• media — The fanout capture pointed at a path the pack flattened away (b406174e1)
• nika-cli — The energy rung stops inventing an iteration, and scopes get subtotals (419488b4d)
• nika-cli — The MODELS rung stops reading a template as a model id (69c402333)
• nika-cli — A human gate can no longer kill a first run (#771) (c6a2ac0cc) (#771)
• nika-runtime — The floor fixture gains its NEP-0002 gate — the e2e twin moved, the copy did not (2a2efcc0b)
• onboard — An invalid answer is said and re-asked, never defaulted (4542a616f)
• pack — The fold doubled two permits blocks in the mirror (d8b8ef18f)
• pack — The canon counts and the manifest hashes tell the truth (#758) (5176f03ce) (#758)
• permits — A declared fs boundary stops granting more than it declares (0e73adc28)
• release — The immutable-sha checkout learns its one tag (79bcf6e66) (#738)
• run — --answer pre-seeds the gates of a fresh run, no --resume needed (F4) (ed873e3b2)
• runtime — Refuse a floor-above-budget launch at admission (NIKA-1709) (c6c52ae0f)
• runtime — An edited child no longer cache-hits its caller (f86fbde07)
• runtime — The scrub redacts secrets of any length by provenance (37f6c1716)
• sandbox — Admit sqlite journal sidecars and cwd/parent listings on exact-file grants (3c767ca20)
• store,dap,event — The memory substrate carries its own bounds (audit wave B) (#765) (4d0a9bee1) (#765)
• trifecta — The exec verb is born-ingress, and notify's default channel is net (F2) (b9901cad5)
• trifecta — The file channel arms on arrived taint, never on born output (fc0b69c15)
• ux — The gauntlet's six wounds close · the taught chain runs green end to end (ab9b5978c)

🔨 Refactors

• catalog — The entry validator splits at its facts seam (34b17a825)
• check — The permit-fit batteries move beside their module (7ae63c0a5)
• check — The two over-limit judges split at their seams (b02b8c3f2)
• check — The one-voice filter gets a name and its own function (6209d6ca9)
• cli — The run verb's tests move to their own file (0ce6cbdfa)
• cli — The resume surface descends to its own module, the loc cap holds (1057859fd)
• display — Descend the check render and the dag art to nika-display (e11558493)
• display — The rung claims descend to their own module, the loc cap holds (85a0adad5)
• runtime — Bring run and the verify tier under the 100-line cap (7208a21f3)
• runtime,dap — Split two fns at the 100-line law (fn-length ratchet) (fcddd872e)

📚 Documentation

• adr — Adr-109 — the composition receipt, condition by condition (1c4064156)
• adr — Re-issue the composition receipt — 9 rows, two at a named lower tier (66be812c9)
• audit — Run 5's four regressions fixed after the operator's decisions (616a4d77a)
• audit — The next session's checkpoint — run 5 domain, traps, and the queue (d6f8b863a)
• catalog — The deepseek three-way resolves at the rendered page (0a8fbf746)
• check — The two laws move to where a check is written and reviewed (d9e4d43e6)
• honesty — The surfaces catch up with the proven behavior (f671f1cf7)
• host — Three links to private items become plain code text (8cd4bc729)
• kit — The delegation rule routes health to the doctor (3d05ce215)
• media — Every drawn frame speaks the released grammar (2a273cc32)
• media — The last two stale paintings catch up with their scenes (bdc7d3117)
• media — The readme's taught slugs face the same executioner (c16d4e891)
• media — The renderer refuses to paint outside the frame (8be8cc8db)
• nika-cli — The fixture doc catches up with its gated shape (763439161)
• plans — The cost ceiling covers half the bill, and four forks get their reasons (27f3f4ec8)
• plans — The contradictory-advice pair closed with the matcher (1513d2f48)
• plans — Sec-009 keeps its semantics, its message stops hiding the approximation (ace795ae9)
• plans — The resume wedge does not reproduce, and that is worth recording (c3c293852)
• plans — The arc record separates shipped from written (0e1b9bee0)
• plans — The adversarial audit run 2 and the handoff closure (eb2342054)
• plans — The adversarial audit run 3 — agent-loop budget + MCP pricing (00e81c55b)
• readme — The repo names its place in the city (5fb78af4c)
• readme — The island links every building (56032f47d)
• readme — The city island names which root this building carries (45fe0d31a)
• readme — The city gains its ci district and loses its witness (f53df4c42)
• roadmap — The skill row points at the living repo, not a dead link (e5382e231)
• trace — The verify help promised a taxonomy the verb had outgrown (5488d2f3c)

🧪 Tests

• check — The integration twin follows the lock, and typos stops reading French (be8ccad00)
• cli — The check-run oracle rides the corpus (fa08fce9b)
• cli — The corpus coverage ratchet holds both axes (92c9fef2e)
• cli — The two builtin roots meet their consumer-side gate (97b6e435e)
• cli — The ratchets absorb the reviewer's mutations (8d3d1179d)
• dap — The rust-python differential renders one verdict (nep-0012 law 4) (#741) (40be14609) (#741)
• nika-cli — The child's floor bounds the parent budget — adr-109 condition 4 closes (01e45f580)
• pack — The vendored canon's 17 must resolve in the shipped catalog (3e32fd4e0)

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.107.0 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.107.0.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.107.0.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.107.0

Provenance

Built from tag v0.107.0 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix(release): the immutable-sha checkout learns its one tag by @ThibautMelen in #738
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #734
• fix(dap,cli): the lot-1 review's fixpack (terminal hygiene · fuzz ci · journal bound · otel class) by @ThibautMelen in #740
• test(dap): the rust-python differential renders one verdict (nep-0012 law 4) by @ThibautMelen in #741
• chore(pack): the pack follows the spec by @github-actions[bot] in #742
• test(check): the r3 relation · verdict invariant under data-position injection (f-p10) by @ThibautMelen in #743
• feat(runtime,check): human approval is a bounded, attested ticket (F-P4 · NEP-0013) by @ThibautMelen in #744
• chore(pack): the pack follows the spec by @github-actions[bot] in #745
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #746
• chore(estate): the manifest follows the tree (4160 files · the pin hash) by @ThibautMelen in #750
• feat(runtime): preview-commit · the judged request is the fired request (F-P6) by @ThibautMelen in #749
• chore(pack): the pack follows the spec by @github-actions[bot] in #747
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #748
• feat(registry): the provenance ladder + the operator admission floor (F-P27 · NEP-0016) by @ThibautMelen in #751
• feat(runtime,check): the thin-laws lot 3a (F-P13 · F-P15 · F-P16 · F-P21 · NEP-0014) by @ThibautMelen in #752
• feat(lot-3): the thin laws (F-P13..F-P23 · NEP-0014) by @ThibautMelen in #753
• feat(nika-store): the signed-memory substrate (F-P8 · lot 2) by @ThibautMelen in #755
• fix(pack): the canon counts and the manifest hashes tell the truth by @ThibautMelen in #758
• fix(docs,tests): the spell gate passes (childs → child · ATTACH-ed) by @ThibautMelen in #759
• chore(spec-pin): the pin follows the spec — d74bd3e (r3-f1 + the lot-3 codes) by @ThibautMelen in #760
• chore(pack): the pack follows the spec by @github-actions[bot] in #756
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #757
• fix(store,dap,event): the memory substrate carries its own bounds (audit wave B) by @ThibautMelen in #765
• fix(audit): wave A — the general adversarial audit's law+security findings by @ThibautMelen in #764
• chore(pack): the pack follows the spec by @github-actions[bot] in #762
• feat(check): the judge-night lane lands — judged defaults, energy aggregate, adversarial greens by @ThibautMelen in #768
• fix: a human gate can no longer kill a first run by @ThibautMelen in #771
• fix: the taught resume line stops answering the gate itself by @ThibautMelen in #773
• feat(display): the run names its fruit and a green run stops lying by @ThibautMelen in #776
• fix(check): the permits stop punishing honesty by @ThibautMelen in #777
• feat(cli): the help shows the craft · the full surface stays one flag away by @ThibautMelen in #780
• fix(agents): the run contract joins the structure that judges it by @ThibautMelen in #779
• feat(cli): one machine-truth · every provider count names its facet (RAMS-12) by @ThibautMelen in #781
• chore(pack): resync from spec · the corpus tells measured truth by @ThibautMelen in #782
• fix(cli): a closed pipe dies clean · the panic leaves the screen (A-4) by @ThibautMelen in #783
• chore(pack): resync spec ab27e17 · the fanout trap fix and the write carve-out land by @ThibautMelen in #790
• fix(explain): SEC-004 and WRITE-001 teach their contracts · one voice (C-9) by @ThibautMelen in #787
• chore(api): the cli-host baseline follows the runner, again by @ThibautMelen in #794
• fix(check): mock is a proven zero + the exec-floor hint drops its phantom route (B-8a · N-6) by @ThibautMelen in #785
• fix(runtime): the fan says its tally · N/M ok · K recovered (V7-1) by @ThibautMelen in #793
• fix(explain): the closer never promises more than the judge checked (V7-2) by @ThibautMelen in #795
• fix(check): the models rung consults the catalog before saying resolves by @ThibautMelen in #784
• feat(cli): the three doors — try · new positional · examples dies (V5) by @ThibautMelen in #796
• fix(parse): a UTF-8 BOM parses — the strict reader stops gluing it to the first key by @ThibautMelen in #791
• feat(onboard): the intent router sees the whole catalog · the ingredients follow every taking door by @ThibautMelen in #778
• fix(cli): every taught door exists in the context where it is taught by @ThibautMelen in #792
• fix(doctor): a healthy machine reads calm — the advisory noise folds by @ThibautMelen in #789
• fix(model): the local route stops teaching what this binary cannot do by @ThibautMelen in #788
• fix(run): a dead local server stops the run in seconds, named by @ThibautMelen in #786
• feat(mcp): the oracle walks the CLI's routing door (RAMS-11) by @ThibautMelen in #797
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #770
• fix(new): every taught line survives the paste-back (gauntlet night wave) by @ThibautMelen in #798
• docs(changelog): the 0.107.0 section carries the night train by @ThibautMelen in #800
• fix(infer-local): the top-n-sigma law names its one float tie (seed kept) by @ThibautMelen in #802
• chore(deps): Bump the github-actions group with 4 updates by @dependabot[bot] in #801
• chore(deps): Bump the rust-minor-patch group with 2 updates by @dependabot[bot] in #803
• chore(deps): Bump p384 from 0.13.1 to 0.14.0 by @dependabot[bot] in #806
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #799
• chore(deps): Bump criterion from 0.5.1 to 0.8.2 by @dependabot[bot] in #804
• chore(deps): Bump jsonschema from 0.33.0 to 0.49.2 by @dependabot[bot] in #805
• chore(deps): Bump tokenizers from 0.22.2 to 0.23.1 by @dependabot[bot] in #807
• test(cli): the LSP transport pins descend from bin_smoke (the cap breathes) by @ThibautMelen in #808
• fix(explain): the wire class stops promising the dial check never made (V7-16a) by @ThibautMelen in #809
• docs(kit): the changelog folds its unreleased into 0.107.0 (train carrier) by @ThibautMelen in #810
• feat(wire): the six pending wires flip · the release ships their probes (train) by @ThibautMelen in #811

Full Changelog: v0.106.1...v0.107.0