v0.116.0

What

Added

• One SDK gains a durable resident HTTP authority. nika serve
  admits immutable execution snapshots, persists job identity, outputs,
  receipts and ordered events, supports idempotent cancellation and replay,
  exposes contained workflow discovery, status, schedule CAS and typed trace
  verification, and publishes the owning OpenAPI contract. Hidden CLI
  identity and snapshot probes let the TypeScript client prove local/remote
  compatibility before admission; receipt job, execution and trace bindings
  fail closed across event and durable settlement paths.

Changed

• The One SDK contract is machine-complete at its live boundaries. Health,
  workflow discovery/metadata, and the SSE event projection now carry owning
  OpenAPI schemas instead of description-only 200 responses. The engine
  release kit under .agents/ is explicitly engine-owned and mirrored
  downstream from immutable tags; the client-registry resync can no longer
  overwrite it from a moving plugin branch.
• The MCP oracle closes the repair loop. nika_check gains
  fix: true: the same transactional repair ladder as nika check --fix
  (typed renames · dead-form migrations · the VAR-021 hoist) runs IN
  MEMORY over the submitted source, re-audits, and answers JSON —
  repairs, applied, changed, the repaired workflow text and the
  plain verdict of that text. The caller writes the text back; nothing
  on the server writes a file (the tool takes source, never a path, and
  the same catalog rides the HTTP transport). The three codes that
  prescribe nika check --fix are now reachable by a no-shell agent.
  nika_examples gains builtin: — one JSONL row per embedded example
  that calls one nika:* tool. The server instructions teach the repair
  door and are pinned ⊆ the catalog: every tool named is served, every
  served tool is named, a declared fix is taught, and a read-only /
  never-run claim is checked against every tool's annotations.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.116.0 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.116.0.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.116.0.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.116.0

Provenance

Built from tag v0.116.0 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix(status): drop the branch row from the auto-block (#1240) + issue-proof refusal teaches its own rule by @ThibautMelen in #1266
• feat(nika-mcp): nika_check fix:true and the examples builtin route by @ThibautMelen in #1287
• feat(release): prepare nika 0.116.0 sdk authority by @ThibautMelen in #1322

Full Changelog: v0.115.0...v0.116.0