v0.118.6

What

This version includes the One Door source changes recorded in the preceding
0.117 and 0.118 sections. The 0.118.5 train passed native, SLSA and OCI payload
checks and published WASM npm, but its release-body update orphaned the
GitHub draft before asset staging. Earlier tags and registry bytes are not
rewritten; companion SDK, editor and release-record gates remain separate.

Fixed

• Authoring guidance follows composition and cleanup contracts.
  Compose checks a draft; child execution uses normal admission. Unwind
  cleanup applies to started producers, and predicate names have one table.
• Cancellation publication has a discriminating model test. A separate
  payload is checked before joining its writer. Diamond CI runs the library
  model and refuses an absent test; weakening either ordering is detected.
• Preserve the release coordinate in metadata writes. The OCI marker and
  final publication PATCHes explicitly carry their already-verified tag and
  target SHA, avoiding the body-only update that orphaned the 0.118.5 draft.
  Post-write identity drift still refuses without rebinding or retrying;
  ambiguous writes no longer claim that nothing committed.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.118.6 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.118.6.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.118.6.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.118.6

Provenance

Built from tag v0.118.6 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix(release): preserve release identity and prepare 0.118.6 by @ThibautMelen in #1487

Full Changelog: v0.118.5...v0.118.6