v0.118.7

What

Fixed

• File journals refuse bytes beyond the verifier's existing bounds.
  Check final encoded lines and cumulative bytes, including newlines,
  before writing. A refusal stops that journal and reports lost evidence
  while preserving the primary output and runtime settlement. This does
  not provide complete proofs for oversized runs or resolve #1458.
• Hash arguments agree across check and execution. Literal null content and invalid algorithm or encoding choices are refused before execution; omitted options keep their defaults, and accepted content keeps its original digest. Tool schemas expose the same closed choices. Gemini tool declarations carry the canonical JSON Schema through parametersJsonSchema.
• Incomplete trace diagnostics describe evidence, not runtime failure.
  A missing terminal frame and an unheld writer lease no longer claim a
  crash or an unsettled run. An invalid final line also does not exclude
  intentional modification. A file journal can stop while the primary
  run still succeeds; verification tiers and exit codes are unchanged.
• Agent guidance reflects readiness and effect evidence. The four skills preserve existing execution authorization and distinguish missing decisions from check readiness. Authoring uses examples for unfamiliar structures; debugging explains resume eligibility, uncertain remote effects and the upstream tasks included by --task. Operating guidance preserves secret host boundaries and separates definition pins from trust in a server. Plugin descriptions now state the limits of metered budgets and trace delivery.

Install

brew install supernovae-st/tap/nika          # macOS · Linux
curl -LsSf https://nika.sh/install.sh | sh   # script install
docker run --rm ghcr.io/supernovae-st/nika:0.118.7 --version

Tarballs below: macOS arm64 / x64 · Linux x64 / arm64, plus SHA256SUMS.

Verify: three independent proofs

# 1 · checksum: the bytes you hold are the bytes CI hashed
sha256sum -c SHA256SUMS --ignore-missing     # macOS: shasum -a 256 -c

# 2 · attestation: GitHub-signed build provenance for this exact artifact
gh attestation verify nika-<platform>-0.118.7.tar.gz --repo supernovae-st/nika

# 3 · SLSA provenance: the intoto asset, verifiable offline
slsa-verifier verify-artifact nika-<platform>-0.118.7.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/supernovae-st/nika --source-tag v0.118.7

Provenance

Built from tag v0.118.7 by release.yml
on GitHub-hosted runners. Provenance is published twice: GitHub's native
build attestation (proof 2) and the SLSA generator's multiple.intoto.jsonl
release asset (proof 3). The release itself is a claim on the
machine-verified timeline: https://nika.sh/timeline

What's Changed

• fix: align hash contracts and bounded journal evidence by @ThibautMelen in #1490

Full Changelog: v0.118.6...v0.118.7