v0.107.1

What

The composition wave. The 0.107 train shipped the trust OBJECTS;
an outside checkpoint then measured what a stranger actually meets and
found the composition missing — the concierge still taught a verb the
0.107 rename had killed, doctor rendered a table-declared guard in the
green word a proven one earns, and every surface composed its own next
step. Three synthetic personas (novice FR · senior dev · privacy-first)
walked the binary end to end; the fixes below each carry the transcript
line that found them.

The doors tell the truth

• One door catalog, one ratchet. DoorId{Discover,Create,Project}
  is the single source behind every taught first-contact command; the
  five workspace states, the chat-only JSON mirror and the kit's
  allowed-tools all derive from it, and a new test replays EVERY
  command welcome can teach against the live clap tree. The dead
  nika examples the concierge kept teaching (the parser refuses it)
  is gone from text, JSON, kit and docs — and hygiene vector 45 sweeps
  the whole rendered output of three surfaces so the class cannot
  return.
• nika try opens on three jobs, not thirty-nine. The storefront
  names one contrasted trade each (support · meetings · release), every
  row a taught try <slug> with its pitch, closed by four doors and the
  verb legend the glyphs never had. A pipe still gets the full parsable
  shelf byte-for-byte (the editor's wire contract), and --all forces
  it on a terminal.

The verdicts narrow to what they cover

• guard-declared is not guarded. The host receipt gains
  guard_evidence (declared · loaded · proven): a hook the static kit
  table declares now reads « guard-declared (kit ships hooks · unproven
  in session) », and the bare word waits for a live allow+deny canary.
  welcome --json carries the same companions the doctor receipt does.
• --plain means ASCII in doctor too — the verb rides the same
  sobriety seam the concierge rides; the machine lane stays byte-exact.
• The journey names its cloud endpoints in words — locus, retention
  and training were machine-only facts while the human line read
  identically for a mock and a cloud model.
• risk unbounded carries its next move, the red pre-run
  diagnostic ends its own line, and a sensitive voyage discloses that
  its trace keeps full task outputs in plaintext, with the removal
  handle beside it.

The experience contracts land

• ExperienceStateV1 → route() → NextActionV1 — one pure
  decision table (drift ≻ unselected multi-root ≻ chat-only ≻ paused ≻
  failed ≻ findings ≻ unknown inventory ≻ clean ≻ several ≻ create ≻
  discover), one primary CTA with at most two safe exits, and gates
  asserted structurally per action across the swept state space: no
  door hides a run. welcome --json is its first consumer;
  WorkflowPreviewV1 renders the same content in strict ASCII and
  Mermaid, beside the context, privacy and authority receipts.

The boundaries hold where they claimed to

A sweep for checks that report a verdict they cannot justify found six
places where a boundary was green and open. Every one was proven on the
binary before it was touched, and every repair carries the mutation that
makes it fail.

• A cross-origin redirect no longer carries the API key. The header
  list that strips credentials on a redirect had been copied from a
  general-purpose HTTP client and did not know x-api-key — which the
  Anthropic wire sends, and which nika:fetch documents to workflow
  authors as the place auth rides. A 302 handed the live key to whatever
  host the redirect named. One list now serves both the redirect strip
  and the Debug redaction, and check-credential-headers.sh fails the
  build when a source sends an auth header the list does not name.
• A permit can no longer name a system root through .. Both
  sandbox backends refused /root/* and granted /root/./x* — they
  compared text where the kernel folds, so the grant resolved back to a
  read-write bind of the host's root inside the jail. The fold lives in
  the kernel now, shared, and the guard test walks every root in the
  const across six spellings instead of the three its doc comment named.
• A tainted nika:notify target is re-gated like a fetch url.
  Notify sat in the taint re-gate's tool list and did nothing: the list
  read url from every member, and notify's argument is target. The
  re-gate asks the capability table now. Measured against the reference
  oracle: parity unchanged at 216/220, all 39 examples clean.
• The run guard stops approving what it never judged. On the generic
  hook wire, "no opinion" and "judged clean" shared an arm, so the kit
  answered permission: allow to every shell command in the session.
  A command with no nika run in it now gets {} — the bytes that mean
  behave as if this hook were not installed. And with the binary off
  PATH the shim used to deny everything, telling the user ls was
  "nika run blocked"; it degrades only for commands that could have been
  ours.
• The editor offers what the binary accepts. Completion taught
  description: at top level (the parser refuses it with its own code)
  and google/ as a provider (this binary does not resolve it — the
  runnable id is gemini), while never offering four keys the parser
  takes. The vocabulary derives from the parser and the catalog now.
• The privacy gate guards the layout that exists. Six of its seven
  patterns matched no directory that still exists, leaving the private
  content it was written for entirely unguarded, and a git mv skipped
  it altogether.

The owned copy works where it landed

• The taught command inside YOUR file runs in YOUR workspace — all
  39 pack examples self-reference their pack path, and the copied
  # Run · comment exited 3 when pasted; nika new re-points it to the
  destination.
• A dropped cadence is named — « chaque lundi … » routed on the work
  and ate the schedule half in silence; the file owns the WORK, a
  scheduler owns WHEN, and the note says so.
• The guard judges both spellings of its own binary (nika ·
  nika-cli): a dev-build invocation rode past the uncapped-priced-run
  refusal as no-opinion.
• The wizard's run hint follows the chosen seat instead of teaching a
  literal $0.00 on an Ollama pick.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.107.1 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.107.1.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.107.1.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.107.1

Provenance

Built from tag v0.107.1 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• docs(kit): the answer ways speak ungated vocabulary (mirror gate catch) by @ThibautMelen in #812

Full Changelog: v0.107.0...v0.107.1