v0.108.0

What

The access layer arrives; the check stops trusting what it cannot
read. Three steps of the access ratification land (access picks the
path, model: picks the intelligence — resolver, pin, and the ACP
harness class with its mock instrument), and the zero-authority scan now
refuses every exec spelling — the shell form included. Proven
red-first, like everything on this train.

Added

• Execution access · step 3 — the ACP harness class (D-2026-08-04-N1
  · P3). The nika-acp spec crate lands (ACP 2.0.0 = wire v1, verified
  against the published schema) with its mock agent in a quarantined
  workspace — the instrument that proves the wire without a vendor in
  the loop — and the kernel gains the AgentBackend seam
  (nika-kernel-ai · lane-agnostic): the harness access path plugs in
  where every other lane already does, behind a trait, never a special
  case.

• Execution access · step 2 — the deterministic resolver, the pin,
  the narration (D-2026-08-04-N1 · steps P2.1–P2.8). model: picks
  the intelligence; access picks the path. The admission-time
  resolver is a pure function with a strict sovereign order (local < mock < harness < oauth < api, codepoint tie-break) — enumeration
  order can never change the outcome (property-tested), and every drop
  carries its witness (dimension · layer · teaching line). --access <path> on run and try pins the path: judged at the launch gates
  before the prologue (zero events · zero spend); unsatisfied refuses
  with NIKA-1800/1801/1802, never substitutes. Without a pin the RUN
  path is byte-unchanged — the gate never fires; the audit surfaces do
  grow (additive, the models_catalog_warnings precedent):
  check --json gains the advisory access_plan rows, explain
  gains the « access (this machine) » section, the run header
  announces an explicit pin, and AccessPlan records the chosen
  path's id. Run-start liveness stays the only runtime act: a dead
  pinned path refuses, never falls back.

Fixed

• Every catalog-miss advisory printed twice. A duplicated block in
  the models rung pushed each models_catalog_warnings row two times;
  one block remains, with a test that proved red against the doubled
  version first.
• The taught surfaces stopped misdirecting. The injected session map
  no longer teaches doors that refuse; --recipe starter says which
  half a pipe cannot deliver; the taught next step works on the machine
  that just ran it; explain's two golden-lane refusals teach instead
  of misdirecting; the check strictness hint says close, not add.
• The sandbox tightened twice more. The scratch claims its path
  exclusively — never adopts one — and the shared host tmp stops being
  an ambient grant; exec-runner's scratch moved out of egress at the
  file wall.
• A resumed run keeps its seat. The model override rides the trace —
  a silent seat swap refuses.
• The pure-internal security exemption asked about the tool, not the
  call. It asks about the call now.
• Every pack skeleton passes its own golden lane — the armor reaches
  the tails.

Changed

• The anthropic default moves to claude-sonnet-4-6. The catalog sat
  two generations back (claude-sonnet-4-20250514) while the spec's
  examples and conformance fixtures standardized on the 4.6 id — the
  docs-spec coherence vector named the contradiction on the public site.
  Six sites across the anthropic · openrouter (anthropic/…) · bedrock
  (anthropic.…-v1:0) entries follow each gateway's naming form. Parser
  and bench test strings keep the historical id on purpose (they are
  inputs, not defaults).

Security

• A shell-string exec: with no permits: block passed nika check
  green. The zero-authority scan (F-O8 · NEP-0003) refused the argv
  spelling it can read (command: ["rm", …] → NIKA-AUTH-006) and
  deferred the shell spelling it cannot (shell: "rm -rf …") to the
  runtime — the exact inversion of a security gate: the verifiable door
  refused, the unverifiable one open. Law 1 puts the exec capability in
  Required the moment an exec task sits in the body, whatever the
  command form; law 3's runtime deferral owns dynamic VALUES, never the
  category question, and the runtime refused both spellings all along.
  The shell form and a computed argv head now refuse at check with
  NIKA-AUTH-006 — check ≡ run restored. Repair:
  nika check --infer-permits writes the block (the shell form widens
  exec to true with a note; rewrite to the array form for a program
  allowlist).

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.108.0 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.108.0.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.108.0.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.108.0

Provenance

Built from tag v0.108.0 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• chore(pack): the pack follows the spec by @github-actions[bot] in #817
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #818
• refactor(errors): docs_url moves under the language world · /errors stays a doorway forever by @ThibautMelen in #825
• chore(spec-pin): the tests leg follows the spec by @github-actions[bot] in #823
• chore(pack): the pack follows the spec by @github-actions[bot] in #827
• test(nika-onboard): the paste-back probe follows the enriched pack by @ThibautMelen in #828
• fix(nika-check): the absent block refuses every exec form by @ThibautMelen in #829
• ci(semver-checks): pin cargo-semver-checks to the repo toolchain by @ThibautMelen in #830
• chore(catalog): the anthropic default follows the spec — claude-sonnet-4-6 by @ThibautMelen in #832
• feat(access): the access layer step 1 · name the implicit by @ThibautMelen in #834
• feat(access): step 2 — the deterministic resolver, the pin, the narration by @ThibautMelen in #835
• docs(specs): nika-acp — the harness access class, specified by @ThibautMelen in #836
• feat(nika-acp): the mock agent lands — in a quarantined workspace by @ThibautMelen in #837
• feat(nika-kernel-ai): the harness seam — AgentBackend, lane-agnostic by @ThibautMelen in #838

Full Changelog: v0.107.2...v0.108.0