v0.116.2

What

Changed

• 0.116.2 supersedes the unpublished 0.116.1 tag. No GitHub Release
  or assets were produced because estate freshness stopped all four
  builders; the immutable tag remains a historical record. This train
  carries the full gauntlet close with a final-tree estate projection.

Fixed

• Relative permit paths keep stable identity during concurrent ancestry
  changes. A sibling creating the first relative ancestor between grant
  and target resolution can no longer change the permit decision.
• Resident schedules settle before their durable store shuts down.
  nika serve joins scheduler authority after prepared runs and terminal
  receipts drain, preventing live-once settlement from racing store shutdown.
• nika try names a missing host tool in the sandbox.
  standup-digest (git) and 03-exec-pipeline (cargo) print a recover
  tip instead of an opaque seatbelt, even under --model mock/echo.
• Night gauntlet close (PR 1320). exec.shell host reads and
  computed file-plumbing are NIKA-SEC-004 at check and confine; mock
  images name the rehearsal and paint a red band; groq/grok-3 is a
  wrong-seat MODELS refusal; live HTTP does not dial RFC 2606
  documentation hosts; the postcard stays six lines; pause teaches
  nika run --answer; --help --all names the one free path (a real
  answer needs a key, a signed-in seat, or Gear One — else a mock);
  journal recover skips the 0.116.0 run_settled envelope (not an Event).
• --answer task=yes stays a string on mode: input. Confirm
  (the stdlib default) still takes yes/y/no/n as the TTY
  boolean; an input gate binds "yes" so resume completes instead of
  re-pausing on a boolean the prompt cannot fill.
• nika explain FILE no longer says checks clean on a red check.
  The human line and the JSON clean flag follow CheckReport::is_clean
  (PERMITS-red files say check red / "clean": false).
• nika check --fix wraps a bare exec: scalar into live dialect.
  Inert tokens become command: ["prog", …]; shell metacharacters
  become shell: "…". The 0.102 command: + shell: true pair is
  gone (it PARSE-019'd).
• A task-level GitHub Actions run: names exec:. Envelope run:
  stays {entropy, clock} at column 0. params: names live args:.
• Pause card teaches a string on mode: input. Confirm still
  shows =true (boolean, not yes). Input/choice show
  --answer task="your answer", so the loud answer: line matches
  the resume line instead of burning the ticket.
• Oversized HTTP uploads now return their typed 413 response. Nika drains
  authenticated bodies with constant memory and the existing request timeout
  before closing, so Node clients no longer lose the response to EPIPE.

Security

• Secret-bearing workflows stay out of test and fallback diagnostics.
  Panic and assertion paths no longer format raw workflow, command, report,
  parser, or runtime content; sentinel regressions close 16 cleartext-log flows.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.116.2 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.116.2.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.116.2.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.116.2

Provenance

Built from tag v0.116.2 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix: try sandbox host-tool tip + gauntlet proven_by rows by @ThibautMelen in #1335
• feat(release): prepare nika 0.116.2 by @ThibautMelen in #1334
• fix(release): sync 0.116.2 estate with final tree by @ThibautMelen in #1337

Full Changelog: v0.116.1...v0.116.2