# Changelog

All notable changes to **Nika** are documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
Nika follows [semantic versioning](https://semver.org); 0.124 is the current release line, focused on maintenance, security and the media capabilities workflows need, with native video planned for 0.125 ([ROADMAP.md](ROADMAP.md)).

Nika Diamond is the ground-up rewrite developed on `main`, beginning at
v0.80.0. The legacy v0.79.3 tree remains on the read-only `brouillon` branch.

---
## [Unreleased]

One file per change under [`changelog.d/`](changelog.d/), assembled into the
section below at tag time (`bash scripts/release/changelog-assemble.sh --fold
<version>`). Do not write bullets here: this file is where four concurrent
pull requests collided on 2026-08-24 with no source overlap between them, and
`--check` refuses a hand-written bullet in this section.

## [0.124.3](https://github.com/supernovae-st/nika/compare/v0.124.2..v0.124.3) - 2026-11-10

Nika 0.124.3 lets an application ask what a workflow's declared ACP route offers before anything
runs. On `nika serve`, `GET /v1/access-offers/{name}` opens the sessions a run of that file would
open, selects the file's model in each, reads the models, the exact reasoning efforts and the
service tiers the route lists for that model, and ends without a prompt. The answer says what was
read and when, and it authorizes nothing: a run still selects and reads back on its own session.
Measured on one codex seat with codex-acp 1.13.1 on 2026-11-10, with a debug build of the engine:
reading the `infer:` session of a file took 4.1 s and 5.3 s, reading an `agent:` session took 1.3 s,
and a second request within the minute returned the kept answer in 0.02 s. For
`openai/gpt-6-luna` that seat listed the efforts `low`, `medium`, `high`, `xhigh` and `max` and the
tiers `standard` and `fast`; for `openai/gpt-6.1-sol` it confirmed the model and listed no effort
and no tier. These are observations of one seat on one day, not a description of the route. The
language and the SDK protocol are unchanged; an engine that answers this request lists
`accessSessionOffer` in `supportedCapabilities`.

### Added

- **`nika serve` answers what a workflow's declared ACP route offers,
  without a prompt.** `GET /v1/access-offers/{name}` (capability
  `accessSessionOffer` on `/health`) admits a served workflow by name, reads
  its `run.access`, and, when the file selects ACP sessions (`via` under
  `protocol: acp`), opens one session per shape its tasks run in and per
  model they resolve to: the route's one-shot completion profile for
  `infer:` tasks, its agent session for `agent:` tasks. Each session is
  opened as a run opens it, selects the file's model for that session only,
  lists the models, the exact reasoning efforts and the service tiers the
  route has for that model, and ends: no effort, tier or mode is set and the
  path holds no `session/prompt`, so an offer uses no turn. The answer is a
  `nika/access-offer@1` document: the file's declared route, then one row
  per session with `observed_at` and `fresh_until`. A model the session does
  not list is a row state, and its efforts and tiers are then left
  `unobserved` instead of being read from another model. A session that
  gives no offer is a row with the code a run would meet (`NIKA-1803`,
  `NIKA-1804`, `NIKA-1805`). Rows are kept 60 seconds (15 when unavailable),
  one reading runs at a time, a ninth concurrent request answers `503
  access_offer_busy`, and every listed value reaches the client as a bounded
  token. The request names a served workflow and nothing else, and the
  answer authorizes no run: `POST /v1/jobs` still selects, reads back and
  refuses on its own session. In the library, `nika_harness::session_offer`
  reads one session and `nika_service_execution::offer` names the sessions
  of a workflow.
## [0.124.2](https://github.com/supernovae-st/nika/compare/v0.124.1..v0.124.2) - 2026-11-10

Nika 0.124.2 lets a workflow ask its route for a service tier. `run.access.service_tier` takes
`standard` or `fast` on the codex seat over ACP (`via: codex`, `protocol: acp`): the session selects
the tier with the model and the effort and reads the selection back before its first prompt. When
the session cannot confirm the tier, the call is refused before the prompt (`NIKA-1805`), and a
route that cannot carry a tier is refused before task 1 (`NIKA-1800`). The receipt keeps what was
requested, offered, sent and read back, and says `unknown` for the tier a turn carried and the tier
that served it, because no ACP answer names them. Omitting the key changes nothing: no option is
sent, and the file keeps its resume identity and its receipt. An ACP task also starts its adapter
once instead of twice. Measured on one codex seat with codex-acp 1.13.1 on 2026-11-10: the single
start saves about 1.6 s per task; an answer of about 400 words took 12.5 s and 13.1 s on the route's
default tier and 9.3 s and 9.1 s with `fast`; one image from the agent's image tool took 15.8 s to
20.7 s on the default tier (3 runs) and 14.8 s to 15.7 s with `fast` (3 of 4 runs; the fourth ended
without an image). These are observations of one seat, not a promise of the tier. A refused seat and
a refused route declaration no longer suggest a pin the same file refuses, `nika check
--infer-permits` names the host an `exec:` URL reaches, and the embedded language pack follows
nika-spec `b4c692f`. The SDK protocol is unchanged; an engine that reads the key lists
`accessServiceTier` in `supportedCapabilities`.

### Added

- **A workflow can ask its route for a service tier.** `run.access` gains
  `service_tier`, with the two words `standard` and `fast` (spec 01
  §run). On the codex seat over ACP (`via: codex`, `protocol: acp`) the
  session selects the model, the effort, the tier and the confinement
  mode in that order, then reads the whole selection back before its
  first prompt; `fast` is sent as codex-acp's `fast-mode: on` and
  `standard` as `off`. The binding is held for codex-acp 1.13.1 only:
  another release of the adapter, an adapter with no measured speed
  control, a model whose session lists no such option, or a read-back
  that does not hold the value refuses before the prompt (`NIKA-1805`).
  A tier no route can carry is refused before task 1 by `nika check` and
  by the run (`NIKA-1800`): an API or local route, a seat without a
  measured control, and an `infer:` task outside `protocol: acp`. The
  `access_selection` receipt gains a `service_tier` block only when the
  file declares a tier: `requested`, `option`, `offered`, `transmitted`,
  `configured` and `configured_source`, plus `turn` and `effective`,
  which read `unknown` because no ACP answer names the tier a turn
  carried or the tier that served it. Omitting the key is not
  `standard`: nothing is sent, the route keeps its own tier, and the
  file keeps its resume identity and its receipt. A resumed run whose
  tier changed re-runs its `infer:` and `agent:` tasks. A child workflow
  resolves its own declaration and never inherits its parent's tier.
  `nika --sdk-identity` and a resident's `/health` list
  `accessServiceTier` in `supportedCapabilities`: an engine without the
  token refuses the key at parse, so a client requires it before it
  admits a file that declares a tier. On `nika serve` the tier is a field
  of the file, never of the request, and the per-call receipt stays in
  the sealed journal. An editor served by an older `nika lsp` refuses the
  new key and loses hover and navigation on the file until it is updated.

### Changed

- **An ACP task starts its adapter once.** For an agent application whose
  identity is its `initialize` answer (codex-acp, claude-agent-acp,
  opencode, copilot), every `agent:` task and every `infer:` task over ACP
  used to start the adapter twice: once to ask `initialize` and stop it,
  once for the session. The session's own first answer is now the one
  judged, before `session/new`. A hosted codex seat saves one adapter
  start per task, measured at about 1.6 s. The refusals are unchanged: an
  adapter that does not answer `initialize` within 30 s, exits before
  answering, answers as another program or sits outside its version pin
  is unavailable (`NIKA-1803`) and is not retried. `nika doctor` and the
  access rows still probe on their own.
- **The embedded language pack follows nika-spec `b4c692f`.** `SPEC_PIN`
  and `crates/nika-pack/pack` advance together from `5cd95cd`, the commit
  0.124.0 and 0.124.1 embed. The schema `nika spec --schema` prints, and
  the one `nika check` validates against, gains
  `run.access.service_tier` (`standard` · `fast`); spec 01 §run states its
  rules and the coverage matrix lists its fixtures. The three status
  amendments that name 0.124.0 and 0.124.1 as released ride along
  (`QUICKSTART.md`, spec 00 and 07). `canon.yaml`, the examples, the
  templates and the stdlib pages are unchanged.

### Fixed

- **`nika check --infer-permits` names the host an `exec:` URL reaches.**
  For `exec: { command: ["curl", "https://example.com/"] }` it printed
  `exec: ["curl"]` alone, and `nika check` then refused that very block
  with `NIKA-SEC-004` (`exec URL host example.com is outside
  permits.net.http`). A literal or `const:`-backed URL in an argv, or in a
  shell line, now adds its host to `permits.net.http`, read from the same
  tokens the check judges. When an HTTP client (`curl`, `wget`, `xh`,
  `http`, `https`) gets only a computed argument, or a template decides a
  URL's host, the block gains a review note naming the task and the
  inferred net face is marked partial, instead of a block that checks
  green and is refused at run. `nika check` also stops asking for
  `"${{inputs.host}}"` in `permits.net.http` when a template written
  without spaces fills an exec URL's host: that host is computed, and the
  run judges it.
- **A refused seat no longer teaches a flag its own file refuses.** When a
  seat fails at the call, the `access_refused` record on `task_failed`
  names the next ready path and the flag that pins it. Under a declared
  `run.access.via`, that next path could be a route the declaration
  itself excludes: a machine with a ready `openai` key answered a refused
  `via: codex` call with `"pin": "--access openai"`, a flag the same file
  refuses before task 1. The record now names a next path only when the
  declaration allows it, and names none otherwise.
- **A refused route declaration no longer suggests a pin that cannot help.**
  When a run is refused before task 1 (`NIKA-1800`) and this machine has
  a signed-in seat, `nika run` adds "or use a seat present on this
  machine: `--access <seat>`". It also did so when the refusal was about
  the file's own `run.access` declaration, for example a `service_tier`
  its route cannot carry. Under a declared route, another seat is refused
  by that declaration and the same seat changes nothing. The line is now
  printed only when the refusal is about what the machine lacks, such as
  a missing credential.
## [0.124.1](https://github.com/supernovae-st/nika/compare/v0.124.0..v0.124.1) - 2026-10-28

Nika 0.124.1 is the first maintenance release of the 0.124 line. On a direct seat route, without
`run.access.protocol: acp`, an `infer:` task with `vision:` files no longer runs without its
images: the run refuses it with `NIKA-432` before the seat starts, `nika check` blocks RUN READY
on the same code, and both name a route that carries the files; `temperature`, `max_tokens` and
`thinking` are still neither sent nor refused there. `nika run --dry-run` refuses what the run's
seat refuses. Where `nika check` said a mock rehearsal, or a file with no model route, dials
nothing, it names the tasks that can still reach the network; its estimate line adds the paid
media calls and the least they cost instead of reading `≤$0.0000`, and `nika arm` prints a cost
floor's refusal code once. `nika explain` answers the MCP pin refusals `NIKA-MCP-003` to
`NIKA-MCP-006` and leads `NIKA-PARSE-001` with the causes its refusal names, a file saved with a
byte-order mark is framed on the right line, and `nika serve` lists the files a `for_each`
fan-out saved. The workflow language, the file format and the SDK protocol are unchanged.

### Changed

- **The SDK guard reads what the published `@supernovae-st/nika` 0.124.0 closes.**
  `published_sdk.json` is re-read from that package's `dist`, and every closed set of 0.123.2
  is unchanged. The one runtime change in that `dist` names three more native task frames
  (`task_skipped`, `task_cancelled`, `task_cache_hit`) in a mapping that reads any other frame
  as an engine event, so it closes nothing new.

### Fixed

- **`nika check` no longer says a mock rehearsal dials nothing.** With
  `--model mock/echo`, the ACCESS row read `mock · never dials · nothing to
  judge` and a file with no `infer:` or `agent:` task read `access ready n/a
  · nothing dials`, while its `nika:fetch` reached the network. The mock row
  now says `this model route never dials` and, under it, names the tasks
  whose own effects can still reach the network (a fetch or webhook to a
  real host, an MCP tool, a paid media call), judged on the PERMITS row; the
  moot line reads `access ready n/a · no model route` and names them the
  same way. Both lines name three tasks and count the rest (`· +17 more`);
  `--json` lists every one as `verdicts.network_tasks`, and the TUI's ACCESS
  READY reason no longer says `nothing dials`.
- **A workflow saved with a byte-order mark is framed on the right line
  (#1608).** The parser strips a leading UTF-8 byte-order mark, but every
  span then indexed the stripped text, 3 bytes left of the file `nika check`
  frames: an unknown key at column 1 was framed at the end of the line above
  it (`5:24` instead of `6:1`), and the `--json` spans, trace and debugger
  lines carried the same shift. Spans now index the text the caller passed
  in, byte-order mark included. The frame and the browser checker's `col`
  count line 1 from the character after the mark, as an editor shows it, so
  a finding on line 1 keeps its column (`1:1`, as without the mark). A file
  without one is unchanged.
- **A direct seat refuses an `infer:` with `vision:` instead of running it
  without the images.** On a seat route without `run.access.protocol: acp`
  (Codex's `codex exec`, Claude Code's `claude -p`, Grok Build, GitHub
  Copilot CLI), the files were judged and read, then never sent: the command
  carries the prompt, system and model (and a `schema:`, except on Copilot),
  never an image. The run now refuses the task with `NIKA-432` before the
  seat is spawned, as the ACP route refuses a `vision:` URL, and `nika
  check` blocks RUN READY with the same code. Both name `run.access: { via:
  <seat>, protocol: acp }` where that seat's ACP one-shot carries `vision:`
  files and the rest of the task; a task that also sets what that session
  refuses (`temperature`, `max_tokens`, `thinking`, a `vision:` URL) is
  pointed at an API route, with those fields named. `temperature`,
  `max_tokens` and `thinking` are still not sent on the direct route.
- **`nika run --dry-run` refuses what the run's seat refuses.** An `infer:`
  task on a Codex or Claude Code seat over ACP that sets `max_tokens`,
  `temperature`, an enabled `thinking` budget or a `vision:` URL, an
  `agent:` with a `tools:` whitelist on a seat, and an `agent:` declaring
  `images:` with no seat previewed as `dry-run · plan only`, then the run
  refused them before anything was sent (`NIKA-432`, `NIKA-465`). The
  preview now refuses with the same lines `nika check` blocks `run ready`
  on, and exits 2 like its other file refusals.
- **`nika explain` answers the MCP pin refusals a run sends you to (NIK-254).**
  A run refused with `NIKA-MCP-006` printed `fix: nika explain
  NIKA-MCP-006`, and explain answered `unknown code` for it and for
  `NIKA-MCP-003`, `004` and `005`, the other codes the pin store mints. Each
  now says what failed and the remedy the refusal prints: re-approve a
  drifted server deliberately (`nika mcp approve <server>`), restore or
  re-enroll an untrusted `.nika/mcp_pins.json`, check the OS sandbox an MCP
  server is confined by, approve the server a tool belongs to. The MCP
  `nika_explain` tool answers the same.
- **Paid media no longer reads as free or doubles its code on the cost
  lines.** `nika arm` printed `NIKA-1709 · NIKA-1709 · refusing to start: …`
  for a beat a cost floor refuses, a paid media call included, and broke the
  line before `(budget_floor)`; the readiness blocker now carries the
  sentence alone, the code once on its own field, in the text and in
  `--json`. The audited line of `nika check`, and the green answer of the
  MCP `nika_check` tool, read `est out ≤$0.0000` for a workflow whose only
  spend is a priced media call; they now add the calls and the least they
  cost (`+ 1 paid media call from $0.0006`), counted as the `--max-cost-usd`
  floor counts them: a literal `for_each` multiplies its call, while a call
  behind a `when:` gate, over an expression `for_each` or made by a child
  workflow is named as one only the run counts. Metered calls are named
  beside unpriced ones.
- **`nika explain NIKA-PARSE-001` names the causes the refusal names
  (#1608).** Its checklist sent a `prompt: Note: here` author looking for a
  missing `:` when the line holds one too many. It now leads with the causes
  the refusal itself names on the pointed line: a `: ` inside a plain value
  (quote the whole value, use a block scalar, or put a key of its own on its
  own line), an unquoted `${{ … }}` inside a flow mapping (quote it), and a
  `{` or `[` the file never closes; then a stray tab, unbalanced quotes, a
  key missing its `:` and a de-commented modeline.
- **`nika serve` lists the files a `for_each` fan-out saved.** A job whose
  `for_each:` called `nika:chart` once per item wrote each item's file, yet
  `GET /v1/jobs/{id}/artifacts` listed only the single calls' files: the
  manifest read the tool from an `invoke · <tool>` note, and a fan-out's
  note is `for_each · <n> items`. A fan-out's tool is now read from the
  task's own journal: the one tool every tool-plane permit decision of the
  task allowed, when every item settled ok, no agent frame came from the
  task and its value holds one answer per item. Each item's file is listed
  with its journaled size and digest and downloads like any other. A
  fan-out with a recovered or failed item still lists none of its files.
## [0.124.0](https://github.com/supernovae-st/nika/compare/v0.123.2..v0.124.0) - 2026-10-27

Nika 0.124.0 opens the 0.124 release line with media capabilities that workflows need, so a
contact sheet or a narration no longer needs `exec magick montage` or `exec /usr/bin/say`:
`nika:image_compose`, the 30th builtin, lays 1 to 64 PNG images out as one grid, row or column,
and `nika:tts_generate` speaks with no key, offline, through `provider: system`. An `agent:` task
on a Codex seat hands the images it generates to the next task as values (`images:`, saved inside
`permits.fs.write` from the bytes its own session received). Over ACP
(`run.access.protocol: acp`), an `infer:` task on a Codex or Claude Code seat carries a `schema:`
and its `vision:` files, and `nika check` blocks what the seat cannot carry instead of passing
what the run refuses; on a direct seat route, without that protocol, the run still sends no
`vision:`, `temperature`, `max_tokens` or `thinking`, and `nika check` does not say so.
`nika doctor` and `nika welcome` name the `nika` that is running and every other copy on `PATH`,
and the first parse refusals a newcomer meets teach the shape they refused and point at the line.

Some workflows that 0.123.2 checked clean or ran unattended are now refused or paused.
`NIKA-SEC-009` follows untrusted content through a child workflow call and through a file a
builtin reads; a blocking `nika:prompt` that dominates the path still clears it, but a gate
inside the child does not count for its caller: put the gate in front of the call.
`NIKA-SEC-014` holds a confirm gate in front of a child workflow that acts: a bare
`after: { ask: success }` edge still runs the child on « no », so bind the answer on the call
(`with: { go: "${{ tasks.ask.output }}" }` and `when: ${{ with.go == true }}`), as an inline
effect already needs. On the `openai` provider, `nika check` refuses a `temperature:` on
`gpt-5`, `gpt-5-mini`, `gpt-5-nano` and the o-series, which accept only the default: drop it
there. On a Codex seat, a command that asks to leave its sandbox always pauses for you, under
`permits.exec: true` too, and a turn Codex reports as failed fails its task instead of
succeeding with the error as its output; what Codex does without asking, such as opening pages
with its hosted web tool or calling MCP tools marked read-only, is stated by `nika check`, not
bounded by `permits:`. On a seat, one `--answer` now decides one ask per task: an attempt that
`retry:` replays pauses on its ask instead of reusing the answer.

A `vision:` file is now a read inside `permits.fs.read`, a breaking change. 0.123.2 sent any file
an `infer:` task named to the model provider, under any `permits:` or none, and read a relative
path from the process directory. The run now reads each file under the workflow's own boundary,
on its resolved path, before any provider call, and fails `NIKA-SEC-004` outside it. `nika check`
refuses an ungranted literal path (`NIKA-AUTH-006` with no `permits:` block, `NIKA-SEC-004`
outside a declared one), and refuses a computed path, or a computed `images: { save: }`, under a
boundary that grants no path at all (no block, `permits: {}`, an empty `fs.read` or `fs.write`).
Grant each file in `permits.fs.read`: `nika check --infer-permits` prints the block for a literal
path, but for a computed one only a note and a partial `fs`, so the grant must cover every file
the run may name, for example `fs: { read: ["./in/**"] }`. A `source: url` entry needs no grant,
a secret in a vision entry now needs `egress: [{ to: "infer" }]` like one in a prompt, and
`NIKA-SEC-009` follows untrusted content that picks a vision file, as for a `nika:read` path.

A run under a cost cap now bills paid media at dated public prices and refuses what it cannot
price, a breaking change for capped runs, scheduled beats included: a beat always runs under
its `plafond:`, and a project `ceiling:` caps a plain `nika run`. Under a cap,
`nika:image_generate` on OpenAI `gpt-image-2` or one of the five Gemini image models the catalog
prices, and `nika:tts_generate` on OpenAI `tts-1` or `tts-1-hd` or a priced ElevenLabs model, are
floored at launch and billed against the cap; OpenAI's `gpt-image-2.5-sunburst` and
`gpt-image-2.5-flare` publish token rates only, so they are billed from the usage they report and
refused at launch only under a zero cap. 0.123.2 ran these OpenAI, Gemini and ElevenLabs calls
with no bound (xAI images were already floored and metered). `nika check` shows each paid media
call's floor, rate and price date, or says it is `METERED`, `UNPRICED` or `DECIDED AT RUN`. A
paid call the catalog cannot price is refused before any request, with `NIKA-1709` at launch, or
with `NIKA-1704` when only the run decides its provider or model or an `agent:` makes it through
its tools: OpenAI's default voice `gpt-4o-mini-tts`, `gpt-image-1.5` and `gpt-image-1-mini`
(which OpenAI shuts down on 2026-12-01), and any model id the catalog does not list. `nika arm`
shows a beat on one of them UNREADY. For speech, set `model: tts-1` or `tts-1-hd` (OpenAI shuts
all three of its speech models down on 2027-01-06), use a priced `elevenlabs` model, the keyless
`provider: system` voice, which bills no provider and runs under any cap as unpriced local work,
or `local` / `mock`; for images, use `gpt-image-2` (the default) or a 2.5 model. A paid call the
catalog cannot price runs only with no cap, and the settlement then counts it unpriced.

The file format and its nine top-level keys are unchanged and the SDK machine protocol stays 2;
the language gains `nika:image_compose`, `provider: system` and the `images:` field of `agent:`.
0.124 is the current release line. Work stays focused on maintenance, security and the media
capabilities workflows need; native video is planned for 0.125. Known limits are listed in plain
words, each with a way around it:
[Known limits in 0.124](https://docs.nika.sh/changelog/known-limits). In short: 0.124.0 makes no
video; `nika:image_compose` reads PNG only; the system voice needs macOS `say` or Linux
`espeak-ng`; only a Codex seat delivers images to `images:`; a seat carries no `temperature`,
`max_tokens` or `tools:` whitelist; the VS Code extension stays at 0.120.

### Added

- **`nika doctor` and `nika welcome` name which `nika` is running.** A
  shadowed install used to read healthy: no path, no installer, no other
  copy. Doctor now prints the running binary's resolved path, version,
  commit and installer (read from the path: `install.sh`, `homebrew`,
  `npm-global`, `npm-payload`, `cargo`, `nix`, `release-dir`,
  `source-build`, else `unknown`), says what typing `nika` runs, warns
  when that is another build, and lists every other `nika` on PATH with
  the version it reports. Each copy is asked `--version` under a
  two-second deadline: one that hangs is reported as unknown, one that
  fails warns, neither is fatal. A relative or literal-`~` PATH entry is
  never executed, and a copy that is asked runs from `/` with no
  credential in its environment and no relative PATH entry; its whole
  process group is killed after the answer. A removal is suggested only
  for a known install layout. `--json` adds `running`, `others[]` and
  `others_truncated`; `nika welcome` says the same in one line under
  `this binary` and carries the same keys.
- **An agent application's images are task values.** An `agent:` task on a seat can declare
  `images:` (spec 02 §Harness images): `.output` becomes `{ message, images }`, each image with
  its `index`, `path`, `sha256`, `size_bytes`, `mime_type`, `width` and `height`, and
  `images: { save: <path> }` has Nika write the received bytes through `nika:write`, inside
  `permits.fs.write`: every path the save can take (image *n* at `-n`, up to four) is judged
  before any file is written, and a save rides the same-path law (`NIKA-SEC-012`) like a
  `nika:write`. `check` types `.output` as `{ message, images }`, so
  `.output.images[0].path` and `.output.message.<key>` resolve and a schema key read at the
  top is refused. Only the bytes sent on the task's own session count: the path an
  application reports (Codex's `~/.codex/generated_images`, which every session shares) is
  never opened, so a workflow no longer asks Codex to copy its image and cannot pick up another
  session's. A save with no image received fails the new `NIKA-AGENT-007`. The image's
  `agent_image_observed` frame records the `saved_path`, and `nika serve` lists the file among
  the run's artifacts with the received digest. On an API or local model, `check` and the run
  refuse `images:`.
- **`nika:image_compose` assembles several PNG images into one.** The 30th
  builtin (stdlib §Media graduate #5) lays an ordered list of 1 to 64 inputs
  out as a `grid` (columns and rows derived from the count when absent), a
  `row` or a `column`; each image keeps its own size, is scaled to fit its
  cell with the aspect kept (`fit`), or is scaled and center-cropped to fill
  it (`fill`), with `gap`, `padding` and a `background` colour. Like
  `nika:image_fx` it is pure, zero-dependency pixel work: the same input
  bytes and args give the same PNG bytes, the `image_compose/v1` recipe rides
  the tEXt chunk, and the output carries path, sha256, width and height,
  never bytes. Every input is an `fs.read` that `nika check` judges, infers
  and counts as a use, and `out:` an `fs.write`; caps on each input's side,
  the summed input pixels, each scaled `fit`/`fill` box and the canvas fail
  `NIKA-BUILTIN-IMAGE_COMPOSE-005` from the PNG headers before any
  decompression (an input count outside 1..=64 is an argument, `-001`), an
  input with a second IHDR is `-004`, and each of the six codes has its
  `nika explain` lesson. Its inputs are file reads the `NIKA-SEC-009`
  content flow follows, like `nika:image_fx`'s. A contact sheet no longer needs `exec magick
  montage`.
- **`nika:tts_generate` speaks with no key through `provider: system`.** The
  host's own synthesizer, offline: macOS `/usr/bin/say`, or Linux
  `espeak-ng` found in an absolute directory of the engine's `PATH`. The
  engine starts it itself as part of the builtin, with the text on standard
  input, so the workflow needs no `permits.exec`. The text is spoken as
  text: every `[[` that `say` reads as an embedded command (`[[volm 0]]`
  would mute the file) or `espeak-ng` as phonemes is broken by a space, and
  the audio is capped at 64 MiB. The WAV still lands under `output_dir:`
  through `permits.fs.write`. `nika check` names the program in its plan and
  refuses a literal `model:` other than `say`/`espeak-ng` or a voice that is
  not a host voice name, as the run does. Every start is journaled as a
  `permit_checked` frame on the `builtin` plane, and the cost is reported as
  unpriced local work (`cost_usd: null` · `cost_unpriced: local_model` on
  the output and the task's frame), never as priced or free; only this
  builtin can label the run's cost that way. A named voice must be installed
  (`say` would otherwise read with its default voice), and a host with no
  synthesizer refuses `NIKA-BUILTIN-TTS_GENERATE-002` naming what is
  missing, with no fallback to another provider. A narration no longer needs
  `exec /usr/bin/say`.

### Changed

- **Capped runs bill common paid media at dated catalog prices, and refuse what the catalog cannot price, beats included.** A beat always runs under its mandatory `plafond:`, and a plain `nika run` in a project with `ceiling:` runs under that cap. Under a cap, `nika:image_generate` on OpenAI `gpt-image-2` (the default) or Gemini (`gemini-3.1-flash-image`, the default, `gemini-3-pro-image`, `gemini-2.5-flash-image`, `gemini-3.1-flash-lite-image`, `gemini-nano-banana-2.1`) and `nika:tts_generate` on OpenAI `tts-1` or `tts-1-hd` or on ElevenLabs (its models mapped to the price page's families) now run, floored at launch and billed against the cap; OpenAI's `gpt-image-2.5-sunburst` and `gpt-image-2.5-flare` publish token rates only, so they run billed from the usage they report, refused only under a zero cap. 0.123.2 ran these OpenAI, Gemini and ElevenLabs calls with no bound (xAI images were already floored and metered). A paid call the catalog cannot price is refused before any request (`nika arm` shows the beat UNREADY with NIKA-1709): OpenAI's default voice `gpt-4o-mini-tts` (no per-call price is published and its speech response reports no usage), `gpt-image-1.5` and `gpt-image-1-mini` (shut down by OpenAI on 2026-12-01), and any model id the catalog does not list; the refusal names every model the catalog prices. A beat on the default OpenAI voice is therefore UNREADY: set `model: tts-1` or `tts-1-hd` (OpenAI shuts every speech model down on 2027-01-06), use a priced `elevenlabs` model, the keyless `provider: system` voice (it bills no provider and settles as unpriced local work), or `local` / `mock`. Only a run with no cap at all makes a paid call the catalog cannot price.
- **The SDK guard reads what the published `@supernovae-st/nika` 0.123.2 closes.**
  `published_sdk.json` is re-read from that package's `dist`. Every closed set of 0.123.1 is
  unchanged, and one is new: an artifact manifest's `verdict` must be `sealed` or `anchored`,
  the two values `GET /v1/jobs/{id}/artifacts` serves. The manifest and its entries are read
  open otherwise, so a later key rides through.
- **The embedded language pack follows nika-spec `5cd95cd`.** `SPEC_PIN`
  and `crates/nika-pack/pack` advance together from `c5dcd97`, the commit
  0.123.2 embeds. nika-spec#397 (`aac8de5`) adds the contract of
  `nika:image_compose` and the keyless `system` voice: `canon.yaml` counts 30
  builtins, the schema's builtin enum and the stdlib gain
  `nika:image_compose`, its caps list each input side, the summed pixels,
  each scaled box and the canvas, the `system` voice speaks its text as text
  with its audio capped at 64 MiB, and the `image-compose-sheet` example
  joins the pack. nika-spec#399 (`ebc6448`) makes the images an agent
  application delivers on a seat a value of the `agent:` task: the schema
  gains `images: { save: }`, chapter 02 its §Harness images, chapter 17 the
  `saved_path` of a saved image and the error registry `NIKA-AGENT-007` (112
  codes), and a seat's `infer:` meets a JSON or JSON Schema need when the
  engine validates its answer. nika-spec#400 (`479b0bc`) makes an `infer:`
  `vision:` file a read under `permits.fs.read` (`NIKA-AUTH-006` under an
  absent block, `NIKA-SEC-004` outside a declared one, and a refusal at
  check, whatever the path's form, under a boundary that admits no read; a
  `source: url` entry needs no grant), makes every `vision:` entry a
  provider-egress sink of its task (`NIKA-SEC-006`, `NIKA-SEC-009`), and
  bounds an `images: { save: }` to four files and names it, with its `-2` to
  `-4` siblings, in the same-path law (`NIKA-SEC-012`). nika-spec#401
  (`5cd95cd`) lets the `cost_usd` of `nika:image_generate` and
  `nika:tts_generate` come from the engine's dated price catalog, marked by
  `cost_basis` with the rates' date in `cost_as_of`, and keeps it `null`
  when neither the provider's report nor the catalog yields a figure.

### Fixed

- **`nika check` accepts the `$key` variables `nika:jq` binds from its
  input.** At run, every key of an object `input:` is a jq variable, so
  `input: { rows: [...], batch: B1 }` with `$rows | map(. + {batch: $batch})`
  works, but the check refused it with NIKA-VAR-005 « undefined filter or
  variable `$rows` » and the documented form could never run. The check now
  binds the same names; a templated `input:` leaves an undefined `$name` to
  the run, and any other undefined name still refuses.
- **The first parse refusals a newcomer meets teach the shape they
  refused.** A scalar `infer:`, `invoke:` or `agent:` body (`infer: "say
  hi"`, `invoke: nika:jq`) now reflects it into its mapping (`infer: {
  prompt: "say hi" }`, `invoke: { tool: nika:jq, args: { … } }`, or
  `invoke: { workflow: ./child.nika }` for a child workflow); a bare builtin
  name is taught under its prefix (`invoke: fetch` → `tool: nika:fetch`). An
  untyped `inputs:` entry names the typed form it meant (`topic: { type:
  string, default: "x" }`, `tags: { type: { array: string }, default: [...] }`
  for a list) and the ten primitives. A builtin written as a task key
  (`fetch:` or `nika:fetch:`) says it is called through `invoke: { tool:
  nika:fetch, args: { url: … } }`. The codes are unchanged (`NIKA-PARSE-019`,
  `NIKA-PARSE-005`).
- **A YAML syntax refusal (`NIKA-PARSE-001`) names its site and its usual
  cause.** `prompt: Note: this has a colon: here` and `infer: {prompt: ${{
  inputs.t }}}` printed one raw sentence with no line frame, and the `--json`
  finding had no span. The refusal now carries the position the YAML scanner
  stopped at (where the content ends, when the scanner ran out of input), so
  `nika check` prints the `-->` frame with its caret and the `--json` parse
  finding carries `span: {start, end}` like a CONFORM finding (every
  span-bearing parse refusal does). A colon inside a plain value is told to
  quote the value or use a block scalar, or to nest a key that meant to be
  one; an unquoted `${{ … }}` inside a flow mapping is told to quote the
  expression; a flow mapping or list the file never closed is told so.
- **A bare `{{ name }}` that names a declared input or a `with:` key draws
  the `[silent-literal]` hint.** `{{ inputs.name }}` was already named as
  literal text, but `content: "Hello {{ name }}"` passed `nika check` in
  silence and the run wrote the braces. The hint now names the reference it
  meant: `${{ with.name }}` for a `with:` key of that task, otherwise
  `${{ inputs.name }}`. A bare word that names neither stays silent, and
  so does a dashed name, whose dotted reference would not parse.
- **`nika welcome` no longer calls an API key « ready now ».** The key rung
  read `OPENAI_API_KEY is set · ready now · billed per run`, but nothing on
  that path checks the key, and a revoked one answered 401 on the first
  paid call. The rung now says the variable is set and is not checked until
  the first call; `welcome --json` carries the same reason.
- **A task-level key from another workflow dialect names the verb that owns
  it.** `prompt:`, `max_tokens:` and `system:` written straight on a task now
  point to `infer:`; `http:`, `url:`, `method:` and `request:` to `invoke:`
  with `tool: nika:fetch`; `command:`, `shell:` and `script:` to `exec:`
  and `permits.exec`; `tool:` and `args:` to `invoke:`. The field list still
  follows, so `check --fix` and the editor repairs read it as before. `nika
  explain NIKA-PARSE-005` now teaches that list and those mappings instead of
  sending the author to `nika spec --schema`.
- **`nika serve` says so when the project arms nothing.** In a project whose
  `nika.yaml` carries no `arm:` entry, `serve --once` exited 0 in silence,
  `serve --dry` never returned and a bare `serve` waited without a word.
  `--once` and `--dry` now print the sentence `nika arm` prints, plus the
  `--bind` command and the token recipe for running workflows over HTTP,
  and exit 0. The resident prints the same lines once on stderr and keeps
  watching `nika.yaml`, so arming it later still takes effect. The token
  recipe, here, in the `--bind` refusal and in `nika doctor`, now creates
  `.nika/` before it writes the token, so it works in a project fresh from
  `nika init`.
- **`nika check` judges a declared route over this machine's access rows.**
  A file that declares `run.access` (a `via:` or a `protocol:`) and has no
  `infer:` or `agent:` task was judged over no rows, so ACCESS said the binary
  was built without agentic CLI adapters and `run ready` was refused, while
  `nika run` resolved the same route and finished. Check now also probes for
  a declared route, as the run does, beside a task that dials a model and an
  `--access` pin.
- **`nika check` no longer calls the members of a folded group dead spend.**
  A task that declares `group: <name>` is read by every `${{ group.<name> }}`
  fold, but the `[dead-spend]` hint only counted `tasks.<id>.output`
  references and told the author to remove each member. The hint now reads
  group membership with the same law the DAG uses to fold.
- **An image save names at most four received images.** The four-image
  bound counted path-only reports, so one delivered image beside four
  reported paths was refused; and the agent verb wrote a fifth image from a
  lent backend at a `-5` path no check judged. The bound now counts images
  whose bytes arrived, and the writer refuses a fifth before any write.
- **A turn Codex could not complete no longer settles as a success.** codex-acp returned a
  failed turn (a 400 `model_not_found`, a retry limit exhausted on 429) as answer text and
  `end_turn`, so an `agent:` or `infer:` task on the Codex seat succeeded with the error as its
  output. Nika now advertises the `sessionFailure` extension, which codex-acp and
  claude-agent-acp implement, and the failure the adapter then reports fails the task with its
  own error: transient (`NIKA-1804`) when the adapter offers a retry, an expired sign-in when it
  asks you to sign in again, a refusal (`NIKA-1805`) otherwise. `nika explain` now describes
  both codes for such a failed turn. An adapter without that extension still returns its error
  as text.
- **`[jq-as-map]` no longer fires on a binding whose scope has ended.**
  `map(. as $r | {n: ($r.a | length)})` binds each element, so the map that
  encloses the binding maps what it was written to map, and so does a later
  map of its output (`map(. as $r | …) | map(.n)`); the run's result was
  right. The hint only checked that a `. as $name` binding and a bare `map(`
  both appeared; it now counts a bare `map(` only inside a dot binding's
  scope, which ends at the bracket that closes the construct the binding sits
  in, so `. as $c | map(.n)` still draws it.
- **`scan` and `IN` in jq expressions give jq's results.** `scan` with a
  regex that has capture groups returned each whole match where jq returns
  the captures (`"abab" | [scan("(a)(b)")]` gave `["ab","ab"]` instead of
  `[["a","b"],["a","b"]]`), and `IN(...)` was an undefined filter. `IN/1`,
  `IN/2` and `scan` over a match where every group takes part now follow
  jq 1.7 in `nika:jq`, output bindings, `nika check` and the compile
  verifier, which load the same definitions. A group that takes no part in
  a match (`a(b)?` on `a`, one side of `(a)|(b)`) still differs: jq yields
  `null` for it, while this engine leaves it out, and yields the whole match
  when no group took part.
- **`--max-cost-usd` and the run settlement now see paid media spend.** `nika:image_generate` and `nika:tts_generate` on OpenAI, Gemini and ElevenLabs billed their provider and reported no `cost_usd`, so a capped run never charged them and the settlement left them out (a run whose only spend was such a call settled `unmetered`). The engine now carries a hand-sourced media price table apart from the models.dev snapshot: each row names its provider, model, unit (per image by size class and quality, per million characters, or per million tokens of text input, image input, image output and text and thinking output), USD rate, official source page and the date it was read (2026-10-27). The builtins bill every priced call from it, each response on its own: at the token rates times the usage it reported, at the per-image price times its images when an image response reports no usage (the dearest row over what the request leaves open, such as `quality: auto`), or at the per-character rate times the characters sent, and say how on the output and the manifest (`cost_basis`, with the rates' date in `cost_as_of`); xAI images keep the spend xAI reports (`provider_reported`). A paid call that fails after its provider billed keeps that spend: a Gemini `n:` batch whose later request fails keeps the bill of the images already rendered, a render that fails after its answer keeps its bill, and a request that broke after it left is counted unpriced. The run ledger debits all of it as it debits a model's, per attempt, so a retry is judged against what is left. Under a cap every paid media call is judged on its rendered arguments before its request, a `${{` in a rendered text being text the provider bills: a provider, model, `quality:`, `size:`, `n:` or `text:` only the run decides refuses NIKA-1704 when the catalog cannot price the call or its floor exceeds what the cap leaves. An admitted call holds its floor until it returns, so the items of a capped `for_each` fan-out, parallel or not, cannot launch past the cap together; a call dropped in flight (a `fail_fast` sibling, a `timeout:`) is counted unpriced and its floor stays consumed; once a paid call billed without a figure, a call billed only from its usage is refused under the cap. An `agent:` loop judges its media tool calls the same way against what its task's remainder leaves after the loop's own model turns, its returned tools and the floors its concurrent calls hold, so a model batching image calls cannot spend one remainder twice; concurrent agent tasks each judge against their own snapshot, as text siblings in flight do. A paid call the catalog cannot price runs only with no cap and is counted in `spend.unpriced_calls`, so the settlement reads `unpriced` or `partially_priced`; a child workflow's unpriced calls reach its parent's settlement, and a grandchild's unpriced media is refused at the root's launch. The run's prologue records the table (`media_pricing`, beside `pricing` and `admission_pricing`), and `nika trace verify` refuses the cost replay of a journal that pinned other media rates. `nika check` names each paid media call on its COST rung with its floor, the rate and unit that set it and the table's date (METERED for a call billed from its usage or, for speech, per character of the text the run renders; UNPRICED; or DECIDED AT RUN), including a composed child's and the paid media an agent's tools can reach, and lists `unpriced_media_cap`, `priced_image_over_cap` and `priced_speech_over_cap` in `failure_plan`.
- **`nika check` refuses a `temperature:` on `openai/gpt-5`, `gpt-5-mini`,
  `gpt-5-nano` and the o-series.** These models accept only the default
  temperature, and OpenAI answers any other value with HTTP 400 at run
  (« Only the default (1) value is supported »), while check showed
  `capacity fit ✔`. The catalog now records that GPT-5, GPT-5 mini and
  GPT-5 nano (and their 2025-08-07 snapshots) take no temperature, as it
  already did for the o-series, and the fixed-sampling finding covers
  OpenAI's own API beside Anthropic's for the models the catalog lists. A
  Session label call on these models, a dated snapshot included, no longer
  sends a temperature. The finding does not yet name a dated snapshot id
  (`gpt-5-mini-2025-08-07`), which the catalog's model list does not carry.
  OpenRouter and other compatible routes, which drop the control, and the
  later dot variants (`gpt-5.1` onward) are unchanged.
- **An oversized PNG input is a size cap, and a PNG has one IHDR.**
  `nika:image_fx` refused an input over 16384 pixels on a side as
  `NIKA-BUILTIN-IMAGE_FX-004` (corrupt, re-produce it); the stdlib files that
  input cap under `-005`, which it now returns. The PNG decoder behind
  `image_fx` and `image_compose` now refuses an IHDR that is not the first
  chunk, or a second IHDR, so the size a pixel budget judged from the header
  is always the size decoded.
- **`check` and the run agree on what a Codex or Claude Code seat can carry.** `check` said
  `run ready` for `schema:` and `vision:` on a seat while the run refused them. An `infer:`
  task over ACP now carries a `schema:`: the prompt carries the schema and Nika validates the
  answer, and each repair is a new one-turn session that receives the earlier answer and the
  errors (`NIKA-INFER-002` after the budget). Its `vision:` files ride as ACP image blocks when
  the application declares image prompts at `initialize` and the file carries an image
  signature. An `agent:` task's `schema:` is validated on the seat's final message, with no
  repair turn. What a seat still cannot carry (`temperature`, `max_tokens`, an enabled
  `thinking` budget, a `vision:` URL on `infer:`, a `tools:` whitelist on `agent:`) is a `check`
  blocker, and `check` no longer suggests `max_tokens` or `max_tokens_total` on a seated task.
- **A `--var` refusal names its code in the `--json` envelope.** An unknown
  input, a value its declared type refuses and a malformed pair reached
  `nika run --json` callers as `{"error":{"code":null,…}}`, while the
  `--inputs-json` channel and the server say `unknown_input` and
  `input_type_mismatch`. The envelope now carries `unknown_input`,
  `input_type_mismatch`, `malformed`, `env_unset`, `env_undeclared_in_ci` or
  `env_name_missing`; the sentence on stderr and exit 3 are unchanged.
- **A streamed WAV reports its real duration.** `nika:tts_generate` read a
  streamed WAV header's placeholder `data` size (`0xFFFFFFFF`) verbatim, so
  an OpenAI narration reported `duration_ms: 89478485` (24.8 hours). The
  size is now clamped to the bytes actually present, which also gives
  `espeak-ng --stdout` audio its true length.

### Security

- **`NIKA-SEC-014` holds a confirm gate in front of a child workflow call.** The consent check only looked at egress tasks written in the workflow itself, so a gate that the trifecta credited in front of an `invoke: workflow:` call was never checked to stop the child's effect on a « no » answer. `nika check` and `nika run` now judge a call as the egress-capable task its child (or a workflow below it) reaches, whatever content reaches that task: every route from a confirm gate to the call must close on a refusal, as for the inline form, and the finding names the call. A confirm gate inside the child owns the effect behind it, as inline. When only a child gate the check cannot decide from the caller stands before the effect (a `when:` on an input the caller may bind to its answer), the call gets the advisory hint instead of the refusal. A child the check cannot resolve counts as acting. `check --json` names the child task under `composed_calls[].effect`, with `effect_conditional` for the advisory case.
- **A Codex command that asks to leave its sandbox now always pauses.** In `read-only`, Codex runs
  ordinary commands in its sandbox without asking, so every command it asks about asks to run
  with no sandbox at all (`require_escalated`). Its ask carries the command as a string and the
  reason in `_meta.permission.description`, which Nika read as `execute · <prose>`: under
  `permits: { exec: true }` it was allowed, and Codex fetched a site outside its sandbox. It now
  pauses for you on the exec plane (`sandbox · command`) whatever `permits.exec` grants, with the
  command and the reason in the question and in the witness. Every pause question now names the
  command and the reason an ask carries unless its title shows it, on one line a harness cannot
  steer: control characters become spaces and invisible ones (direction overrides, zero-width
  characters) are removed, so a Claude Code title, which is the model's own command, can no
  longer erase itself on your terminal. A long command keeps its end in view (its beginning and
  end around the bytes left out and their SHA-256; whole up to 16 KiB in the witness), and a
  sandbox widening's witness names the command it is for. One `--answer` now decides one ask for
  the task: an attempt that `retry:` replays never reuses it, where a typed 429 failure could
  otherwise replay the session and approve a different command with the same answer.
  `nika check`, `nika explain harness` and docs/usage/harness-agents.md now also state what Codex
  does without asking: it calls its MCP tools marked `readOnlyHint`, opens pages with its hosted
  web tool, writes its own `~/.codex`, starts every configured MCP server and applies your global
  `~/.codex/AGENTS.md` and plugins.
- **`NIKA-SEC-009` now judges a child workflow through the call that runs it.** A parent that
  read a private file and sent data out passed `nika check` and ran when part of the flow sat
  in a child reached through `invoke: workflow:`, while the same tasks written inline were
  refused. `nika check` and `nika run` now judge each call as the tasks it stands for, through
  every workflow below it. The call is a source of untrusted content when content the child
  brings in (a `nika:fetch`, an `exec:`, an `mcp:` tool, an `agent:` whose tools admit one)
  reaches its outputs or a file it writes. It is an egress task when untrusted content reaches
  an egress task inside it: content the child brings in, the call's arguments, or a file
  written before the call that a child `exec:` reads. The parent is refused unless a blocking
  `nika:prompt` of its own dominates the path, as for the inline form; a gate inside the
  child is not credited to the caller. The finding names the child task behind the call. A
  child the check cannot read, parse or resolve counts as all of these (fail-closed).
  `check --json` lists every direct call under `composed_calls`, resolved or not, and the
  runtime's report check re-derives the trifecta over the same calls. `NIKA-DRIFT-001` no
  longer tells you to remove a grant a child needs (its program, its tools, the files and
  hosts its own `permits:` lets its subprocess reach); removing it failed `NIKA-COMP-002` or
  the child's run. A check of the source alone (an editor, the MCP `nika_check` tool) reads
  no child: its trifecta judges the parent's own tasks only, and its `NIKA-DRIFT-001` makes
  no `permits:` claim on a file that calls a child.
- **`NIKA-SEC-009` follows untrusted content through a file a builtin reads.** A gate could clear the task that saved untrusted content to a file, and a `nika:read` of that file then fed an ungated egress: the trifecta counted only an earlier `exec:` as a reader of such files, so `nika check` passed the workflow. A builtin read (`nika:read`, `nika:grep` (its default root `.` included), `nika:glob`, `nika:edit`, a `nika:decide` bundle, the files `nika:image_fx`, `nika:chart` and `nika:image_generate` read, a `nika:fetch` multipart upload) of a path the write may have reached now carries the content on, inline and inside a child workflow, and, when the write's path is literal, whatever the order: a read in the writer's own wave, or before it in the run (the next run reads the file), counts too. Paths compare lexically: folded, case-blind, a segment past ASCII may be any segment, `/private/tmp` is `/tmp`, and a templated path may be any file. A read whose path cannot reach the written one stays clean.
- **A run refuses a report that judged no child for a workflow call.** The runtime's report check re-derives the trifecta over the child calls the report resolved, and a call missing from that list counted as having no ingress: an embedder pairing a plain `nika_check::check()` with `Runtime::run` and a child runner could run a fetching child into an ungated egress. A call the report does not list for its task and target now counts as unresolved, and the run refuses with `NIKA-1707`, naming it. `nika run --task` re-checks the kept tasks with their children, so a scoped run of a composed workflow keeps its calls resolved.
- **A `vision:` file is a read inside `permits.fs.read` (breaking).** The
  `infer:` verb opened every `vision: [{ source: file }]` path itself, on
  every route (API and ACP; `nika run`, serve, Session, child workflows,
  `nika test` and rehearsal rooms), with no `permits` check: an absent block,
  a narrower `fs.read` grant, a symlink or a `..` did not keep the file from
  the model provider, and a relative path was read from the process
  directory instead of the run's root. The run now reads each file through
  `nika:read` under the workflow's own boundary, on its resolved path,
  before any provider call: outside it the task fails `NIKA-SEC-004` (one
  `permit_checked` fs frame), and a granted file that cannot be read fails
  with the read's own code (`NIKA-BUILTIN-READ-001` when no file is there,
  `-002` otherwise) instead of the internal `NIKA-432`. `nika check` judges
  a literal or bare-`const` path (`NIKA-AUTH-006` with no `permits:` block,
  `NIKA-SEC-004` outside a declared one), and refuses a computed path, or a
  computed `images.save`, under a boundary whose side grants no path at all.
  `--infer-permits` prints the grant, the drift scan counts it as used, a
  child's vision reads join `NIKA-COMP-002`, and the check card no longer
  calls such a body pure compute. The `vision:` entries are sink fields of
  the task, on check and run alike: a secret in a vision URL or path is the
  `infer` leak (`NIKA-SEC-006` unless `egress: [{ to: "infer" }]`), and
  untrusted content that picks an entry reaches the answer, so the trifecta
  (`NIKA-SEC-009`) follows it as it follows a `nika:read` path; the file
  channel follows a vision read of a file an untrusted writer left. A
  `source: url` needs no grant: the provider fetches it. Migration: grant
  each vision file in `permits.fs.read` (`nika check --infer-permits` prints
  the block); embedders hand the verb bytes they read (`VisionPart::Loaded`),
  never a path.
## [0.123.2](https://github.com/supernovae-st/nika/compare/v0.123.1..v0.123.2) - 2026-10-26

Nika 0.123.2 is the second maintenance release of the 0.123 reference line. An `agent:` task on
a harness seat (Codex, Claude Code, Gemini CLI) is now held to the workflow's `permits:` as far
as the seat allows: Nika selects the seat's asking mode, judges every ask against your grants and
pauses for network, sandbox-widening and the harness's own MCP approvals, and `nika check` says
what the seat still does without asking. `nika serve` can return the files a settled job made,
and verifies journals sealed with an explicit run key pair. A mock rehearsal no longer calls
itself offline when a step can reach the network, and `crypto-bigint` leaves its yanked release.
The workflow language, the file format and the SDK protocol are unchanged.

### Added

- **`nika serve` downloads the artifacts a settled job's sealed journal
  records.** `GET /v1/jobs/{id}/artifacts` lists them, bound to the job's
  receipt: each file `nika:chart`, `nika:image_generate`,
  `nika:tts_generate` or `nika:image_fx` saved inside the project, and each
  image an agent's harness sent, with its size, SHA-256 and media type.
  `GET /v1/jobs/{id}/artifacts/{name}` streams one, with `Content-Length`
  and `Nika-Artifact-Sha256`. Both need the bearer token, answer only once
  the job settled (`409 job_not_settled`), and serve nothing unless the
  journal verifies sealed and intact with the receipt's chain head. A
  name is looked up in the manifest, never on disk, and the file opens
  below the project root with no link on the way. One artifact is served
  up to 256 MiB. Bytes that no longer match the journal are refused
  (`409 artifact_changed`), and a file changed mid-stream never arrives
  whole. Health advertises `artifacts`; ADR-117 records the decision.

### Changed

- **`crypto-bigint` moves from the yanked 0.7.6 to 0.7.9.** Upstream
  yanked 0.7.6, 0.7.7 and 0.7.8 for a breaking change, so `cargo deny
  check` refused the lockfile and blocked every push. The crate reaches
  the build through `p384`, which verifies the Sigstore timestamp
  authority's ECDSA P-384 leaf in trace anchoring. 0.7.9 keeps the same
  dependency set and has no build script or procedural macro.
  `Cargo.lock` and `fuzz/Cargo.lock` move together.
- **The SDK guard reads what the published `@supernovae-st/nika` 0.123.1 closes.**
  `published_sdk.json` is re-read from that package's `dist`: machine protocol 2, a scheduled
  origin's `missed_first` and `missed_count`, `choice` questions and the three compile cognitions,
  on both compile generations. It still recorded 0.120.3 on protocol 1, so its test passed on a
  moved clock; it now compares what the widest resident serves with what the published SDK reads.
- **The embedded language pack follows nika-spec `c5dcd97`.** `SPEC_PIN`
  and `crates/nika-pack/pack` advance together from `6390b08`, the commit
  0.123.0 and 0.123.1 embed. The examples and templates that `nika try` and
  `nika compile` serve no longer call a mock rehearsal offline: the mock
  replaces the model, not the network, so a fetch step still reaches its
  host (#1605, the pack half of #1833). `release-notes` no longer drafts
  notes from a sample log when `git log` fails (the sample is now an
  explicit `--var rehearse=true`), and `pr-review-fanout` closes its fan-out
  on a « no » at the gate instead of failing. The spec chapters and stdlib
  pages carry current model ids and the 0.123 reference-release amendments.
  The schema and `canon.yaml` are unchanged.

### Fixed

- **`nika explain NIKA-SEC-004` and `NIKA-SEC-005` say a redirect is held to the same
  boundary.** `nika:fetch` follows a 3xx itself and judges every hop like the URL in the file:
  a hop onto a host outside `permits.net.http` is SEC-004, a hop into loopback, private,
  link-local or metadata space (or onto an undeclared loopback name) is SEC-005. Neither page
  named a redirect, and the SEC-005 closer promised that `nika check` catches it before a run;
  it now says that check catches a literal URL and that a hop is judged at run.
- **`nika explain NIKA-BUILTIN-JQ-001` names `decode: json` for `exec:` stdout.** A command that
  prints JSON hands `nika:jq` a string, and the page taught only the `nika:read` + `fromjson`
  path for files. It now names the exec side's explicit decoder,
  `exec: { command: [...], decode: json }` (`jsonl` for one value per line), whose output is
  the parsed value.
- **`nika explain NIKA-SEC-001` names the OS sandbox.** A confined `exec` child refused at run
  reads « seatbelt refused the confined process », and the page it points at named no
  sandbox. It now says that `exec` runs inside the sandbox built from `permits:` (Seatbelt
  through `/usr/bin/sandbox-exec` on macOS, bubblewrap through `/usr/bin/bwrap` on Linux, the
  backend `nika doctor` reports). It also says that a denied exit is classified as that
  sandbox's refusal from its stderr text alone, so a program's own permission error (a file
  the OS refuses inside the grant) reads the same, and the file's own permissions are worth
  checking too.
- **An unresolved `${{ fetch.output }}` now teaches the task-output form.** When the root of a
  NIKA-VAR-001 reference is a declared task id, the finding says so and names
  `tasks.<id>.output` (bound in `with:` on a body surface), and `nika explain NIKA-VAR-001`
  teaches the same `with:` binding. Neither surface names `config:` any more: the nine-key
  envelope refuses that key (NIKA-PARSE-005), so a typo'd root is no longer offered it.
- **`nika check --help` says what `--fix` really applies.** It read « Apply typed rename
  repairs and re-audit », while the repair ladder also hoists `with:` bindings (NIKA-VAR-021)
  and migrates retired forms (`needs:`, `depends_on`, `vars:`, a string `exec:` …). The help
  now names the three repair families and says that other findings stay the author's, and the
  `○ FIX` line printed when nothing applied names the same families instead of « typed rename
  suggestions only ».
- **`nika try` no longer calls its mock rehearsal offline, and names the hosts it may reach.**
  The mock seat replaces the model only: `nika try snippets/use-a-tool` still GETs
  `https://nika.sh`, and `snippets/weekly-radar` and `ceo-monday-brief` reach `hnrss.org` and
  `hn.algolia.com` once their gate is answered. The `nika try` help, the first-run shelf heading,
  the `--all` listing, the rescue tips, the `try` door blurb, the `model` glossary entry, the
  `MODELS` row of `nika check`, the `NIKA-INFER-001` lesson and the provider connection hint now
  say what is true (« on the mock model by default: zero keys, no model call; a step that fetches
  still reaches its host »), and the rehearsal line of `nika explain <file>` names the declared
  hosts (`# mock model · zero keys · may still reach nika.sh`). Before a mock rehearsal runs,
  `nika try` prints `may reach: <hosts> — the mock replaces the model, not the network` from the
  workflow's `permits.net.http`; a workflow that declares no host prints nothing new, and
  `--quiet` keeps its compact card. The network itself is not blocked.
- **`nika explain NIKA-PARSE-019` teaches the `permits.net` mapping.** A host list
  (`net: [api.example.com]`) refuses with « `permits.net` must be a YAML mapping », and the
  page answered with `tasks:` and `exec:` forms only. It now teaches the shape the parser
  accepts, `permits: { net: { http: [api.example.com] } }`, ahead of the exec lesson: list the
  host, not the URL (an `https://` entry is refused), and the one `http:` key covers `https://`
  URLs too.
- **`nika doctor --ping` no longer calls a web page on `:8080` a ready engine.** Its model-list
  sweep asked `…/v1/chat/completions/models`, a 404 on every engine, and the ping row said
  `ok … listening` for any open port. The sweep now asks the chat route's sibling,
  `…/v1/models`. Only an answer that is clearly not an API (a 2xx body that is not JSON, such as
  a web app's page) drops the `ok`: the row then reads « accepts connections but answers a page,
  not an API — not a model server », and `--json`'s `adoption_state` no longer counts it as a
  reachable engine. A 401 or 403 is named `key-protected`, a 404 `no /v1/models route` (the
  `nika model serve` sidecar), and a timeout keeps the connect verdict. Ollama's
  `{"object":"list","data":null}` reads as an empty model list.
- **A `nika try` rehearsal that pauses at a gate names the try form that finishes it.** The
  paused card said `nika run --answer approve=true FILE`, a file the verb discards when it
  returns. Under `nika try` it now says `nika try <slug> --answer approve=true` (the answer is
  pre-seeded on a fresh rehearsal, the form `nika try --help` documents), nested slugs such as
  `snippets/weekly-radar` included. It carries the rehearsal's own flags as typed (`--var`,
  `--model` with `self` kept as `self`, `--access`, `--max-cost-usd`, `--resume` and the answers
  already given), so the pasted line reruns the same rehearsal, and the rehearsal card names
  that slug too (`rehearsal · snippets/weekly-radar`, no longer the room's folded stem). A
  workspace `nika run` keeps its own card.
- **A recorded run's card names `nika trace verify`.** The run footer taught
  `nika trace outputs` and never the proof itself. When the run recorded a trace, the card
  (and the piped close) now lists `verify it: nika trace verify` beside `wrote .nika/traces`:
  zero-arg, the verb judges the workspace's latest trace and prints the head the `trace:`
  line names. The note is short enough that the card keeps its width.
- **The ADR index carries `amends`.** `docs/adr/README.md` says `docs/adr/index.json` holds the
  full relation graph, but `scripts/adr/generate-index.sh` emitted every edge except `amends`,
  so the twelve ADRs that amend another (ADR-154 amends three) read as amending nothing. The
  generator now emits it, the index is regenerated, and a hygiene self-test pins the edge.
- **Release tarballs record root ownership.** The v0.123.1 archives recorded the build runner's
  own uid (1001 on the Linux legs, 501 on macOS), so `tar -x` run as root in a rootless
  container failed to restore an unmapped owner. The packaging step now writes every member
  as 0:0 by number (GNU tar `--owner=0 --group=0 --numeric-owner` on Linux, bsdtar
  `--uid 0 --gid 0 --numeric-owner` on macOS); the archive contents, the checksum step and the
  replay of existing assets are unchanged.
- **`nika serve` attributes the journals it seals with an explicit run key
  pair.** A resident started with `NIKA_RUN_KEY_FILE` and `NIKA_RUN_PUB_FILE`
  naming a pair outside `~/.nika/keys` sealed its jobs with that pair, but
  `GET /v1/jobs/{id}/trace/verify` called the seal unattributable and both
  artifact routes refused the job with `409 artifact_journal_unverified`.
  The verifier now weighs that pair's public half after `--key` and before
  `~/.nika/keys/run-signing.pub` and the retired-key ledger, the order the
  signer takes them, so `nika trace verify` also attributes such a journal
  without `--key`. A host that names no pair verifies as before.
- **The `nika serve` OpenAPI document declares what the server answers.**
  The trace verify response's `tier`, the 412 schedule error's
  `error.currentRevision`, the schedule 422 `{findings}` body (kept as the
  published SDK reads it) and the 404 of a by-name `POST /v1/check` and
  `POST /v1/jobs` were sent but undeclared. `GET /v1/workflows/{name}` now
  says a name containing `/` is sent with literal separators, and the
  cancel route states its fixed 5-second grace before a run is
  interrupted.
- **The Session guide says what 0.123.1 suggests on an unsigned run.** It still named 0.123.0's
  `nika sign`, which signs workflow files; `/proof` and `nika trace verify` now point at the run
  key, `nika key init`, which seals later runs.

### Security

- **An `agent:` task on a harness seat is held to the workflow's `permits:` as far as the seat
  allows, and `nika check` says where that stops.** On codex-acp the session kept the adapter's
  default `agent` mode, whose own reviewer approves most actions, so a Codex task wrote `./out`
  and read files outside the project without a single `permit_checked` frame. Nika now roots the
  session in the admitted project (never the server's or the shell's directory), selects the
  seat's measured asking mode (codex-acp `read-only`, claude-agent-acp `default` instead of your
  `auto` default, gemini-cli `default`) and reads it back before the prompt or refuses to start,
  never picks a mode that approves on its own, and ends the session if the mode moves mid-turn.
  The mode, every ask and every refused client `fs/` or `terminal/` call are journaled as
  `permit_checked`, also when the run pauses on the ask (a paused trace used to carry the
  question and no decision). Asks are judged in the project's own terms: an absolute path the
  harness names now matches `./out/**`, and every path is judged where the operating system
  lands, walked through each symlink (a dangling one included) and each `..`: `out/link/../x`
  with `out/link` pointing outside the project was judged as `out/x` and allowed; a path that
  cannot be resolved now pauses. An ask for network access pauses for you even under
  `permits.exec: true`: codex-acp's SOCKS approvals (`socks5Tcp network access to <host>`) carry
  no URL and were answered `allow_once` as plain commands. So does a command asking the harness
  to widen its own sandbox, which `exec: true` also answered (codex-acp `additionalPermissions`,
  Claude Code `dangerouslyDisableSandbox`). What the mode still leaves to the harness is printed
  on every such task as a `[harness]` hint (`nika explain harness`,
  docs/usage/harness-agents.md): Codex, for one, reads any file and writes the project, `/tmp`
  and `$TMPDIR` inside its own sandbox even with no `fs.write` grant, and a Codex command that
  `permits.exec: true` admits after it asked to leave that sandbox runs with none.
  `NIKA-DRIFT-001` no longer tells you to remove a `permits.exec` or `permits.fs` grant that the
  permission bridge judges.
- **A Codex MCP tool approval no longer rides `permits.exec: true`.** codex-acp asks to approve
  its own MCP tool calls as a command ask with no command, which `exec: true` answered
  `allow_once`; it now pauses for you on the tools plane, because `permits.tools` names your
  workflow's MCP tools, not the harness's.
## [0.123.1](https://github.com/supernovae-st/nika/compare/v0.123.0..v0.123.1) - 2026-10-25

Nika 0.123.1 is the first maintenance release of the 0.123 reference line. It carries a security
update (`crypto-bigint` 0.7.6, RUSTSEC-2026-0387) and corrections to what Nika tells you on your
first runs: the welcome screen no longer advertises a hosted Nika Cloud, which does not exist;
access errors, hints and help name commands and steps that exist; `nika init --example` copies the
files its lesson reads; and a founded project keeps the `nika serve` token and job state out of
Git. The workflow language, the file format and the SDK protocol are unchanged.

### Changed

- **The repository's documents describe the released 0.123.0 and its maintenance.** The README,
  `llms.txt`, the Session guide, CONTRIBUTING, SECURITY, ROADMAP and DIAMOND say that 0.123 is
  maintained with security fixes, bug fixes and compatibility, with no hosted service and no 1.0
  launch planned; SECURITY's code table lists only codes `nika explain` resolves, and it names the
  MCP pin codes it does not. The serve operations page gives a first run that works (a project
  `nika.yaml` it keeps when one exists, a served rehearsal workflow, a health and job request, the
  served cancel route), `llms-install.md` adds the container and provenance paths and an
  uninstall that names what `~/.nika` holds, and the README and the Session guide say that runs are
  signed once `nika key init` minted a key. The README says what the TypeScript SDK's server door
  changes (`allowInsecureHttp` for plain loopback HTTP, an `idempotencyKey` and no `maxCostUsd`),
  and the Session guide lists the routes a Run admits. The README clips are captured again from
  0.123.0, and a new `sdk-doors` clip shows the SDK's two doors (the bundled engine and
  `nika serve`, with the two lines whose options change) from a capture of the published
  `@supernovae-st/nika` 0.123.0.

### Fixed

- **The `AGENTS.md` that `nika init` writes no longer says the shipped binary cannot serve models.**
  It said `nika model serve` « needs a `local-infer` build — the default binary prints the build
  recipe », but release binaries are built with `local-infer`, and 0.123.0's `nika doctor` reports
  « local inference built in ». The guide now says release binaries include it and that only a
  source build without the feature prints the recipe.
- **`nika arm --emit --mode system` states its limit instead of a coming release.** It refused with
  « la portée root arrive avec serve (W5) », promising a release. It now says « la portée root n'est
  pas émise » and that units go to the operator's session (LaunchAgents · systemd --user), with the
  same exit 2.
- **A project without `nika.yaml` is pointed at plain `nika init`.** `nika arm`, `nika arm fire` and
  `nika serve` answered « fix: `nika init --project-file` lays a commented starter », naming a hidden
  flag and leaving out what init writes. Plain `nika init` has laid that starter by default since
  #1283 (the flag only keeps older scripts working), among the project's starter files (agent
  briefs, hooks, editor and MCP wiring, a first workflow). The hint now says « fix: `nika init`
  writes the project's starter files, a commented `nika.yaml` among them (existing files are
  skipped) ».
- **Unsupported schedule policies state the present limit, not a future release.** `nika arm fire`
  refused `chevauchement: remplacer`, `après_saut: à-complétion`, `manqué: rattraper` and
  `décalage:` with « arrive avec serve v0.2 », the unit emitter said the same, and `nika arm` read
  « not supported by this firer (arrives with serve v0.2) ». No such release is planned. The firer
  now says « ce tireur ne tient pas cette politique » (this firer does not keep this policy), then
  what it does today, as before. For the two catch-up policies, `rattraper` and
  `{ rattraper: N }`, which the resident `nika serve` already keeps, the refusal adds « `nika serve`
  la tient » and `nika arm` adds « `nika serve` keeps it ».
- **A home or project path through a symbolic link is refused by name.** Nika opens its owned
  directories (the Session history under the home, among others) through real directories only. A
  path with a symbolic link on the way stopped the terminal Session with « Not a directory (os error
  20) »; the refusal now names the link and the resolved path to use instead.
- **`nika catalog --tools` names a command that exists.** Its listing began « nika tools — 29
  builtins » and ended « machine: nika tools --json », but `nika tools` is not a command and exits
  2. The listing now names `nika catalog --tools`, and its footer points at
  `nika catalog --tools --json`, the projection that carries the model-facing JSON Schemas.
- **`nika check --fix` no longer renames an argument when its value is the mistake.** A literal
  outside a builtin's closed set (`nika:inspect` `view: record`) carried its nearest member as the
  key-rename suggestion, so `--fix` rewrote the file to `records: record`. The nearest member is now
  said in the refusal (« did you mean `records`? ») and `--fix` leaves the value for you to change.
- **`nika init --example` founds a project its lesson can run in.** The example lane copied the
  workflow alone: 19 lessons that read files under `examples/fixtures/` (`csv-chart-report`,
  `meeting-actions`, …) failed their first suggested run with « file not found », and
  `10-compose-pipeline` founded without the child it invokes, so its own audit refused
  NIKA-COMP-001. Init now stages what `nika try` stages: the fixtures under the project root, where
  runs resolve them, and composition children beside the lesson in `workflows/`. Each staged file
  is a `created` row, and an existing file is never overwritten.
- **`nika init` keeps the `nika serve` token and job state out of Git.** The generated `.gitignore`
  covered only `.nika/traces/`, while every `nika serve` surface teaches minting the HTTP Bearer
  token at `.nika/serve.token` and the resident keeps job events and results under `.nika/serve/`.
  In a founded repository `git status` listed the token as a file to commit. Init's ignore section
  now covers both, as does the same adds-only section `nika compile` writes beside a workflow, and
  `NIKA.md` says so. Repositories founded earlier keep their section; add the two lines by hand.
- **The agent kit links the `nika arm` reference instead of a guide that was never published.** The
  operating and migration skills, the language rule, the session map, the kit README and the
  check-on-edit message on a `nika.yaml` finding pointed at docs.nika.sh/guides/projects-and-schedules,
  which answers 404; they name docs.nika.sh/reference/arm, and `nika init` lays the corrected files.
  The operating skill and the project reference also say what 0.123.0 fires: `sauter` and
  `rattraper-une-fois`, with `rattraper` and the bounded `{ rattraper: N }` read UNREADY. The Cursor
  manifest lists `/compile` where it still named the retired `/new`.
- **The agent kit separates signing a workflow from sealing a run.** The operating skill's audit
  checklist asked for a run « signed (`nika sign`) », but `nika sign` binds a workflow file to its
  author, and only the run key `nika key init` mints seals a journal. The checklist now asks for
  both, each with its own command. The portable plugin manifest's description opens with the
  README's « Say it once. Keep it as a file. » instead of the retired intent-as-code pitch.
- **The editor's `secrets` hover names the sources that work.** `nika lsp` described `secrets:` as
  « Masked, vault-backed references ». Spec 01 §secrets withdrew `vault`, and no engine resolves it.
  The hover now says the references point at an environment variable (`source: env`) or a file
  (`source: file`).
- **A registry child is refused as a present limit, not a coming lane.** `nika check` and the run
  both refused a pinned `registry:owner/name@1.2.0` child with « registry child execution lands with
  the registry lane », which promised a release. They now say « this engine does not run registry
  children; run a filesystem child (`./child.nika`) », still as NIKA-COMP-001 and in the same words
  at check and at run.
- **`nika trace verify --help` lists every exit the verdict returns.** The help named exits 0, 2 and
  3, while a journal that never reached a terminal frame (a run in flight or a writer that died)
  exits 5 INCOMPLETE. It now lists 5, names buried seals and replay divergence under exit 2, and
  counts its four named refusals as four.
- **`nika try` no longer hands over a command for a file that is gone.** After a rehearsal, the run's
  closing line said « explore: nika run /var/folders/…/nika-try-01-hello/01-hello.nika --json > … »,
  but the rehearsal room is deleted when `try` returns, so that command could never run. A try
  rehearsal now ends on its own line, which names the example and `nika compile --list`; workspace
  runs keep their explore line.
- **Refused type names state their status instead of a coming wave.** A `returns:` or `type:` naming
  `result`, `artifact`, `secret` or `money` was refused with « is reserved — lands with outcomes
  (W5) » (or W4, W-DEC). Spec 09 keeps only `artifact<mime>` reserved, never as a delivery claim,
  and withdrew the other three from the grammar. The refusal, still NIKA-TYPE-001, now says « is not
  a type — reserved by the spec and not implemented » for `artifact` and « withdrawn from the type
  grammar (spec 09) » for the others.
- **An unsealed journal now points at the run key, not at `nika sign`.** `nika trace verify` said
  « `nika sign` seals future runs » and the Session's `/proof` said « `nika sign` signs future runs ».
  `nika sign` binds a workflow file to its author; it never seals a run. Both now say that a run key
  (`nika key init`) makes later runs seal, which is what turns the next journal SEALED.
- **Secret teachings no longer offer the withdrawn `vault` source.** The refusals for a missing or
  unknown `source:` listed « vault · env · file », and the `secrets-store` hint said a `vault`
  secret would work « until vault resolution ships » and fail with NIKA-1702. Spec 01 §secrets
  withdrew `vault`, and the run reports the failure as NIKA-VAR-001. The teachings now list `env`
  and `file`, and the hint says `vault` is withdrawn from the contract and names NIKA-VAR-001. A
  `vault` secret still parses as before.
- **The welcome screen and the access errors no longer advertise a Nika Cloud.** `nika welcome`
  said « Local first. Cloud when you want it. » and « Coming: Nika Cloud · our models, our tools, your
  workflows online. », and its envelope listed an unavailable `cloud` rung; access errors told the
  person to « pick Nika local / Nika Cloud ». There is no hosted Nika service: the screen now opens
  with the README's « Say it once. Keep it as a file. », the cloud rung is gone, and the errors
  point to an API key or a local engine (`nika doctor --verbose` lists them). The featured local
  model is described as open weights that need no API key, not as « ours » or « free » (a local
  model is unpriced).

### Security

- **Big-integer arithmetic is past its October constant-time advisory.** `crypto-bigint` 0.7.6
  keeps subtraction, zero counting, division and Montgomery multiplication free of secret-dependent
  branches (RUSTSEC-2026-0387), in the workspace and fuzz lockfiles.
## [0.123.0](https://github.com/supernovae-st/nika/compare/v0.123.0-preview.1..v0.123.0) - 2026-10-23

Nika 0.123 is the open-source reference release of Nika: the Rust engine, the `nika` command
line and its terminal workspace, and a TypeScript SDK (`@supernovae-st/nika` 0.123.0) that runs
`.nika` workflows from an application. After this release the project is maintained: security
fixes, bug fixes and compatibility. No hosted service is planned.

What it does:

- **Say it once, keep it as a file.** Describe an outcome in the terminal workspace (`nika`);
  Nika asks only for what is missing, writes a `.nika` workflow, checks it and, where it can,
  rehearses it on a copy of your files before you save or run anything.
- **Audited before it runs.** `nika check` reads the whole file first: the effects it may
  perform and nothing else (`permits:`), where secrets go, literal credentials, cost estimates
  and the lethal trifecta, and it names the repair where it knows one.
- **Metered and recorded while it runs.** `--max-cost-usd` caps a run, every run is recorded
  under `.nika/traces/`, and a run paused at a human gate resumes with the person's answer.
- **Scheduled by your own machine.** `nika arm` emits launchd or systemd units, with an env file
  for the provider keys a scheduled run needs.
- **Your choice of model.** The workflow file names its model, and Nika never substitutes
  another one silently.

Known limits are listed in plain words, each with a way around it:
[Known limits in 0.123](https://docs.nika.sh/changelog/known-limits). In short: a rehearsal
does not call models and replays only plain GETs of pages already observed; writing a workflow
with a large model can take minutes; the terminal mixes English and French lines; the VS Code
extension stays at 0.120; scheduled runs need your keys in an env file.

The changes since the 0.123.0-preview.1 prerelease follow; those from 0.122.0 to that
prerelease are in its own section of this changelog.

### Added

- **An ACP agent can lead a Session conversation with Nika's tools alone.** The harness opens
  one persistent session per conversation (`SpawnedHarness::converse`) and sends one prompt per
  user entry; the agent keeps the history and runs its own loop with no turn limit. Claude Code
  gets the audited one-shot surface without `maxTurns` (no built-in tools, strict MCP, no
  settings, plugins, skills or agents, nothing persisted, summarized thinking) and exactly one
  MCP server, Nika's; Codex mounts it from its configuration, read back before the spawn with
  every other server disabled. The transport follows the agent's advertised HTTP MCP capability
  and is recorded; an agent that cannot mount what Nika offers is refused, never sent down the
  one-shot path. Only Nika's own tools are allowed, once; every other permission is rejected and
  recorded. Stop sends `session/cancel` once per turn, and each turn ends with its activity
  record, where tool frames are expected activity.
- **An admission tariff can name the dated models its provider serves, and a
  cache-write rate.** `nika/inference-admission@1.2` adds two optional fields.
  `served_models` lists the models the provider's own documentation names as
  served for the selected model (a dated snapshot its replies report): a reply
  naming one of them answers that same route at settlement, in a restored
  checkpoint and in the per-dispatch record, and any other name leaves the
  charge unknown. `cache_write_nano_per_token` prices input written to the
  provider's cache, and a write rate above input reserves the whole context as
  written; a tariff without it leaves a call that wrote the cache unknown, now
  at settlement as well as in the per-dispatch record. No current row uses
  either field. Pricing observations name `table_schema` `@1.2` and a
  `cache_write_rate`, and records written under `@1.1` still read.
- **Claude Sonnet 5.5, Opus 5.5, Haiku 5.5 and Fable 5.1 are admitted on the direct API.**
  Each row reads Anthropic's pricing page of 2026-10-15: input, output, cache hit and
  5-minute cache write, a 1M window (Claude Haiku 5.5 up to its 100,000-token lower
  tier) and 128K output. The model choice offers the four first for an Anthropic key,
  Sonnet 5.5 leading, each with its admitted output price. A Session allowance still
  refuses a Claude author until the Anthropic wire settles bounded calls: a qualified
  route is never sent in another wire's shape.
- **Anthropic requests ask for prompt caching.** A conversation, or a request with tools,
  now carries the automatic cache marker (five minutes) and a breakpoint on its last tool,
  so a later turn reads its prefix at a tenth of the input price. A one-shot request sends
  no marker, since a cache write costs a quarter more than the input it holds, and a
  request that names its own `cache_control` keeps it unchanged.
- **`nika arm --emit <OS> --beat <label>` emits one schedule's unit.** With `--write`, only that
  beat's unit is written, and every other beat's unit stays as it is. Another beat that could not
  arm no longer refuses the emission. An unknown label refuses with the labels `nika.yaml` gives.
- **An authoring call's receipt says how many requests it sent.** Each
  authoring call in a compile's receipt records `requests_sent`, read
  from the provider's own record of its dispatches: a call that left
  twice says two, a call its deadline cut says one, and a harness route,
  which counts its own invocations, says nothing.
- **A kept run says whether it ran a component of saved bytes.**
  `KeptRun::component_run` reads a journal's frames of the run's own execution:
  its one start must name the hash of the exact saved bytes, and each of the
  component's tasks is settled by that execution's frames alone (`completed`,
  `skipped`, `failed`, `recovered`, `cache_hit`, … or `absent`). The run's exit,
  the last start a journal holds and a child run's task of the same name never
  stand in for it; what the frames cannot attribute is `Unknown`, with why.
- **A new conversation in the same project.** `/new`, and `SessionRuntime::begin_new_conversation()`
  for hosts, seal the current conversation beside its journal under a dated name and start the
  next one empty. Nothing is deleted, and its receipts and any unknown charge stay on record. The
  project's workflows, schedules and runs, the chosen intelligence and a paused run's gate carry
  over, and the Session says so. Nothing begins while a decision waits for the person or a run is
  under way. A restart resumes the new conversation.
- **A run is told the instant it serves.** `${{ run.scheduled_for }}` reads the slot a
  `nika arm fire` or a `nika serve` schedule fired the run for, the instant
  `nika test --at <instant>` names, or else the run's own start, as RFC 3339 UTC. The
  run's opening frame journals it with `scheduled_for_source` (`slot` · `at` · `start`),
  and a child workflow the run calls serves the same instant. Under `manqué:
  rattraper-une-fois`, `${{ run.missed }}` reads the silence a catch-up covers, `{ first,
  last, count }` (journaled as `missed`), and null otherwise. A `nika serve` catch-up's job
  carries that silence on its schedule origin as `missed_first` and `missed_count`.
- **A run's result says the ceiling it was admitted under.** The result of a run said its cost
  but not the most it was allowed to cost, so asked whether her $0.10 ceiling held, the
  conversation answered that it could not tell which ceiling applied and pointed to the trace
  file. The result now says « ceiling · $0.10 · the most this run was allowed to cost », read from
  the run's own start frame, and the conversation is told the same.
- **A Session can speak the host's language before the person writes.**
  `SessionRuntime::with_initial_language` takes the host's guess from its locale. The restored
  notice and `/status` then read in French under `fr_FR` from the first screen. A line the
  person types, or one a restored conversation kept, still decides. The restored notice is now
  said in the restored language. A turn that parks with nothing to ask says how to go on,
  rather than showing an empty question.
- **A knowledge release can carry a block proven on recorded worlds.**
  Profile r2 admitted a block only as `CHECKED`, so a block whose
  outcome was qualified on recorded worlds could not say so. A block may
  now claim `OUTCOME_PROVEN`. Its check receipt stays bound as before,
  and an `outcome_receipt` binds the same bytes, the target's
  specification and the target binary to its worlds: at least one, each
  judged `OUTCOME_CORRECT` and run at least once. Releases that do not
  claim the level are admitted unchanged.
- **`manqué: { rattraper: N }` fires the N latest missed slots.** A `nika serve` project beat
  declared with the bounded catch-up fires up to the N latest missed slots, one run each,
  oldest first, each run told only its own slot; the older slots are skipped first, journaled
  once. `nika check` reads the form (N a whole number from 1, `{ rattraper: 1 }` being
  `rattraper`); `nika arm` refuses it by name, as it refuses `rattraper`: catch-up is served.
- **The catalogue lists current Anthropic, OpenAI, DeepSeek, xAI and
  OpenRouter models, each with the source and date of its limits.** Claude
  Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 (1,000,000-token window,
  128,000 output tokens), GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna (1,050,000
  and 128,000), DeepSeek V4 Pro (1,000,000 and 384,000), Grok 4.7 and Grok 4.3
  (500,000 and 1,000,000-token windows; their output caps are OpenRouter's
  listing, xAI publishes none), and the five admitted OpenRouter routes at the
  smallest window and output of their endpoints. Every admitted route now
  reads a dated window and output cap. Claude Haiku 4.5's output cap is
  corrected to 64,000 tokens (it read 8,192), from Anthropic's model page.
- **The provider catalogue records where a model's limits were read and when
  its provider retires it.** `nika/llm-providers@1.2` lets a model row carry
  `limits_source` with `as_of`, and a `lifecycle` (`retires_not_before`,
  `successor`, `source`, `as_of`) whose successor is another model of the same
  provider; `nika_catalog::model_facts` returns them. Two nicknames may name
  one model only as aliases with identical limits and facts. Rows without
  these facts keep their exact shape.
- **`nika-catalog` states a model's output facts.**
  `model_output_limit` returns the output limit the catalog records with
  where it is recorded, `generated_cap` the cap a caller generates for a
  reasoning model within that limit, and `output_caps` the facts an
  authoring seat reads before it writes (reasoning recorded or not, the
  documented effort levels, the suggested cap). `nika-compile` now reads
  them there; no record changed.
- **The catalog records how a model reasons, and what a `.nika` file can do about it.**
  `ModelCapabilities.reasoning_facts` says, per capability rule, whether the model reasons
  when the request names no reasoning control, whether that reasoning is spent inside the
  output cap, and how a `.nika` file turns it off on this engine (`ThinkingOff`: by default,
  a zero thinking budget, not reached, or never). DeepSeek Flash and V4 Pro, Gemini 2.5
  Flash and Pro on the Gemini API, and Claude on Anthropic's API carry recorded facts; every
  other model stays unknown rather than assumed. Tests pin the facts to what each wire sends.
- **A conversation's workflow can be verified like any compiled one.**
  `verify_document` verifies a document a Session conversation wrote
  exactly as the compiler verifies its own candidates: the fidelity laws
  over the world the host observed for the request, the core's finish, a
  run in the room when the host lends one, then the whole-request verdict
  of the permitted judge (a decision model, else the authoring model),
  never asked again on bytes it rejected. It is ready only on that
  verdict: a doubt nothing located is held, a located defect keeps the
  workflow as the preview with what to repair, and with no judge the
  request stays pending.
- **A dropped value needs words that remove it, as the judge reads them.**
  When a conversation's revision drops a value an earlier proposal bound
  (a source, an output), the Session cites the person's words that remove
  it. Those words were only checked to be the person's: « I wanted
  today's articles » could drop a source no one asked to change. The
  verifier now asks its judge, for each such claim, whether the words
  remove that value; a claim it does not confirm keeps the workflow from
  being proposed, and the conversation is told which value to keep or
  ask about.
- **The decision seat's journal says how long each request took.** Every
  System One request that left, a single question or one request of a
  batch, now records `elapsed_ms` in the Session's decision-seat
  observation (`nika/session-decision-seat@2`, additive): the time its
  transport took, measured by the host. A request never sent records none.
- **`nika doctor --json` states its scope.** The report carries
  `"scope": {"mode": "audit-wide"}`: it audits the machine as a whole. A
  question about one workflow stays with `nika check`.
- **A draft read whole runs at its model's documented low effort.** When
  every model step of a request is a draft (write, summarize,
  translate), the reader admits the request whole with no constraint
  beside it, and the model's exact catalog row documents a `low`
  reasoning effort (DeepSeek Flash and V4 Pro today), the compiled
  workflow declares `run.reasoning.effort: low` and the proposal says
  so. On Flash, one measured 16.7k-token summary spent 83% of a
  16,384-token cap reasoning at the default effort and 69% at low; at
  the default effort the same step had ended with no answer. A
  candidate that already declares an effort or a route keeps it, and a
  model-written candidate gains one block, never a reformatted file.
  The level reaches only the model's exact direct route: behind a
  base-URL override (a gateway), every request that carries it is
  refused with nothing sent.
- **What a workflow reaches reads in French.** A French proposal card showed « à l'exécution ·
  model output estimate · unbounded: `grade` declare(s) no `max_tokens`; Run admission is
  separate » and « connected: anthropic/claude-sonnet-5-5 (remote model) ».
  `nika_display::check_render::review::effect_row_fr` says each row `effect_rows` writes in
  French, and `World::summary_fr` the reach summary. Paths, hosts, tools, models, tasks and
  amounts stay as written. A row they do not know is returned as it is.
- **`egress/001` warns about a private key in a prompt.** A `prompt:` or
  `system:` text holding a PEM private-key block (a line
  `-----BEGIN … PRIVATE KEY-----`) is a credential bound for the model
  provider: the linter flags it and the check verdict lists it in
  `hints[]`, on inline text and on the text of a prompt file alike, where
  the door read that file. It refuses nothing and never repeats the text;
  a secret the provider needs belongs in `secrets:`.
- **A finding has a canonical key a host can compare across revisions.**
  `fidelity::keys::finding(kind or target, message)` keys a finding on
  its kind, its law's head and the subject it quotes, for example
  `conversation:invented-literal:./news/digest.md` or
  `semantic_verification:write the digest`. A Session can tell whether
  the same defect still stands on a new revision without comparing
  prose: rewording or an appended remedy keeps the key, and another
  subject or another law changes it. No finding's target changes.
- **A harness authoring call's record tells thinking from answering.** The
  `activity` of a terminal ACP authoring record now also says when this
  session's first thought and first answer arrived (`first_thought_ms`,
  `first_answer_ms`) and which update it received last, by its closed word
  and time (`last_update`), each null before any. A receipt can now say a
  call was silent until its first answer, or that its last update before a
  silence was a thought. The fields are additive; counts, deadlines and
  acceptance are unchanged, and no frame text is kept.
- **Hosts name a zone as the Session does.** `nika_session::zone_words` (« heure de Maurice »,
  "Mauritius time") and `nika_session::zone_place` (« Maurice », "Mauritius") give a host the
  words the Session itself uses for a schedule's zone, so a run list and a cadence never name the
  same zone two ways.
- **Hosts read a declaration's schedule in words.** A candidate that declares a schedule in
  `nika.yaml` carries `Candidate::schedule` (`ScheduleWords`) in the person's language: when it
  runs, what a missed run does, and its ceiling per run. A host shows these words instead of
  the cron. The work snapshot's compile draft is kept only while one of that compile's own
  questions waits, so a host never shows a draft beside another question.
- **A declared schedule can be installed on this Mac from the conversation.** Once a schedule
  lands in `nika.yaml`, the terminal Session asks « Installer le déclencheur sur ce Mac ? ». The
  question names the workflow, its cadence and zone, the missed-run policy, the ceiling per run
  and the effect (one launchd unit run by the program that wrote the workflow). « Installer et
  activer » writes the unit as `arm --emit launchd --write` does, loads it and says when it runs
  next. « Garder déclaré seulement » installs nothing, and « désactive-le » unloads and removes
  it. Nothing is installed without that yes. Hosts other than the terminal on macOS keep the
  schedule declared, as before.
- **The embedded knowledge release is r3, the Foundry enrichment.** It adds 16 families,
  14 facets, 23 packs and 83 patterns written in the studio's own words. A family now
  recommends its packs, so the door's family, pack, pattern and block path reaches the
  qualified blocks (`feeds-items-on-local-date`, `json-threshold-report`).
  The r2 release it replaces stays embedded for earlier pins, which reopen its exact bytes.
- **`nika-mcp` serves a Session's tools to the agent leading its conversation.**
  `conversation::ToolServer` lists the session's `nika/author-tools@0` definitions and relays
  each call of a listed tool to the session over Streamable HTTP, bound to `127.0.0.1` on an
  ephemeral port with a bearer minted for that conversation alone and always required. A tool the
  session does not list never reaches it; a failed call returns `isError: true`. Connections are
  served side by side under the same bounds as `nika mcp --http`, and the session receives one
  call at a time. The server interprets nothing and grants nothing. A stdio bridge to the same
  server exists as a library; no CLI starts it yet.
- **A pinned `mcp:` step is judged against its approved schema.** Once the
  project registers the server, approved its pins under the command,
  arguments or URL the registry names now, and the pins hold the tool,
  `nika compile` judges an `invoke:` step's literal arguments against the
  pinned input schema (an argument a template builds is wired, the run's to
  judge) and records each verdict on `decision.mcp`, without reaching the
  server. A registry re-pointed after its approval keeps the hold until the
  server is approved again, as the run's own verification requires. The
  served compile door judges the same step on the server project's pins and
  records the verdict, but keeps the step held: that server runs no MCP
  step. Any other answer keeps the source-only hold, in words that say what
  to do; permits stay the only authority over what a step may do.
  `nika check` advises, without blocking, on a registered server whose pins
  were never approved or do not hold the tool.
- **An agent can list the models each role can use and have its pick
  validated.** `nika_providers::model_choice` keeps separate offers for
  the Run, Author and decision roles, built from this machine's routes
  and the catalogue, and answers a selection with one exact target, a
  delegated pick with its rule, a targeted choice, or an exact refusal
  with real alternatives. No id is invented and no closed provider,
  route or protocol is changed.
- **`nika check` names a model's published retirement floor and its
  successor.** A workflow on `anthropic/haiku` or Claude Haiku 4.5 still
  checks clean, with one advisory line under the green MODELS line: Anthropic
  does not retire it before 2026-10-15, and `claude-haiku-5-5` is available to
  name. The nickname keeps its model; nothing switches silently.
- **OpenAI's GPT-5.2, GPT-5 mini and GPT-4o mini are admitted on the direct API.**
  Each standard-tier row reads its model page of 2026-10-12: the input, output and
  cached-input prices, the context window and output cap, and the dated snapshot
  OpenAI's replies report (`gpt-5.2-2025-12-11`, `gpt-5-mini-2025-08-07`,
  `gpt-4o-mini-2024-07-18`), which settles the same route. The pages list no
  cache-write price, so a call that wrote the cache stays unknown. GPT-6 direct
  rows are not admitted.
- **An OpenAI conversation keeps its prompt cache together.** A request can name the conversation
  it continues (`InferRequest::cache_key`, a hash of the conversation's id); the OpenAI wire sends
  it as `prompt_cache_key`, so one conversation's calls route and account their cached prefix
  together. Other providers ignore it, and a caller's own `prompt_cache_key` stays unchanged.
- **Five paid OpenRouter routes are admitted.** GLM 5.3 Flash, MiMo V2.6 Flash, Step 5
  Preview, HY4 Preview and GPT-6 Luna have exact admission tariffs read from
  OpenRouter's endpoint listings of 2026-10-12: the highest price of any endpoint, the
  smallest context and output limit, and, for GPT-6 Luna, an input bound below its
  long-prompt surcharge. A Run no longer needs an unknown-cost choice for them, and a
  Session can reserve them.
- **`prompt:`, `system:` and `schema:` can name a project file, and
  `nika check` judges it.** `{ file: <path> }` resolves from the folder of
  the workflow that names it, stays inside the root workflow's folder, and
  is read only inside that workflow's `permits.fs.read` boundary, never
  through a symbolic link: a broken path law is `NIKA-FILE-001`, a missing
  file `NIKA-FILE-002`, more than 65,536 bytes or bytes that are not UTF-8
  `NIKA-FILE-003`, a schema file holding no JSON Schema `NIKA-TYPE-007`.
  The text or schema read then meets every law the same field written
  inline meets, in a composed child too, where each finding names the
  child, task, field and path. A door without the files names them as
  unread (`judged.project_files: false`). No run carries project files
  yet: `nika run`, `nika test` and a captured world refuse such a workflow
  before any task, and the runtime refuses a file no compose step read,
  at launch and at the `infer:` or `agent:` dispatch.
- **An unstable build trims the authoring prompt for evaluation.** The
  `unstable-prompt-trims` feature of `nika-compile-seats`, off by default,
  makes the document door show the language's schema without its
  descriptions (29,749 bytes compact, 9,705 without them). It also narrows
  the callable contracts to what the reader's typed plan reaches: `fetch`
  only for a fetched, looked-up or explored source or an outbound effect,
  `convert` for a computation, `prompt` for an approved effect, `notify`
  for a sent one. A default build sends the whole prompt, as before; the
  feature exists so an evaluation can measure authoring quality with and
  without the trims.
- **An Anthropic key can be checked on request, without running a model.** `check_key` (and
  the Session's `check_api_key`) sends one GET of Anthropic's model list with the key, its
  API version and the endpoint a run would use (`NIKA_ANTHROPIC_BASE_URL` honored). It
  answers valid, refused (401 or 403, in the provider's words with the key withheld),
  unreachable or unknown, spends no token, never follows a redirect or retries, and runs
  only when a person asks. Another provider answers unknown without a request: an
  OpenAI-compatible model list may answer without a key, so it would prove none.
- **A trial run shows what each step received and returned.** A host's
  rehearsal report can carry each task's flow, the items it received
  and returned. The verifier is shown it with the trial's outputs, a step
  that returned nothing from a non-empty input marked, so a filter that
  kept no item of today's news is a fact the verifier weighs; a host's
  card can show a passing trial's flow.
- **A rehearsal runs `nika:validate`.** A candidate that checks data against a JSON
  schema is tried in the room before its proposal, instead of being refused as a
  tool the rehearsal does not know; the check reaches no network and no file.
- **`nika check` reads the facts of the run.** `${{ run.scheduled_for }}` and
  `${{ run.missed }}`, the closed set of facts the engine tells a run, resolve in
  every value position and in `when:` and never make a data edge. Any other
  `${{ run.X }}` is an unresolved reference (`NIKA-VAR-001`) whose message names
  the two facts; a near miss (`run.schedule_for`) is offered as its rename, a
  typo'd root is offered `run`, and `${ run.missed }` or
  `{{ run.missed }}` without `${{` is caught as for the other namespaces.
- **A schedule's history says its firer, its last skip's reason and its catch-ups.**
  `ScheduleHistory` now says whether a resident `nika serve` holds the project's server lease
  (`serve_running`), and when the unit was last disarmed and how many runs fired since
  (`last_disarmed_at`, `fired_since_disarm`). `LastDecision` now carries a skip's reason
  (`missed:1`, `overlap`) and the slots a catch-up run answered. Both types have `new()`
  constructors. The unit's presence is asked of the Session's trigger host.
  `nika_cadence::ledger::decisions` returns each decision with its instant, reason and slots.
- **Activation offers its ceiling and missed-run policy as choices.**
  `SessionRuntime::waiting_activation_choices` states the activation's
  finite question (its sentence and one short line, its options, and
  whether another typed value is admitted). The ceiling per scheduled run
  offers 0.10, 0.25, 0.50 and 1.00 USD, recommending the smallest that
  holds about three times the workflow's last observed run (its trace's
  total) and 0.25 when none was observed, with why in the label. Another
  amount is still typed, the same grammar validates every answer, and no
  amount is ever applied without the person's answer.
- **The selected intelligence leads the Session's conversation.** With an API or a local route,
  a person's line now goes to one loop over that model and the Session's tools
  (`nika/author-tools@0`): it reads the project and the language, writes and edits the candidate,
  asks several questions together with their own identities, and proposes. Every value the
  candidate binds carries its provenance (named, delegated, derived, answered, offered or kept)
  checked against the person's own cited lines; a value they saw bound is never dropped
  silently; a reopen keeps the values and their provenance, never a question or a proposal.
  Saving and running stay the consent door's acts: the person's words open it only for the exact
  candidate they were shown, and a candidate whose effects changed waits for their consent.
  `NIKA_SESSION_DRIVER=rounds`, read when a host door opens the Session, keeps the round driver
  during the transition.
- **A Session host answers one question by its identity.** Both Session doors take `answer`
  (`command`, `snapshot`, `question`, `line`) and `delegate` (`command`, `snapshot`,
  `question`) and advertise `sessionQuestion`: a client that read several questions asked
  together, or the choices a proposal shows, binds its reply to the one it names and the others
  keep waiting, where a plain line answers every question whose offers it names. The host takes
  the identity only among those the current snapshot asks (`unknown_question` otherwise, with
  nothing sent), and `delegate` leaves that choice to Nika as the person's act, never as words.
- **Every model and tool call of a Session turn reaches the host.** The
  conversation's model requests are activity frames naming their rank in
  the turn, the route asked, when they left, how long they took and the
  tokens the provider reported; tool calls also name when they began and
  their reply's size. Neither carries a prompt, an answer, arguments or a
  reply.
- **A conversation's candidate is tried before it is shown.** Each public
  GET source the candidate names is observed once for the conversation
  through the guarded observer (no credentials, no private address,
  bounded), and the observed room replays those pages to a run of the
  candidate where nothing leaves: a GET of exactly an observed address is
  answered with its page, every other request is refused. A step the trial
  cannot run (a model step, a request other than GET, an effect outside
  the room) is named, never run as itself. A failed trial, or a filter that
  keeps nothing of the items it read, goes back to the author with its
  facts before any proposal; a passed trial is bound to the proposal, which
  says what it ran on and what it did not run.
- **A Session conversation proposes only a workflow its judge found
  ready.** Every `verify` and `propose` of the conversation's candidate
  now faces the verification a compile round of the same request faces:
  the laws over the files the request names, then the whole-request
  verdict of the Session's judge (its decision model, else its authoring
  route; a seat's agent judges through its own one-shot). Anything short
  of ready goes back to the author with the findings, and nothing is
  shown. A verdict that declined some bytes is kept for the conversation
  and never asked again on those bytes, and a ready verdict on unchanged
  bytes, words and selections is reused.
- **A conversation's run can be steered, stopped and watched while it works.** The Session
  host (`nika/session-host@1`, both doors) gains `steer` and `follow_up`: a line sent while a
  turn of the conversation runs is queued with its identity (`l1`, `l2`, …) and shown in
  `busy.queued`, then enters after the calls under way (an ACP agent is asked once to stop) or
  when the run would end, as the person's next cited line; a line no run reads is refused,
  never kept for later. Stop of such a turn now settles as the typed outcome `stopped` (how it
  reached the intelligence, the lines returned unsent, the draft kept). Each tool the
  conversation's intelligence calls reaches the event stream as typed activity (call, tool,
  started/finished/failed, elapsed), never its arguments. On `nika/session-work@0`, additively:
  `queued`, and a `choice` on each offered model this machine's inventory knows (route,
  billing, list price).
- **One edit call, several passages.** `candidate_edit` takes `edits`, a list of old and
  new passages applied as one revision: each old passage is found exactly once in the
  candidate and none overlaps another, so an author repairs several places in one call.
- **A failed run goes back to its author.** When a run the person asked
  for fails, the author receives the run's facts and proposes the repaired
  revision with what changed; a complaint about a run's result starts the
  same repair. The repaired revision runs again only on the person's words
  or consent. A revision that replaces a value the person saw bound says
  so in words.
- **A failed tool step says why.** The Session's activity frame for a
  tool call that failed carries the tool's reply (`tool.reply`) as a host
  may show it: its obvious secret shapes redacted first, on one line, at
  most 512 bytes. A call that started or finished carries none, and no
  frame carries a call's arguments.
- **A gate shows its values, structured.** A run paused at a
  `nika:prompt` gate journals the values its message renders as one
  object (`values`), bounded, and names the keys it withheld with why
  (`withheld`: a value derived from a secret, one past the bound, one
  that did not resolve). A Session's gate outcome carries both beside
  its text, so a host or a consent review binds the exact values shown.
- **The Session host's activity frames say what each finished call cost.** An activity frame's
  `call` now carries `cost` once the call returned, as the Session settled it:
  `{"kind": "priced", "nano_usd": "120000000"}` (nano-USD at list price, as a decimal string: an
  estimate, never an invoice) or `{"kind": "unpriced"}`. It is absent while the call runs, when
  nothing settled, and when its producer states nothing. A host can sum the priced calls for a
  live preparation cost, as the terminal does. The published contract now describes the frame's
  `call` (`SessionCall`) and its `cost` (`SessionCallCost`).
- **Intelligence options state each model's prices, context and lifecycle.**
  Every option naming a model now carries typed facts for any host:
  `ModelFacts` gains `input_usd_per_million`, `context_tokens` and `legacy`
  beside the output price, from the route's qualified tariff or else the
  catalogue's list row on a metered route. Unknown stays absent, never
  zero; nothing is selected or called by stating them.
- **The intelligence picker recommends one model.** While the choice is
  open, `Work.intelligence.recommended` names the option recommended for
  the conversation: the operator's saved default when this machine serves
  it, else the default model of the first configured provider in catalogue
  order (an Anthropic key yields Claude Sonnet 5.5). It selects nothing.
- **The bytes a verification judged are kept.** A conversation's Session keeps each
  candidate its verifier judged, redacted and bounded, in its history as
  `verified/<sha256>.nika`, the digest its verify record names, so a hold can be
  checked after the candidate is rewritten.
- **A proposal shows its open choices with their defaults.** When the author
  can recommend a value the person left open, such as the run model or an
  output folder, it writes the recommendation in the candidate and proposes
  at once, showing the choice with its default and the other options
  instead of asking first. The person's yes keeps every default, bound as
  the option they picked with that line; naming another option binds it and
  the author revises; nothing is saved while a choice the proposal does not
  show is open. The author tool contract is `nika/author-tools@1`.
- **After a result, an optional « what would you like to adjust? ».** When a run of the workflow
  the conversation proposed succeeds and writes its result, the terminal offers, at the free
  prompt, the dimensions that workflow's own tasks have (depth, length, topics, sources,
  presentation), « Nothing to change » and « Later ». Picking dimensions asks Nika to ask only
  what is still missing and propose an amended workflow, approved as any other; the run of a later
  revision of that same request then offers one neutral opinion (suitable for this use, still
  needs changes, wrong result, not evaluated yet, later), with no default. Only a choice selected
  in the offer answers it, and only while nothing else waits: words typed instead always go to the
  conversation, whatever they read as; asking for a run or the next run closes the offer, the same
  workflow bytes are never offered twice (a reopened conversation included), and Esc answers
  nothing. An answer changes nothing by itself: it is kept with the exact request, revision, run
  and files it is about, never as a permission to save, run or send.
- **A conversation can switch its decision seat and save its default.**
  `choose_decision` makes Jev (only the seat the host named) or the author
  alone consult the next turn's finite choices; the author alone clears a
  refusal the earlier seat caused, and an unavailable Jev is refused with
  its reason. `save_operator_default` writes the kind, model, decision seat
  by name and time to `~/.nika/session-intelligence.json` atomically, never
  a key; a default saved deciding alone opens new conversations that way.
- **A Session Stop now reaches the Run it handed off.** While a `save & run`
  or a run line executes through the native door, a `stop` command asks that
  Run to stop at its next wave boundary, as a first Ctrl-C does: the work in
  flight completes and is counted, the next tasks are cancelled and the trace
  seals one cancelled terminal. A Stop that arrives before the run child
  exists is applied when it starts (before the spawn, nothing starts). The
  receipt says `stop_requested` until the Run takes the signal and
  `run_stopping` once it has; the snapshot's phase reads `stopping`; the
  result adds `run_stopped` when the trace sealed, `run_aborted` when the Run
  ended without sealing it, and the work snapshot's run gains `sealed`, so an
  interrupted run that stopped is told from one cut mid-flight. A replayed or
  second Stop sends nothing more and never escalates to an abort. A door that
  cannot stop its runs (the resident's job door, for now) still answers
  `run_underway`.
- **The last run a Session keeps names its job, its receipt, its outputs and its verified seal.**
  For a run `nika serve` ran, the kept run now records the job it ran as, the receipt and the
  declared outputs that job serves (kept whole up to 16 KiB encoded; larger ones stay with the
  job, at `GET /v1/jobs/{id}`), and whether `nika trace verify` accepts the journal's
  `run_sealed` record and its signature (`seal_verified`, `signed`), never a seal read from the
  receipt's chain head. Forward
  compatibility: these parts are written only for served runs, and an engine older than this one
  reports such a kept run as unreadable and keeps its bytes unchanged, so nothing is lost; the
  kept value of a native run is unchanged.
- **Both Session doors advertise `sessionSteering`.** The native identity
  (`nika --sdk-identity`) and a resident serving Sessions (`/health`) name
  the word beside `sessionHost` and `sessionIntelligence`, so a client tells
  a door that takes `steer` and `follow_up` from an older one, and refuses
  those lines itself, before it sends one.
- **One contract for the tools a Session serves.** `nika_session_change::tools` types the
  `nika/author-tools@0` tools once for Nika's own agent loop and for an ACP agent reaching them
  over MCP: the 17 fixed tool names, `ToolDef`, `ToolCall` (with the caller's tool-use id),
  `ToolReply` (text, failure, and whether the turn ends on it) and the `SessionTools` trait the
  Session implements. It grants nothing: saves, runs and consents keep their own doors.
- **A proposal's activity carries its original verification records.**
  The activity of a successful `propose` tool step carries a separate,
  versioned `tool.verification` receipt: the compiler's semantic
  verification records for the candidate it shows, unchanged, with the
  candidate's digest and whether this proposal reused an earlier
  verification. A receipt the secret-shape filter would alter is withheld
  whole, and no other tool step carries one.
- **The work snapshot carries a conversation's values, delegations and questions.**
  `nika/session-work@0` gains, additively, `bindings` (each value, its role and its provenance
  with the person's citation and words), `delegations` and `questions` (each with its identity,
  open or waiting for its prerequisites, and the concrete values its options carry), and
  `waiting.kind: questions` when several questions are asked together. A snapshot without a
  conversation keeps its bytes.
- **A Session snapshot says how long its knowledge and trial stages took.**
  `work.authoring.stages` now carries, as the compile's decision record
  states them, the wall time of the Foundry knowledge qualification
  (`qualification_ms`) and each trial of a candidate in order (`trials`:
  how far it went, `elapsed_ms` and the host's `runtime_bound_ms`). The JSON
  door and `/v1/sessions` carry it unchanged; a time the record does not
  state is null, nothing is summed, and no output or failure text passes.
- **A System One request can write its options in a chosen order.** `system_one::body` serializes
  a request with each question's criteria in an `Order`: `Alphabetical` (today's bytes exactly),
  the question's own order, or its mirror, the pair a both-order reading averages. Nothing sends
  it yet: requests keep today's alphabetical order until the both-order setting lands.
- **The Session reads each schedule's history, and journals its removal.**
  `SessionRuntime::schedule_history()` returns every schedule `nika.yaml` declares, with how many
  runs its arm ledger records as fired, skipped, paused, failed or disarmed, its last decided slot
  and whether this Mac holds its unit. Reading it creates, locks and repairs nothing.
  « désactive-le » now journals a `disarmed` decision in the schedule's ledger and says so.
  Installing a trigger from the conversation installs that schedule's unit only: a schedule kept
  declared stays without one.
- **The Session says its own sentences in the person's language.** Every French-speaking person
  met English questions and cards between the author's French answers. The Session now reads the
  language of the person's own lines, English or French, and asks the activation questions (time
  zone, missed run, ceiling), proposes the declaration and says what saving and declaring did in
  it. A host reads it (`SessionRuntime::language`) to say its own words in it too.
- **The activity card a turn leaves in the workspace now uses the language you write in.** In
  a French conversation it reads « Terminé · en moins d'1 s · 1 appel auteur · routage de la
  conversation et appels du service de décision non comptés ». Its phases (« Compréhension »,
  « Génération », « Réparation ») and its call row (« appel 1 · planifier le workflow · demandé
  deepseek/v4 · revenu après 3 s ») follow too. What the Session reported, the model and the
  times stay as they are. The card's text from other doors is unchanged:
  `ActivityCard::lines_in` is a new variant that takes the door's words, and `lines` still
  says English.
- **The workspace's project list and header now use the language you write in.** In a French
  conversation the aside reads « Projet » and « Nika · Fichiers ». It names « cette
  conversation », titles its groups (« FICHIERS », « MÉMOIRE », « RÉGLAGES ») and states a
  workflow's verdict in French (« 2 constats », « non conforme », « run échoué »), and so are
  its counts, footer and notes. The header says « projet local », « pas de git · pas de
  nika.yaml » and « Préparer avec : » before the selected intelligence, or « non choisie ».
  Project names, paths, hosts and the intelligence's own words stay as they are. A click on
  « Fichiers » turns the list as « Files » does.
- **A finished run's card lists its steps, models and files.** Below a run's story, the
  terminal's card now opens on how the run ended in the theme's own state glyph (`✔ Ran in
  16.5s · 14 tasks · $0.034 · 1 model call`, `✖ Failed after …`), then lists each step
  with its glyph, wall time, model and cost (`✖ notify · failed: the webhook answered 500`
  in the failure colour, beside its words; `⊘ tidy · not run`), what each model cost and
  how often it was called, and every file the run reported writing with its path
  (`→ ./out/digest.md (write)`). A long run lists its first twelve steps and every
  failure, then counts the rest; unknown times, models or costs are left out.
- **One live line says what Nika does while it prepares or runs.** In the terminal, a turn
  that prepares reads `Preparing · 45s · 12 author calls · Ctrl+C stop`, then the Session's
  own phase words; a workflow the turn runs reads `Running veille-tech.nika · 12s · 6/14
  tasks · now: pick (claude-sonnet-5-5) · $0.012 of $0.25 · Ctrl+C twice leaves` (a Run is
  never stopped there). Its card opens on how it ended: `Ran in 16.5s · 14 tasks · $0.034 ·
  1 model call`. Outside the workspace, whose activity card already says it, a preparation
  that called its author ends with `Prepared in 2m 10s · 35 calls · $0.91`. Every fact is
  one the terminal observed (typed calls, the run's frames, its clock, the Session's known
  cost estimate after the turn); an unknown one is left out, never a placeholder, and the
  facts refresh at most twice a second. Hosts can report typed activity with
  `Seen::activity` and the spend with `Conversation::spend`.
- **A question that recommends an answer needs no typing.** The terminal opens such a
  question with the recommendation selected (each recommended answer checked in a multiple
  choice), marked `recommended`, so `Enter` alone accepts it; nothing is sent before that
  `Enter`. A « Let Nika choose » row follows the offers and leaves the choice to Nika as the
  person's own act, never words: the Session binds the recommended answer as delegated,
  whatever another answer's label reads, and on a choice a proposal shows that keeps the
  request's save and run. The own-reply field stays. Decisions, settings and the knowledge
  choice keep opening on nothing.
- **A source's address reads beside its name in a question's options.** When an option's
  label names a site or a data source and then its address after « · » (`TechCrunch ·
  techcrunch.com/feed`), the terminal paints the name first and the address dimmed in one
  column aligned over the list, beside `recommended` where the author recommends it; a
  narrow row cuts the address with a visible mark before it ever cuts the name. The ASCII
  glyph column keeps every fact.
- **`PgUp` and `PgDn` page through a long choice list.** In a question,
  decision or `/intelligence` list they move the selection eight rows at a
  time and stop at either end; the list follows the selection page by page.
- **Reception proofs for the choice surfaces.** The TUI prototype takes
  `--demo-surface intelligence|multi` and says back what it receives, and
  `qa_surfaces` proves at 80x24, 120x40 and 180x48 that a long model list
  pages, filters and applies the selected row, that `Esc` steps back
  without answering, and that a multiple choice validates with `Enter`.
- **Question options are counted, checked together and picked by their digit.** In the
  terminal, each of a question's first nine options shows the digit that selects it: with
  nothing typed yet, pressing that digit moves the selection there and sends nothing (once
  words are typed, digits are words, and the `/intelligence` list keeps digits for its
  expert route). A multiple choice counts `N of M selected` in its title, `Ctrl+A` checks
  every answer (or none when all are), `Space` still toggles one and `Enter` validates the
  checked set. The Submit row no longer repeats the count.
- **A decision's question and acts now use the language you write in.** In a French
  conversation the proposal's decision asks « Que faire de cette proposition relue ? » over
  « Enregistrer le workflow », « Enregistrer et lancer une fois », « Écarter cette
  proposition » and « Examiner les changements exacts ». The same holds for a run's cost
  decision (« Continuer ce run une fois ? », « Lancer une fois », « Annuler ce run »), a gate's
  acts, a schedule's and a run ceiling's way out, and the recovery of a drifted workflow. Every
  act keeps its key, so `yes`, `no`, `save & run`, `/show` and `details` answer as before. The
  Session's own questions and options stay as it says them, and English stays the default.
- **Digits select a decision's act in the terminal.** In a decision list (Save · Save and
  run once · Discard · Inspect, a gate's answers, a missed run's handling), each act now
  wears the digit that selects it, and pressing that digit with nothing typed moves the
  selection there and does nothing else; only `Enter` acts, once. A decision still opens
  with no act selected, and the `?` keys list the digits beside it.
- **The workspace says what a schedule's trigger fired, and the rail reads « Actif ● » only once
  a fire is proved.** At the opening and after each turn, the workspace reads the Session's history
  of each declared schedule's arm ledger (`SessionRuntime::schedule_history`, a read only) and
  says, once, what changed: « `compiled-workflow.nika` a tourné tout seul : 1 run par son
  déclencheur », its last slot with its exit and its trace, a slot caught up late (« son créneau
  … a été rattrapé à … »), and the slots skipped, the runs a gate parked and the failures. The
  list counts the runs fired under their workflow (« 1 run déclenché · 10-16 06:00 ✔ »). The rail's
  activation field stays declared (◐) until a fire of an installed, active trigger is proved,
  then reads ●, and goes back to declared once the trigger is removed.
- **Card names, band titles and the `?` keys overlay now use the language you write in.** In a
  French conversation a refusal's card reads « Impossible de continuer », your own messages
  are labelled « Vous » and a result « Nika · Résultat ». A decision's band is titled
  « Décision · obligatoire », and a question's card names the answer it takes (« Une réponse
  en texte »). The keys overlay lists every key in French under « Conversation », « Décision »
  or « Pendant que Nika travaille », its reader frame included. The Session's words inside
  every card stay as written, and English stays the default.
- **A held message shows its way on.** When the knowledge your
  configuration names is refused, the message Nika holds stays in view
  with the refusal and its two acts: `/knowledge embedded` resumes it
  once with the knowledge built into Nika, `cancel` drops it.
- **The TUI's hint row now uses the language you write in.** When the Session reads French in
  your lines, the keys under the composer are shown in French: « ↑↓ choisir · Entrée valide »
  at a decision, « Entrée répond · annuler l'abandonne » under a typed question, and
  « oui + Entrée : enregistrer · non : annuler » at a proposal. The same goes for the notices a
  key leaves (« rien n'est envoyé · tapez oui ou non… »), what a second `Ctrl+C` does, a
  proposal's standing and the composer's caption. The words the Session reads when you type
  them keep their form: `oui`, `non`, `annuler`, `details`, `save & run` and the slash
  commands. The Session's words, your words, values, paths and model ids are never rewritten.
  English stays the default and the fallback, and an ASCII screen shows the French without
  accents.
- **The whole-words reader opens the block at the reading position.**
  Scrolled back in the workspace conversation, `F2` (and its palette
  entry) opens the Session's own words of the newest block shown there
  short of whole: a summarized refusal, the current proposal, the question
  its card carries. A plain press on such a block opens the same words:
  the key and the pointer read the rows painting uses. Closing returns
  the exact rows, the draft and the keys. At the latest rows the question
  waiting comes first, then the latest such block, as before.
- **A fire while the workspace sits open shows without a keystroke.** About once a minute, while
  no turn or run is busy, the TUI reads the Session's schedule history again (a read only) and says
  a schedule's new fires as it says them after a turn: once, with the rail. Before, a fire while
  the TUI stood open stayed unsaid until the person typed something. `Options::idle_every` sets
  the period (`None` never asks); a conversation answers through `Conversation::idle`.
- **The workspace installs a declared schedule's trigger on your yes (D1).** On a Mac, in your
  own terminal, once « active-le » has declared a schedule in `nika.yaml`, the workspace asks
  « Installer le déclencheur sur ce Mac ? » with two rows, « Installer et activer » (recommended)
  and « Garder déclaré seulement », under the Session's report of what it wrote. « oui » writes
  and loads the launchd unit run by the program you use and says when it fires next (« Installé
  et actif · … prochain run : … »); « désactive-le » removes it. Nothing is installed without that
  yes; any other door, and every test, keeps the schedule declared and names the command.
- **Type a model's name anywhere in `/intelligence`.** From the home
  screen or the connection list, typed words now also find models by
  their display name under every connection (`son` finds Claude Sonnet
  5.5 under Anthropic), and `Enter` applies the one selected.
- **`/intelligence` opens on a short home screen.** The recommended model
  comes first and is selected, so one `Enter` applies it; then keep the
  current choice, other choices (every connection and its models), and the
  Author, Decision and Run roles with their values, each row opening its
  change: Jev or the author deciding alone for decisions, and the model for
  the next workflows' AI steps, told to the author. `Set as default` keeps
  the choice for new conversations. `Esc` steps back one list at a time.
- **`/intelligence` names the key a provider uses and can test it.** API
  rows show the variable that supplies the key (`key: ANTHROPIC_API_KEY`)
  and warn when two set variables differ, naming the one Nika uses. A
  `Test the key` row on the current or opened API connection sends one free
  model-list request only when you pick it and shows the verdict inline
  (valid, refused, unreachable, unknown); the key is never printed.
- **Models in `/intelligence` read by name, with prices and context.** A
  model row now shows a display name (`Claude Sonnet 5.5`, `GPT-6.1 Sol`,
  `DeepSeek Flash`) and, in a quiet aligned column, its current and legacy
  marks, its input and output prices per million tokens when known, its
  context window and a key it still needs. Typing filters on these words
  too; the key sent is always the exact model id.
- **Type to filter the `/intelligence` lists.** Typed words narrow the
  rows to those holding every word, case aside; the first match is
  selected and `Enter` applies it. Words that match no row are sent as
  typed, so `/intelligence 2 provider/model` still works for an unlisted
  model. Questions and decisions keep their own reply field unfiltered.
- **The live line shows what preparation costs while Nika works.** While Nika prepares, the line
  now sums what the returned author calls cost as the Session settled them, at list price:
  `Preparing · 45s · 12 author calls · ~$0.12 · Ctrl+C stop`. A call that returned without a
  price is counted beside the sum (`~$0.12 + 2 unpriced`); while no call is priced, no cost is
  shown at all. A finished call's activity mark now carries its settled cost (`CallCost`), read
  from the preparation scope's own journal of returned requests: an estimate, never an invoice.
- **`/new` and `Ctrl+N` begin a new conversation in the workspace.** Through the Session's own
  door (`begin_new_conversation`): the conversation is kept as it was, the opening is painted
  again (the banner, then the Session's words of what carries over: the project's workflows,
  schedules and runs, a gate still waiting), and the prompt is free. While a decision waits, the
  Session refuses in its own words (« une décision vous attend encore … ») and the decision is
  shown again. `/new` is listed in the palette before `/quit`, and `Ctrl+N` among its keys.
- **The notices around your own words now use the language you write in.** In a French
  conversation a draft kept aside reads « votre brouillon « … » · il est dans la zone de saisie,
  non envoyé », a correction « correction en attente « … » · la préparation s'arrête, puis elle
  est envoyée », a command typed while Nika works « Nika continue · /intelligence attend votre
  tour », and the decision card says « cette proposition n'a pas changé depuis votre dernier
  message ». What an earlier session kept reads « dernier run ✓ sortie 0 dans une session
  antérieure » on the status row (« Run ○ (précédent ✓) » on the rail), with its kept line and
  its earlier context, and the conversation panel names « Message pour … », « Joint : … ». Your
  words stay exactly as typed, a brace included. For other doors, nika-display adds
  `correction_queued_in` and `correction_unsent_in`, and nika-tui-view `Thread::speaking`;
  English is unchanged.
- **The palette and the slash list now use the language you write in.** In a French
  conversation each command and view key says what it does, where it applies and its one
  sentence of help in French (« /status · Où vous en êtes », « Ctrl+L · Redessiner l'écran »),
  and the chooser's own words follow too: the band's title, what waits (« Une proposition attend ·
  aucune commande n'y répond »), its keys (« Entrée envoie /show · ↑↓ choisir · Échap masque
  la liste ») and the search prompt « commandes › ». Command names stay as you type them, and a
  French word finds the command it describes while the English search words still work.
- **The prompt beside the line and the own reply's placeholder now use the language you write
  in.** In a French conversation a proposal's line reads « Enregistrer ? › » and a question's
  « réponse › », and the field beside a choice invites « ou tapez votre propre réponse »,
  « ou tapez oui ou non » or « tapez pour filtrer ». The line keeps the cells the longer
  prompt leaves, and a field already on screen changes its placeholder at once while keeping
  what you typed. `action ›` and `nika ›` read the same in both languages.
- **`?` shows the keys of what is on screen.** With nothing typed, `?` opens a read-only
  frame listing the keys of the surface in view (the conversation, the intelligence list,
  a question, a decision, or the work under way), its hint row's own words first, then the
  keys that always hold and the view keys the palette offers now, from the same catalog.
  `Esc`, `Enter` or `?` closes it with everything as it was; once words are typed, `?` is a
  word. The stage line ends with `? for shortcuts`, the palette lists it, and the ASCII
  glyph column reads the same keys.
- **`PgUp` reads the conversation behind a question's or a decision's card.** On a full screen the
  card covers the conversation down to the box, and a mandatory decision left no way to read the
  activity behind it before answering. `PgUp` now steps behind the card: the conversation shows
  and scrolls with the page keys and the arrows, the hint says « PgUp/PgDn scroll · any other key:
  back to the card », and any other key brings the card back as it was, answering, selecting and
  typing nothing. The card's hint names the key (« PgUp: history » where the row holds it), and so
  does `Esc` with nothing left to undo. A decision still opens with nothing selected; a question
  still opens on its recommended answer.
- **The request beside its question.** A typed choice shows what the
  Session keeps of your request, its goal and the questions still open,
  above the question, so nothing already understood has to be typed
  again.
- **A proposal's review card now uses the language you write in, around the Session's own
  facts.** In a French conversation the card reads « crée compiled-workflow.nika (33 lignes) »,
  « remplace … · sur les octets attestés … », « révisé sur place · … » and « run demandé ·
  report.nika une fois · plafond $0.25 ». Its headings follow (« à l'exécution · », « atteint,
  comme déclaré · », « répétition · aucune liée à cette identité »), and so does its identity
  on the border (« proposition 74189e5877e0 · F2 : tous les mots ») and the faces' first rows.
  What the Session's audit says a workflow reads, writes and reaches, and its rehearsal words,
  stay as the Session says them. On an ASCII screen these French words lose their accents.
- **A proposal's check face details the compile record of its bytes.**
  Below the static check, the object now shows how the proposed bytes
  were made (the mode, their sha256, the base a revision rests on, what
  changed and the preservation claimed) and every admitted component
  they hold, with its version, release and admitted-file digests, its
  bindings and what the bytes show of it now. `invoked` is admitted
  reuse like `expanded`; only a revised, absent, unreadable or
  unwitnessed component asks for attention.
- **A run's ceiling is chosen from rows.** When the Session asks the
  ceiling of a run it cannot prove one for, the TUI shows the amounts as
  rows, the recommended one preselected with why, another amount typed
  beside them and a way out; the transcript keeps the save report and
  the one short question.
- **The run in view now speaks the language you write in.** In a French conversation its
  faces read « [run] sorties fichiers preuve », its standing « un nouveau run · terminé ·
  réussi » (on its pinned row too), and the facts above its graph say the bytes it binds
  (« graphe · les octets … sur lesquels il a été demandé, tels que le run les nomme »), how far
  it went (« en cours · 4 tâche(s) vue(s) »), its settlement (« clôture · normal · 4/4 tâches ok
  · 9857 ms »), its stream (« flux · 19 événements et la clôture, entiers ») and its evidence
  (« attestation · scellée, comme le run l'a déclarée · la preuve est la vérification propre de
  la trace »). Its graph counts in French, its tasks wear « ✔ réussie » or « ○ planifiée », and
  the list says « tâches · ↑↓ choisir · Entrée détails ». The workflow, the cause, counts, times
  and digests stay as they are; a task's detail and the outputs, files and proof faces still
  read English. English is unchanged.
- **A settled run's story folds to one row.** In the workspace
  conversation, a run's story is folded once, when it is committed and
  the shell observed its run typed, whole and settled (never paused), to
  one quiet row: the run's label, its state and `F2`. The fold is never
  recomputed: a later block never folds or unfolds it. `F2` at the reading
  position, or a press on the row, opens the whole story; an untyped or
  incomplete run keeps its words.
- **A run's story now speaks the language you write in.** While a workflow runs from a French
  conversation, the busy row and the activity card read « en cours · meteo-maurice-quotidienne »,
  « ↺ today · depuis le cache », « ◇ en pause · `approve` vous attend » and « succeeded · 4/4
  tâches · 9857 ms », and the story the transcript keeps reads the same. The workflow, the
  tasks, the engine's status word, counts and times stay as they are. For other doors, a
  `RunSink` gains a `say` method that defaults to English, so `nika`'s plain output and every
  existing sink are unchanged.
- **The stage line, the live line and a run's card now use the language you write in.** In a
  French conversation the stage line reads « Brouillon ✓ · Enregistré ✓ · Vérifié ✓ · Actif ○ ·
  Exécution ○ » beside « ~$0.31 dépensés » and « ? pour les raccourcis ». The line under work
  in progress says « Préparation · 45s · 2 appels auteur · Ctrl+C arrête » or « Exécution de
  veille-tech.nika · 2/3 tâches · en cours : write · $0.012 sur $0.25 », and a run's card opens
  on « Échoué après 16.5s · 3 tâches exécutées · 1 échouée ». Times, amounts, file, task and
  model names keep their form, the Session's phase words stay as it says them, and English
  stays the default.
- **The stage line carries what the session spent so far.** After its stages (`Draft ✓ ·
  Saved ○ · …`), the terminal now adds `~$0.62 spent`: the Session's known estimate of
  this session's preparation plus the metered spend of the runs it observed. Nothing is said
  while the spend is unknown, a row too short for it drops it before the stages give way,
  and the model and decision seat keep their one home, the header.
- **`/welcome` brings the welcome back.** Once the first exchange took its space, the welcome and
  the example it offers (« Try: aggregate-by-key ») could not be read again. `/welcome`, listed
  with the commands, now brings it back as the object in view beside the conversation until
  another object takes its place; outside the workspace its words are said in the conversation.
  Nothing is sent to the Session.
- **The butterfly is drawn in braille.** Outside the ASCII column the
  welcome's mark takes Unicode braille renditions, 2×4 dots per cell, read
  from the same samples of `media/brand/nika-logomark.svg` as the ASCII
  density ramp, for the same five sizes; the reveal lights its dots in the
  same five frames. A test now regenerates every rendition from the pinned
  mark and fails on any difference, so a handful of ramp cells moved one
  step to the reproducible sampling.
- **A workflow's faces now speak the language you write in.** In a French conversation the
  object pane names its faces « source plan graphe vérification », and says the facts above the
  face (« workflow Nika · source · 1.9 Ko · identité … · 34 lignes »), what it cut (« 7 lignes
  plus larges que 65 colonnes, coupées au bord »), the plan's waves, the graph's summary
  (« Définition · 4 tâches · 3 arêtes ») and the check's reasons (« la définition est
  conforme »), as well as the compile record a proposal binds to its bytes and the rows around
  an opened file (« les octets de ce fichier …, tels que lus en dernier · r le relit »). The
  object's own action reads « [+] Agrandir · F4 », and a click on a face's tab finds it by the
  word painted there. The bytes, the engine's findings, the check's layer names, digests and
  values stay as they are; English is unchanged, except that the check's closing reminder
  now wraps rather than being cut on a narrow pane. For other hosts, `Canvas::speaking`,
  `Inspected::speaking`, `Checked::importing` and `Face::label_in` are new additive calls.

### Changed

- **An Anthropic key starts on Claude Sonnet 5.5.** The catalog's Anthropic default and
  the first-run suggestion for an Anthropic key name `claude-sonnet-5-5`, so a person who
  picks Anthropic without naming a model runs it; an explicit model keeps running as
  named.
- **The Anthropic nicknames name the latest Claude models.** By maintainer decision of
  2026-10-15, `anthropic/sonnet` runs Claude Sonnet 5.5, `anthropic/haiku` Claude Haiku
  5.5 and the new `anthropic/opus` Claude Opus 5.5, each with that model's 1M-token
  window and 128K output cap; the catalog's cheap Anthropic model is Claude Haiku 5.5.
  `anthropic/claude-sonnet-4-6` and `anthropic/claude-haiku-4-5-20251001` keep running
  as named, the latter with its retirement advice.
- **The conversation's author offers only what one workflow can carry.** Its instructions now say
  that every proposal is verified against the whole request, so splitting the work across several
  workflows is no option; that an option dropping a file says so in its label and one asking for
  an approval says who approves before what, so picking it settles the question; and that a
  refusal is told in plain words, never by a finding's name.
- **The workflow author shapes its choices for picking, not typing.** The author's
  instructions and the `ask` tool now say: whenever an answer is among known alternatives,
  give two to seven native options rather than a free-text question, with `multi_select`
  when several may apply; label an option that names a website or a data source with its
  display name, then « · », then its domain or feed address (`TechCrunch ·
  techcrunch.com/feed`); whenever a default can stand, show the choice in the proposal's
  `open` with exactly one recommended option. The assumptions-first rules are unchanged: a
  default is still never asked, and a question asked with `ask` recommends nothing.
- **The author waits for a fan-out and keeps independent items.** Its card showed `fail_fast: true`
  as the one form of a fan-out, and never said that a fan-out over an empty collection is skipped
  with a `null` output: an inbox workflow failed with NIKA-VAR-006 on an empty folder, its steady
  state, and one failed summary of two lost both. The card now shows the plain fan-out, has every
  task that reads a fan-out's output wait for it with `after: { <id>: success }` (an empty
  collection then ends the run with nothing to do), and, when each item stands alone and the
  request does not want all or nothing, keeps the other items with `on_error: { skip: true }`.
- **Provider defaults and nicknames follow the served model ids.** OpenRouter uses
  `anthropic/claude-sonnet-4.6` and `anthropic/claude-haiku-4.5` with their sourced
  limits; `deepseek/chat` aliases `deepseek-flash`, while the explicit retired wire
  id remains unchanged. OpenAI defaults to `gpt-6.1-sol` and `gpt-6-luna`; xAI
  defaults to `grok-4.7` and `grok-4.3`, with the first-run suggestion naming
  `xai/grok-4.3`. Retired grok-3 prices are removed, and the human catalogue lists
  each aliased wire once. Groq defaults retain their models.
- **`nika catalog` lists providers in the spec's presentation order.** Within its
  LOCAL and CLOUD sections the rows follow the vendored design tokens'
  `presentation.providers_order` (local engines first, then Mistral, Hugging Face,
  OpenAI, xAI, Anthropic, DeepSeek, Google, Groq, NVIDIA and OpenRouter), the
  order the language server already teaches; a provider the tokens do not name
  comes after every named one, by id. The command keeps no order of its own.
- **The TypeSafe decision seat lives in a size-cap member.** `nika-cli-host-typesafe` now holds
  the System One seat (its transport, the Session's journaling seat and the batch exchange);
  `nika-cli-host` re-exports it whole as `compile::typesafe`, so no consumer changes. The host
  crate drops from 14,995 to about 14,076 production lines. The seat's key accessor now
  returns a `Secret`, read only through an explicit `expose`.
- **Decision partitions retain the exact serialized request bytes.**
  `Partition::begin` returns the optional carried request as `Vec<u8>` instead of
  a JSON value. Callers must preserve those bytes rather than serialize a parsed
  value again. Model-part qualification also exposes its typed findings; this
  preview's public API change is not exclusively additive.
- **A decision batch is not refused twice at a size it already learned.**
  When the System One decision service refuses a request of several items
  for capacity, the rest of the batch never sends a request that large
  again: a waiting half as large as the refused request is split before it
  leaves, in order, instead of being sent whole to be refused. The seat a
  Session keeps also remembers what its batches learned, so a later
  compile's batch starts at the largest size the service answered, below
  every refused size; a batch that never met the capacity teaches nothing,
  and nothing persists beyond the process. Each journaled request split
  before it left names that bound (`split_below`). Single items, order,
  answers and the rest of the journal are unchanged.
- **`nika doctor` says "unknown" when it could not see.** A harness seat
  whose login check did not answer in time was a warning; it is now its own
  level, `unknown` (glyph `?`), counted apart in the verdict line and in
  `--json` as `summary.unknown`, never as ok, warn or fail. The exit code
  is unchanged: an unknown row never makes `nika doctor` exit 3.
- **Groq's catalogue row lists its self-serve gpt-oss models, and its defaults
  move to them.** `groq/gpt-oss-120b` and `groq/gpt-oss-20b` name
  `openai/gpt-oss-120b` and `openai/gpt-oss-20b` (131,072-token window, 65,536
  output tokens, from Groq's models page of 2026-10-12), and Groq's default and
  cheap models move to them from the Llama rows, which that page now lists for
  enterprise contracts only. The Llama nicknames keep their models, and the same
  ids stay usable on Scaleway, NVIDIA and local engines.
- **The knowledge door ranks families by the light French stems of their words.** A request and a
  family now meet whatever the inflection: each informative word of both is read by a light French
  stem (a plural, « -aux », then one inflectional or common derivational ending), so « importées »
  meets « importer » and « feeds » meets « feed ». On 32 held-out French requests, the family each
  belongs to now ranks first for 20 instead of 19 and is recalled for 31 instead of 28.
  Patterns, blocks, examples and skills reached by their own text keep their words; each family
  recalled still brings its packs' patterns and blocks, presented whole. The pack names its
  builder `knowledge-door-v8`.
- **The embedded knowledge release is r3.5** (`knowledge-0.123.0-r3.5-foundry-20261016`). It adds
  seven blocks for recurring jobs, each qualified in recorded worlds: an API value watched with a
  state file that asks only on the first run and on a change, a report of the previous month on a
  day-of-month cadence with amounts in integer cents, a folder translated file by file with each
  failure named in a report, an inbox processed and emptied, a weekly reading list from feeds, a
  daily news digest posted only on approval, and a CSV cleaned with the file line of every removed
  row. Nine patterns (among them the run's spending ceiling, which lives in `--max-cost-usd`, the
  project's `ceiling:` and a beat's `plafond:`, never in the workflow file), eight packs, two
  families and French phrasings come with them, and the cadence knowledge reads a day of the month
  (`TZ=<zone> 0 8 1 * *`). The r3.2 release it replaces stays embedded for earlier pins, which
  reopen its exact bytes.
- **Machine protocol 2.** This engine reports `machineProtocolVersion: 2` on `/health` and
  `nika --sdk-identity`.
  - **Why.** Compile questions may be `choice`, which `@supernovae-st/nika` 0.120.3 refuses
    mid-compile. From now on, any change to an object a published SDK reads closed raises the
    protocol in the same commit, held by a contract test against that SDK's closed sets. That SDK
    then refuses this engine at connect (`NikaCompatibilityError`), before any job is admitted,
    never in the middle of a run. Use the SDK of the same release. It reads protocols 1 and 2, so
    upgrade the SDK first, then the engine.
  - **Resident stores.** A resident stamps its stores with the protocol once it holds the lease,
    so stores a 0.123 resident wrote are refused by an older resident, by design. Before
    upgrading, copy the state root (by default `.nika/serve`). To roll back, serve that copy, or
    a fresh `--state-root`.
  - **Doctor.** Its resident row fails for stores a newer protocol wrote, whether a resident runs
    or not, and names those two ways out. It used to read a stopped newer resident's stores as
    fine and suggest a restart this binary would refuse.
- **The models.dev pricing snapshot is refreshed to 2026-10-12.** It carries
  729 rules (716 before): 38 rows arrive, among them Claude Sonnet 5.5 and
  Haiku 5.5, GPT-6.1 Sol and Step 5 Preview, and 25 rows models.dev no longer
  lists leave, among them `openrouter/qwen/qwen3.8-27b:free`, with the three
  measured energy figures that rode on them. DeepSeek V4 Pro's snapshot price
  moves from $0.435/$0.87 to $0.66/$1.98 per million tokens; its admission
  tariff, at the peak rate, still prices its runs. DeepSeek's retired
  `deepseek-chat` and `deepseek-reasoner` names, which models.dev no longer
  lists, keep their `deprecated` status: priced for a recorded run, never
  offered.
- **The knowledge door lives in a size-cap member.** `nika-onboard-knowledge` now holds the strict
  admission of a Foundry knowledge release, the releases this build embeds, the catalogue and the
  authoring pack, with their assets and pinned vectors; `nika-onboard` re-exports every item at
  `knowledge::`, so no consumer changes, and keeps `knowledge::pin`. The onboarding crate drops
  from 14,999 to about 11,090 production lines.
- **The access plan, the probe facts and route identity live in a size-cap member.**
  `nika-providers-access` now holds `resolve_access`, `route_identity`, the probe's data types and
  `canonical_provider`; `nika-providers` re-exports every one at its historical path, so no consumer
  changes. The provider crate drops from 14,991 to about 12,800 production lines.
- **A rehearsal bounds the values a run builds.** A candidate whose templates
  build a value larger than the rehearsal room holds is run, and stopped where
  the value is built: the rehearsal reports a data bound naming the task and
  the value's size, instead of refusing every amplifying template before any
  run.
- **A served `rattraper` catch-up fires the latest missed slot once.** As spec 01 states, and as
  the activation's one-ceiling worst spend assumes: a `nika serve` schedule under `manqué:
  rattraper` (the job API's `catch-up`) no longer fires every missed slot, up to 10,000 runs. The
  older slots are skipped, journaled once. A catch-up due while its schedule's previous run still
  runs now waits for that run instead of being skipped as an overlap.
- **A new run reads earlier work lean.** When the person writes, a superseded candidate's
  arguments and findings and a page read again later reach the model as one-line stubs;
  the person's lines, the provenance replies and the current candidate stay whole, the
  record is unchanged, and nothing before a replayed thinking block is edited.
- **A Session conversation is compacted within its route's window.** On
  a route a tariff prices, the conversation's earlier entries are folded
  into a summary before a request its route could not take, instead of
  every request carrying the whole conversation. A route no tariff prices
  keeps its whole conversation, as before.
- **The session's intelligence, reasoners, line router and authoring door
  now live in the `nika-session-intelligence` member crate.** A structural
  split (ADR-150) that brings `nika-session` back under its production-size
  wall: every `nika_session::{authoring, intelligence, reasoner, turn}` path
  and root re-export names the same items, and no behaviour changes.
- **A default picked at a proposal needs no author round trip.** When a
  proposal shows its choices with their defaults, picking a choice's
  recommended option (Enter on its preselected row, its key or label, or
  `yes`) binds it and keeps the proposal shown, with its next choice or
  its save decision, instead of asking the author to propose again. The
  bytes, identity and card stay those the person saw. Another option, a
  sentence, a changed candidate, the last pick of a proposal whose request
  asked to save or run, and a conversation an ACP agent leads still reach
  the author.
- **The author reads the language up front.** A new conversation's instructions carry
  the engine's one-page language, its canonical fragments and output conventions as
  reference, and an index of what `language` and `knowledge` hold, so a missing detail
  costs one narrow lookup.
- **The observations of one message run side by side.** An observation reads one public
  page outside the Session's lock, and consecutive ones run at once: three sources cost
  about one page's time. Their replies keep the message's order; every other call stays
  sequential.
- **A Session turn keeps one connection to its model route.** The
  conversation's calls in one turn share one client and its runtime,
  built at the turn's first call, instead of a new client per request;
  each request is still admitted and can still be stopped on its own.
- **The author knows the run model's efforts.** The `models` tool names the
  reasoning efforts each offered run model documents and its output limit, and the
  author declares a `low` effort for tasks that only write or summarize text, so a
  reasoning model's thinking no longer exhausts the answer's tokens.
- **A saved default naming Jev opens new conversations with Jev.** When
  the operator default names a decision seat and the host names none, the
  session builds that seat by name, its key read through the seat's own
  boundary, and consults it while it can; with the key missing the seat is
  shown unavailable and never blocks the author. The header now reads
  `Decision: Jev 1.13.0` (or `Decision: same model`).
- **The properties you state are checked before an output is written.** The Session's
  author is asked to check each property your words require of an output (an order, an
  exclusion, a count or a total) with an assertion that the trial and every run evaluate
  before the output is written; a candidate that breaks it fails its trial and is repaired
  before you see it.
- **A line typed during a turn holds back only the calls that hand the turn over.** A
  steering line waits before ask, propose and new_request; a candidate write or a read
  the author already decided still runs, and the line enters after them.
- **A Session's last run names its job, receipt, outputs and the verifier's seal facts; `sealed`
  keeps its meaning.** `work.run` gains `job`, `receipt`, `outputs` (kept whole up to 16 KiB
  encoded, absent past it: the job keeps them) and `seal_verified` / `signed` as `nika trace
  verify` attests them for the run's journal, absent when no verifier judged it. The Session
  judges a native run's local journal when it observes the run and holds those facts beside its
  kept value, which stays the one an earlier engine reads; an opaque trace identity is never read
  as a local journal. `sealed` still names what the Stop's story reads, the settlement's receipt
  naming the chain head: a run that stopped at a wave boundary without a run key reads stopped,
  never cut, and no verifier's judgment is read from it.
- **The author writes and proposes in one message.** A write's reply now
  carries Nika's check findings, the laws over the person's words and
  the values it dropped, so a candidate needs no separate check or verify
  round before it is proposed; a shown proposal ends the turn instead of
  costing one more model call; `compose` is lent the pinned release's
  components and the release is admitted once per turn.
- **The size walls are 25,000 production lines per crate and 2,500 lines per file.** The CI
  ratchets and the pre-push gate now block a crate above 25,000 production lines and a source
  file above 2,500 lines; the hygiene dashboard warns, without blocking, above 15,000 and 1,500
  and names the crate closest to its wall, and a file with a `LOC-EXEMPT` marker stays capped at
  5,000 lines. One ceiling applies to every crate: the native renderer's 19,000-line exception
  is absorbed. ADR-154 records the decision and amends ADR-004, ADR-023 and ADR-143.
- **A conversation's document needs an executable check for each count,
  total, order or cut its request states.** A document the Session's author
  wrote was READY although a typed property the request states had no check
  any run evaluates, so its trial proved nothing about it. The conversation
  door now holds such a document before its trial and its judge, INCOMPLETE,
  naming each property with the request's words and the check to add: a
  `nika:jq` boolean asserted by a `nika:assert` that reads it through
  `with:` and quotes those words, the write waiting for it. A bound on text a
  model writes is not asserted and stays the judge's. No model is called to
  decide it, and the other doors follow once their author prompts teach the
  same checks.
- **`/status` says first whether the saved workflow is scheduled.** A person asking « is my Monday
  recap on? » got the intelligence, the seat, the knowledge and the money lines and no word about
  the schedule. `/status` now opens with the workflow this session saved, whether a schedule is
  declared for it and whether a firer is proven on this machine, and how its last run ended.
- **The conversation's author speaks as Nika and leaves the Session's acts to it.** The author's
  instructions now say to speak as Nika in the first person. Installing, removing, activating
  and deactivating a trigger belong to the Session: the author never claims them, nor advises a
  terminal command or a hand edit of `nika.yaml` instead. They also cover plain text without HTML
  entities, and « montre-le-moi avant de l'enregistrer » as a request to see the proposal. The
  author never advises a stronger model unless the verifier asks for it, and a recommendation
  never contradicts the person's explicit requirement. Each source of a multi-source result
  recovers on its own, and a thinking model's `max_tokens` leaves room for its thinking.
- **Schedule questions show their options once.** The missed-run policy
  and the ceiling per scheduled run are chosen from rows the Session
  states, the recommended amount preselected and another one typed
  beside them; the transcript keeps the question's sentence and one
  short line instead of repeating the options as text. A host without
  rows still reads every option as text.
- **A chosen command runs once.** `Enter` on a command in the palette
  or the slash list runs it once, your unsent message left as it was;
  `Tab` still only inserts it. A repeated `Enter` after choosing or
  answering counts once, and queues nothing from a message waiting out
  of view.
- **One surface above a fixed composer.** The command palette, the slash
  list and a typed question's offers open as one opaque surface above the
  composer. The composer and the transcript keep their rows and the reading
  position: opening, searching or closing it moves nothing, and nothing
  hidden under it takes a key or a click. A typed choice keeps your unsent
  message out of view, untouched, and gives its own reply a field of its
  own; the arrows choose whatever that message holds.
- **A decision names the act the Session recommends.** Its rows now say « recommandé » /
  « recommended » beside that act, as a question's rows already did: the trigger's install marks
  « Installer et activer », or « Garder déclaré seulement » when a scheduled run would not see the
  workflow's keys, and a run's or a schedule's ceiling marks its recommended amount. A decision
  still opens with no act selected, so Enter consents to nothing by itself; a decision the
  Session recommends nothing for, such as a save, marks nothing.
- **The workspace wears electric blue.** The brand, focus, selection,
  primary action and interaction chrome take the electric-blue accent
  and selection fill of the ratified design, replacing violet. Success,
  caution, failure and each verb keep their own hue; `NO_COLOR` still
  carries no hue and the ASCII column keeps its marks.
- **`Esc` steps back and never answers a decision.** In a choice list it
  first empties what you typed, then the selection; on a Save, cost, gate
  or other decision it then sends nothing and says so, so its discard or
  cancel row is chosen only with `Enter`. In `/intelligence` it returns
  from a connection's models to all connections, and at the top keeps the
  current choice.
- **A connection's models open on the current generation.** In
  `/intelligence`, earlier generations, dated snapshots and legacy models
  now fold behind one `Older models (N)…` row, so Anthropic opens on its
  Claude 5 models; the model in use and the recommended one always stay
  in view.
- **Reopened, `/intelligence` opens on `Keep current`.** Opening the picker again selected
  `Recommended for you`, so a reflexive `Enter` replaced the author in use with the
  recommendation. Once an intelligence is chosen, the picker now opens on `Keep current ·
  <model>` and one `Enter` keeps it; where a first choice is required, the recommendation is
  still selected and one `Enter` applies it.
- **The intelligence guide no longer teaches a typed route.** `/intelligence`
  and an opened connection now say only to choose below; every model this
  machine offers is a row. Typing `/intelligence 2 provider/model` still
  works as an expert fallback.
- **`Enter` validates a multiple choice.** Space checks or unchecks an
  answer; `Enter` on any row now sends every checked answer at once instead
  of toggling the row under the cursor. With nothing checked it sends
  nothing and says that Space checks an answer.
- **The lifecycle rail names its stages in the Session's words, in the person's language.** The
  workspace now asks the Session for the rail in the language it reads from the person
  (`nika_session::Lang::rail`: « Brouillon ✓ · Enregistré ✓ · Vérifié ✓ · Actif ◐ · Run ○ ») and
  paints it as it comes, instead of translating the Session's English stage names word by word
  with its own table (which said « Exécution » where the Session says « Run »). A first
  question's or a waiting proposal's own rail still gives its row to the card in either language.
  Under the ASCII glyph column the Session's words keep their accents, as its other words do.
- **The connections you can use now come first in « Choose an AI connection ».** Within each
  access (agent accounts, APIs, local servers), the connections usable now lead: an API whose
  key is present, an account or a local server the Session detected that can write workflows.
  The rest keep their order below, and every other order is unchanged. With only
  `NIKA_ANTHROPIC_API_KEY` set, Anthropic is now the first API row, where it stood twelfth under
  eleven « key required » rows. Nothing is probed to tell.
- **The workspace reads the Session's schedule histories as they are.** `ProjectView::schedules`
  now holds `nika_session::ScheduleHistory` itself (built with its `new`), and the TUI's own copy
  of it (`ScheduleView`, `SlotView`, both added in this preview) is gone. Whether this machine
  holds a schedule's unit is the lent trigger host's answer (`TriggerHost::installed`), so a test
  host proves the rail's « Actif ● » without touching launchd. Nothing a person sees changes.
- **A stopped call wears the cancelled mark, not a failure's.** In the activity card a call the
  person stopped read « ✖ call 1 · … · stopped, a charge may be unknown », the glyph the run views
  use for a failure. It now reads « ⊘ call 1 · … », the theme's cancelled mark (« - » in ASCII):
  a stop is the person's own act, not a failure.
- **A typed « je voudrais l'enregistrer et le lancer » at a shown proposal is pinned through the
  TUI.** The save decision takes the person's words through its bound door: the Session saves the
  workflow and hands its run over, and the door runs it once. A test now holds that journey end to
  end in the TUI, nothing run before the door performs it.
- **The welcome names the Session's own demo.** « Try: aggregate-by-key » on the welcome screen
  now reads the Session's `nika_session::WELCOME_DEMO`, the demo it gives a person who asks for
  « l'exemple de l'écran d'accueil »: the screen and that answer cannot drift apart.
- **The welcome's butterfly wears the brand's ice.** Where `COLORTERM`
  proves 24-bit colour the mark takes the logomark's own ice, and while it
  is revealed what each frame has just lit glows until the last frame
  settles it. A 256-colour terminal gets the nearest xterm indices, the 16
  ANSI slots bright cyan and bright white, `NO_COLOR` no hue; reduced
  motion draws the settled mark at once.
- **The wordmark locks up with the butterfly.** The welcome's spaced
  `N I K A` becomes the wordmark `nika.` under the mark, the name strong and
  its dot in the exec hue, and the header opens with the same wordmark in
  place of `◆ NIKA`. Both glyph columns draw the same characters; without
  colour it is plain `nika.`, and every other welcome word stays.
- **A workflow named exactly `v1`, `v2`, … must be renamed.** `nika:`
  names the file, and `v1` is the retired schema tag it once held. A
  workflow named that way is now refused at parse (`NIKA-PARSE-003`) with
  a remedy that says so, as `nika.yaml` already refused it. Only the
  whole marker is refused: `vault`, `v2ray` and `v1-migration` stay
  ordinary names.

### Fixed

- **« active-le » on a schedule declared earlier offers its trigger.** On a Mac whose terminal
  Session installs triggers, activating a schedule `nika.yaml` already declares no longer stops at
  « déjà déclaré · pas prouvé actif ». When no unit is installed, Nika asks « Installer le
  déclencheur sur ce Mac ? ». When the unit is there, it says the schedule is active and when it
  runs next. A line asking for another cadence still points to the entry to change.
- **The activation honours « choisis pour moi », says when a schedule is already declared, and
  never runs instead.** On the activation's questions, « choisis pour moi » or « fais au mieux »
  was dropped or refused (« is not a positive amount in USD »): it now takes the run-once policy
  and the recommended ceiling, both shown in the declaration consented to. Activating a workflow
  already declared said so only after asking the missed policy and the ceiling again; it is now
  said at once. « Vous pouvez l'activer pour moi, directement ici ? » ran the workflow: a filler
  around the activation words keeps them the activation, and a line about activating or
  scheduling never reaches Run. A green run that recorded no priced cost is still a run observed:
  the ceiling says it cost nothing priced, not « no run of this workflow observed yet ».
- **A second schedule joins the `arm:` list Nika wrote.** Activating a second workflow of the
  same project was refused with « Nika does not rewrite a list it did not write », about the
  `nika.yaml` Nika had written minutes earlier, and the person was sent to edit YAML by hand. An
  activation now appends its entry to an `arm:` list that ends the file; a list followed by other
  settings is still the person's to edit, and a workflow already declared keeps its entry.
- **An agent no longer runs the calls of a message cut at its output limit.** Each call of
  such a message is answered « not run: your message was cut at the output limit; re-issue the
  call with complete arguments » and the loop goes on under the task's own limits, as the
  Session's agent does. A turn the provider interrupted on its side is never acted on: the task
  fails `NIKA-INFER-001`, transient, naming the provider's own word.
- **An answer the provider cut at its output limit now fails instead of passing as the
  output.** An `infer:` task whose provider stopped at `max_tokens` used to return the
  truncated text as a success (a model that reasons by default can spend most of the cap
  on reasoning: 4,096 of 4,096 output tokens, 3,860 of them reasoning, the answer cut
  mid-sentence). It now fails with `NIKA-INFER-005` (not transient), before any `schema:`
  validation or repair. The run record's `details` carry the text received
  (`partial_output`) and the provider's stop reason, and an `on_error:` recovery can use
  them. An agent's final message cut the same way fails with `NIKA-AGENT-006`. A blank
  cut answer keeps its earlier failure: `NIKA-INFER-004` on a text task, the schema check
  that names the token limit under `schema:`.
- **Anthropic calls are priced again.** Every Anthropic reply now carries `"speed": "standard"` in
  its `usage` object, a key the completeness rule did not know, so each call counted as « provider
  did not report usage »: runs on Claude showed « cost · UNKNOWN · 1 unpriced call(s) » and no
  allowance settled them. The standard speed is now a known axis beside the standard tier and
  global inference; a fast reply, billed at another rate, still leaves its call unpriced.
- **« Active-le tous les matins à 7h » activates that schedule.** An activation line that states
  its cadence re-proposed the saved workflow, then asked for the English word « activate ». The
  cadence it states is now the schedule declared, and a plain « activate » after a workflow saved
  without one takes the cadence the person's latest line stated (« qu'il tourne toutes les
  heures »). The activation questions read the person's words: a city for the time zone
  (« Paris », « heure de Paris »), a sentence for a missed run (« le faire une fois quand il se
  rallume »), an amount with its currency (« 0,10 $ ») and a choice left to Nika after another
  clause (« je ne comprends pas, choisissez pour moi »).
- **« Active-le tous les matins » activates the saved schedule.** An activation word with only
  the period the saved schedule already runs on reached the author, which proposed the saved
  workflow again. It now opens the same activation « active-le » opens; another period is a change.
- **An activation question takes its recommended option in words.** « le recommandé, celui à
  10 cents » was refused as no amount in USD, and « comme la dernière fois, vous choisissez » was
  not one of the three, while « comme vous voulez » was. The recommended option, a choice left
  to Nika in other words, and one amount said with its unit inside a sentence are now read.
- **An answer at a gate is recorded when the paused run spent part of its ceiling.** A run that
  paused at a `nika:prompt` gate after a priced step resumes under what its ceiling leaves, and
  its admission priced the whole workflow again, the finished step included. « non » and « oui »
  were both refused (`NIKA-1709 · … unavoidable cost floor $0.196608 exceeds --max-cost-usd
  $0.195214`), the answer was never recorded and the run stayed paused, from the Session, the
  terminal and `nika run --resume <trace> --answer <task>=<value>` alike. The CLI preflight and
  the runtime's own launch gate now price the work still to run: a task the resumed journal
  completed is a cache hit and costs nothing, with any child workflow or priced builtin it
  calls, and a branch the answer closes was already priced closed. A step edited since the
  pause runs again and is still priced by the runtime's gate. What still runs is judged as
  before, and a fresh run's floor is unchanged.
- **A question Nika asked no longer blocks a proposal that shows it.** When the author asked a
  question and then proposed with that same choice shown on the card, `yes` was held (« Nika asked
  `topics`, which this proposal does not show ») and the asked question could not be answered while
  the proposal waited. The card's choice now is that question: `yes` keeps its default, another
  option revises. A question the card does not show waits first and is answered by its own
  identity (that reply never names the workflow's file); a proposal shown before that answer is
  revised before it saves.
- **A reasoning effort the model does not offer is a finding, not « clean ».** A workflow
  declaring `run.reasoning.effort: low` for a model whose catalog lists no effort level passed
  « check · clean ✔ » and « Vérifié ✓ ». Every run of it was then refused before its first task
  (NIKA-1800). The Session's check now reports it as a finding, so such bytes are neither shown
  as ready nor saved as clean. What only this machine lacks, such as a seat not installed, stays
  a run-time matter.
- **An empty product is said in the run report.** A run reported « réussi » with « produit ·
  ./journal.md (0 B) » among its green ticks, after moving the three messages it read to
  `traites/`. The report now says when a file it wrote is empty, and how many files the run
  removed beside it, so the person checks the result before running it again.
- **An HTML feed title reads as its words.** A feed title of type `html` (Atom `type="html"`, as
  The Verge publishes) kept its markup: a reading list showed « Bluesky&#8217;s AI tool ». The
  `feed` mode now decodes its entities and drops its tags for the feed's and each item's title; a
  plain title, the summary and the content are unchanged.
- **An identical restatement no longer piles up in the request.** A retry or a restatement sent
  twice joined the request each time: « Original request: » four times, three identical
  corrections, and a judge question large enough to overflow its context. A correction whose
  words equal the request's last ones now leaves the request as it was.
- **An installed trigger whose runs would miss their API keys is never said to run on its own.**
  After the activation card had warned that a scheduled run would not see the person's keys, the
  install still answered « Installé et actif · tournera tout seul ». It now says the trigger is
  started, that every scheduled run fails until it sees the named keys, and how to give them: a
  file of `KEY=value` lines passed to `arm --emit launchd --env-file <file> --write`.
- **An answer the provider interrupted says how to go on.** « the provider interrupted the
  answer: nothing of it was kept or run » came back three times after 2 min 05 s with nothing
  saying whether to retry, rephrase or change the model. It now says the provider ended the
  answer with an error, that nothing was kept or run, and to send the same line again or choose
  another model with `/intelligence`.
- **A GPT-6 call that wrote the prompt cache is priced.** OpenAI reports the input it wrote to
  the prompt cache beside the cache read; Nika read any write as an unknown billed axis, so such
  a call stayed unpriced. The write now counts within the input, at the cache-write rate the
  GPT-6 pages state; on a model whose page lists no write rate, the call stays unpriced.
- **An authoring call whose recalled knowledge exceeds what one request carries is still sent.**
  Bounded inference sends at most 1 MiB and refuses a larger request before any byte leaves, so a
  large knowledge pack lost the whole call and nothing was authored. The document, sketch,
  revision and Plan doors now weigh their opening first: past the capacity less an eighth kept for
  the rounds that follow, the pack's references are shown by their first line from the end of each
  kind's order, the same share of every kind, until it fits. Each says so in its text, and its
  receipt keeps the whole entry's size and digest (`first_line_only`). The request, the card, the
  callable contracts, the language and the component list stay whole, and an opening that fits is
  sent unchanged.
- **An OpenRouter reply is priced again.** Every paid OpenRouter reply read as an unknown cost
  (« cost · UNKNOWN · 1 unpriced call(s) ») because it carries the upstream provider's cost
  beside its own charge, which Nika took for a BYOK bill. A non-BYOK reply now settles at the
  charge it reports, its breakdown read for its shape only: `z-ai/glm-5.3-flash` costs
  $0.000078 for a one-word reply instead of an unknown amount.
- **An unbounded estimate names what bounds it not.** « model output estimate · unbounded: a
  token or iteration bound is missing » stood beside a declared `max_tokens: 4096`, when only
  the number of items a step fans over was unknown. The line now names the tasks that declare
  no `max_tokens`, the tasks that run once per item of a list known only at run time, and a
  composed workflow with an unbounded step.
- **An unpriced call says why.** Every unknown cost read « a route with no price table (a local
  model is unpriced, never free) », said of OpenRouter and Gemini routes, remote and billed. The
  run result now names the reason its frames recorded: no verified tariff for the route, usage
  its provider did not report completely, a subscription seat, rejected usage or a local model.
- **An approval stated before an effect is a gate without an asking verb.** The reader saw a human
  gate only through an asking verb or an « after my approval » shape, so « je veux une validation
  humaine avant d'écrire jobs-<date>.md » or « je valide chaque run avant l'écriture de … »
  stated none, and the « écrire jobs.md » such a gate holds was no write without the word
  « fichier ». A person's approval that a `before` closes now gates the effect named after it,
  and inside a gate a form of writing followed by a file it names is the write. A denied approval
  (« pas de validation avant … ») and a validation step no person performs (« a schema
  validation before writing ») stay none, and a person turning down a proposal (« non, je veux
  plutôt écrire le total dans ./out/total.txt ») bans nothing.
- **`nika arm --emit` no longer arms a beat that cannot run.** `nika arm` reported a beat
  UNREADY (a required input with no binding source, a missing workflow, an unpriced
  model), yet `--emit` printed its unit and `--write` installed it, so the OS would fire
  a run that could only fail. The emission now refuses while any active local beat is
  UNREADY, naming each one with the blockers `nika arm` shows: fix the beat, or suspend
  it with `actif: false`. A beat whose only open question is an unknown (a child
  workflow whose model only the run decides) now reads READY, as `nika arm fire` fires
  it, and `nika arm` still names the unknown.
- **`nika arm --emit --write` retires the units of beats `nika.yaml` no longer arms.** A beat
  removed from the registry, renamed, or moved to the cloud kept its OS unit, which went on
  waking `nika arm fire` for a beat that no longer exists; neither `--write` nor a dry
  emit mentioned it. Now `--write` syncs the units with the registry: each of this
  project's units whose beat is no longer armed is named with the command that unloads it,
  then its files are removed. Loading and unloading stay your gesture, as before. A dry
  `nika arm --emit` lists what `--write` would retire. Another project's unit, and a unit
  without this project's GENERATED mark, are never touched.
- **Two projects that arm a beat of the same name keep their own OS units.**
  `nika arm --emit … --write` named a unit after the beat alone
  (`nika.arm.daily`). A second project's `--write` replaced the first
  project's unit, `nika arm disarm daily --write` in one project deleted the
  other's, and a flagless `--write` could copy another project's env-file
  wrap, so its runs sourced that project's keys. Unit names now carry the
  project's key (`nika.arm.<key>.daily`, the start of the project root's
  fingerprint), and neither the emit nor disarm reads, replaces or removes
  another project's unit. Disarm now prints `launchctl bootout
  gui/$UID/<label>`: the printed path form failed once the plist was gone, so
  the job stayed loaded until logout. Units an older engine wrote are
  reported with the commands that retire them; re-run `nika arm --emit
  <target> --write` in each project. A project whose `.nika/arm/env-file`
  already names another project's file keeps it until you pass `--env-file`.
- **A failed authoring call names the provider's status again.** A dispatched call that fails
  carries its money observations, and the authoring boundary judged that wrapper instead of the
  error inside it: a busy seat's 503, now ended at once instead of re-sent, read only « the
  authoring provider call failed », and an observed admission refusal lost its type. The document
  now says « the authoring provider answered HTTP 503 », so the caller knows a retry may help.
- **The author reads the Session's spend so far with each line.**
  QA gauntlet q09: asked what preparing had cost, the author answered
  « je n'ai accès à aucune mesure » while `/status` said $2.32. Once a
  preparation request was observed, each line the person types now
  reaches the author with the spend as `/status` says it, ahead of the
  run and recovery notes. An agent leading over ACP, whose subscription
  the Session never meters, reads none.
- **« quoi ? » reaches the conversation.** With no recovery to tell, a bare « quoi ? » or
  « hein ? » answered with the last run's fact, « no run yet under this root (no trace in
  `.nika/traces/`) », beside a question the person could not read. It now reaches the
  conversation, which answers what the person did not follow. « what happened? » still reads the
  last run.
- **A bare yes answers the author, never runs the workflow.** « Oui, allez-y, merci. » to the
  author's offer to prepare a change ran the saved workflow and overwrote its report. A line made
  only of a yes, a go-ahead and courtesy now goes to the conversation, which knows what it
  offered.
- **A behaviour defect is said in words.** When a rehearsal of the draft gave a result the request
  does not ask for, and no repair followed, the conversation showed the repair's raw record
  (`{"kind":"behaviour_failed",…}`) under « what stopped it ». It now says what the rehearsal
  showed against what was asked.
- **A choice or decision card no longer hides what Nika just said.** The card covers the
  conversation, so a reply written after your last message, such as why a requested change could
  not be made, was only found by scrolling once the card had closed, and the save decision came
  back looking as if nothing had happened. The card now opens on Nika's words since your last
  message: the whole reply where it has room, otherwise its first row, marked as cut, then its
  latest lines, with Markdown marks read as words. A decision on a proposal shown before your
  last message says `this proposal is unchanged since your last message`; an act you picked on
  the card, such as « Inspect the exact changes », does not count as a message.
- **A recommended ceiling reads as a multiple of one run.** « $0.10 · covers 10 runs like the last
  one » read like a budget for ten runs. It now says « 10 × the last run ($0.0094) », in French
  for French speakers.
- **Naming the ceiling without an amount no longer refuses the line.** « Le plafond, je le donnerai
  au moment de lancer » or « quel est le plafond ? » was refused as an invalid amount, and nothing
  was prepared. Such a line now states no ceiling. A bare « …, budget » after the work and a
  malformed amount (« plafond -1 », « budget NaN ») are still refused.
- **A ceiling offer counts the runs it holds.** The recommended ceiling read « $0.10 · covers at
  least 3 runs like the last one, $0.0015 » for an amount that holds 66 of them. It now says how
  many: « covers 66 runs like the last one, $0.0015 each ».
- **A run's ceiling now reads the same way wherever it appears.** Before a run, the
  Session wrote « ceiling $0.1 (saved with the workflow) » and the line below it wrote « ceiling
  $0.10 ». A ceiling under a cent showed as « $0.00 », which is wrong. Every surface that names a
  ceiling (the run's announcement, the proposal's asked run, the project facts, a run's result,
  `nika check` on a project) now writes the amount as you set it: `$0.10`, `$0.25`, `$0.001`,
  `$2`. Every significant digit is kept, cents show wherever there is a fraction, and no amount is
  rounded to zero.
- **A change said beside a rerun is made first.** A line with a rerun word and an amount was read
  as « rerun the saved workflow under this ceiling » whatever else it asked: « passe l'étape IA du
  commentaire sur Claude Sonnet, et relance avec le même plafond de 0,10 $ » reran the Haiku
  workflow at once and overwrote its report, the model change lost without a word. The shortcut
  now applies only to a line that says nothing but the rerun and its ceiling (« augmente le budget
  à 1 $ et relance », « relance-le, max 0,50 $ »); a line asking a change beside it reaches the
  usual reading, which prepares the change.
- **A choice left to Nika is said in the person's language.** « Laisser Nika choisir » recorded
  « I leave the choice to Nika. » as a French person's words. It now records « Je laisse le choix
  à Nika. » for a person who writes French.
- **A revision's circumstance is judged with its clause.** « Dans rapport.md, pour les doublons,
  mets l'email … » was cut at its commas and refused because « Dans rapport.md » and « pour les
  doublons » were judged as missing requirements of their own, under a « Change: » label the
  person never typed. A short phrase that opens with a preposition and ends at a comma now joins
  the clause it frames, and the refusal no longer quotes the label.
- **A long conversation keeps the person's own words.** When a conversation outgrew the
  model's window, its earlier part was folded into a summary that, by design, is not the
  person's words. The author then had nothing of theirs it could cite: it asked four times to
  restate a request that was still on the screen, and refused to bind an authorization given
  earlier. A summary now comes with the person's own lines it folded, verbatim, each with its
  citation. An old line too long to fit is given by its opening words.
- **A cost ceiling says when a model reasons beyond `max_tokens`.** On a route whose reasoning
  no request bound holds (xAI's Grok models), check said « ✔ COST $0.0123 – $0.0123 worst-case
  output ceiling » and « model output estimate ≤ $0.0123 ». Runs then cost $0.016 to $0.021. The
  line now reads « visible-output ceiling · reasoning of `task` billed beyond it ». The proposal's
  money rows name each such task and model. Run admission already reserved the whole generation.
- **A number that counts or ranks something is no ceiling.** A run line was refused whenever it
  held a number without a currency: « J'ai déposé 3 messages dans inbox/, relance-le stp » and
  « relance-le une 2e fois stp » met « that number has no explicit monetary meaning ». A number
  followed by what it counts (« 3 messages », « 2 fois ») or with an ordinal ending (« 2e »,
  « 3rd ») now states no money; a bare number still asks for its currency.
- **A request to create or copy a workflow is shown before anything is written.** The
  conversation's model could treat a request such as « Crée-moi un nouveau workflow X, identique
  à Y » as the person's consent, and the Session then saved a workflow nobody had seen. A workflow
  the person has not seen is now saved on their earlier words only when those words say save or
  run (« enregistre-le », « puis lance-le », « save it »). Otherwise the proposal waits for their
  yes. Their consent to a proposal already shown is read as before.
- **A CSV workflow is rehearsed.** A rehearsal refused every `nika:convert` step: « task
  parse_perso runs nika:convert, outside any bounded subset a rehearsal vouches for ». So no
  workflow that parses a CSV was ever tried before its first run. The room now runs
  `nika:convert` over its own copy, within the copy bound. Every value a room run builds is
  bounded where it is built.
- **A day a noun names is no money.** « J'ai mis le fichier du 16 de côté. Relance-le. » was
  refused as a ceiling without a currency, in English. A day of the month a noun names (« le
  fichier du 16 ») is now data; a day said after a run verb (« relance-le le 16 ») is still asked,
  since it may say when to run.
- **A day a past participle names is no amount.** « J'ai remis le 17 et mis le 16 de côté.
  Relance. » was refused as a ceiling without a currency. A day after « remis », « mis »,
  « gardé » or « déplacé » names what was moved, as « le fichier du 16 » does; « relance-le le 16 »,
  which may say when to run, is still asked.
- **A day of every month is a monthly schedule.** « Le 1er de chaque mois à 8h », « tous les 15
  du mois à 9h » and « every month on the 1st at 8 am » had no cadence reading: the Session
  refused them as incomplete, and an author bound a daily 8:00 with a date check inside the
  workflow, which lost every missed 1st. They now read as `0 8 1 * *` at the head or the end of
  a request and in a schedule answer. A 29th, 30th or 31st, which some months lack, is asked
  again with the last day of the month offered, never bound.
- **A schedule's declaration says no freshness of its sources.** Landing `nika.yaml` said
  « source freshness not judged: it reads no project file », even for a workflow that reads
  `releves/*.csv`. A set that lands no workflow runs nothing, so its yes now says nothing of
  sources.
- **A declared schedule changes zone, or goes, in the person's words.** Four attempts to move a
  declared schedule from Mauritius to Paris time reached the author, which cannot write
  `nika.yaml`, and « retirez cette planification » was sent to « désactive-le », which removes a
  trigger, never the declaration. « Mettez plutôt l'heure de Paris » now proposes `nika.yaml` with
  that entry's cadence in the new zone, its hour, missed policy and ceiling kept, and the trigger
  is offered again once it lands; « retire la planification » proposes the file without the
  entry. A schedule this Mac fires is deactivated first. « l'heure de Paris » now reads as a zone.
- **A demo asked for by its name is its skeleton.** Only the bare name of the welcome's demo
  (« aggregate-by-key ») reached its exact skeleton: « montre-moi cette démo aggregate-by-key dont
  tu parles sur l'écran d'accueil » went to the conversation, which showed the workflow in the
  chat, and « enregistre et lance » then failed because no request of the person's stood behind
  it. A line that names one demo and only asks to see, try or run it now reaches its skeleton
  with no model: its one open value is asked and its answer proposes the demo. A line that adds a
  path, an address or a number stays the conversation's.
- **A discarded proposal never comes back.** After « Discard » of a revision over a saved
  workflow, the next fix edited the discarded draft, which came back under another name as a
  second workflow beside the saved one. A discard now leaves the saved workflow as it stands as
  the base of the next change (no base when nothing is saved), and the author is told what was
  discarded. The discard is said in the language you write in.
- **A failed step says why.** « proposing the workflow failed · 3 ms » now carries the reason
  the run reported, on one short line.
- **A resume serves back a fan-out over its own `with:` and a group fold.** A `for_each` whose
  collection read the task's own binding (`for_each: { items: "${{ with.ids }}" }`) was never
  stamped, so `--resume` ran it live again: the content a gate had shown changed under the
  answer, and every answer was refused NIKA-SEC-010. The stamp now resolves the collection over
  the item-free `with:`, as the run does. A `${{ group.<name> }}` fold is stamped over its
  declared members, without their durations, which the journal cannot serve back.
- **A fetch that sends says it sends.** A `nika:fetch` task whose method is POST, PUT, PATCH or
  DELETE now reads « sends to the web » wherever the Session says what a task does. That covers
  the gate's « un oui permet … » line. Before, a POST to a webhook read « fetches from the web ».
- **A file the person names alone is found where it is.** A request that names a file by its
  name only (« si la note tarifs-2027.md échoue ») while the file lives in a folder
  (`./notes/tarifs-2027.md`) was refused at every revision as « UNREALIZED PATH », even when the
  workflow read every note through a glob. The observation now locates the one file of that name
  under the project (hidden folders and build outputs aside), and a workflow that reads it where
  it is realizes the name. Two files of that name, or none, leave it unrealized as before.
- **A file the person takes back is no longer owed.** Every file a request named stayed owed for
  the whole conversation: after « ne lis pas profil.md, copie mon profil dans le workflow », each
  workflow that no longer read the file was refused until the person restated everything. Their
  latest words about a file now decide: a later line that stops it from being read or used, or an
  offer they picked that says it is no longer read, withdraws the earlier mention, and naming it
  again asks for it again. A line that only qualifies the reading (« ne lis pas data.csv en
  entier ») or a condition (« si tu ne lis pas … ») withdraws nothing.
- **A folder named in words is held by the rehearsal.** « Les fichiers .txt du dossier inbox »
  named no folder, because only path-shaped words (`./inbox/`) counted. The rehearsal then held
  nothing, and the first run on the empty inbox failed. A folder introduced by its noun
  (« dossier », « folder », « répertoire ») and a bare name is now copied into the rehearsal room
  when the workflow reads under it. « Le dossier client » with no read under `./client/` stays a
  case file. A named folder that is not there is skipped, as the real run finds it.
- **A folder you name as `copies/` is tried before « propre ✔ ».** « Dans le dossier copies/ … »,
  « dans commandes/ … » or « du dossier notes/ » named no folder the rehearsal could hold, so a
  workflow reading those files was proposed as clean without running a step on them, and its
  first real run could fail on its own jq. Such a folder is now copied into the rehearsal room
  where the workflow reads under it (within the room's copy bound, originals untouched), and the
  steps after a model step that declares its answer's shape run on an example of that shape: a
  wrong jq is caught before you are asked to say yes.
- **A proposal over a folder is really rehearsed, and a rehearsal that binds nothing is said.**
  A Session proposal whose request reads a folder (« copies/ », « inbox/ ») was still shown
  « propre ✔ » with no rehearsal: the world observed before the trial refused the folder as no
  regular file, the trial's evidence was refused for having no receipt of the folder itself, and
  the refusal was dropped in silence. The world before a rehearsal now holds each file of a
  folder or a pattern the request reads, and of a destination folder, so the rehearsal is bound
  to the copies it ran on; a source the workflow reads only under (« lis ./inbox ») is held as
  the folder it is, even empty; a file the run writes that the request never named is bound as
  the absence it was in your project. The proof then keeps what the request names and what the
  run wrote: files arriving in or leaving an inbox between runs are no drift. A proposal whose
  trial binds nothing says « No rehearsal bound to these bytes » and why.
- **A schedule in another zone than the Mac's can be armed with launchd.** launchd fires in the
  machine's zone, so `nika arm --emit launchd` refused a cadence such as `TZ=Europe/Paris 0 8 * *
  *` on a Mac set to another zone. The unit now wakes at each machine hour one of the schedule's
  slots can fall on over the coming year (10:00 and 11:00 on a Mauritius Mac for 08:00 Paris,
  summer and winter time). The firer reads every wake in the schedule's own zone: it runs the due
  slot and leaves the other wakes not due, without journaling them.
- **A free « Oui » to the author's approval question is the person's approval.** When the
  author asked « Veux-tu valider chaque envoi avant qu'il parte ? » and the person typed « Oui »,
  that answer bound nothing, so the gate it approved still read as invented and the author asked
  again (six times in one session). Such a yes now states the approval its question names, as a
  picked option already did; a « Non », a qualified no (« oui, sans validation ») or a yes to a
  question that asks no approval states none. Approval questions read their infinitive
  (« valider », « approuver », « confirmer ») and the person glued to the verb that asks them
  (« veux-tu », « dois-je ») or doing them (« par un humain »).
- **A French proposal card says its rehearsal in French.** The card beside a French proposal
  read « répétition · Rehearsed on a copy of your files · nothing ran on the originals · … »,
  while the proposal's own text said it in French. The rehearsal words a host draws now follow
  the person's language as the proposal does.
- **A French card says what runs in French.** A proposal's run-time rows (« writes … », « pauses
  for a human answer », the model estimate), the understanding note and the resume line were
  English on a French card; they now read in French, every path, host, model and amount as
  written.
- **A French session reads its proposals and its runs in French.** A French proposal still
  read « money: $0.25 USD · session default · proposal/Run ceiling · … », « when it runs: » and
  « apply this? (yes applies · …) », and its run « check · … · clean ✔ · ceiling $0.10 (saved
  with the workflow) » and « run observed · exit 0 · succeeded ». A person who writes French now
  reads them in French, every path, amount, identity and workflow byte as written. The identity
  a consent answers is unchanged. The ceiling's source now says « saved beside the workflow »:
  it is kept beside the file, never in it.
- **Asking one more change to a proposal no longer fails the turn.** The revisions of one
  proposal drew on one rehearsal account across every turn, so after a few changes each new one
  failed with « the session runtime failed: the shared turn rehearsal budget admits no further
  world ». A line that answers no open question now starts a fresh account; answering a question
  still continues the one it belongs to, and a suspended proof still waits aside.
- **A run's text result says its last line too.** The run card showed a declared text output
  by its first line. A journal each run appends to read the first run's line after every run, as
  if nothing new had been written. A text of several lines now reads as its first line, its last
  line and how many lines it holds.
- **A workflow that keeps its own state is rehearsed, first day included.** A journal it appends
  to, or yesterday's figure it compares with, was read in the rehearsal room as « read but not
  observed », or refused as an absent input on the first day, so the whole rehearsal was dropped
  and the first real run met the first-day case untried. A path the request names that the
  workflow both reads and writes is now handed to the room as its state: copied as it is, or held
  as the first day's absence, read back after the run, and its write advances the proof.
- **A jq step built from a `const:` value is compiled by `nika check`.** A `nika:jq` expression
  holding `${{ const.NAME }}` was skipped as « built at run time », so a constant set unquoted in
  the program (`${{ const.target_dir }} + "/"`, read by jq as names) checked clean and failed the
  first paid run with « undefined filter or variable ». The check now builds such a program
  exactly as the run does and compiles it; a template only the run can know is still left to the
  run.
- **A judge reads the Foundry offers it weighs, not the whole catalogue.** Every verification
  question carried each offered component with its contract, about 70 KB for fifty components.
  The decision seat could not read the whole-request question, so nothing was judged on the
  standard path. A question now carries in full the components the bytes hold; every other offer
  appears by identity, title and status. Only a localization, which weighs every contract, is
  sent them all. A seat that refuses a question as too large no longer advises a retry that
  would ask it again.
- **A refused key check says what the provider said.** Testing a key the provider refused
  answered with the hint a failed run prints for the command line (« NIKA-INFER-001 …
  `--access <seat>` »). It now reads the provider's own words and its error's kind, the key
  withheld.
- **A launchd unit given an env file passes its keys to the run.** `nika arm --emit launchd
  --env-file <file>` sourced the file through `/bin/sh` without exporting it: the plain
  `KEY=value` lines of a dotenv file never reached the firer, and every scheduled run that needs
  an API key failed. `nika arm fire --env-file <file>` now reads the file itself (plain
  `KEY=value` lines, an optional `export `, comments, blank lines, single or double quotes) and
  fires the beat with those variables set, never printing a value; a file it cannot read, or a
  line that is not `KEY=value`, refuses the fire before anything runs, naming the file and the
  line. The launchd unit hands `--env-file <file>` to the firer in its `ProgramArguments`, with
  no shell wrapper. Units written by an earlier engine are still recognized when they are
  re-emitted or retired.
- **A line typed after a failed run's diagnosis is the person's own message.** When a run the
  person's words authorized failed, Nika's note started a turn the model answered, but the
  proposal it ran still counted as waiting: the person's next line was read as that proposal's
  answer and moved into its reply, so the request ended on the model's own message. Claude Opus
  5.5 refused it (« does not support assistant message prefill ») and the turn failed. Once the
  model has answered such a note, nothing waits on the proposal any more.
- **A change that names the saved workflow's files revises it.** After a workflow was saved,
  « Trie le rapport par ligne. » could be read as new work. It then got an English question about
  the run model and an unrelated, paid `classify` workflow. A line that opens with a change (« trie
  », « ajoute », « retire », « sort »…) and names a file the saved workflow reads or writes, by
  name or without its extension (« le rapport » for `rapport.md`), now revises it. A line that
  states the work again, or asks for a new workflow, still starts one.
- **A judge locates a missing part over each offer's purpose.** On the standard path, every
  revision still overflowed the decision seat on one question: the localization of a missing part,
  which was sent every contract of the catalogue. It is now sent each offer's identity, title,
  purpose and status. The components the bytes hold stay whole.
- **A model's working notes are never shown.** A model that streams its reasoning as text (no
  reasoning field) had its English working notes, turn ids and finding names shown in the
  conversation and in a question card to a French person. The words beside a call are now shown
  only when they are written in the person's language, without what a reasoning tag
  (`</think>`, `</mm:think>`) closes or opens.
- **A model the person named is told how to state it.** A model the person named in words
  (« Grok 4.7 (xAI) ») but stated by the author as typed (`answered`) was refused as words
  « not in the person's line », though they were; Grok 4.7 retried other excerpts of the same
  line again and again. The refusal now says the value was not typed and asks for it as
  `named` with the same words.
- **A newline after a lone reference is written.** `content: "${{ with.d.version }}\n"` wrote
  `3.15.0` without its newline, and `"${{ x }}\n\n"` lost both: a string holding one reference
  and only whitespace around it was read as the reference alone, which keeps the value's type and
  drops the whitespace. Only the reference alone keeps its type now; any other character around
  it, whitespace included, is text. A `for_each` collection is still read whole when a block
  scalar leaves whitespace around its reference.
- **A per-run budget never blocks a proposal.** « … chaque run doit coûter au maximum 0,10 $ :
  budget max 0,10 $ par run » was read as an obligation whose quote spanned the model clause too,
  and the first proposal was blocked twice for a ceiling no task can carry. An obligation whose
  requirement states only the Run ceiling beside the candidate is now carried there. A copy of a
  saved workflow also keeps the ceiling the person set for its next runs in the conversation
  (« Le plafond est de 0,10 $ par run stp », then « identique à … »: the copy ran at $0.25).
- **An approval the person picks is their gate.** The approval laws read only the person's typed
  words, so a gate they picked from a question (« Oui, je valide chaque run avant l'écriture de
  jobs-<date>.md ») was refused as an invented gate, while the Rule of Two required that very gate:
  a job digest that read the person's profile was refused after each of five such questions. The
  laws now read the label of an offer the person picked themselves as their words: the gate it
  asks for stands, and a candidate without it owes the approval. A choice left to Nika or a label
  that denies the approval states none.
- **A proposal's choice takes the words you type beside it, and `cancel` discards the
  proposal.** The card's hint said « or type your reply · cancel drops it », yet a sentence of
  your own came back as « not taken · answer text restored for editing » after Nika had read and
  answered it, and « cancel » or « annuler » were sent to Nika as one more answer, so the only
  way out was to accept a change you did not want. Words Nika reads now stay said: its reply
  shows above the choice, which keeps waiting. `cancel` or `annuler` on its own line discards
  the proposal through the same door as « Discard this proposal », with no model call and
  nothing written, and the hint now says `cancel discards the proposal`. An offer that is itself
  named `cancel` still answers the choice.
- **A proposal of the saved workflow says nothing changed.** The saved workflow proposed again
  byte for byte showed Save, Save and run once, and Discard. It now says nothing changed and how
  to run or activate it, and no proposal waits.
- **The Session no longer crashes when the decision seat skips an oversized question.** After the
  seat had refused one question alone for its context, a later, larger question was skipped
  without a place in the request journal. The next request then settled at the wrong index and
  the terminal app panicked (`batch.rs:121`). Every skipped question is now journaled as never
  sent, in its own place.
- **A question the author asked owns its answer.** After an accidental « annuler », the author
  asked when the journal should be written; « tous les soirs à 20h » then opened the activation
  of the welcome example saved earlier, and its zone, missed-run and ceiling questions. A line
  that answers a question the author asked now reaches the author; with no question waiting, a
  schedule stated for the saved workflow still activates it.
- **A rehearsal says when what it read back came from steps it did not run.** A trial that
  could not run three model steps still read back the file written behind them, « _Aucun article
  sur les 7 derniers jours._ » three times, as if it were the result; the real run wrote 46
  articles. A trial now says that what it read back of a file its unrun steps write never is what
  a run writes.
- **A recommended run ceiling says why, never as a ratio.** The ceiling question of an activation
  said « $0.10 · ~3× the last run, $0.0015 », read as $0.10 being three times $0.0015 (it is
  about 67 times). It now says « covers at least 3 runs like the last one, $0.0015 ».
- **A run whose gate the person refused is never said to have succeeded.** After a « non » at a
  gate, the observation line now says « exit 0 · stopped at your no » / « arrêté à votre « non » »
  instead of « succeeded ». `/status` says « Last run · Done · stopped at your no » / « Dernier
  run · Terminé · arrêté à votre « non » » instead of « le run a réussi »
  (`RunFacts::refused_at_gate`).
- **A refused key reads plainly while a workflow is prepared.** When the provider refused the
  key of an authoring call, the recovery card carried the hint a failed run prints for the
  command line (« --model … --access <seat> »). It now says the provider refused the
  connection's key, with the provider's own words, and to check it with « Test the key » in
  `/intelligence` or choose another connection.
- **A turn whose proposal was refused says so, whatever the reply claims.** After Nika's check had
  refused every draft of a turn, the author's own words reached the person as they were, and could
  read « C'est enregistré et lancé » while nothing was proposed, saved or run. Such a turn now ends
  with « Nothing was proposed, saved or run in this turn: Nika's check refused the draft. » (in
  French in a French conversation), after the author's words. A turn that refused no proposal
  carries no such line.
- **A refused revision says the proposal you saw still waits.** When Nika's check refused a
  revision while an earlier proposal was still waiting, the turn ended with « Nothing was
  proposed, saved or run in this turn », beside a proposal the person could still save. It now
  says « This turn changed nothing: Nika's check refused the revision, and the proposal shown
  before still waits for your answer. » (in French in a French conversation).
- **A rehearsal holds the folders and patterns the request names.** A request naming a folder
  (« inbox/ ») was not rehearsed: the room refused the folder as no regular file, and
  `nika:glob` was outside what a rehearsal runs. The room now copies a named folder with each
  file under it, and makes an empty one empty: the empty day is rehearsed too. It copies a named
  pattern by its matches. A rehearsal runs `nika:glob` and `nika:remove_file` over its own copy. A
  listing that no named folder or pattern holds is refused before any room, as a read is.
- **A rehearsal names a web read as one.** A `nika:fetch` whose answer jq shapes was listed
  among the steps not run as « a jq extraction » (« une extraction jq »), which reads as a jq step;
  it is now « a web read through jq » (« une lecture du réseau filtrée par jq »).
- **A rehearsal is told in French to a person who writes French.** The proposal's rehearsal
  lines (« Rehearsed on a copy of your files … », « tried on the pages observed at … », « not
  run: the model step (…) … ») stayed English under French answers. They now read « Répété sur
  une copie de vos fichiers … », « essayé sur les pages observées à … », « pas lancé : l'étape du
  modèle (…) … ». Names, paths, excerpts and reasons stay as written. The proof keeps the engine's
  own words.
- **A rehearsal tries the day a gated step is skipped.** A workflow could pass its check and
  its rehearsal, then fail its first run with nothing new: a filter after a skipped step read its
  null (« cannot use null as string », « cannot use null as iterable »). After its run, a
  rehearsal now evaluates each such `nika:jq` step on that null, in its bounded jq process. It
  fails with `NIKA-REHEARSAL-SKIPPED` only when the null alone makes the filter fail: the same
  filter passes with a value in its place. The author then guards the step before anything is
  proposed.
- **A rehearsal tries the steps after a model step on an example of its answer.** A trial ran
  no model step, so it never ran the steps after one either. A workflow could pass its check and
  its trial, then fail its first run in a step that read the model's answer, or a date beside it,
  the wrong way. When a model step declares its answer's shape (`schema:`, `returns:`), a second
  pass stands an example of that shape in for the answer, over the room's files, writing nothing.
  A step behind it that fails on the shape (a jq type error, a binding that reads beneath a value)
  fails the trial with `NIKA-REHEARSAL-SHAPE`. A failure of content (an assertion, an empty
  filter) is the example's, never counted. Nothing this pass computes is shown as a result.
- **A file the run removed no longer reads « produced ».** The run result listed every path the
  run was allowed to write as « produced », so the inbox files a run moved to `traites/` read
  « produced · ./inbox/… ». A path that is not there now now reads « removed » when a
  `nika:remove_file` step of the run took it away, « not there now » otherwise; the run's own
  completed writes still read « produced ».
- **A reopened conversation checks its saved workflow again.** After a restart, the workflow
  the conversation saved is checked again on disk, with the same audit the save ran and no model.
  An unchanged clean file now stays « Vérifié » instead of « Vérifié ○ », and a file changed into
  findings says so.
- **A reading that repeats a coverage row is said once, not repaired.** When the author's
  reading of the request covered one span in two rows (« coverage[1].span · This identifier is
  repeated »), the verification started a repair round with the model: 2.7 minutes, then 9.7, on
  a slow model, before anything was judged. Rows for one span or one answer key are now merged,
  their references united, before the reading is checked. Nothing the reading claims is dropped.
- **A candidate refused the same way under a new revision is told it repeats.** The author was
  never told it was repeating itself when the same `candidate_write` came back refused with the
  same findings, because each reply carried a new revision number: Grok 4.7 sent it some sixty
  times. The revision is left out of the comparison, so the repetition and stall notes reach the
  model from the second and third identical call.
- **A request over the model's context window is told apart from other refusals.** A
  provider's documented overflow code (`context_length_exceeded`) used to be dropped, so
  the failure read as a generic HTTP 400. It is now a typed context overflow that names
  the model's window when the catalog knows it. On a wire without such a code (Anthropic),
  a 400 `invalid_request_error` counts as an overflow only when Nika's own estimate of the
  request reaches that window; the provider's wording never decides. The overflow is
  never retried as transient, and 429, 503 and 529 stay transient rejections. An answer
  that stopped because the context window was full (Anthropic
  `model_context_window_exceeded`, Mistral `model_length`) stays cut, as before: never a
  normal end, its tool calls never run. It now also carries a window-full marker, set too
  when a provider reports more input than the model's window holds, so a conversation
  can compact before asking again instead of re-sending the same full window.
- **« je voudrais l'enregistrer et le lancer » saves and runs the proposal shown.** Requests around
  the save and run words are now read by the closed consent grammar, so they no longer reach the
  author as new work: « je voudrais », « pouvez-vous », « can you », « I'd like to », with the
  infinitive verbs « l'enregistrer », « le lancer ». A line that asks anything more keeps its
  route.
- **A request to see the results never starts a run.** Asking to show, display
  or read what a workflow produced (« Pouvez-vous me montrer le contenu des
  trois traductions », « affiche le résultat », « lis-moi », « show me what it
  wrote ») could be heard as a request to run it again: a metered run then
  rewrote the very files the person wanted to read. Such a line now never
  reaches Run, whatever a classifier hears in it, even beside a run verb; the
  conversation answers it from the files or the last trace, and a run still
  takes its own words (« lance-le ») (NIK-234).
- **A refused call names the amount it needs.** A model call whose reservation the stated
  allowance cannot cover was refused with « remaining catalog allowance cannot cover the
  full-context reservation ». It now names the reservation, what it covers (for Grok, its whole
  generation, since a request cannot bound its reasoning), what remains of the allowance, and the
  amount to state: « state at least $3.40 for this work, or choose a model whose call reserves
  less ».
- **A result offer, a decision and a schedule are said once.** After a run, « What would you
  like to adjust in this result? » was printed twice: in the run's words and on its own card. A
  trigger's decision repeated « Install the trigger on this Mac? » under its own heading, and a
  schedule read « every day at 9 · every day at 9 (Mauritius time) ». Each is now said once; words
  the cadence reads differently stay beside it.
- **A resumed run keeps its ceiling.** A run that paused at a gate and was resumed without
  `--max-cost-usd` ran its next leg unbounded (« budget: none journaled »). The run answered in
  the same terminal got its whole ceiling again. Now both continue under what the paused leg's
  ceiling leaves after its spend (`RunFacts::ceiling_left`), and the resumed leg journals that
  budget. A ceiling stated on the resume still stands as given.
- **A run a gate split reports the ceiling it started under.** Its resumed leg records only
  what the first leg left, so the report said « ceiling · $0.212482 » for a run started under
  $0.25, and a ceiling stop compared the whole spend with that remainder.
- **A revision of a budgeted workflow is no longer refused for its ceiling.** After a workflow
  saved with « 0,10 dollar par run » was run, every revision was refused: « the judge finds no
  task performing » the budget. The person's later words for the same ceiling (« le plafond de
  0,10 dollar s'applique au lancement du run ») were not the words beside the candidate, so the
  judge was asked to find a task for a ceiling only the Run applies. Words that say only the
  ceiling of the amount beside the candidate are now carried there, as the first statement was.
- **A run's card shows one task count and one cost.** The card under a finished run said
  « ✔ Ran in 1.7s · 20 tasks · $0.005 » while the run's result beside it said « 9 tasks ran (6
  from cache) · 2 skipped » and « cost · $0.0046 ». A run as small as « <$0.001 » read
  « cost · $0.0004 » there too. The card now counts tasks as the result does: the tasks that
  ran, those answered from cache, then those skipped, failed or never run. It also writes every
  cost on the card at the result's precision (`$0.0046`).
- **A run line with courtesy is still a run.** « lance copy.nika s'il te plaît », « lance-le une
  fois » and « relance-le tout de suite stp » were not read as run lines. They reached the
  conversation instead, and in one case met an English reply. They now run as « lance-le » does.
  « lance-le une fois par jour » still is not a plain run: it asks for a schedule.
- **A run names the items it recovered.** A site check listed `https://example.com`, a host its
  workflow permits, and logged it as down with a code 0: the transport never dials a
  documentation address (RFC 2606/6761), the step recovered the item, and the run report said
  nothing of it. The report now names each item of a list that failed and was recovered, and
  says when the address is one Nika never dials, in the person's language.
- **A run number of no amount is refused in French to a French person.** « that number has no
  explicit monetary meaning … » now reads « ce nombre ne dit pas un montant … » in a French
  conversation; the money record keeps the reason as found.
- **A run refused before it started says why.** A run the engine refused before its first step
  (an access path refused, NIKA-1800, for an effort Gemini does not offer) showed only « exit 3 ·
  refused by the environment »: its reason went to a discarded stderr. The run's lane now keeps
  that reason and shows it as the run's line, never doubling a reason the stream already gave,
  and the conversation hears it with the person's next line instead of guessing a cause.
- **A run says whether each step that sends sent.** The run card named the files a run produced,
  but not whether its webhook or notification went out. Each step that sends beyond the machine
  (a notification, a request other than GET) now reads « sent · `ping` · the step completed »,
  or « not sent · `ping` · its condition was false » (cancelled, failed, served from the cache),
  in the person's language.
- **A run now settles a crashed run's leftovers when it starts.** A run killed before its
  end (SIGKILL, a machine that went down) left the files it created in place as if
  whole, and the original bytes of the files it changed in `.nika/originals/`, where
  nothing ever mentioned them. Each file a run first writes now leaves a small record
  there, with the digest of a created file's bytes after each write. The next `nika run`
  in the project settles a run whose journal shows it dead: a file it created moves to
  `.nika/quarantine/<its run>/` only while its bytes are still the ones it wrote (a file
  you changed since stays where it is), a file of yours it changed stays and its
  original moves to `originals/`, and a `manifest.json` lets `--resume` of that run put
  the moved files back. A run that is still alive, or whose state cannot be proven, is
  never touched. Each action is one line on stderr.
- **A save and its checks are said in the person's language.** A French conversation read
  « applied · wrote », « check · … · clean ✔ », « running … once · ceiling $0.25 », « (the
  proposal still waits …) », the source freshness lines, the ceiling question after « save &
  run » and every withdrawal in English. They are now said in French to a person who writes
  French, and a rehearsal that read no file no longer prints an empty « les fichiers de l'essai
  sont tels qu'il les a vus :  (…) ».
- **A schedule question names its hour in French.** For a cadence with no stated hour (« toutes
  les heures »), the French questions read « il fixe quand tombe the scheduled time » and « Si cette
  machine est éteinte à the scheduled time ». They now say « l'heure prévue ».
- **A schedule stated for the saved workflow opens its activation.** After a save, « déclare-la
  à côté, tous les jours à 8h heure de Maurice », « je voudrais que ce bilan se fasse tout seul
  le 1er de chaque mois à 8h » or « ok tous les jours à 8h du mat alors » now open the activation
  with that cadence, as « active-le » does. They used to reach the author, which tried to write
  the schedule into the workflow and failed after several minutes. A zone the line names
  (« heure de Maurice », « Europe/Paris », « Paris time ») answers the zone question, which is no
  longer asked again. A line that also asks something else, or asks for a new workflow, keeps its
  route.
- **A schedule's time zone shown as a choice is said to be the schedule's.** An author that
  offered the schedule's zone among the choices beside the candidate was told to write it in the
  candidate, which a schedule binding never is, and tried 35 times. The refusal now says to give
  it as the schedule's `timezone` or ask it, and to leave it out of the shown choices.
- **Searching the intelligence list counts its matches, not every model behind it.** Typing a
  name over the list of connections showed « 1 of 657 match » next to about 23 connections. The
  657 counted every model of every connection, which the list keeps out of view until a search
  finds them. Where a search can find such rows, the title now counts the matches alone
  (« 1 match », « 17 matches »). A list that shows every row keeps « 4 of 30 match ».
- **An agent account that cannot write workflows says so before you choose it.** The
  intelligence list offered « copilot · Agent account » with no warning. Once chosen, every
  request failed with « authoring unavailable · seat `copilot` is not infer-grade for
  json_schema ». The list now reads « copilot · Agent account · cannot write workflows here » on
  the connection's row and on its own. The check is the same one applied once a seat is chosen:
  one turn, no implicit tool, an answer checked against a JSON schema, and an observable model.
  Accounts that can write workflows show nothing new.
- **The intelligence list's filled radio marks the choice in use, not the cursor.** Moving
  through the list filled the radio of the row under the cursor, so « › (●) GPT-6 Astra » could
  read as the current choice while Claude was in use. The filled radio now stays on the value
  the list holds: the model in use, the decision seat consulted, or the model requested for
  Run. The cursor alone shows the row `Enter` applies.
- **A schedule's zone, once settled, stays settled.** After a repair of the saved workflow,
  « active-le tous les matins à 7h » asked the zone again. A revision that carries no schedule
  now keeps the one asked for the workflow, zone included. « Choisis pour moi » at the zone
  question takes this machine's zone and goes on; before, the Session demanded `Area/City`
  syntax. A word that names no zone is refused in the person's language.
- **An OS unit left behind by an edited schedule is named and refused.** After a cadence
  change in `nika.yaml` without re-running `nika arm --emit … --write`, the installed unit
  kept waking `nika arm fire` at the old time; the beat answered « not due » every day and
  nothing woke it at the new time, while `nika arm` still reported it READY. Each beat
  unit now carries the revision of the schedule it was written for (the cadence, and for
  launchd the machine zone it was rendered in) and hands it to the firer, which refuses a
  wake from a stale unit with the re-emit that fixes it and fires nothing. `nika arm` lists
  such units under « unités périmées », and also names a unit written by an older engine,
  which carries no revision. Re-run the emit with `--write` once to give existing units
  their revision.
- **An author stuck repeating one failing call is told to change it.** On Gemini 3.1 Pro the
  author copied the note Nika leaves in its history in place of an earlier candidate's document
  and sent it as a new candidate 80 times in 15 minutes, each refused « needs the complete
  document in `source` ». That refusal now names the copied note and the two ways out (the whole
  document, or `candidate_edit`), and a call that returns the same reply three times in a row is
  told that repeating it cannot change the reply. Nothing stops the conversation: no quota.
- **A step whose output is over 1 MiB no longer ends its run's trace.** A fetched 454,763-byte
  JSON page made a 1,180,930-byte `task_completed` frame: its `output` and its `outcome` each
  carry the value, the journal refused the line (« journal line is 1180930 bytes; maximum is
  1048576 ») and the trace stopped there, so the run could not be resumed. A frame over the
  line bound now moves its largest values, one at a time, to `<trace>.values/<sha256>` beside
  the journal until it fits, each field keeping the value's digest, and `spilled_fields` names
  them. The chain commits to each digest, `--resume`, `nika trace show|replay` and the debugger
  read the values back only when their bytes match it, and `nika trace verify` refuses a value
  that is missing or altered. The line bound stays; trace retention removes the values with
  their journal and counts them in its budget.
- **A decision seat that cannot hold a document no longer stops its proposal.** When the decision
  seat's context is too small for the state a verification asks about, every question was sent,
  refused, halved and sent again (about a thousand calls in two live runs) and nothing was ever
  proposed. A question larger than one the seat already refused alone for its context is no
  longer sent, and a verification the seat stopped is judged by the authoring model instead. The
  proposal says which seat could not judge and which model did.
- **A choice gate takes the answer its resume line prints.** A choice gate whose choices spell
  numbers (`choices: ["42", "17"]`) printed `--answer review=42` to resume, then refused that
  very line: `42` was read as a number, not one of its strings, and a shell could not pass the
  JSON string without a second quoting. An `input` or `choice` gate now takes the text typed
  (`'"42"'` still gives its text); a word outside the choices is still refused.
- **A topic is selected by the model, never by keywords.** « les 5 top stories de la front page
  qui parlent d'IA » was written as a fixed keyword regex: it missed AI stories that do not use
  the words and kept stories that only mention them, so one story in five was wrong in every run.
  The author is now told that selecting items by what they are about is a judgment: an `infer`
  step returns the matching identifiers, and a deterministic step keeps them in the source's
  order. A filter on words the person names exactly stays deterministic.
- **A trial names the steps it cannot run behind one it does not run.** A trial said « not
  run: … the model step (select_top) … » and nothing of the steps that read it, which were not
  tried either (the first run failed in one of them). Its words now add « nor what reads them: »
  with those steps, in the workflow's order.
- **A Unicode regex class is found before the run.** `test("\\p{L}")` compiles as jq, then the
  runtime's regex engine refuses it on the first item: a clean check was followed by a failed
  run. The check now names the class and the way out (an explicit set such as
  `[A-Za-zÀ-ÖØ-öø-ÿ]`), so the author repairs it before proposing.
- **The trigger install says when a scheduled run would not see the API keys.** A unit started by
  launchd does not inherit the terminal's environment, so a workflow whose model reads its key
  there (`NIKA_ANTHROPIC_API_KEY`, `ANTHROPIC_API_KEY`…) would fail at every scheduled run.
  « Installer le déclencheur sur ce Mac ? » now names those keys, says the run would fail until
  the project's units load a file that holds them (`arm --emit --env-file`), and recommends
  keeping the schedule declared. Workflows with no model step, with a mock or a local model, or
  whose units already load an environment file naming their keys keep the card as before.
- **A line that sets the ceiling moves it.** « Mets le plafond à 0,001 $ par run et relance »
  was not read as money: only a ceiling phrase attached to the work (« avec un plafond de … »,
  « budget max … ») was, so the run kept the first request's 0,10 $. A verb that sets the work's
  limit (« mets », « remets », « passe », « set », « change », « je veux un budget de … ») now
  states the ceiling, « à » and « to » link it to its amount, and the directive ends before the
  conjunction that opens the next clause. A record's budget (« le budget du client à 500 $ dans
  ./clients.csv ») stays data.
- **A verification no longer reads the same request again.** Every verification in a
  conversation asked its author to read the person's request, then asked for an audit of that
  reading, even when the words had not changed. With Grok 4.7, those calls took 89 % of a
  session's reasoning tokens. The Session now keeps, in memory, the last reading audited as
  covered. The next verification of the same words, answers, model and prompts reuses it with
  no call. The judge still judges every candidate, and a reopened conversation reads and audits
  the request again.
- **A workflow named without its extension is the one run.** « je voulais relancer
  journal-histoire-du-soir » ran the last saved workflow, journal-recopie.nika, twice. A line
  naming exactly one project workflow by its name (a hyphen, an underscore or a digit in it)
  now runs that workflow; two such names, or a plain word, name none.
- **A workflow may read back the file it keeps.** « Il garde le chiffre d'affaires du jour pour le
  comparer au jour suivant » asks for state a next run reads. The output law refused any read of a
  derived output, so every such workflow was refused and the author re-parsed an older report
  instead. An output may now be read back by the workflow that writes it (`nika:read`,
  `nika:grep`, `nika:glob`), and nothing else uses it. A read source that a pure step builds
  addresses from is refused with the way to keep it: compose the base address in the `url:` of the
  fetch that reads each item.
- **A workflow that keeps its own state runs again.** A rehearsed workflow that reads and writes
  the same file (a log it appends to, yesterday's figure it compares with) could run once: every
  later « lance-le » was refused because that file had « appeared » since the rehearsal, and the
  only way out was the command line. The run's own completed write now advances that file in the
  rehearsal's witness, like any file the workflow only writes. An edit by anyone else after the
  run, or of a file the workflow only reads, still withdraws the rehearsal.
- **A workflow that also writes a file you never named runs again.** A site check that appends to
  `statut.log` and keeps its own `etat_echecs.json` could run once: every later « lance-le » was
  refused because `statut.log` had « appeared » since the rehearsal. One written file outside what
  the rehearsal witnessed cancelled the whole advance. Such a file is now left out of the witness
  (nothing witnessed it, so it can never drift), and the files the rehearsal bound advance as
  before. A source edit, a foreign write, or a write outside the project still withdraws it.
- **A written text file ends with a newline.** Translated notes written from a model's answer
  ended on their last character, while their sources ended on a line break. The author is now
  told to end each written text with one line break.
- **« Oui, enregistre » saves.** A plain yes before the save verb (« oui, enregistre »,
  « ok, save it and run it ») and a courtesy after it (« stp », « s'il vous plaît », « please »)
  were not read as the consent they gave, and the proposal waited on. They are now read as the
  closed save, or save-and-run, line they are; a line opened by another word keeps its route to
  the author.
- **« oui, enregistrez ces changements » saves the card it answers.** Under a card whose option
  reads « Enregistrer ces changements », the person's « oui, enregistrez ces changements » was
  not read as a yes: it reached the author, which proposed something else, and the `nika.yaml`
  was never saved. A yes may now name what the card shows: « ces changements », « these
  changes », « ça ».
- **« Oui, activez-le » and « vous pouvez l'activer ? » open the activation.** Only an
  imperative opened it: « oui activez le s'il vous plait » ran the workflow once more instead,
  and « vous pouvez l'activer ? » became a change proposal, so a French person had to learn the
  English keyword « activate ». A yes before the words, a space for the hyphen and the polite
  question forms now open the activation, whose questions still decide everything.
- **A yes to the bytes a file already holds says nothing changed.** The landing said « applied ·
  wrote » for a proposal identical to the saved workflow; it now says « applied · nothing
  changed in … ».
- **A yes with its go-ahead consents to the proposal shown.** « Oui, allez-y », « ok vas-y
  merci » or « yes, go ahead please » under a proposal card now save the bytes shown, as « oui »
  does. They used to reach the author as new words and start a fresh revision. A line that adds
  anything else (« oui mais change le titre ») still goes to the author, and a spending approval
  still takes the strict yes.
- **A cloud inference call is no longer cut at 30 s by a deadline the workflow never declared.**
  An `infer:` task without `timeout:` gave a buffered cloud call a total deadline of 30 s (300 s
  for a local model), so a legitimate answer from a reasoning model or a long prompt failed with
  NIKA-INFER-001 (provider 408) and the Run wrote nothing. Every buffered call without a task
  `timeout:` now gets 600 s, local or cloud: the provider transport's own bound on a connection
  that delivers nothing. A task `timeout:` still sets its own bound, streaming keeps its
  idle-read guard, and the timeout message names the deadline that applied.
- **A call that wrote to the provider's prompt cache keeps its price.** Nika priced a call
  that reported a cache write as unknown. It now prices the written tokens at the catalogue
  row's own cache-write rate (the five-minute one, the only lifetime Nika asks for). A row
  that states no write rate, a declared tariff and an admission tariff still leave such a
  call unknown, as do two write meters that disagree.
- **« annuler » at a question the author asked drops it.**
  Gauntlet wave 3: « cancel », « annuler » or « laisse tomber » typed at
  the author's question reached it as one more answer. The hosts' one
  cancel reader now drops the question with no model call: nothing is
  bound, the author reads in one fact that the person dropped it, and
  asking it again is refused. A cancel word the question itself offers
  (an option « Annuler ») still answers it.
- **The native authoring card's example no longer caps its `infer`
  step at `max_tokens: 600`.** The card's own rule says to write
  `max_tokens` only when the person names a token bound and otherwise to
  leave the default to the compiler, which sizes it once the workflow's
  model is known; its example contradicted the rule, and an author that
  copied the 600 left a model that reasons before it answers no room to
  answer.
- **Carriage returns leave a model's call arguments.** GLM 5.3 Flash slipped carriage returns
  between the words of its calls (`schedule\r_zone`, `Indian\r/Mauritius`) and copied its own
  earlier calls with more of them each time: 115 calls were refused for a key or a time zone that
  did not match. They are removed from every call's arguments before the tool runs and before the
  call is recorded, so the model never reads them back.
- **`nika check` no longer says a run would fail for a model its catalog does not
  list.** The advisory line under MODELS, the oracle's `models_catalog_warnings` and
  the MCP `nika_check` now read: not one of the provider's models in this binary's
  catalog snapshot, a typo or a model newer than the snapshot, and the provider
  decides at run time. It stays a warning, never a refusal.
- **« Augmente le budget du run à 1 dollar » states a ceiling.** The money reader took the word
  after « budget » as the amount, so « le budget du run à 1 dollar » was refused as an invalid
  amount, and an unaccented « a » (« budget du run a 1 dollar ») stopped the reading too. The run a
  ceiling bounds may now be named between the anchor and the amount (« du run », « of the run »,
  « pour ce workflow »), and « a » reads as « à » before an amount.
- **`nika check nika.yaml` judges the beats as `nika arm` and `nika serve`
  do.** It read the project file's shape only, so a beat whose cadence has
  no `TZ=` zone, names an unknown zone, breaks the cron or readable grammar,
  carries a `décalage` other than `hash`, a `jusqu_au` that is not a date or
  a workflow path with a `..` segment passed `check` and was refused only
  when someone armed it. `check` now applies the arming door's own laws
  (the same function `nika arm` uses) and names every law broken, each with
  its beat, its code and its fix; `--json` lists one finding per law.
- **`nika check` names a read that breaks when its producer is skipped.** A task
  that can be skipped (a `when:` that can close, an empty `for_each`, `on_error:
  skip`) hands its readers `null`, and a `with:` binding is evaluated before the
  reader's own `when:`: `u: ${{ tasks.x.output.url }}` guarded by
  `when: ${{ with.u != null }}` failed the run with `NIKA-VAR-001` while `check`
  said « run ready ✔ » with zero hints. `check` now carries a `skipped-read`
  hint for such a read, in a binding or in a `when:`, `for_each:` or verb field
  stepping into a whole bound value that no `when:` rules out as null. The hint
  names the reader, the read, the producer, why it can skip and the repair: bind
  the whole `tasks.x.output`, test it in `when:`, then step into it in the verb.
  Guards that hold once the producer skipped stay silent (`has()`, `!= null &&`,
  the producer's own consent guard repeated), so does a task the skip cancels
  or a verb read its `on_error:` recovers. Advisory: `is_clean` is unchanged,
  and past the 2,000-task analysis cap the miss is stated.
- **The CI file ratchet honours `LOC-EXEMPT`, as the hygiene dashboard does.** A source file
  with a whitelisted marker (codegen, lookup-table, enum-mega) on one of its first 5 lines may
  hold up to 5,000 lines in CI too, where it used to be refused above 2,500. Both gates read one
  file-size policy and state the same verdict for the same file.
- **A Claude 5 model's fixed sampling and adaptive thinking are named at check, not by an
  HTTP 400.** The catalog records that Claude Fable 5.1, Fable 5, Opus 5.5, Opus 5, Sonnet
  5.5, Sonnet 5 and Haiku 5.5 think by default and, on Anthropic's API, refuse a thinking
  budget and any temperature but the default. `nika check` and the run's model admission
  name a `temperature:` (on `infer:` or `agent:`) or a `thinking.budget_tokens` on such a
  seat, a nickname included, with the repair; the Anthropic wire refuses the same request
  before any byte instead of dropping the value. The Session's classification calls send
  no temperature to these models.
- **A Claude Code session over ACP no longer reads as silent while it
  thinks.** Every Claude Code session the engine opens (the authoring and
  `infer:` one-shot profile, and the `agent:` seat) now asks the adapter
  for adaptive thinking with its summary displayed
  (`_meta.claudeCode.options.thinking`), unless a thinking option is
  already named. Recent models otherwise default to signature-only
  thinking whose text is empty, which the adapter never streams, so a long
  thinking turn showed no frame at all until its answer, and could be cut
  as silent. This changes what is displayed, not the model, effort, budget
  or tools; thought frames stay counted, never stored as text, and the
  silence allowance is unchanged. Codex and other adapters send nothing
  new.
- **A `claude-code` call no longer runs with the person's own Claude Code setup.** `--tools ""`
  empties only Claude Code's built-in tools: every MCP server of the person's configuration
  (plugins and claude.ai connectors included), their hooks, plugins and personal CLAUDE.md still
  loaded into each authoring, conversation and decision call through `claude -p`. Measured on
  2.1.283: 180 MCP tools and about 115,000 input tokens for a one-word answer, and an authoring
  call that ran a web-search MCP tool, then stopped at its one-turn limit, which the TUI showed as
  « I couldn't use the authoring model for this part ». The call now also passes
  `--strict-mcp-config` and an empty `--setting-sources`, the isolation the ACP completion profile
  already has: a model or effort set in the person's Claude Code settings no longer applies to
  these calls either, and the CLI's own default for the account answers, as on the ACP route.
- **Claude Sonnet 4.6 and Claude Haiku 4.5 are priced.** The catalogue still offers these two
  legacy models, but they had no admission tariff: the author offered them as « prix non connu
  ici », and no run ceiling could be checked against them. Two rows now read Anthropic's pricing
  page of 2026-10-16 (Sonnet 4.6 at $3 in / $15 out per million, its whole 1M window at standard
  rates; Haiku 4.5 at $1 / $5, a 200K window) and each model's own page for its limits. Claude
  Sonnet 4.6's catalogue limits were also out of date (200K, 8K output): its page says 1M and
  128K.
- **A refused cloud key reads « key refused », and a keyed route's own listing governs its
  offers.** A Session's census used to call every keyed cloud route ready from the key's presence
  alone: a key the provider had revoked was offered, and the offers came from the catalogue. The
  census now sends each keyed OpenAI-compatible route one bounded, authenticated
  `GET {base}/models` with its own key (about 3 s, all routes at once, never an inference): a 200
  lets the listing govern the route's offers, a 401 or 403 reads « key refused » with the
  provider's own words (the key withheld) and the route is not offered, and no answer leaves the
  key configured, not validated.
- **Codex authors again on codex-cli 0.162.** Nika admits Codex as an author only on the codex-cli
  minors where its pre-execution empty-tools profile was measured, and that was 0.160 alone: after
  the CLI updated to 0.162.1, every authoring call refused with « codex-cli 0.162 has no measured
  pre-execution empty-tools profile », so the `codex` account could not write anything. The
  profile is now measured on 0.162.1 (every disabled feature reads `false`, a prompt asking to read
  a file, run a command and search the web ran no tool and never saw the file, a JSON-schema answer
  came back in one turn) and that minor is admitted. Any other unmeasured minor still refuses
  before the prompt.
- **A Codex conversation's approval of Nika's own tool is now recognized.** codex-acp 1.13.1
  announces each MCP call with the server and tool Codex routed it to, then asks Codex's
  approval of it by the call's id alone (`{toolCallId, kind, status}`); Nika read only Claude
  Code's tool name, so it rejected every such ask. Codex 0.156.1 asks one before each Nika tool
  that is not read-only (`candidate_write` among them), and a rejection reaches the model as the
  user cancelling the call, so no Codex-led Session could write a candidate. A turn now keeps
  what each open call was announced as, and an ask by id alone is for that call; Codex's own
  question (`Allow the <server> MCP server to run tool "<tool>"?`) is read when codex-acp cannot
  tie the ask to one. Only an offered tool on Nika's server is allowed, once; an id never
  announced or no longer open, another server, a tool Nika does not offer and a command stay
  rejected. Claude Code's path is unchanged.
- **A Codex-led Session conversation can write its candidate.** Codex 0.156.1 asks before each
  Nika tool that is not read-only, and the ask reaches the client only through its
  `tool_call_mcp_elicitation` feature, which the Codex profile turned off with every other
  feature. Codex then asked through `request_user_input` instead; codex-acp 1.13.1 answers that
  itself with no answer, because Nika advertises no form elicitation, and Codex reads no answer
  as the user cancelling the call. So `candidate_write` was cancelled without Nika ever being
  asked. The conversation profile now keeps that feature on, and the spawn-time read-back
  requires it on, so each ask reaches Nika as `session/request_permission` and Nika allows its
  own tool once. The one-shot completion profile and `codex exec` keep it off.
- **An open name the request already settles is no longer asked.** When a
  request leaves open where a file's name starts (`un payload
  out/notification.json`), a folder another path of the request names
  (`out/report.json`) settles it, and an answer the person gave counts on
  every document door. A name nothing settles is still asked, with its
  readings as the options and the path alone as the default.
- **A request opened or closed by « tout les matins » states its
  schedule.** The compiler's reading of a request took « tous les » and
  « toutes les » as the quantifier of a cadence at the start or at the
  end of a sentence, but not « tout les » or « toute les » as people
  often type them, so « tout les matins à 9h, … » kept no trigger. They
  now read the same way; the singular « tout le matin » (all morning
  long) still opens no schedule.
- **A child grant inside its parent's glob now composes.** A parent granting `fs.read: ./references/**` and a child declaring and reading exactly `./references/preview-shell.html` were refused with `NIKA-COMP-002`, because the parent ∩ child meet kept only grants spelled identically on both sides; repeating the parent's wider glob in the child was the only way through. The meet now keeps a pattern the other side contains, at its narrower spelling, for `fs.read`, `fs.write`, `net.http` and `tools` (`*.example.com` ∩ `api.example.com` is `api.example.com`, `nika:*` ∩ `nika:read` is `nika:read`), in the reading of the matcher each family is enforced with. `nika check` and the run share that one meet, so the child's read is admitted at run too, and a read outside the parent's glob is still refused (`NIKA-COMP-002` at check, `NIKA-SEC-004` at run). A child glob wider than its parent's is cut to the parent's tree, never widened past it. Path grants that leave the workspace (absolute, `~/`, climbing) or name `..` still meet only by their exact spelling, and two globs that overlap without either containing the other still meet to nothing.
- **A workflow that computes its read paths reads the project.** For a workflow reading
  `./releves/*.csv` or `./notes/**` through computed paths, the Session said « fraîcheur des
  sources non jugée : il ne lit aucun fichier du projet ». It now counts the declared read grant,
  and says the freshness of those sources is not judged because they are a pattern.
- **« On continue » shows the waiting proposal whoever prepares.** After switching to an
  intelligence that leads no conversation, « On continue là où on en était » reached the
  compiler: a free, ready proposal was re-authored for 13 minutes into a new one with model
  steps. A line that only asks to go on now shows the waiting proposal again as it stands, at the
  consent door as in the conversation.
- **« On continue » shows the waiting proposal again.** After an intelligence switch, « On
  continue là où on en était » sent a ready proposal back to the author, which wrote it anew for
  minutes and lost part of it. With a proposal waiting, a line that only asks to go on shows the
  same proposal again, as it stands. It is never a consent and never a change.
- **The authoring conventions show a total written alone as a workflow
  writes it.** They said the value is « stated as `alone: true` on its
  write ». `alone` is how the plan states that a file holds one computed
  total by itself; `nika:write` takes no such argument, and no door that
  reads the conventions (the native, sketch and document authors, their
  verifier and the Session's author) states a plan. An author that copied
  the line wrote an argument the check refuses (`NIKA-BUILTIN-001`). The
  conventions now show the write's own form, the total's field as its
  `content` (a json file holds `40`), and that several totals or a csv,
  yaml or toml file are asked about rather than written. The plan's field,
  the compiler's lowering and its refusals are unchanged.
- **The conversation knows about a run refused before it started.** Only a run that ended (exit 0
  or 1, with a readable trace) reached the conversation's author. A run refused before it started
  (exit 2, its cost floor above the ceiling) or around it reached nothing, so « pourquoi le run a
  échoué ? » right after « NIKA-1709 · refusing to start » met « aucun run n'a échoué ». Every
  observed run now rides the person's next line to the author, as a success already did; a failed
  run of the author's own candidate is still repaired at once.
- **`nika:convert` reads semicolon and tab separated CSV, and writes a null as an empty
  cell.** A European spreadsheet export (`nom;montant`, decimals with a comma) was read
  with the comma: it became one column, or failed on its first decimal. The separator
  is now counted on the first line outside quotes: a semicolon or a tab that outnumbers
  the comma is the separator, otherwise the comma stays (RFC 4180). JSON to CSV wrote a
  `null` as the text `null`; it is now an empty cell, as a missing key already was.
  Cells are still strings: convert numbers with `tonumber` before arithmetic or
  ordering.
- **`nika check` refuses a `nika:date` arg its op never reads.** `{ op: now, format: "%Y-%m-%d" }`
  passed the check, because `format` is an arg of `nika:date`, and ran without it: the file got
  `2026-10-15T21:39:15.511348+04:00`, matching neither declared format. Each op now reads only its
  own args (`now`: tz · `add`/`subtract`: base, duration, tz · `format`: input, format, tz ·
  `parse`: input, format · `diff`: start, end, unit), and an arg of another op is refused as « not
  an arg of `nika:date` op `now` » with that op's own args. A templated op is left to the run.
- **`nika:date` documents every op that reads `tz:`.** The tool catalog
  described `tz` as applying to `now` only, so `op: format` looked unable
  to render local time, and workflows sliced ISO strings by hand instead.
  `format` renders its fields in `tz:` and `add`/`subtract` apply calendar
  units there. The description now says so, and adds that an input's own
  offset is not kept when `tz:` is absent.
- **« désactive-le » removes only units the trigger host says it keeps.** When an earlier
  conversation had installed a trigger, the Session built its launchd path in
  `~/Library/LaunchAgents` itself. A host that keeps its units elsewhere was then handed a file it
  never wrote. A host now says where its units are (`TriggerHost::unit_of`, given by the launchd
  host). The declared state of a schedule also asks the host whether its unit is installed.
- **A System One decision seat no longer starts a batch with a request known to fail.** A
  seat of `typesafe/jev-1.13.0` plans each batch inside the capacity the service documents (64k
  tokens per request), splitting a request in halves before it leaves when its exact body would
  exceed it, and never again sends a body as large as one the service refused for capacity. The
  Foundry qualification of a large knowledge recall used to send the whole batch first and only
  shrink after `max_tokens_exceeded` refusals. Other decision models keep their earlier
  behaviour.
- **A `provider/name` decision seat is stated as sending each request once.** The compile
  receipt and the `--decision-model` help said its client kept protocol retries; the provider
  transport no longer re-sends anything, so the receipt now says « its own provider client, one
  attempt per request ».
- **The decision seat's tally counts every call it sent.** A batched decision call (the whole
  request's verification, its parts, Foundry qualification) is answered as a whole, but the
  tally counted only single-question answers: `/status` said « 33 call(s) sent · 7 answered · 0
  without a response ». A batched call that came back now counts as answered, and one the seat
  answered with an HTTP error as without a response.
- **« Choisis toi-même » now settles a setting instead of asking it again.** When the person left a
  value to Nika (« choisis toi-même » to the question for a time zone, « carte blanche pour le
  reste »), the author chose one and the fidelity law refused it as an unauthorized selection,
  so the same question came back (« le compilateur n'accepte pas que je le choisisse à votre
  place »). A delegated selection may now be a value, but only one that no effect carries: a pure
  step (`nika:date`, `nika:jq`, `nika:assert` and the rest of the pure-internal class, the call
  proven pure) or the words of a task. A fetch, a write, a command, any other tool or agent
  configuration, the document's model, permits, run access and secrets still refuse it, and the
  person's own words must still be cited.
- **`/details` says what a conversation built, saved and ran.**
  QA gauntlet q09: after two Saves and three runs it still said « no
  workflow was read in this session yet », because only a compile round
  set what it reads. With no such round, it now names the conversation
  that wrote the workflow, its last revision, the workflow saved, the
  preparation spend and the last run's trace.
- **`nika doctor` names a refused key.** A provider that answers 403 to the route's key now reads
  « 403 · key refused for this route » with the fix to export a key the route accepts, where the
  doctor printed a bare « 403 ».
- **`nika doctor` no longer calls a seat whose login check did not answer
  "not signed in".** A harness seat whose own login command did not answer
  within its deadline is now a warning that says the sign-in is unknown
  and why ("the login check did not answer within 30 s"), and it teaches no
  sign-in. A seat whose login command answered "signed out" still reads
  "not signed in" with its sign-in gesture.
- **A dropped task now debits the tool spend it had already incurred.** A task cut by its
  `timeout:` or by a `fail_fast` sibling debits, once, the cost reported by tool calls that had
  already completed, including a ready MCP reply it never read. The task stays failed, with no
  output, row or checkpoint credit.
- **`nika:edit` refuses an empty `find:` instead of rewriting the whole file.** An empty
  `find:`, such as a templated input left empty, matched between every character: the
  replacement landed between every byte (`price: 10` became `XpXrXiXcXeX…`) and the
  task succeeded. It is now `NIKA-BUILTIN-EDIT-001`, refused before the file is read.
- **`Enter` pressed right after `Esc` in the intelligence list now acts.** Stepping back with
  `Esc` (from the connections to the home list, for instance) armed the guard that ignores a
  second press of the same `Enter`, so an `Enter` pressed within half a second on « Keep
  current » or another row did nothing. Only an `Enter` that sent something starts that guard
  now; after `Esc`, the next `Enter` is your next choice.
- **Every card can be left.** A saved workflow whose files changed since its
  rehearsal showed a mandatory card with one act, « Adapter le workflow aux
  fichiers modifiés »: `Esc`, words of one's own and `/new` all left it in
  place, and only quitting the app did. `Esc` with nothing left to undo now
  sets a decision's card aside, never answering it: the conversation says
  what stays undecided (the workflow stays not run, a paused run stays
  paused, a proposal still waits) and gives the line back. Words typed at
  that recovery card are the person's next line, `/new` begins a new
  conversation the card does not come back over, and a fresh spending
  question keeps its card (its cancel or `Ctrl+C` leaves it). The refused
  run no longer says « restore the original file »: it names what a retry
  as rehearsed would put back, file by file, in place of what each holds
  now (NIK-227).
- **A failed run no longer moves a person's own files into quarantine.** When a run
  failed, `nika run` moved every file a successful `nika:write` or `nika:edit` returned to
  `.nika/quarantine/<run>/`, including a `notes.md` that existed before the run and was
  only edited. The next run then failed to read or edit it. Now only files the run created
  move. A file that existed stays where it is, and its original bytes, copied before the
  run first changed it, wait under `.nika/quarantine/<run>/originals/`. A writer reached
  by `after: failure`, `terminal` or `unwind` keeps its file, since it records the failure.
  The quarantine dir carries a `manifest.json`, and resuming the failed run with
  `--resume` puts the moved files back before it starts. The run says on stderr which
  files moved and where each kept file's original is.
- **A failed run's journal records its quarantine, signed or not.** What the teardown did
  with a failed run's files rode only inside the signed `run_sealed` frame, so a run
  without a signing key journaled nothing about it, and a crash between the moves and the
  seal left only the manifest. A `quarantine_recorded` frame now lands right before the
  seal: the quarantine directory, how many created files moved (and any move that
  failed), how many of your files stayed in place, and the manifest with the sha256 of
  its bytes. A signed run's seal covers it like every earlier line.
- **A feed item dated only by its revision keeps its date.** `mode: feed`
  dropped an Atom entry's `<updated>` and a JSON Feed item's
  `date_modified`, so an item carrying only that date looked undated and
  a filter on today's items dropped it. Each item now carries `updated`
  when the source dates a revision of its own, an RFC 3339 instant like
  `published`; a date filter reads `published // updated`. An RSS item's
  `pubDate` stays its `published` alone.
- **An author knows what a fetched feed returns.** The `nika:fetch`
  contract an authoring model reads named the extraction modes only by
  pointing to another page, so an author filtered a feed's items by the
  feed's own date text and kept nothing. It now shows what each mode
  returns, the feed's shape, and that feed dates are RFC 3339 instants
  with an explicit offset; `nika:date` joins the everyday contracts to
  compute a bound such as today.
- **`nika:fetch` honors its task's `timeout:`.** A fetch whose task declares `timeout: "3m"` gets
  those three minutes for the whole request, as the stdlib states, instead of a fixed 30s that cut
  long API calls (an image generation, a non-streamed inference) and a 30s idle guard that cut a
  server computing before it answers. A fetch without a task `timeout:` keeps 30s, and a timed-out
  fetch names the setting.
- **`nika:fetch` sends a JSON `body:` with `content-type: application/json`.** An object,
  array or other non-string `body:` was serialized as JSON but sent with no content type,
  so a receiver that parses by type read it as empty. It now carries
  `application/json` unless the author's `headers:` already name a content type; a
  string body is still sent as written.
- **`nika:fetch` returns a CSV, text or JSON body as served in its page modes.** The
  default `markdown` mode, like `article` and `text`, read every body as HTML: a
  `text/csv` export came back on one line with markdown escapes (`A\_1`), so a following
  `nika:convert from: csv` produced no rows while the run succeeded, and a `text/plain`
  body lost its line breaks. A body whose `Content-Type` is text other than HTML
  (`text/*`, JSON, XML, CSV, YAML, NDJSON, TOML and their `+json`/`+xml`/`+yaml`
  suffixes) now comes back unchanged, decoded by its BOM or declared charset, else as
  UTF-8, else as windows-1252. HTML, XHTML and untyped bodies keep the extraction.
- **Files the person says they have in a folder are sources.** « J'ai deux fichiers CSV dans le
  dossier releves (a.csv et b.csv) » made each file a write destination of the whole request,
  because « dans » counted wherever it stood. Every revision reading `./releves/a.csv` was refused
  as « UNREALIZED PATH », and one author wrote permits for files that do not exist to pass. A
  path is now a destination only through a connector in its own sentence, in a clause that writes
  there. A clause that says what the person has, or what there is, places existing material.
- **A second Ctrl-C no longer leaves exec children running.** The second
  signal ended `nika run` with `exit(130)`, which runs no destructor, while
  every `exec` child leads a process group of its own that neither the
  signal to the CLI nor a terminal's Ctrl-C reaches: the child kept running
  and writing after the CLI was gone. The abort now ends every process group
  the run still owns first (SIGTERM, a one-second grace, SIGKILL, then a
  bounded reap), never signals a group whose leader the process can no
  longer wait for, and says on stderr how many groups ended and which did
  not confirm their end. Nothing is rolled back: what already ran stays
  done, and an effect in flight has an unknown outcome.
- **Gemini runs, priced at Google's own pages.** A budgeted run with a Gemini model was refused
  (« this provider's wire has no bounded admission settlement »), any other run reported an
  unknown cost, and Gemini 4 Argon, newer than the vendored price snapshot, read as unpriced
  even to `nika check`. The Gemini wire now reserves, sends once and settles each text call at
  its tariff: ten models (Gemini 4 Argon, 3.8 and 3.6 Flash, 3.5 and 3.1 Flash-Lite, 3.1 Pro
  Preview, 3 Flash Preview, 2.5 Pro, 2.5 Flash and Flash-Lite) read the pricing page at peak
  Standard rates, thinking billed with the answer. The picker and `nika check` read the same
  prices, Gemini's snapshot rows included.
- **GPT-6 Sol and GPT-6.1 Sol take `max_completion_tokens`.** OpenAI refused them with « 'max_tokens'
  is not supported with this model » (HTTP 400) on the first message: the catalog knew the
  parameter only for GPT-6 Astra. Both observed models now send `max_completion_tokens`; the rule
  stays exact, with no claim for the rest of the family.
- **Grok runs, priced at the charge xAI reports.** Every xAI model was unpriced at run time: a
  workflow that fetched a page with Grok as its model was refused (« unknown-cost Run supports
  only direct infer and local read/write/jq/assert »), and any other run reported an unknown
  cost, while the model picker showed a price. grok-4.7 and grok-4.3 are now admitted from
  their model pages and settle at the charge each reply reports (`cost_in_usd_ticks`). xAI's
  reasoning is not bounded by `max_tokens` (measured: 1,973 reasoning tokens under a bound of
  40), so a call reserves the model's whole window: a run ceiling needs about $3.40 per
  grok-4.7 call in flight ($2.75 for grok-4.3), while the settled cost stays the real one.
- **`nika guard` no longer refuses plain shell it can read.** Loops,
  `if`, `[ … ]`, `find` without `-exec`, `xargs` with any other command,
  a heredoc script such as `python3 - <<'EOF'` and a command word in a
  variable that cannot make a run (`"$EDITOR" notes.txt`) were refused
  as `guard_unavailable`, blocking agent commands that run no workflow.
  The guard now judges the commands inside them and keeps no opinion
  when none is a `nika run`; `find -exec nika`, `xargs nika` and
  `$N run x` stay visible.
- **A slow login check no longer reads a signed-in seat as signed out.** A
  harness seat's own login command now has 30 s to answer: valid checks
  were measured at 12 s and 25.8 s, and the former 10 s turned them into
  a "not signed in" seat. The harness probe facts now also carry the
  check's answer (`login`): signed in, signed out, or unknown when it did
  not answer in time ("the login check did not answer within 30 s") or
  could not run, so an unanswered check is no longer the same fact as a
  signed-out seat. Admission still requires an answer before it admits a
  seat, and no credential is read.
- **Hints name the program the person runs.** A proposal's hint line said « `nika check x.nika`
  prints them » to a person running `nika-dev`, whose `nika` on the same machine was an older
  release that refused the file. Hints in the Session, the check summary and the refused-run
  story now name the running program (`nika-dev`, `nika`), and a paused run's meaning no longer
  gives a command line: the Session asks its question itself.
- **The Session's hints name the program you run.** `/help` and `/proof` said `nika trace
  verify` while the person ran `nika-dev`. On that Mac, `nika` was an older release that refused
  the trace. Every command those hints name now uses the running program's own name.
- **`Home` takes the conversation back to its first message.** `PgUp` pages through the
  conversation a screen at a time, so a long card such as a full proposal took several presses
  to pass, and `Home` did nothing. With nothing typed in the box, `Home` now goes to the first
  message, `Ctrl+Home` does it even with words typed, and `End` still brings the latest
  messages back. The `?` key list names these keys.
- **An infer answer interrupted by its provider fails as a provider call.** When the provider
  reports it interrupted the generation (`StopReason::Interrupted`), the answer is never the task
  output: the task fails `NIKA-INFER-001`, transient, naming the provider's own word, and the
  task's `retry:` decides. An answer cut at the output cap that parses, even one that satisfies
  `schema:`, still fails `NIKA-INFER-005`.
- **« Inspect the exact changes » shows the lines a revision changes.** For a proposal that
  replaces a saved workflow, it used to print the whole file (« replaces `clean-contacts.nika`
  whole (109 lines …) » followed by all 109 lines), so you had to find the one line that changed.
  It now opens on what changes against the file as it is now, with the size of the change
  (`+1 −1 lines`) and each change shown removed then added among the lines around it. Every byte
  still follows. A file that changed since the proposal was made is said so and not compared.
- **A verifier's unlocated doubt is asked where it is, then held as
  unresolved.** The question whether a step does something the request
  does not ask no longer offers a step that only reads paths the request
  names and writes the output a part it carried asks: the checker's own
  effect inference, with constants resolved, settles such steps, and
  with none left the question is answered with no model call and
  recorded on the attempt (`engine`). The previous check, which let a
  named step pass without resolving its constants, is gone. When the
  verifier rejects the whole request but carries every part, names no
  step, and no trial run of those bytes can decide it, it is asked once
  where its doubt is: a part or step it names is located and repaired
  from as before, and naming nothing holds the workflow as unresolved,
  never ready and never proposed, in words that say nothing was verified
  (`unresolved` on the attempt).
- **Kept defaults, source freshness and the questions left read in French.** For a French speaker,
  « kept the default », the source freshness lines and « 1 more after this one » are now said in
  French; the receipt lines (« applied · wrote », « check · … · clean ✔ ») keep one wording.
- **A development build no longer asks for the keychain password on every run.** A macOS
  keychain grant (« Always Allow ») is bound to the signature of the binary that asked. A
  Developer ID release keeps the same signature from one version to the next, so its grant
  sticks; an ad-hoc build (every `cargo build`, every dev build) is a new identity each time, so
  the password prompt came back on every run. Now only a binary whose signature can keep a grant
  opens the keychain for its run-key; any other takes the explicit `NIKA_RUN_KEY_FILE` pair or
  the 0600 files under `~/.nika/keys`, silently, and runs unsigned when there is none, never
  under a new key. `nika serve` never opens the keychain. A secret key file other users can read
  is refused, as ssh refuses one. `nika doctor` says in one `run-key` line where the key comes
  from, the fingerprint of the key this process would sign with, and why the keychain is or is
  not part of it. A machine whose keychain holds the key a signed release signs with, beside a
  0600 pair dev builds and `nika serve` sign with, has two identities: a release's doctor names
  both keys, and `nika key align`, run from a signed release, gives the 0600 files the keychain
  key and retires the one they held (the journals it sealed stay verifiable). At init, rotate and
  align a signed release records the keychain key's fingerprint and the item's modification date
  in `~/.nika/keys/keychain.json`; a dev build compares through that record only while the item
  is unchanged, and otherwise says it does not know. `nika key init` in a process that does not
  open the keychain refuses to mint a second key beside the keychain's, unless forced. Even a
  signed release now opens the secret keychain item only to sign or to align: `nika key trust`,
  `nika doctor`, the memory fold, a seal grade and a workflow signature read the public item
  alone, and each item is read at most once per process. `nika key init` sees whether the keychain
  holds a key from the items' attributes, never their data. `NIKA_KEYCHAIN=off` still turns the
  keychain off everywhere.
- **Without a decision seat, an authoring call no longer receives every other knowledge entry.**
  With a knowledge release lent and no decision seat selected, the author was shown, beside the
  recalled pack, the descriptor of every other admitted entry and of every embedded template,
  unqualified: 244 to 369 references (102 to 199 KB) per request on the release this build
  embeds, measured over 16 requests. A descriptor is there for a decision seat to judge whether
  its entry serves the request, and without a seat nobody asks it. Nothing is widened then: the
  author reads the recalled pack, and the qualification record says why. With a seat, every
  admitted entry is still asked.
- **A shared stopword no longer recalls knowledge for an authoring call.** The knowledge door's
  text recall (BM25 over the release's rows) read every word of three letters or more, so a row
  sharing only « the », « and » or « with » with the request was recalled and presented whole:
  on the release this build embeds, a ten-word authoring request reached 22 of its 26 examples
  and all 16 skills that way. The recall now reads informative words only, without the
  compiler's shared stopwords. Every row it reaches is still presented whole, with no count or
  byte quota, and the pack names its builder `knowledge-door-v7`.
- **A French article no longer recalls knowledge either.** The knowledge door's text recall also
  reads past the compiler's retrieval lexicon (French articles, pronouns and politeness; English
  request scaffolding such as « please » or « help me »), the words the compile's own retrieval
  already reads past. On the release this build embeds, a French request for a news digest
  recalled four French-titled patterns through « les » alone; it now recalls by its content
  words. The lexicon moved beside the shared stopwords (`nika_compile_reader::text`) unchanged.
- **The Linux jail no longer drops a write grant without a word.** bwrap
  can only bind a path that exists, and a jailed command cannot create its
  own grant. The jail used `--bind-try`, which skipped such a grant
  silently, so a command that had to create the granted file failed far
  from the cause (on Linux only: macOS Seatbelt admits a file that does
  not exist yet). Existing write grants now bind with `--bind` (a source
  that vanishes before the mount fails loudly), and a spawn that leaves
  grants unbound writes one line on stderr naming them with the remedy:
  grant the directory, and make sure it exists before an exec writes into
  it. An absent grant is not refused, since another task of the workflow
  may be the one that creates it.
- **An MCP server's network allowlist now reaches its hosts.** On macOS a
  server declared with `"network": {"allowlist": [...]}` reached no host at
  all and could not even resolve a name: its jail admitted loopback only,
  while `nika mcp approve` announced it as confined like `"allow"`. The
  spawn now starts the loopback egress proxy that the exec allowlist uses,
  points the server at it (`HTTPS_PROXY` and siblings) and fences the jail
  to the proxy's port, so exactly the declared hosts answer. The approval
  note says `through a loopback egress proxy`, and a refused host prints
  one `nika:egress REFUSED` line naming the server's allowlist.
- **Nika's MCP server and client say only the protocol they speak.** The
  server answered an `initialize` asking for MCP 2026-07-28 with that
  revision, and an unknown revision with it too, yet the final 2026-07-28
  text has no handshake and neither half implements its MUSTs; it now
  answers 2025-11-25, the latest handshake revision, as does the
  conversation server, and the 0.94.0 changelog line that said it spoke
  2026-07-28 natively carries the correction. As a client, a `tools/call`
  result whose `resultType` is `input_required` or `task` is a failed call
  instead of an empty success; a reply that follows more than sixteen
  interleaved notifications is read, the wait being bounded by its deadline
  and by 8 MiB of skipped messages; and a call that times out is cancelled
  with `notifications/cancelled` before the server is stopped.
- **`nika mcp --http` holds every connection to a deadline and serves them side by side.**
  A request has 30 s in all to arrive, head and body, and its response 30 s to leave; each
  connection runs on a thread of its own, at most eight at once, the next waiting in the
  listener's backlog, so a slow client holds one connection for a bounded time. A failed accept
  on the server's side pauses the loop briefly.
- **An MCP call the run stops waiting for is cancelled, not left running.**
  When a task's `timeout:` cut an `invoke` of an `mcp:` tool, its call kept
  running on its worker until the 120 s call timeout, holding the server's
  pipe so every other call to that server waited behind it, and the server
  was never told; the operator's Stop (Ctrl-C, SIGTERM, a Session's Stop)
  waited for such a call to finish. The call now carries a stop: one not yet
  written is never sent, and one in flight is cancelled with
  `notifications/cancelled` while its session stays open for the next call.
  Under the operator's Stop the task fails `NIKA-CANCEL-001`, never retried,
  its `error.details.stopped_call` naming `{tool, call_id, outcome}` with
  `outcome` `not_sent` or `unknown` (it was sent, so the server may have
  acted), and the run's settlement lists every such call as `stopped_calls`
  (`{task, tool, call_id, outcome}`), whether its task failed, was skipped
  past or recovered. Other in-flight work still completes at the wave
  boundary. A reply that already arrived now wins over a stop, a server
  request that reuses the call's id is no longer taken for its reply, and a
  stopped call's late reply no longer counts against the next call's byte
  budget.
- **`/meaning` beside an authored proposal reads your request.** Beside a proposal an
  intelligence wrote, `/meaning` printed the money card: no compiler reading stood behind it.
  It now lists, in the language you write in, what Nika kept of your request: your words, each
  value the workflow relies on with its part and where it comes from, what you left to Nika to
  choose and the questions still open. The proposal keeps waiting for your answer.
- **The model question no longer demands `<provider>/<model>`.** On a subscription account (codex,
  claude-code), a request with an AI step asked « Which explicit runtime provider/model should run
  the language steps? » with nothing offered: « choisis toi-même » was taken as typed, and the
  compiler answered « Name the runtime model as <provider>/<model> ». The question now offers the
  configured model this conversation recommends (the saved default, else the newest configured
  one), which Enter takes. A reply that leaves the choice to Nika takes it too, said as Nika's
  choice beside the proposal, and a model named or described in words (« prends Claude Haiku ») is
  read against the configured models whose name carries those words, never invented. A reply that
  designates none of them binds nothing and says which model is offered.
- **A proposal's money line says its ceiling as it was set.**
  « money: $0.1 USD » sat two lines from « ceiling $0.10 »: the Session's
  money lines and project default printed a ceiling with the float's own
  digits. They now read through the one ceiling formatter every other
  surface uses (« $0.10 », « $0.001 », « $2 »).
- **More of the Session's own words in French.** A line the Session could not read now says, in
  a French conversation, « je n'ai pas lu cette ligne comme un travail, et je n'ai pas su ce
  qu'elle veut dire — rien n'a changé ». The same holds at a proposal, a question and a gate. A
  revision's card says « Même workflow que la proposition vue » or « Changé depuis la
  proposition vue », and a model failure says « la conversation n'a pas pu continuer ».
- **A Claude call is priced, so the Run ledger, `--max-cost-usd` and a Session allowance
  count it.** The Anthropic wire never marked a reply's usage complete, so every Claude
  call stayed cost-unknown ("provider did not report usage") and a Session allowance with
  a Claude author was refused. A reply whose usage accounts for every billed meter (input,
  output, cache read and 5-minute cache write, no server tool, standard tier, global
  inference) is now complete: it is priced at the model's admission tariff, else the
  pricing snapshot on Anthropic's own endpoint, and an allowance reserves, sends once and
  settles a Claude text call through the Anthropic wire, the model named exactly, by
  nickname (`anthropic/sonnet`) or through the `claude` alias. A reply missing a meter, or
  a Claude Haiku 5.5 prompt above its admitted 100,000 tokens, stays unknown, never zero;
  under an allowance, a Haiku 5.5 request whose bytes could exceed that tier is refused
  before anything is sent.
- **The key a provider reads is named, and the Nika-scoped variable is the one advised.**
  The probe lists the key variables set for each provider, names only, in the order the
  run reads them; the census and `nika doctor` name the one that supplies the key
  (`NIKA_ANTHROPIC_API_KEY` before `ANTHROPIC_API_KEY`), and two variables set with
  different values earn a doctor warning naming both, compared in memory where the keys
  are read and never printed. A missing key at run or in a conversation now advises
  `NIKA_<ID>_API_KEY`, which no other tool reads (exporting `ANTHROPIC_API_KEY` can move
  another application, such as Claude Code, onto that key), and a conversation shows it
  without the command-line teaching. An API pick naming the `claude` alias
  (`/intelligence 2 claude/<model>`) selects Anthropic.
- **`run.reasoning.effort` reaches a Claude 5 model.** The catalog records the levels this
  engine names (`low`, `high`, `max`) for Claude Fable 5.1, Fable 5, Opus 5.5, Opus 5,
  Sonnet 5.5, Sonnet 5 and Haiku 5.5, so a declared effort on such a model, a nickname
  included, is admitted at check and rides the Anthropic request as
  `output_config.effort` on Anthropic's own endpoint, read back from the bytes sent. An
  earlier Claude model, a thinking budget beside the level or an operator-pointed endpoint
  still refuses before any byte, and `nika check` names the file's refused access as the
  blocker instead of an empty list beside ACCESS READY ✖.
- **`nika check` refuses a `nika:date` zone the run would refuse.**
  `tz: "Paris"` checked clean, then the run failed at its first
  `nika:date` task with `NIKA-BUILTIN-DATE-001 · unknown tz: Paris`. A
  literal `tz:` is now judged against the embedded IANA time-zone
  database the builtin itself reads, and an unknown zone is refused with
  the run's code, naming the zone when one is obvious (`Paris` or
  « L'heure de Paris » → `Europe/Paris`). A templated `tz:` is left to
  the run. The ARGS rung now prints every refused literal value with its
  own code and the checker's wording, where it said « has no `<arg>`
  arg ».
- **`nika:notify` now reaches Slack and Discord webhooks.** A Slack incoming webhook
  (`hooks.slack.com/services/…`) refused the stdlib body `{ message, severity, data? }`
  with HTTP 400 `no_text`, so a project whose last step posts to Slack failed on every
  run. Slack incoming webhooks now get `{ text, mrkdwn: false }` and Discord webhooks
  (`discord.com/api/webhooks/{id}/{token}`) get `{ content, allowed_mentions }`: the
  message, a non-`info` severity and the `data:` context as plain text. Slack's `&`, `<`
  and `>` become entities. Discord's markdown and mention openers are escaped, no
  mention is parsed, and the content is bounded to Discord's 2,000 characters. Every
  other target, including a Slack Workflow Builder trigger, keeps the stdlib body. A
  refused delivery (`NIKA-BUILTIN-NOTIFY-002`) now quotes the receiver's answer, as one
  bounded line with the target's own parts withheld, and carries `details.status_code`.
- **A model offer shows the price its admission uses, or none.** A Session's
  model offer showed the models.dev snapshot's list price, not the price its
  admission uses: GLM 5.3 Flash on OpenRouter read $1.2 per million output
  tokens while its admission reserves $1.6, the peak of its tariff, and a model
  no tariff admits, such as Claude Sonnet 4.6 on an Anthropic key, showed a list
  price all the same. An offer is now priced only from the qualified admission
  tariff of its exact route and endpoint (the reply still settles at
  OpenRouter's reported charge), and a route the admission cannot qualify shows
  no price, never a bare snapshot price. Claude Sonnet 5.5, offered on an
  Anthropic key without an admission tariff, shows no price, is never ranked by
  the strongest-offer rule and is still chosen exactly when named.
- **One « newest » mark per model family, chosen by real recency.** Searching the intelligence
  list for `deepseek` showed « newest DeepSeek » on three rows at once: DeepSeek V4 Pro on the
  DeepSeek API, the dated V4 Flash 0731 on Scaleway and R1 0528 on Hugging Face, whose « 0528 »
  was read as version 528. « newest Grok » stood on Grok 4.20 0309 rather than Grok 4.7. A date
  written in digits (`0528`, `250731`) is now a snapshot date, never a version; a minor version
  reads as a decimal, so 4.7 comes after 4.20; and a family is marked once in a list that spans
  several connections, on its newest model.
- **GPT-6 and GPT-5.6 work with tools.** Any `agent:` task or tool-using author on GPT-6 Astra,
  Sol, 6.1 Sol or Luna, or GPT-5.6 Sol, failed with HTTP 400 « Function tools with
  reasoning_effort are not supported … use /v1/responses »: these models refuse function tools
  on Chat Completions. A request with function tools to OpenAI's own endpoint now rides its
  Responses API (stateless: `store: false`, reasoning items kept encrypted and sent back in
  place), priced at the same verified tariff. A GPT-6 Astra agent that reads a file now answers
  in three turns ($0.01).
- **OpenAI's zero usage meters no longer void a reply's usage.** OpenAI's usage object
  carries audio and predicted-output meters on every text reply, even at zero, and Nika
  read any such key as an unknown axis, so a direct OpenAI reply never had complete
  usage. Zero meters now read as complete; a non-zero one, a cache write or an unknown
  key still leaves the usage incomplete.
- **The free OpenRouter admission names a route OpenRouter still lists.**
  `qwen/qwen3.8-27b:free` has left OpenRouter's catalogue; the declared-free
  admission now names `nvidia/nemotron-3-super-120b-a12b:free`, read from its
  endpoint listing of 2026-10-12: one endpoint at a zero prompt and completion
  price, a 262,144-token window and 235,929 output tokens, for bounded text
  requests only. A run naming the old id is no longer admitted as free.
- **A paid OpenRouter call settles at the charge OpenRouter reports.** A paid
  OpenRouter reply always read as unknown cost, and an admitted paid route would have
  turned its account Uncertain at the first settlement. A non-BYOK reply from
  OpenRouter's own endpoint with complete usage now settles at its `usage.cost`, which
  receipts name as a provider-reported charge; its catalogue tariff only reserves. A
  BYOK reply, a gateway's `cost` or an unknown fee stays unknown. A charge above the
  reservation still settles known, and that route then refuses its next call until its
  catalogue tariff is refreshed.
- **An open-weight model named on another provider is no longer refused as a
  wrong seat.** `nika check` refused `scaleway/llama-3.3-70b-versatile`, or a
  local engine's `meta-llama/…` model, as served only by the one provider whose
  catalogue row lists it. An `org/model` id, or a model the pricing snapshot
  marks open-weight, now has no single owner, whoever lists it; a
  provider-exclusive id pasted on another provider (`groq/grok-4.3`) is still
  refused with its owner's id as the repair.
- **A long conversation no longer overflows an OpenAI-compatible model's window.** Nika asks a
  route for its whole published output capacity, and an OpenAI-compatible route counts the prompt
  and that output against one context window. On OpenRouter's DeepSeek V4 Flash (943,718 output
  tokens in a 1,048,576-token window) every call failed with HTTP 400 once the conversation passed
  about 105,000 tokens: « you requested about 1060562 tokens (… 943718 in the output) », after an
  authoring loop of 30 calls and 13 minutes. The output budget sent is now what the prompt leaves
  of the window, the prompt counted generously from the request's size, less a margin of 1/64 of
  the window. A budget that already fits, and a route with no known window, are sent unchanged.
- **A task with a large output no longer stops the run.** The Session reads a run's frames line by
  line and refused any frame over 1 MiB, ending the child mid-run: a workflow that fetched three
  job boards (one of them 3.4 MB of JSON) failed with « Run cost review refused: Run frame exceeds
  1 MiB; no automatic retry », its effects uncertain. A frame over the cap is now drained without
  being kept and the run goes on to its own end; memory stays bounded. The Session says the step's
  output was neither shown nor kept: the run's trace bounds its lines at the same 1 MiB, so its
  journal stops at that step and the run settles with its evidence lost.
- **The intelligence picker states a model's own context window, and how far a tiered price
  holds.** Claude Haiku 5.5 read "100k context" because its tariff, which prices prompts up
  to 100,000 tokens, stood in for its million-token window. An option's `context_tokens` is
  now the model's window (its provider row when a source is recorded for it, else the
  tariff's, else the list row's), and `ModelFacts` gains `prices_up_to_tokens` when a tariff
  prices only a cheaper part of that window: the TUI reads "from $0.10 in / $0.50 out per
  MTok (≤100k tokens) · 1M context".
- **« active-le alors s'il vous plait » activates the schedule.** Only the bare activation words
  (« active-le », « activate it ») opened the activation; with a courtesy around them the line went
  on as a request and the workflow ran once more. A courtesy or a filler before or after them
  (« alors », « s'il vous plaît », « stp », « please », « now », « ok ») now leaves the same
  activation, and « active-la », « activez-le », « active la répétition » are read too. Anything
  more, such as a cadence, keeps its route.
- **The project file's refusals teach a cadence the arming door reads.**
  A beat with no or an empty `cadence:` was told to write
  `cadence: "dimanche 18h07"`, which `nika arm` and `nika serve` refuse for
  its missing zone. The remedy now shows `TZ=Europe/Paris dimanche 18h07`
  and the cron form with its zone.
- **A misconfigured `nika:prompt` fails at once instead of pausing forever.** An unknown
  `mode:` (`select`), a missing `message:` or a `default:` the mode cannot use was coded
  `NIKA-BUILTIN-PROMPT-001`, the failure the runtime turns into a durable pause: an
  unattended run whose author had declared a default waited for a human, and resuming
  an unknown mode with an answer paused it again. These are now
  `NIKA-BUILTIN-PROMPT-002`, judged before anyone is asked, with the modes or the
  expected type named. A confirm `default:` written as a person answers a confirm
  (`yes`, `y`, `no`, `n`, `"true"`, `"false"`) now reads as that answer, as `--answer`
  already did; YAML 1.2 reads an unquoted `yes` as a string. Only a prompt with neither
  a human nor a `default:` keeps `PROMPT-001` and pauses.
- **A provider call is never re-sent by the transport, and every receipt counts what was sent.**
  On a 429, 503 or 529 the provider layer re-sent the same request up to three more times
  (after 1, 2 and 4 s), so one authoring call on a busy route sent four identical 772 KB requests
  while its receipt said one call, and the money admission, which counts only the author's
  `retry:` and schema re-asks, never counted them. The call now ends at its first answer with a
  transient rejection; `nika_providers::transient_rejection` reads its status and the delay the
  provider named, for the author's `retry:` or the Session to decide. Every provider client also
  makes one physical attempt per post (no protocol-NACK replay). The fetch plane is unchanged.
- **An answer cut or interrupted by its provider is never read as finished.** Anthropic's
  `model_context_window_exceeded` and Mistral's `model_length` now count as an output-limit cut,
  and a generation the provider interrupted (DeepSeek's `insufficient_system_resource` and
  `aborted`, the `error` finish of OpenRouter and Mistral, Anthropic's `pause_turn`) is a new
  `StopReason::Interrupted`, where it was read as an unknown, normal end. A limit finish that
  carries a tool call stays a cut on every wire.
- **A provider's refusal reaches the person in the provider's own words, never with the key.**
  A provider failure kept only its status and recognised identifiers, so an exhausted Anthropic
  balance (HTTP 400 with "Your credit balance is too low" in its message) read only "provider
  API error (HTTP 400); type=invalid_request_error". The error now adds `the provider said:
  "…"`: the provider's message as one line of at most 400 characters, without control or
  invisible characters, with the key the call sent and every credential-shaped word withheld.
  The words are relayed, not classified: transience, quota and retry still read only the status
  and the recognised identifiers. The compile server keeps provider text from remote clients.
- **A failed run's quarantine moves only the file the run created, inside
  the project.** The quarantine and its restore now act through directory
  handles opened under the project root: a recorded path that leaves the
  project (`..`, an absolute path) is refused by name before any file
  operation, a directory on the way that is a symbolic link is refused, and
  the quarantine directory is created without following links. A file moves
  only while it is the very file the run created (same device and inode,
  one name, the size the run left); a link, another file, a second name or
  a changed file at the path stays where it is, and the fold says why. A
  restore links the file back at its path, so a file a person put there
  since is never overwritten: that is a named conflict, and both files stay.
- **A conversation's workflow leaves a reasoning model room to answer.**
  A summary on a model that reasons before it answers (deepseek-flash),
  capped at 4096 output tokens with thinking left on, spent the whole
  cap on reasoning: the run ended with no answer, or with one cut short.
  A cap the person did not type that cannot cover the reasoning plus the
  answer, or no cap at all, is now refused before the workflow is
  proposed, with the repairs that reach the model's route: set
  `run.reasoning.effort: low` first where the model documents that
  level, then raise `max_tokens` (at its default effort the model spends
  most of a larger cap reasoning).
- **A reasoning model's own state now goes back with the turn it came with.** Gemini puts a
  thought signature on the parts of an answer and asks for it back, Anthropic signs each
  thinking block and asks for assistant turns back as received, and DeepSeek asks for the
  `reasoning_content` of earlier turns when a request carries tools. Nika dropped all three, so
  a multi-turn tool conversation sent the model its own turns without the state it asked for.
  The kernel carries that state as `ContentBlock::Reasoning` (and `InferEvent::Reasoning` on a
  stream), opaque to everything but the wire that produced it: Gemini gets each signature back
  on its own part, Anthropic its signed and redacted thinking blocks in place, and DeepSeek its
  reasoning on every assistant message of a request with tools, empty when a turn had none.
  The state never goes back alone or to another provider, and a decision never reads it as an
  answer. Two limits: a Session tree that holds reasoning blocks does not load in an older
  binary, and nothing assembles `InferEvent::Reasoning` from a stream yet, so the round-trip
  holds on buffered calls only.
- **A rehearsal the room stopped at its data bound is no longer read as
  a timeout.** When a value a candidate workflow built crossed the
  rehearsal room's data bound, the room stopped the run there, and the
  compiler took that stop for the time bound: it asked the author to fix
  a slowness that never happened. The stop now reads as the data bound,
  in the room's words: a construct the workflow chose, so the author is
  asked once for an equivalent workflow the room runs, as for a
  candidate the room refused to start. The run still counts as not run,
  never as failed.
- **Rehearsal warnings include files whose paths are constants.** When a skipped model step
  feeds a file write through `${{ const.out_path }}`, the trial now names that file in its
  warning that the read-back is not a result of the run. Literal paths retain the same warning;
  paths that depend on runtime inputs or task results are not guessed.
- **Trial runs of « Look in ./x » requests.** A path the request names
  after a locative such as « in » or « dans », which the candidate only
  reads, was taken for an output the run should write, so the room
  refused the run (« … is read but not observed ») or the run proved no
  whole output. It is now copied in as the run's input.
- **A path in a reply is no longer corrected as an unknown model.** The
  reply guard judged any slash-shaped token whose prefix was not on a
  folder list, so `news/2026-10-09.md` read as provider `news`. It now
  judges a `provider/name` only in a model slot — a `model:` field, a
  `--model` flag, or a name the prose calls a model — and there with
  the same words whatever the name looks like; the folder list is gone.
- **A ceiling the request states for each run is kept and named.**
  « budget max 0,10 $ par run » in a request was read as no directive (and
  « budget max 0,10 $ » refused the request), so the proposal showed the
  $0.25 session default and every rerun used it in silence. The money
  reader now takes « max » after a limit and a closing « par run », « par
  exécution » or « per run »: the proposal shows the amount, the Save
  keeps it, « Relance-le » reuses it, and every run report names its
  ceiling and where it comes from.
- **What a request says each run may cost is its ceiling.**
  QA gauntlet q09 typed « … et chaque exécution doit coûter au maximum
  0,10 $ (budget max 0,10 $ par run) »: the money reader found neither
  phrase, so the proposal kept the $0.25 session default. A clause with
  the run as its subject, a closed cost phrase and its limit (« doit
  coûter au maximum », « must cost at most », « ne doit pas dépasser »)
  now states the ceiling, and a segment holding no directive is read
  again with its asides apart. An aside needs a currency; a record's
  price or a relative clause stays business data.
- **« Augmente le budget du run à 1 dollar et relance » reruns under that ceiling.** A natural
  rerun line reached Run only when the classifier heard a run request and nothing else; a ceiling
  in the same line counted as something else, so the line went to the author, which raised the
  workflow's `max_tokens` instead. A line with a rerun word (« relance », « rerun », « run it
  again ») and an amount the Run reader takes now runs the current workflow once under that
  ceiling, as « run it max $1 » does, including right after a run refused before it started for
  its cost.
- **A request said again keeps the answers already given.** A change or new words typed at an
  authoring question read the request again in a fresh round, which dropped every answer the round
  had bound: the time zone and the model, both answered, were asked again after the person
  restated the sources. The restated round now starts with the answers already bound; the compiler
  uses those its new reading still asks for.
- **A resumed run no longer calls a task done when its file stayed in quarantine.** When
  `--resume` could not put a failed run's file back (something now stands at its path, for
  example), it said so on stderr, then still counted the task that wrote it as a cache hit
  and could finish `succeeded` while that task's bytes sat in `.nika/quarantine/<run>/`.
  Now that task runs again, with every task after it, and the run says which one. Like a
  fresh run, the re-run writes its file over whatever stands at that path; if the resumed
  run then succeeds, that earlier file is not kept. A file the resume did put back belongs
  to the resumed run: if that run fails too, the file moves to its quarantine again instead
  of passing for a whole one.
- **A Session no longer offers DeepSeek models the provider has retired.** `deepseek-chat`
  and `deepseek-reasoner` were discontinued upstream on 2026-07-24, yet the Run and Author
  model offers still listed them beside `deepseek-flash` and `deepseek-v4-pro`. Their price
  rows are now marked deprecated and a model whose own price row is deprecated is never
  offered; a recorded run that used one still prices.
- **A revision says what changed in its bytes, and when nothing did.**
  QA gauntlet q03 and q04: « Changed from the proposal you saw: model
  claude-haiku-5-5 added » and the author's « J'ai retiré cette ligne »
  appeared over bytes and a proposal id that never changed, because the
  line came from the values the author bound. A change is now said only
  where the bytes gained or lost that value, with the size of the diff
  (or its first lines), and the very same bytes read « Same workflow as
  the proposal you saw: its bytes did not change. »
- **A conversation's revision keeps the ceiling saved with the workflow.**
  QA gauntlet q09 saved its workflow with $0.10, then asked for another
  model in a line stating no amount: the revision showed « money: $0.25
  USD · session default », its Save rebound $0.25 and « Relance-le » ran
  under it. A proposal landing on a saved workflow, with no ceiling of
  the person's own for the work, now binds the one saved with its current
  bytes, proven as a Run proves it, as a revision through the request
  door already did.
- **« Corrige ça » after a failed run now fixes that failure.** A revision asked right after a run
  of the same workflow failed was sent to the author without the run: « No diagnostic was supplied
  with « corrige ça » », so it guessed. In the live gauntlet a fetch refused after a redirect
  (`docs.claude.com` → `platform.claude.com`, NIKA-SEC-004) was « fixed » by removing an unrelated
  `max_tokens` and adding fallbacks, the estimate became unbounded and the next run failed the same
  way. The revision now carries that run (`observed_world.last_run`: the exit and each failed task
  with the error its trace recorded) and the author is told to fix what it reports and touch
  nothing else. Live: the author granted the redirected host for GET and the next run wrote the
  digest. A succeeded or paused run, or a run of another workflow, adds nothing.
- **Operator-stopped MCP tasks and native agent loops retain their control outcome and every
  actual stopped-call witness across fan-out, fail-fast and timeout.** Ordinary authored recovery
  and completed in-flight work retain their meaning; stopped work cannot become a successful
  resume checkpoint. Ready MCP replies keep their physical Stop and reported cost facts when a
  stopped sibling drops their future before its final poll. A stopped batch counts those costs
  once, without turning unread work into a successful checkpoint.
- **What a run may cost is checked beside the workflow, not in it.**
  QA gauntlet q09: the verifier read « chaque exécution doit coûter au
  maximum 0,10 $ » as an obligation of the bytes and judged it missing,
  and a revision looped 11 author calls ($0.62): no workflow field holds
  a dollar cap per run, the Run does. The proposal's Run ceiling now
  rides beside its bytes with the person's words that state it, and an
  obligation those words alone evidence is settled there with no
  question; one with other evidence is still asked.
- **CLI resumes and answered TTY continuations retain the continued run's scheduled instant,
  its source and missed-slot facts.** Fact-reading tasks keep their valid checkpoint identities
  and prompt answers bind the question originally shown, while each leg retains fresh execution
  identity and admission. Legacy traces without these facts keep the existing behavior; malformed
  recorded facts refuse.
- **Every door judges a run against the request's own contract before READY.**
  The behavioural judgment of a rehearsal against the computation the
  request states ran only in the sketch and document doors; a conversation's
  document, an answer-round replay or a semantic record whose trial wrote a
  wrong total, order or cut was READY whenever its judge accepted it. The
  final barrier now judges the request's contract on the run it accepted,
  with no new run and no model call, and withdraws the candidate with the
  obligations it fails. Requests for a total (per group or not), a sort or
  a top-N in the closed language also prove their output required: a run
  that writes nothing fails, and a right one passes.
- **A run model left to Nika is taken from its offer, unasked.**
  QA gauntlet q04: « carte blanche » on a model switch was asked three
  times, then the person had to type a model id: the author was told to
  bind its own choice, which the fidelity law refuses for a run model. The
  author now offers the models with one recommended, and Nika takes it for
  the person, citing their words, with no second question; a model they
  name later stays theirs.
- **A run or a ceiling typed at a waiting proposal no longer re-authors.**
  QA gauntlet q03: « Peut-être que le plafond de 0,25 $ est trop bas.
  Lance translate-notes.nika avec un plafond de 2 $. » went to the author,
  which spent five minutes writing the very bytes saved. A run naming a
  saved workflow now runs it while the proposal waits on, a sentence
  states its ceiling by its directive rather than by an amount it only
  mentions, and a ceiling stated alone binds the proposal shown under a
  fresh identity, with no author call.
- **What a trial run showed missing stays a rejection.** A verdict that
  stopped while locating a part a run showed missing was resumed in a
  later round that had no run of those bytes, and the whole-request
  answer over the bytes alone could then settle the workflow READY. That
  verdict now stands as it was, repeated with no call.
- **« Enregistre ce workflow et lance-le » saves and runs a shown proposal.** Only « save & run »,
  « save and run » and « enregistre et lance » were the combined consent; the natural « Enregistre
  ce workflow et lance-le. » at a shown proposal was routed as a change and the proposal came back.
  The consent words now also read, as a closed grammar over the whole line, a save verb and the
  workflow shown (a pronoun on the verb, « it », « ce workflow » or nothing), then optionally « et »,
  « and », « puis » or « then » and a run verb said the same ways. « enregistre-le » or « save it »
  alone saves. Anything more, a destination or a cadence, keeps its route.
- **« Enregistre ce workflow et lance-le » no longer asks the workflow to create something.** A
  line asking to save or run the workflow itself was read as an effect its tasks had to perform:
  on the welcome demo, « Enregistre ce workflow et lance-le », then Nika's own suggestion
  « sauvegarde-le sous le nom aggregate-by-key et exécute-le », then the `/help` keyword « run
  aggregate-by-key » were each refused with « DROPPED EFFECT: the request states `create` », so
  a workflow that only computes could not be saved from the conversation. Such a line (the
  workflow, a pronoun standing for it or a workflow's name, with nothing but a time, a polite
  word or the name it is saved under) is now read as the Session's act and accounted for, never
  as an effect. A destination still makes it a write: « enregistre-le dans out/resume.md » writes
  that file.
- **A cadence or a zone you pick from Nika's choices schedules the work.**
  A cadence picked from the author's list (the list sends its key) is
  cited from the label you picked, so « Tous les jours à 9h » is shown
  as a schedule instead of being asked again in free words. A zone you
  picked from a proposal's choice is yours: proposed again without that
  choice, the schedule is shown, where the Session refused it while also
  refusing to show the settled zone again. A label you did not pick, a
  choice left to Nika and a zone you never saw or picked are refused.
- **A schedule's hints name the program the person runs, and the author never calls a declared
  schedule active.** The hints after an activation said `nika serve` and `nika arm`, while the
  person ran `nika-dev` and the `nika` on their path was an older release that refused the
  workflow; they now name the program Nika was started as. The conversation's author told two
  people their declared schedule was active and invented an « Activer » button; its instructions
  now say that a declared schedule runs nothing until a firer runs, to repeat what Nika says of it
  and to invent no button, setting or command.
- **A cadence picked before a restart can still be scheduled after it.**
  The label of an option the person picked was citable as their words
  only while the Session stayed open. It is now read back from the kept
  record of their answer, so after a reopen a schedule citing « Tous les
  jours à 9h » from the line that picked it is shown. A label they did
  not pick and a choice left to Nika are still refused.
- **« tout les matins à 9h » is a daily schedule at 9:00.** People often
  type « tout les » and « toute les » for « tous les » and « toutes les »:
  the schedule a phrase states now reads them as that quantifier, so the
  Session no longer refuses « tout les matins à 9h » as an incomplete
  schedule. The singular « tout le matin » (all morning long) is not read
  as a schedule, and no hour or day is ever invented.
- **A change you ask keeps the zone you picked.** The zone a schedule
  carries rides beside the workflow, never in its bytes, so a revision
  after the proposal had shown it dropped your zone and could not be
  proposed. A revision now keeps the zone a shown schedule carried, after
  a reopen too, while your pick still binds it: once you changed the
  zone, the old one is not brought back, and it is never asked again.
- **A zone you leave to Nika as the default shown is yours.** When a
  proposal showed the zone as a choice and you answered « comme tu veux »,
  Nika took its default, yet a schedule following that zone was refused
  while showing the choice again was refused as already settled. Such a
  zone now schedules the work and is never asked again. A zone the author
  chose on a choice that showed no such default is still refused until
  you see it.
- **An author's choice within the person's own words is no longer
  refused.** A conversation's workflow was stopped when its author named
  the output file the person left to it (« tu choisis »), listed pages
  under the folder of a file the person typed, granted that folder's
  read scope, or named the host of the address the person gave for
  their local sink. Each is now admitted within that scope: a new file
  inside the project, a read under that folder, the exact host of that
  address. Anything beyond what the person typed is still refused.
- **A file the request asks for without naming it is derived, not asked.**
  When a document wrote no file for « write it into a file », or wrote
  one under a name it never stated, the finding told its author only to
  declare a placeholder and ask the person. The document door and a
  Session's author now get the selection that answers it: derive a new
  file inside the project, grant it, and state it with the person's
  words. A public source they name or leave to the author, or a file read
  under a folder they typed, is stated the same way. The door's
  instructions teach every scope the selection law admits. The question
  remains when the person's words leave the file's name to them.
- **`nika serve` no longer spins on a slot it cannot fire.** When the CLI firer had
  already fired a project beat's slot, or held its beat lock, or the workflow failed
  admission, or the queue was full, the slot stayed due in the resident's own store and
  the scheduler woke again at once, re-admitting the workflow in a busy loop: an idle
  resident burned seconds of CPU per minute until the slot aged out. A slot the CLI
  firer answered is now recorded as skipped (`answered_elsewhere`), and any other slot
  that stays due is looked at again after the 5-second rescan. A slot that comes due
  while the schedule's previous run still runs is now skipped once under
  `chevauchement: sauter` (the default), instead of firing late when that run ends.
- **A conversation's proposal that reads a project file can be saved.**
  The yes withdrew every agent-written proposal that read a project
  file: no compile had recorded its source basis, and compiling the
  request again without AI never rebuilds an agent's bytes. The proposal
  now keeps the witness of the bytes of each file it reads, as its
  author read them or as they were when it was shown. At the yes those
  files are read again: unchanged bytes let it land, and a changed or
  missing file withdraws it before anything is written.
- **Your words are read before an author acts on them.** When a conversation's author
  says your words consent to saving or running its proposal, the Session reads those
  words itself: unless they consent, nothing is saved or run and the proposal waits
  for your consent. Natural consent keeps working without a second confirmation.
- **A busy provider is asked again, and the person is told.** When the
  conversation's route answers 429, 503 or 529, the Session waits the
  delay the provider named (else 1 s, then 2 s) and asks again, twice at
  most, each ask counted as a call. A longer named delay or a third
  rejection ends the call with the provider's own words, how many times
  it asked again and how long it waited. A money account that keeps the
  rejected call's charge as unknown is never asked past: the call ends
  there, saying so.
- **A consent in words keeps the verdict of the proposal it answers.** Words that
  save or run the candidate the person was shown no longer send its unchanged bytes
  to the verifier again; a candidate written since is judged as before.
- **A message cut at the output limit runs none of its calls.** Each of its calls is
  answered « not run: your message was cut at the output limit; re-issue the call with
  complete arguments », and a cut answer is marked as cut: a half call no longer reaches
  a tool as text.
- **A choice with a reasonable default is proposed, not asked.** When the Session's author
  asks a question it could answer with a recommendation, or asks for the name of an output
  in your project, Nika refuses that question and the author proposes the workflow with the
  choice shown and its default: your yes keeps the default, naming another option changes
  it. The Session still asks what no default can stand for: a fact only you have, readings
  whose effects differ materially, or an authority only you can grant.
- **A proposal you saw keeps its rehearsal once you pick its defaults.**
  When the same workflow is proposed again after you picked the defaults of
  the choices it showed, the rehearsal of those same bytes follows it, so
  saving and running proceed instead of withdrawing the proposal. Other
  bytes, another proposal or a changed project still withdraw it.
- **Your request's save and run survives a default you pick.** When your
  request already asked to save and run, and the proposal showed choices
  whose defaults you then picked, the same proposal proposed again is
  authorized by your request instead of waiting for a second consent.
  Another option, a changed scope or any other line since still waits for
  your consent.
- **A saved workflow whose files changed since its rehearsal offers its recovery.** When a run
  of the saved workflow is refused because the workflow or the files it reads changed since the
  rehearsal, the terminal now offers « Adapt the workflow to the changed files » beside your own
  words: a new request, proposed, rehearsed and approved afresh, never a run on the withdrawn
  proof. Restoring the original files and asking again still runs it.
- **Bytes whose own check fails are never offered, saved or run.** A
  candidate failing its check (a temperature on a Claude 5 model, which
  refuses any but its default) was shown with « Save and run once » and
  saved over a clean file. The author's proposal is now refused with the
  check's findings before any judge reads it, so the author repairs it
  first; a consent to such bytes saves and runs nothing, replaces no
  file, and keeps the proposal waiting; the TUI offers no Save for them.
  The preview names the model findings that make a check fail.
- **Your answers reach the verifier as yours.** When a conversation's candidate is
  verified, its judges now read your answers to the questions asked (and the defaults you
  accepted) and your request as you first stated it, as a compile round of the same
  request does; a value you typed in an answer is no longer judged as invented.
- **A refused knowledge override no longer stops the conversation.** A Session
  whose configuration named a knowledge release it cannot verify (a historical
  `NIKA_KNOWLEDGE`) refused every model-backed request, and its only remedy was
  to quit and open the Session again. The conversation now opens as usual and its
  snapshot types the refusal (`knowledge`). A line that would reach a model waits
  before any request, exactly as typed, with one short explanation;
  `/knowledge embedded` uses the knowledge built into Nika for that conversation
  (its history keeps the choice) and resumes the line once, under the same
  intelligence and effort. Nothing falls back silently, and lines that need no
  model behave as before.
- **Finite Session choices use native terminal controls and keep the current
  request.** Single and multiple answers, intelligence settings, proposal actions,
  paused questions, and required boolean/enum inputs have selectable lists.
  Navigation and empty submission apply nothing; readers and settings preserve
  the draft. An explicit Save/Run request continues through clarification without
  asking for the same permission again. After reopening, a new rerun request can
  reuse an unchanged saved or previously observed workflow through normal Run
  admission; reopening itself performs no action. Failed conversation requests
  retain their original context for recovery, and expired questions show their
  renewal requirement before an answer.
- **Only the offer the person picked is theirs.** An answer to a question
  is read once (the protocol words, else one bounded reading of the line
  against the offers), and the Session binds the picked offer itself: an
  author can no longer claim an option the person did not pick, a free-text
  « no » picks nothing, and words that left a value ambiguous never name
  it. A choice left to the author is bound as its own (a new output's
  name derived, a source delegated), said, and never asked again. A
  value the person settled is asked again only when the question cites
  their later words asking to change it.
- **Where an open name starts stays answered after a reopen.** When you
  answered where one output's name starts and the Session reopened, the
  other output's choice is no longer refused as settled, and a revision
  that drops that other output is still reported. Nika reads the question
  you answered back from the conversation's own record; an answer it
  cannot match there exactly keeps the single-output rule.
- **An open name's choice is shown beside another output you named.**
  When a request names two outputs and leaves where one's name starts
  open (`générer out/stock.json` beside `notes/stock.md`), the choice of
  that start is no longer refused as settled by the other output, asking
  or answering it keeps the other output, and a revision that drops the
  other output is still reported. The same holds the other way round:
  once you answered where the name starts, the other output's choice is
  still shown, and answering or reopening it keeps the name you chose.
  A choice that also offers one of that name's readings asks for the
  same output: its answer replaces the other, in either order.
- **A conversation over its model's window folds and goes on.** When a request is over the
  model's context window, or a reply filled it, the Session folds the conversation once and asks
  again; a second overflow fails and names the window. A long run from one line can now be folded
  between its steps, a summary that would not shrink the conversation is not used, and a
  conversation too large for one summary request is summarized in whole-object parts within
  its estimated payload budget; an indivisible object or fixed prompt over budget is reported
  without folding originals.
- **The author knows the person's time zone.** A conversation's instructions name
  this machine's IANA zone, so « today » is computed as the person's day (with
  `nika:date` in that zone) instead of the UTC day.
- **A scheduled proposal is verified with its schedule beside it.** The
  proposal's verification now receives the schedule the Session accepted
  (the line it cites, the person's words and the zone), so a request that
  runs « tout les matins a 9h » is shown instead of being refused on every
  try because no task runs the workflow each morning.
- **A Session's provider call is sent once.** The conversation's model,
  the Session's own readings and the provider authoring seat use a
  transport that never sends a call again on its own, not even after a
  protocol refusal, so every request that leaves is one the money
  admission counts.
- **The recovery card reads a corrected request as the person said it.** After a
  correction (a delegated answer included) and a failed authoring turn, the `I still have`
  card printed the request as restated for the author:
  `your request: « Original request: … Correction (it takes precedence …): … »`. It now
  reads the original words, `your request: « … »`, then each correction in the order it was
  said, `your correction: « … »`, never the frame that joined them.
- **A Session line the host cannot parse is refused naming its command.**
  Both doors refuse such a line `malformed` naming the command identity its
  JSON carries, when a valid one, so a native client tells the refusal of
  its own line from another's instead of taking it for a reply to a read; a
  line naming none, or an invalid one, is still refused naming none.
- **Words that replace a value remove it.** A revision that gives a value the
  person saw bound its replacement (« raise the threshold to 72 hours »), or that
  replaces a value whose choice they left to Nika, no longer asks whether the old
  value should leave the workflow.
- **Your answer to a question no longer names the saved workflow.** When
  Nika asked you for a value, such as the text a workflow writes, and you
  answered with something that looks like a workflow file
  (`bonjour.nika`), the new workflow was saved under that name. Your
  answer now counts only for its question, whether or not the author
  bound it and after the Session reopens: the workflow is saved under
  the file your request names, else under its own name.
- **A revision needs your own words.** When a conversation's author changes a workflow you
  were shown and claims your consent for it, the Session now saves or runs it only when your
  words asked for that change before the save or the run, and the revision answers them with
  the same effects. Words that consent to the workflow as shown never cover new bytes: the
  revision waits for your consent.
- **A run asks its ceiling when none can be proved.** After a reopen, a
  Save that bound no ceiling or a restored exposure no longer refuses
  « Save and run once » or « run it » in the money law's words: the
  Session asks the run's ceiling (`Waiting::RunCeiling`), offering 0.10,
  0.25, 0.50 and 1.00 USD and recommending the smallest that holds about
  three times the workflow's static cost floor or last run, with why.
  The amount stated continues the run as « run it max $X » would, through
  the explicit path; « yes » states no amount, none is applied for the
  person, and a changed file, an unreadable receipt or several bindings
  still refuse. `SessionRuntime::waiting_run_ceiling_choices` states the
  choice; a host without rows asks one short line, in French when the
  run line was.
- **A Save says how to run the workflow from a terminal, with the program you run and your
  ceiling.** After a Save, Nika now adds `from a terminal: nika-dev run report.nika
  --max-cost-usd 0.1`: the program is the one Nika was started as (`nika`, or a `nika-…`
  release name), so the command reaches this same binary rather than an older `nika` on the
  path, and the ceiling is the one you saved with the workflow. With no ceiling of yours the
  flag is left out, never filled with a default. A file name with spaces is quoted (NIK-171).
- **A served Session run its resident refuses before any task runs is told as not started.** A
  job refused at admission (an unpriced cloud route, `NIKA-1709`) used to settle as « run
  observed · exit 1 · the workflow failed » with nothing to read, so an author could « repair » a
  workflow that never ran. The Session now answers that the run did not start, in the resident's
  own words and code, and a job that ran and failed names its error beside its exit.
- **A Session turn never ends in silence.** An author model's message with
  no words and no call (one that only reasoned) is asked once more, in
  Nika's words; if that answer is silent too, the person reads that the
  turn ended without a word, with nothing asked or proposed, instead of an
  empty reply.
- **A doubt the verifier states reaches the proposal.** On the agent-led route a
  ready verdict's stated doubt was dropped; the proposal now states it after its
  summary, before the person consents, and its identity covers it.
- **A Session's Stop stops its run over Serve too.** The run door Serve
  lends a Session never armed a Stop: over HTTP, a Stop during a run
  answered `run_underway` and the run went on. It now asks the resident's
  own job cancellation (the one `POST /v1/jobs/{id}/cancel` takes) once:
  the run is stopping and ends interrupted, a second Stop sends nothing
  more, and a Stop before the job's admission admits nothing. A resident
  that cannot stop a job says so.
- **An answer you type counts only for the question it answers.** When
  you answer a question Nika asked in your own words instead of picking
  an offer, the answer now settles only what that question asks. The same
  path no longer settles another name of your request that shares it,
  whether through the answer or through your reply's words, and the
  question's own wording is never taken as yours.
- **A new workflow is saved under the file name your request gives it.**
  When a request names its workflow file (`comptage.nika`), the proposal
  and the Save use that file whatever `nika:` the author wrote; a file
  already there is replaced only with your consent, as any update is, and
  a folder you name is kept.
- **An author now reads three laws that a run used to teach.** The
  `nika:date`, `nika:jq` and `nika:fetch` contracts an authoring model
  receives now say that a day added in a time zone is a calendar day (23
  or 25 hours across a DST change; `PT24H` is exactly 24 hours), that a
  `nika:jq` program emits exactly one value (wrap a stream in `[ … ]`),
  and that a JSON API is fetched with `mode: jq` or `mode: raw`, never
  the default Markdown.
- **A source used through a task's binding is judged as that use.** A
  public address the author chose, sent with POST through a `with:`
  binding of its task, passed the scope law that keeps it read with GET,
  and so did a person's file written through one. Both are now refused
  as when the tool's argument holds the value directly.
- **`/status` reads for the person.** The status card offered on the first screen listed the
  authoring context: strategy, knowledge snapshot digests and the decision seat's internals. It
  now shows the workflow, the project, the intelligence, who prepares and the money, and points
  to `/details`, which keeps those internals.
- **`/status` says a run the person refused.** A run stopped by a « no » at its gate exits 0
  as a success does, so `/status` said « last run: succeeded » beside « stopped at your « no » ».
  It now reads the refusal from the run's trace.
- **A suspended beat wakes after its `jusqu_au`.** A beat suspended with `actif: false`
  and `jusqu_au: 2026-08-31` stayed asleep forever under the OS units: `nika arm fire`
  skipped it as inactive at every slot, `nika arm` kept it DORMANT, and `nika arm --emit`
  wrote it no unit, while `nika serve` woke it on the machine's calendar. Both firers now
  read one law: the suspension ends at midnight after its date in the cadence's own zone
  (a `TZ=Europe/Paris` cadence wakes at 00:00 Paris on 1 September), and the beat fires
  again with its silence counted from that wake, so the slots it slept through are
  neither reported missed nor caught up. A suspended beat keeps its OS unit, and
  `nika arm disarm <label> --write` rewrites it instead of deleting it: the firer
  journals « inactive — <raison> · jusqu_au <date> » until the date. A beat still active
  in `nika.yaml` is not disarmed by the flag; the gesture is in the file.
- **Switching intelligence keeps what the person already said.** A request typed while the chosen
  intelligence could not author (a seat that is not infer-grade, not signed in) stayed in the
  Session's memory but never reached the next intelligence: after switching, « lance la tâche
  qu'on avait définie plus tôt » met « Je n'ai pas trace … aucun échange avant ce message ». A
  conversation that starts now begins with the person's earlier lines (the request the Session
  kept and up to three of their latest lines, never a command or a consent word), cited as theirs,
  with a note that nothing was prepared from them yet. Live: after copilot refused, Claude Sonnet
  prepared the same translation from that sentence alone, and its run wrote the file.
- **« Test the key » judges an OpenAI, xAI, DeepSeek, Mistral, Groq, OpenRouter or Gemini key.**
  Only Anthropic's key could be checked: an invalid OpenAI key read « unknown », and its HTTP 401
  came with the first message. On each provider's own endpoint, one free GET of a listing that
  authenticates the key now says valid or refused (Gemini's `API_KEY_INVALID` included); an
  operator's endpoint, which may list to anyone, is still not judged.
- **The conversation and `/status` say what `nika.yaml` declares.** Right after « applied ·
  wrote `nika.yaml` », the author said nothing was declared, and `/status` read « no schedule
  declared » for the last workflow saved while another workflow's schedule stood in the file.
  Nika now tells the author, with the person's next line, the declaration it saved and that a
  declared schedule runs only once a firer runs; the status also lists the schedules the project
  file declares for other workflows.
- **The author lists a folder instead of guessing its file names.** Asked to read every export
  of `releves/`, DeepSeek guessed fifteen file names, each refused « does not exist in the
  project ». The author's read now lists a folder (`.` the project root), and a file that is not
  there is answered with what its folder holds; hidden entries never show.
- **The consent card names every file the run may touch.** When a workflow computes its paths
  (one file per item, a path built from a list), the card showed only the literal paths, such
  as « writes ./journal.md » for a run that also wrote ./traites/** and removed ./inbox/*. It
  now shows the grant in force. It also says « removes files » when the workflow removes any.
- **The install decision, « désactive-le » and the engine's own answers no longer reach the model.**
  While the install card of a declared schedule waits, every answer goes to it: its label, a yes,
  a number. Before, the conversation's model read the answer (and even the row key `declared`),
  and the same card came back after every line. « désactive-le » now removes the trigger even when
  an earlier conversation installed it, and so do « retire le déclencheur de ce Mac », « désactive
  <nom du workflow> » and « turn it off ». The model is told when the Session installed or removed a
  trigger, so it no longer contradicts the card. The answers /help promises without AI also work in
  French: « est-ce que X est valide », « vérifie le workflow X », « explique-moi le code NIKA-… »,
  « que veut dire NIKA-… ».
- **The intelligence list no longer leaves its directions in the conversation.** Browsing
  `/intelligence` used to add Nika messages such as « Choose an intelligence below. », « Choose
  a connection below. No selection has changed. » and « Choose a model below. No selection has
  changed. » to the history, right before « Intelligence: … ». These directions now show only
  in the list's own head while it is open. The conversation keeps the intelligence you chose
  and what a row you picked reported, such as a key check or a refusal.
- **GPT-6 Astra, GPT-6 Sol, GPT-6.1 Sol, GPT-6 Luna, GPT-5.6 Sol and GPT-5.5 are priced.** These
  models had no verified tariff: a budgeted run was refused and any other run reported an
  unknown cost, while the model picker showed a price. Each now reads its official model page:
  price, cache-write rate for the GPT-6 family, the 272K lower tier and the snapshot its replies
  name. A live call on each settles at its page's price ($0.000076 on GPT-6 Sol for one word).
- **The result offer fits the result and speaks the person's language.** After a run, a French
  person read the offer to adjust the result in English (« What would you like to adjust in this
  result? »), with choices from another kind of workflow (« Depth of the summary », « Diversity
  of sources » after a bank-statement total), beside a « Request · » line that quoted their
  latest answer rather than the request. The offer, its choices, its refusals and its
  acknowledgement are now said in the person's language. Topics and sources are offered only for
  a result a model writes from what it read; a computed result is offered its presentation only.
  The offer card no longer names a request, and the request line of other cards is labelled in
  the person's language. The keys a host sends are unchanged.
- **The run card speaks the person's language.** A French conversation's run card now reads
  « Terminé · `x.nika` · 9 étapes exécutées », « produit · … », « coût · 0,0004 $ · 1 appel
  tarifé », « plafond · 0,10 $ · le plus que ce run pouvait coûter » and « Échoué · … · `t` a
  échoué » (`RunFacts::result_in`). A run whose gate the person refused says « arrêté à votre
  « non » » rather than a plain success. A failure's code is said once. The failure card no
  longer tells the person to repair a workflow whose step failed for an outside cause: it asks
  for a repair only if the cause is the workflow's own.
- **The run ceiling stays the person's, and a run that would pass it does not start.**
  - « Mets le plafond à 0,001 $ », with nothing waiting, sets the saved workflow's next runs in
    this conversation. The Session says so itself, and the run card names it (« the one you set
    for its next runs »). Before, the conversation's model acknowledged it and the next run kept
    the old ceiling.
  - A new request that states no ceiling keeps the one the person stated earlier in the
    conversation, instead of the Session's $0.25 default. Before, a copy of a workflow ran under
    $0.25 after « budget max 0,10 $ par run ».
  - A run whose last run of the same bytes cost more than its ceiling is refused before it
    starts, with the ceiling to give instead. Before, it stopped partway and wrote nothing.
  - A run its ceiling stopped says « Arrêté · le plafond est atteint : 0,0035 $ dépensés pour un
    plafond de 0,0010 $ » with what never ran. It no longer asks to repair the workflow
    (`RunFacts::result_in`, `spent_usd`, `stopped_by_ceiling`).
  - A run cost under a tenth of a cent shows two significant digits ($0.00015, not $0.0002).
- **The run report says the workflow's outputs.** A run's declared `outputs:` (the totals of
  an aggregate, the message of a translation report) appeared only in a side panel's JSON; the
  report now lists each one (« output · totals · {"north":15,"south":20} »), a long value cut
  at 160 characters. A read whose task failed and was recovered, such as a state file that does
  not exist yet on a first run, reads « not there · ./state.txt · nothing was read » instead of
  « read ».
- **The schedule inside an author's cited words is read.** « qu'il tourne toutes les heures » and
  « tous les soirs à 20h, heure de Maurice » were refused as incomplete schedules because the
  whole excerpt was read as one cadence. The one schedule inside such words is now read; two
  schedules stated apart are still asked.
- **The Session's own lines follow your language.** Under French answers, the saved facts, the
  help card, the stage rail, the status row and the reply to a second activation stayed in
  English. They now follow the language you write in, with the same facts (« Enregistré ·
  vérifié · pas actif · rien n'a tourné », « Brouillon ✓ · Enregistré ○ · … »), and the
  language resumes when a conversation is reopened. A host can render the rail in it with
  `Lang::rail`.
- **Schedules, paused runs and saves read in the person's words and language.** A declared
  schedule reads « tous les jours à 20h (heure de Maurice) » instead of its cron. Its state now
  comes from the arm ledger and this Mac's unit (« Actif · … · dernier run … · réussi »). The
  missed-run policy and the value an activation waits for are said in words, not as
  `rattraper-une-fois` or `project.timezone`. A paused run's gate card, its question, « why? » and
  the restored gate notice follow the person's language. A save counts its hints instead of
  naming their internal kinds, and its refusals are said in French to a French speaker.
- **The verifier no longer asks the workflow to hold a run's ceiling or a declared schedule.**
  When the person changed their per-run ceiling (« budget max 0,10 $ par run », later
  « plafond 0,001 $ par run »), only the words stating the ceiling bound to the proposal rode
  beside it, so the verifier asked the plan for the other amount. One person met seven refusals
  of a one-line model change this way. Now every earlier ceiling the last one supersedes rides
  beside it too. A schedule `nika.yaml` already declares for the workflow a revision lands on
  also rides beside the revision, quoted in the person's own words. Before, a repair was judged
  to miss « tous les matins à 7h ».
- **Asking for « l'exemple de l'écran d'accueil » gives the welcome's demo.** A person who named
  the demo by where the welcome shows it, not by its name, got the author's smallest example,
  written for another model. That line now opens the welcome's demo (`aggregate-by-key`) with no
  model, as its name does. Hosts can name the same demo through `nika_session::WELCOME_DEMO`.
- **A task `timeout:` names the MCP call it stopped.** When a task's
  `timeout:` cut an `mcp:` call, its `NIKA-TIMEOUT-001` error now carries
  `details.stopped_call` = `{tool, call_id, outcome}`, `outcome` being
  `unknown` once the call was sent and `not_sent` when it never was; the
  task's terminal frame repeats it as a `stopped_call` field, and the run's
  settlement lists it in `stopped_calls`, whether the task failed, was
  skipped past or recovered. A task whose call the operator's Stop cut
  carries the same frame field.
- **A run that a human gate split in two now costs both of its legs.** The summary after a
  resumed run read « cost · no model usage recorded » although the leg before the gate had made
  a priced call ($0.0438), and the activation's ceiling hint then said « the last run cost
  nothing priced ». A resumed journal now reads what the legs it continued spent from their
  own journals in the same store, following `resumed_from`: « cost · $0.0438 · 1 priced call(s)
  · … · over its 2 legs ». The forecasts that `nika explain` and the ceiling hint read fold the
  resumed leg into the run it continued: the cost is summed, the state is the final leg's, and
  the time is the legs' time.
- **A workflow that pins its model's access can be proposed again.** A file whose `run.access`
  names a route or a protocol (`via: anthropic`, `protocol: api`) made the trial before a
  proposal stop with « The rehearsal engine failed » and nothing to repair, so asking for an
  API-only workflow could never reach a proposal. The trial now keeps that model step out, as it
  already did for an unpinned one, and rehearses the rest. A real run still judges the pinned
  access on its own plan.
- **The rail reads « Actif ● » only for a fire since the trigger's last disarm, with a firer
  standing.** It took any fire of an installed unit as proof, so a trigger installed again after
  « désactive-le » read « Actif ● » before it ever fired again, and a fire by a resident
  `nika serve` alone never counted. The rail now reads ● when the schedule is active and its
  ledger reads, a fire is journaled since its last disarm (`fired_since_disarm`), and a firer
  stands: its unit on this Mac or `nika serve` serving the project.
- **The activity card says what Nika is doing, not the names of its tools.** While a workflow
  was prepared the card and the busy row read « ✓ Generating · candidate_write · 28 ms »,
  « propose failed » and « call 2 · audit_interpretation · requested … ». A tool step now reads
  as what it does (« writing the draft · 28 ms », « proposing the workflow failed · 2 ms »), a
  call by what it is for (« check its reading of your request », « read your request », « answer
  you », « write the workflow », « repair the workflow »), in French too. The exact names stay
  in the activity's typed marks and the receipts; a name no words are known for still shows as
  it came. `nika_display::activity::tool_words` and `nika_display::activity_card::role_words`
  give other doors the same words.
- **An approval gate takes a typed yes or no.** A workflow's approval gate said `answer
  yes or no`, yet typing `oui` or `yes` only showed `nothing sent · ↑↓ choose, then Enter`:
  its field took no words. A whole-line `oui`, `yes`, `y`, `ok`, `valide` or `approuve` now
  picks Approve, `non`, `no`, `n` or `refuse` picks Refuse, and `why` or `pourquoi` picks
  Explain: the act's radio fills while the word is typed and `Enter` sends it, once. Other
  words send nothing and say so, a typed command is sent as before, and `Esc` empties the
  words and never answers no (NIK-194).
- **A run whose turn ended never reads running.** When a run's turn ended before its
  settlement frame arrived (an environment that refused it, for one), the header, the
  pinned row and its task cards kept `◐ running` for as long as the session lasted, while
  the report on the same screen said `exit 3`. No frame outlives its turn, so such a run
  now reads `ended · no settlement received` (`ended · no frame received` when nothing
  arrived), and a task it saw start reads `no end received`, never running. A settled run
  keeps its settlement.
- **A model picked in `/intelligence` reads by its name, never its key.** Picking a row
  of the intelligence list wrote the person's line as the row's internal key
  (`choice › 1 claude-code`). It now reads `Intelligence: claude-code`, the name the
  list showed, and a step to another list (`Other choice…`, a connection, `Esc` back)
  adds no line at all: the next list, or Nika's confirmation, says what happened.
  Words typed over the list and typed commands still echo exactly as typed.
- **A command beside a decision answers visibly, and an act's name does that act.**
  With a decision on screen (`Decision · required`), `/meaning`, `/why` and `/show`, from
  the palette or typed, were answered by the Session while the decision waited again, but
  the decision's band hid the conversation: the screen did not change. Their answer now
  opens in the reader (`Answer to /meaning`), and `Esc` returns to the decision as it was;
  a command that said nothing says `nothing to show`. Typing an offer's exact name
  (`Inspect the exact changes`, a source's name before « · ») fills its radio and `Enter`
  picks it, as selecting it would; any other words stay the person's words.
- **Typing a connection's name narrows the list to that connection.** In the connections list,
  « openrouter » matched all 376 entries and « openai » 113 across providers, so the
  connection's own row was buried. Words that name a connection now show that connection's row.
  Its models appear once it is opened. Words that name no connection still find the models they
  name, and home still finds models by name.
- **A decision and the intelligence list no longer name a stale request.** Every decision
  card (`Decision · required`) and the `/intelligence` list carried a `Request · …` row
  with the Session's goal: the conversation's first request with its corrections, so it
  stayed on the session's first message across unrelated proposals and every intelligence
  switch. Those surfaces now name no request; a proposal's card keeps its own `request:`
  fact, and a question and a held message still show the request they serve.
- **A first-run choice list reads whole beside the welcome.** In the workspace, the
  required intelligence list of a first run shared its width with the welcome mark, so
  at 120x40 the conversation column was 44 cells wide and every row was cut (« Recommended
  for you · Claude Sonn… »). A choice the person must read now starts the exchange like a
  sent line does: the welcome yields its width to the conversation and the rows read
  whole at 80x24, 120x40 and 180x48.
- **A model found in `/intelligence` names how it is reached.** Typing `codex` over the
  connections listed the Codex agent account beside API models whose names hold « Codex »,
  their access only in the quiet facts, so an API model could be taken for the person's
  subscription. A model found by its name, or listed among connections, now reads its
  access in its name: `GPT-5.3 Codex Spark · OpenAI API`, `GPT-5.3 Codex · Codex agent
  account`, `qwen3-coder · Ollama on this machine`. Lists of one connection stay as they were.
- **A message typed after `F6` is never lost, and the hint row says where the keys are.** With
  the project list or the object holding the keys, the letters of a message vanished with no
  echo, and nothing on screen said which panel had the keys. That panel's hint row now reads
  `keys: the project list` or `keys: the object in view`, `· typing writes in the conversation
  · Esc returns` where it fits, and a character typed there (other than that panel's own keys:
  `r`, `+`, `-`, `0`) returns the keys to the composer, which takes it with the rest of the
  message.
- **A line typed at a list question reaches the Session.** « choisis pour moi » or « 7h30 »
  typed at a list question was dropped: a question its author closed to its offers, and an
  activation's or a run ceiling's list question (the missed-run policy, the ceiling per
  run), took no words, so the line showed `nothing sent` or the focused row was applied in
  its place. Every question beside its rows now takes the typed line and sends it as the
  reply, a delegation included, for the Session to read. Only consent decisions keep their
  rows alone (a cost decision; an approval gate takes a typed yes or no), and a run's input
  keeps its exact values.
- **A recommendation its label already says reads once.** A proposal's choice read
  `claude-sonnet-5-5 (recommandé) · recommended`: the row added its own `recommended` beside
  a label that said it. The suffix is now left out when the offer's own words already say it
  (`recommandé`, `recommandée`, `recommended`, any letter case); any other recommended offer
  still reads it.
- **A run stopped at your « non » never reads as a success.** When the person answered a gate
  « non », the runtime still settles the run succeeded, and the TUI read that word: the runs list
  said « réussi », the run object and the pinned row « terminé · réussi », the gate's row
  « ✔ approve », the live line « Exécuté en … ». The runs list, the run object and the pinned row
  now say « terminé · arrêté à votre « non » »; the gate's row, its graph chip, its detail and its
  step on the run card read in the stop glyph with « répondu non »; the live line says « Arrêté à
  votre « non » après … ». A gate the person allowed still reads done. In the runs list, a stopped
  run, like a cancelled one, now reads « stopped » (« arrêté »).
- **A connection whose key was refused is not put in use.** After « Test the key » said OpenAI
  refused the key (401), the picker still let the person keep or choose that connection, and
  every request then failed with the same 401. Keeping it, choosing its row or one of its models,
  or typing over the list while it is the one in use now says « clé refusée par OpenAI (401) · ce
  choix n'est pas appliqué · vérifiez la clé ou choisissez une autre connexion ». The list stays
  open for another choice, and typed words come back to the box. A later key check that passes
  lifts it.
- **A sentence typed while the `/intelligence` list is open reaches the conversation.**
  Words matching no row used to be sent as a choice and refused with a lesson in typed ids
  (`1 <app>/<model>`). When they take no expert route (a pick number alone or with one
  name, `4`, a command, a lone `provider/model`), the list now closes with the current
  intelligence kept, one notice says `intelligence unchanged`, and the words are the
  conversation's next message. The list says so before `Enter` is pressed. Without a usable
  intelligence the Session keeps the words until one is chosen, as before, and a decision
  waiting behind the list takes nothing from them: they come back to the box.
- **A settled run draws no task running, and a lost journal says why.** A task whose end frame
  was drained (its output over the stream's 1 MiB bound) kept `◐ fetch_stripe` on the run's
  card and list although the settlement said `11/11 tasks ok`. Once a run settles no task
  reads running: one still drawn running reads `settled ok` when the settlement counts every
  task ok, and `no end received` otherwise. When the run's evidence is `lost`, its header now
  says why when the stream told it (a step's output its trace could not keep either) and
  `reason not reported` when nothing did (NIK-195; the 1 MiB trace bound itself is NIK-131).
- **A single choice opens on a row, and a filled radio is the one `Enter` applies.**
  A question the author asked and a settings list (an Agent account's model step, for
  one) opened with no row selected: `Enter` sent nothing, and the first `Down` selected
  row 1, so `Down Enter` meant for the second hour of a list answered the first. Every
  single choice now opens on its recommended row, else its first row, and `Down` reaches
  the second; a decision still opens with nothing selected. Once words are typed beside
  a question or a decision, `Enter` sends them and no radio is drawn filled. A PTY proof
  drives an hour list at three sizes, across a shrunk and regrown terminal, with typed
  words and in the ASCII glyph column.
- **A catch-up and a skipped slot are said as the arm ledger records them.** The workspace took a
  fire answered five minutes or more after its slot for a catch-up, so a late fire on its own
  slot read as one and a quick catch-up did not. It now says the missed slots one catch-up run
  answered as the ledger counts them (« 2 créneaux manqués rattrapés à … »), and a skipped slot
  says why in words: « 1 créneau manqué », « un run tournait encore », « suspendu dans nika.yaml »,
  and the firer's other reasons; a reason it does not know is said as the ledger wrote it.
- **The check's hints point to the check face, not to a terminal.** After a save, the
  conversation said « 2 conseils pour l'améliorer · `nika-dev check x.nika` les affiche ». That
  sent a person who never opened a terminal to one. In the workspace the line now says « 2
  conseils pour l'améliorer · la face vérification les affiche · F6 puis Gauche/Droite ». The
  check face of the saved workflow, in view after the save, lists the hints. The whole words (F2)
  keep the command.
- **Code in a reply reads between quiet rules, not backticks.** A reply showing a file's content
  framed it with literal « ``` » lines. The fences now read as quiet rules (« ─── », « --- » in
  ASCII), the first naming the code's language when the fence does (« ─── text »); the code
  itself stays exactly as written.
- **A connection's row and its list now count the same models.** « openrouter · API · 375
  models » opened on a list titled « 1-50 of 280 »: the row counted every model, older ones
  included, while the title counted the list's rows, its moves included. The row now counts the
  models its list shows and says the older ones apart (« 278 models · 97 older »), and a list's
  title counts its choices only, never « Older models (97)… », « Test the key » or « All
  connections » (« 1-50 of 278 »).
- **The `nika.yaml` card says its schedule in words.** A declaration's card showed only « crée
  nika.yaml (6 lignes) » and « à l'exécution · pas un workflow audité par la Session : il n'exécute
  rien », the schedule itself left to the file's raw `cadence: "TZ=Europe/Paris 0 8 * * *"`. The
  card now says it as the Session does: « planification · compiled-workflow.nika · tous les jours
  à 8h (heure de Paris) », « si le Mac est éteint : le rattraper une fois », « plafond 0,20 $ par
  run ». The file view keeps the exact bytes.
- **« Laisser Nika choisir » echoes in French.** Leaving a choice to Nika in a French
  conversation put « I leave the choice to Nika. » in the person's bubble. The bubble now reads
  « Je laisse le choix à Nika. », and where no typed question is painted, the line the control
  sends is in the person's language too.
- **Discard asks once before it is done, and the selected act is named.** On a proposal's
  decision `Down` three times then `Enter` discarded it at once, with nothing on screen saying
  which act the cursor was on: a persona lost a 1 min 26 s proposal that way. The first
  `Enter` on `Discard this proposal` (or `Discard the unqualified candidate`) now asks
  `Discard this proposal? Enter again · Esc keeps it`; only a second `Enter` discards, and any
  other key or `Esc` keeps it. Once an act is selected the hint row names it, `Enter acts:
  Discard this proposal`, and its row stays filled even when the list does not hold the keys.
- **F6 no longer shows a draft from another round.** While a question waited, the source face
  could show a draft the Session kept from a discarded or earlier round (« brouillon ·
  lecture-semaine-flux » while the change was asked of the saved `lecture-semaine.nika`), so it
  looked as if the change was being made on the wrong file. A draft is now shown only under a
  question its own round asks; otherwise the saved file, or nothing, stands in its place.
- **The footer tells an earlier session's run only while this conversation ran none.** After a
  green run here, saving a revision reset the rail's Run field, and the footer then showed the
  last run an earlier session kept: « Run ○ (précédent ×) » and « dernier run … × sortie 1 dans
  une session antérieure », beside a bottom bar saying the run here succeeded. Once this
  conversation observes a run, that earlier one is no longer told.
- **`Esc` back out of an `/intelligence` list leaves no message behind.** Going back from a list
  below home (every connection, a connection's models, the decision or Run list) left a phantom
  `You · choice › /intelligence` bubble in the conversation, as if the person had typed it. The
  step back to the list above now adds no line; a choice still reads `Intelligence: <name>`, and
  words or a command the person types still echo as typed.
- **One `Esc` closes the `/intelligence` list when nothing is typed.** A selected row is
  browsing, never a choice, so the first `Esc` no longer stops to clear it: the list closes
  with the current choice kept, or, inside an opened connection, steps back one level.
  Typed filter words still go first, alone, and the emptied field keeps saying what typing
  does there (`type to filter`) instead of falling back to the reply placeholder.
- **A face's key cue now names keys that work from where you type.** While the question box had
  focus, the object pane said « Left/Right change the face », keys that do nothing there until
  `F6` moves the keys to the object. From the box the cue now reads « F6 then Left/Right change
  the face » (« F6 then r reads it again » on an opened file, « tasks · F6 then ↑↓ pick · Enter
  details » on a run's list), and once the object holds the keys it names them alone, as before.
  For other hosts, `Inspected::keys_here` and `Proposed::keys_here` are new additive calls; the
  default keeps the previous cues.
- **A face's key cue stays whole in a narrow object.** At about 120 columns the row saying whose
  bytes a face shows was cut at the object's edge, taking the keys with it (« this file's bytes,
  as last read · F6 then r re… »). The row now wraps at its words onto a second row where it is
  wider than the object, so « F6 then r reads it again · Left/Right change the face » always
  reads whole, on a workflow's faces and on a reviewed proposal's.
- **A run's files face and its card now list every file the run wrote.** The face said « wrote
  no file » while the run had written three files with a `for_each` of `nika:write`, and again on
  the leg resumed after a gate, whose written file comes back as a cache hit. A task now counts
  as a write when its note names `nika:write` or when the bytes the run names declare it, and
  each path its output names is listed, every path of a fan-out included. A path is only ever
  read from the write's own output.
- **A schedule's fired runs read on the clocks the person reads.** The schedule's line and its list
  entry said its slots and catch-ups in UTC (« dernier créneau 2026-10-16 06:00 UTC »). A slot now
  reads on its own schedule's clock, the zone its cadence declares, that zone named where it reads
  otherwise than the machine's (« dernier créneau 16/10 08:00, heure de Paris », « 16/10 08:00
  Paris » in the list), while a catch-up reads on the machine's clock (« rattrapé à 16/10 12:00 »),
  dated as the runs are. The zone is read from the embedded tzdb, never the host's.
- **The first screen speaks this machine's language.** On a French machine the top bar and the
  first screen read English (« Prepare with: … », « No workflow in … yet ») until the person's
  first French line. Before the person writes, the TUI's own words now take the locale (the first
  of `LC_ALL`, `LC_MESSAGES` and `LANG` that is set): « Préparer avec : … ». The person's words
  still decide from their first line on, and a conversation resumed in French speaks French.
- **A folded run's row no longer says how the run ended.** A run's story folded to « run … ·
  succeeded · F2 », the settlement's own word, in English on a French screen, and still
  « succeeded » after the person refused a gate. The row now reads « run 17/10 11:04:30 · F2 »:
  how the run ended is the Session's block's to say, just below it.
- **The trigger's install decision shows its card above its two acts.** While « Installer le
  déclencheur sur ce Mac ? » waited, the decision showed only that question and its two rows: the
  card it decides (the workflow, the cadence, the missed-run policy, the ceiling, the launchd
  unit, and the warning when a scheduled run would not see the terminal's API keys) stayed hidden
  behind it. The decision now reads its card as the schedule's other questions do, so the warning
  is on screen when « Garder déclaré seulement » is the act the Session recommends.
- **Intelligence guidance matches the native choices.** The command palette
  points to the connection and model list, and session help no longer asks
  users to send their next message as a choice.
- **Sending a request while an earlier run's journal loads no longer loses
  Enter.** The terminal retains the activation and subsequent input in order,
  then handles them normally after the read. Later edits remain a separate
  draft; cancelling the retained request preserves its text without sending it.
- **A key typed just before a question appears never answers it.** Nika
  already keeps what you type while it works away from the decision a turn
  ends on. A key that arrived after the turn ended, but before the decision
  was drawn, could still answer the decision before you saw it. Such keys now
  join your draft like any other typeahead. Only keys pressed after the
  question appears answer it.
- **A refused key reads in one plain line.** « Test the key » on a key the provider refused
  answered « Key check · OpenAI: refused (401). authentication failed (HTTP 401);
  code=invalid_api_key … The run could not reach that model … `--model` … `--access <seat>` … ».
  That was the provider error's text and its command hints. It now says « clé refusée par OpenAI
  (401) · vérifiez la clé ou choisissez une autre connexion ». Every key check line and the
  verdict word beside « Test the key » follow the person's language.
- **A question card never paints empty.** After an answer, a « Question » card could show only its
  border, with nothing to answer. A block that comes with no words now paints no card: a question
  has its words, or there is no card.
- **The picker's filter finds word starts in names.** Typing « xai » listed `MiniMax`, whose
  Hugging Face organisation `MiniMaxAI` holds those three letters. The filter now finds a row
  when each typed term starts a word of its names (its model, its provider, its access), never
  letters inside a word, and no longer searches the quiet facts beside it.
- **The intelligence picker speaks French under a French footer.** Its own words stayed English
  beside French ones: « Intelligence for this conversation », « Choose an AI connection », a
  connection's « Agent account · 7 models · 11 older · key required », a model's « current ·
  recommended · $2 in / $10 out per MTok · 1M context », the home rows (« Other choice… »,
  « Author: … », « Set as default ») and every list's guide. They now read in the person's
  language (« Choisir une connexion IA », « Compte agent · 7 modèles · 11 plus anciens · clé
  requise », « en cours · recommandé · $2 en entrée / $10 en sortie par MTok · 1M de contexte »);
  the models', providers' and keys' names, the prices and the Session's own words stay as they
  are.
- **The intelligence picker marks the connection in use.** With codex authoring, « Choose an AI
  connection » read « ( ) codex · Agent account », with no filled radio and no « current », while
  models in use read « (●) … · current ». The connection in use now reads as models do: its
  radio filled and « current » first among its facts, in every connection and on its own option
  in its list, whether the Session marks a model of it or only the selection names it (an agent
  account that lists no model of its own). No other connection is marked.
- **A picker list fills one radio.** The list of connections showed two « (●) … current » at
  once: the model in use, leading the list, and its connection. A list now holds one filled
  radio: the model where models lead it, the connection where it lists connections alone; the
  other row in use keeps its « current » word without a second radio.
- **The `/intelligence` filter finds the provider first, keeps each provider's rows together, and
  lists only models that write.** Typing `xai` matched 17 of 670 rows with Hugging Face models
  mixed in, and the Run list offered embedding models such as `text-embedding-3-large`. Rows
  whose provider or access words hold the typed words now come first (the xAI connection and
  its models), then the others, each provider's rows together; each provider marks one model,
  the one Nika recommends or else its newest (`newest Grok`), never a dated snapshot or a
  legacy model. The author and Run lists no longer offer a model that writes nothing: one the
  catalogue prices for input alone, or whose name says it embeds or reranks.
- **Proposals and files read by their names, not by hashes.** The workspace named a proposal by
  the hex of its identity (« proposition b5973f37d7a7 · F2 : tous les mots ») and every face of
  a file or a proposal by the hex of its bytes (« ces octets 7594d366fc7c »), on the card's
  border, the object's first row, the replaced file's row and the workflow's facts. They now
  read by name: « compiled-workflow.nika · F2: whole words », « these bytes, the proposal's own »,
  « this file's bytes, as last read », « replaces ./notes/plan.md (4 lines) · over its bytes as
  read ». The Session's whole words (F2) keep the identity a yes answers. Where a short band
  joins the name and « Not saved yet » on one row, the name takes its shorter whole form so the
  proposal's facts keep their rows.
- **A proposal's card no longer shows its identity.** A proposal card read « identité
  2df0f6a0c37c · « oui » écrit exactement ces octets · « non » abandonne ». The hex looked like a
  code to keep or type back. Every proposal card, the focus view and the inline transcript now
  read the line without the identity: « « oui » écrit exactement ces octets · « non »
  abandonne ». The proposal's whole words (F2) keep it.
- **The rail tells a schedule's three states apart.** « Actif ◐ » read the same whether the
  schedule was only declared or its trigger was installed and waiting for its first slot. The
  rail now says a word beside the glyph: « Actif ◐ déclaré » with no firer, « Actif ◐ en
  attente » once its unit is on this Mac or `nika serve` serves the project and no fire is proved
  yet, and « Actif ● » once it fired since its last disarm.
- **A refused « Laisser Nika choisir » comes back in French.** When nothing took a choice left
  to Nika, the box got « I leave the choice to Nika. » back in a French conversation. It now gets
  « Je laisse le choix à Nika. », as the echo says it.
- **A run refused before it starts now settles as refused, with its reason.** It stayed « run
  (starting) » in the aside and the run pane. Now the leg is named « run (refused) », its pinned
  row reads « refused · NIKA-1709 · … », and the run pane says « refused before its start · … ·
  nothing ran ». For other doors, a `RunSink` gains `refused(why)`, a method that does nothing
  by default, told by the run's story when the stream's first document is the check's refusal
  or the error envelope.
- **A reopened conversation says once that it was kept.** After a reopen, one card said the
  recovery three times: the Session's « conversation restored · … » notice, the TUI's own « plus
  tôt dans cette conversation · gardé dans votre historique · rien n'est rejoué » header, and the
  Session's bracketed recovery note repainted as an earlier turn. Under the Session's notice the
  earlier turns now follow with no header of the TUI's, and the Session's own recovery notes are
  no longer repainted as turns.
- **Nika's replies read their Markdown instead of showing it raw.** A reply such as
  `**Résumé** · *3 sources*` with `- Le Monde` items and a `| Source | Articles |` table read
  with its stars, dashes and pipes as typed. Replies now show bold and italic words in weight and
  slant without their markers, code spans with their backticks, headings in weight, list items
  behind a bullet and simple tables as aligned columns over a rule. Fenced code stays as written,
  every word is kept, and your own lines stay exactly as you typed them. Under `NO_COLOR` the
  weights still read; the ASCII column draws `-` bullets and `-+-` rules.
- **The status row's reply label speaks French.** In a French conversation the status row read
  « Latest reply above · Dernier run · … ». The label now follows the person's language:
  « Dernière réponse ci-dessus », « Dernière demande refusée », « Préparation arrêtée ».
- **A reply's table stands as a table in a narrow conversation.** A Markdown table wider than
  the bubble, the focus view or the terminal wrapped its rows, the tail of a header landing under
  its first column. Its widest columns now narrow to fit the row and a cell wider than its column
  is cut on the cut mark (« Croissance … »), the narrow columns keeping every figure: one row of
  the screen for each row of the table. A table that fits keeps its natural columns.
- **A tool failure later work recovered no longer reads as a red failure.** The activity card kept
  every failed tool step as a red « ✗ … failed », even when the next attempt of the same tool
  succeeded a moment later, so ordinary retries read as errors. The failed step keeps its row but
  now reads as retried, muted: « ↺ Generating · reading a project file failed · 7 ms · retried »
  (« réessayé » in French, « r » in ASCII), and the card's heading says no failure. A failure no
  later attempt recovered keeps its red « ✗ » to the end.
- **The review card keeps a long release name whole.** A component whose
  release name cannot stand whole on a row of the card shows its row
  without the name. The check face's detail and `F2` still show the name,
  and it is never broken mid-word. A name that fits keeps its place.
- **A revised workflow says what changed in words.** The review read « revised in place ·
  tasks.clean.invoke.args.expression » and « component · block:csv-clean-dedupe-report
  knowledge-0.123.0-r3.5-foundry-20261016 · expanded · const.key = "email" ». It now reads
  « revised in place · step clean », « component · csv-clean-dedupe-report · reused as bound ·
  key = "email" », and a creation « created · composed from components », in French too. A
  component's kind, release and digests stay on the check face's compile record.
- **The runs list names each launch by when it began and says how it ended.** Runs were listed by
  the first twelve hex digits of their execution (« run 01a148a70999 hn-ia-di… »), with no time and
  no outcome, and a gate split one launch into two rows. Each launch now reads once, named by the
  second it began, in UTC (« run 10-17 07:04:30 release.nika »), its row ending with how it stands
  or ended in words and in its state's hue (« succeeded », « paused », « running »; « réussi »,
  « en pause », « en cours » in French), which a narrow list keeps while it cuts the name. A resumed
  leg folds into the launch it continues as soon as its start names it, and keeps the launch's name
  in the run's title, the conversation's folded story and a later run's « again » fact. The hex
  stays in the detail: the whole story (F2) is titled with it.
- **Runs are named on the machine's clock, dated the person's way.** A run read « run 10-17
  07:04:30 », the second it began in UTC: four hours off on a machine in UTC+4. It now reads the
  machine's local time (« run 10-17 11:04:30 »), dated day/month in French (« run 17/10 11:04:30
  release.nika »), and a resumed run and a later run's « again » fact follow the person's
  language too. The detail (F2) keeps the run's hex; traces keep their UTC instants.
- **The card under a resumed run counts the leg before its gate.** A run that a human gate split
  in two showed no cost on its card, because the resumed leg made no model call of its own and
  the paused leg leaves no card. The card now adds what the earlier legs observed in this
  session spent, following `resumed_from`: « ✔ Ran in 1.3s · … · $0.0438 · 1 model call ». The
  session's spend so far counts the paused leg too, so the card, the Session's summary and the
  status row agree.
- **A run's card now lists its steps in the order the run ran them.** The card under a finished
  run listed tasks in the order the engine first scheduled them, which is alphabetical
  (« admit, aggregate, validate » for a run that ran validate first), while the run pane showed
  run order. The card now follows the graph of the bytes the run names: its waves, then the
  declaration order within each, cleanup last. Without a bound graph it follows the order the
  steps started.
- **A run's task detail and its outputs, files and proof faces follow the person's language.**
  Beside a French conversation they stayed English: « task save · Backspace: back to the tasks »,
  « reported written by `save` », « not read yet », « this run's journal · its execution, source
  and receipt match ». They now read « tâche save · Retour arrière : retour aux tâches »,
  « annoncé écrit par `save` », « pas encore lu », « le journal de ce run · son exécution, sa
  source et son reçu concordent », with the task's standing, what was measured, its output, the
  child run a task called and what each face lacks. Task ids, paths, the trace, the language's
  own words, the verifier's lines and the journal's values keep theirs; English stays the default.
- **One summary per run: the Session's.** After a run, the conversation read two summaries of it,
  the TUI's « ✔ Exécuté en 1.3s · 2 tâches exécutées » and its files, then the Session's
  « Terminé · `copie.nika` · 1.3 s · 2 étapes exécutées » with its cost and ceiling. The Session's
  block is now the one summary. The TUI's card under the run keeps only its steps, and only when
  they say more: a step failed (its row in the failure's red), or a model was called (each step
  with its model and its own cost). A run with no model and no failure has no card; the run
  object (F6) and the run's story (F2) keep the whole detail.
- **A run's report and the Session's summary now read the same duration.** The report under a
  finished run cut its time to the tenth (« Ran in 9.8s » for 9857 ms) while the Session's own
  summary of the same run rounded it (« Done · … · 9.9 s »). The report now rounds as the Session
  does, in every language: « Ran in 9.9s », « Exécuté en 9.9s ».
- **The spend counter says what it counts.** The stage line read « ~$1.10 dépensés » beside the
  Session's « Total dépensé aujourd'hui dans cette session … environ 2,75 $ », and restarted from
  zero after a reopening without a word. It counts what was spent since this conversation opened,
  and now says so: « ~$1.10 dépensés depuis l'ouverture » / "~$1.10 spent since opening".
- **A question is said once, a card names only the request it answers, and nothing says a
  decided proposal still waits.** An activation's decision printed its question twice in a row
  (`If this machine is off at 08:00 …?` above itself), and a run ceiling's did the same; the
  question now reads once, then its consequence. A question card showed `Request · ` with the
  first line of the session (even `qu'est-ce que tu sais faire ?`) beside questions about an
  activation or a later change; the row now appears only beside a question the request itself
  keeps open, and no other card names a request it does not answer. A line said beside a
  proposal (`kept the default · …`, a revision Nika could not make) kept reading `(the proposal
  still waits · yes applies it …)` after the proposal was applied or discarded; once no
  proposal waits, its card leaves that line out (`F2` still reads the Session's whole words).
- **A call you stopped no longer reads as a failure in ASCII.** In the ASCII glyph column, a call
  stopped by the person read « x call 1 - … - stopped, a charge may be unknown », and the TUI
  painted it in the failure's red, since « x » is also the failure's ASCII mark. A stopped call
  now reads « - call 1 - … », never red, as its Unicode « ✖ » row already was not.
- **A second `Ctrl+C` after a stop now leaves, even once the stopped turn has
  ended.** While Nika prepares, the first `Ctrl+C` asks the preparation to stop,
  and the screen says that a second press leaves. A stop ends a call under way
  at once, so the turn often ended before the second press was read. That
  press then only armed the idle prompt, and the door stayed open. Now the idle
  prompt keeps the first press armed (« Ctrl+C again leaves · any key stays »).
  The next `Ctrl+C` leaves, and any other key keeps the session. A correction
  queued during the turn is still sent as the next line, with no press armed.
- **A CSV or TSV file reads as its records, the header aside.** The files face said `14 rows × 4
  columns` for a header and 13 records, though it draws the first row as the header. It now
  says `13 rows × 4 columns`, and a table cut at its bound says how many records it drew of how
  many it read the same way.
- **The decision card shows what Nika said above a proposal.** A proposal's words can open
  with notes, such as `read your answer as « … »` or which model Nika chose for a choice the
  person left to it; the workspace's `Decision · required` card summarized the proposal
  without them, so a delegated choice was invisible there. Those leading notes now read
  above the card's question, wrapped whole where the band holds them; in a short band one
  row of them stays before the last facts, cut with a visible mark, and `F2` reads them whole.
- **The request beside a question reads as the person said it.** After a correction (a
  delegated answer included), the `Request · …` row beside the next question showed the
  goal as the Session restated it for its author: `Original request: … Correction (it takes
  precedence over the original …): …`. It now reads the person's original words and their
  latest correction, `Request · Fais-moi une veille quotidienne (correction: en markdown)`,
  never the frame. The restatement and its reading now live together in the request
  (`work::Request::restated` and `work::Request::said`), which the recovery card uses too;
  the goal itself is unchanged.
- **One state of a run per screen: the settled outcome wins.** The project list showed `ok`
  beside a workflow whose last run had just failed, and the live line kept saying
  `Running … 15/15 tasks` while the run's own header said `settled · failed`. A workflow whose
  last run in this session failed now reads `run failed`, in the failure colour, until a newer
  run of it settles otherwise. Once a run settles, the live line says how it ended, as its card
  and its header do (`veille-tech.nika · Failed after 16.5s · 3 tasks · $0.034 · 1 model
  call`), then what the turn does now, and never that the run is still going.
- **Typing over a long `/intelligence` list is instant again.** With 655 rows open, each
  keystroke cost about 260 ms in a debug build: every frame compared the whole list once
  per row to learn which boxes were checked, and the filter lowercased every row's words
  on every key. The list now builds its lowercased search index once when it opens,
  reads the checked set with one comparison, and draws once per burst of waiting keys
  instead of once per key. A debug-build regression proof types 40 keys over 1,000 rows
  in three rounds and holds each keystroke's own work (edit, filter and one whole frame)
  in the quickest round to an average and a median of 25 ms, so tests running beside it
  cannot fail it; it measured 145 ms before and about 3 ms after.
- **An unreadable arm ledger is said once, even when it counts nothing.** The workspace said a
  schedule's line only when its counted fires changed, so a ledger the Session could not read
  (its counts then zero) was never said and its fires stayed silently unproved. It now says, once
  until the ledger reads again: « `compiled-workflow.nika` : le journal de son déclencheur est
  illisible, ses runs ne peuvent pas être prouvés : … », with the reason as the Session gives it;
  the rail stays declared. A ledger that reads again with nothing counted says nothing.
- **The welcome card no longer says a choice is pending once you made it.** When a conversation
  opened without a usable intelligence, « Choose an intelligence below. A message typed here
  waits for your choice. » stayed in the welcome card after the choice. That guide now stands in
  the intelligence list's own head while the list is open, as every list's guide does, and
  leaves with it. With no intelligence to offer, the conversation still says what is missing.
- **The TUI welcome card no longer keeps the warning of an intelligence that is not in use.**
  When the kept intelligence could not serve (for example an API provider without its key), the
  welcome card said « ⚠ no key for `anthropic` … » and kept saying it after another intelligence
  had been chosen, and again on every reopening of the same conversation. The opening list's head
  says why while the list is open; the welcome card no longer repeats it.
- **The welcome speaks French to a French speaker.** Its line, its three steps, the example it
  offers and the « no project » note stayed English beside a French conversation. They now follow
  the person's language once the Session reads it (« Transformez une intention en workflow. »,
  « 1  Décrivez le résultat voulu dans la conversation. », « Essayez : aggregate-by-key »), the
  example's name kept.
- **A question's or a decision's long option reads whole.** An option wider than the band was cut
  at its edge (« …avant d'écrire python-version.txt / re… »), with no way to read the rest on the
  card. It now wraps under its own indent, up to three rows, a fact never parted at its separator
  (« techcrunch.com/feed » under its name, « recommended » after it), the last row cut with a
  visible mark only past three rows. A press on any of its rows picks it, and the selected option
  is filled on every row. Settings lists keep one row per model or connection.
- **A schedule's zone reads as the Session names it.** The fired rows named a schedule's zone by
  its database city, so a French screen read « dernier créneau 16/10 20:00, heure de Mauritius ».
  They now use the Session's own words for a zone: « heure de Maurice » in a line, « Maurice » in
  the list, and "Mauritius time" in English, the same words the Session says in its replies.
- **A file you name can be the source a conversation's workflow reads.**
  A source stated as a file the person typed (« notes.txt ») was refused
  as « not a public address », so an agent tried other statements until
  one passed. A source the person typed, or picked from an offer the
  Session showed them, is now admitted as a file inside the project that
  the workflow only reads. A source the author chose stays a public
  address, and its refusal says how to state a typed file instead.
- **A schedule shown beside a proposal is never judged missing from its
  bytes.** A trigger is deployment, never part of the workflow, yet the
  verifier asked the judge whether the program runs « every morning at
  9:00 », found no task doing it and refused every proposal. A document
  presented with its schedule (the cited line, the words, the zone) now
  settles, with no judge call, each obligation whose every evidence quote
  lies in those words, and states it among the verdict's engine facts.
  Evidence beyond those words keeps an obligation judged; without a
  schedule nothing changes, and an obligation only whole schedule words
  evidence, judged missing, says to carry them as `propose.schedule`.
- **A waiting question is explained in French to a person who writes French.** « Pourquoi ? »
  beside an authoring question or a run input, and the lines under a waiting question (« the
  question still waits · reply on the next line · `cancel` drops it », « authoring discarded »,
  « run discarded », « activation dropped »), stayed English under French answers. They now read
  « la question attend toujours · répondez sur la ligne suivante · « annuler » l'abandonne »,
  « préparation abandonnée », « run abandonné » and « activation abandonnée ».
- **A part judged missing on an unsure answer no longer refuses a
  workflow.** On identical bytes, a decision model's answer on one part
  of the request moved across its old cut, so the same workflow was
  refused on one run and proposed on the next. A part's weighed
  « missing » now decides only at the confidence a whole-request
  rejection needs (0.75), read over that part's own options; below it,
  the part is stated with the proposal and nothing more is asked of it.
  At or above it, a part the model ties to a step goes back to its
  author as before, and one it ties to no step is stated, never held.
  The same holds over a trial run: a part the question over the run
  names below that confidence is stated, never traced to a step, and a
  part left open stays open. A judge that reports no distribution keeps
  its verdict.
- **A decision model's unsure verdict no longer holds a workflow.**
  Checked against workflows whose correct result is known, a decision
  model's answer on the request as a whole was reliable only as a
  confident rejection: its « faithful » never reached a confidence of
  0.6 and was wrong 5 times in 13, and its « unfaithful » below 0.75
  also held correct workflows. Now a weighed verdict decides only as a
  rejection at that confidence or more; otherwise the parts of the
  request, each judged alone, and the extra-task question decide. A
  workflow they carry is proposed with the doubt stated in words, never
  held or turned into a question about the verifier; a part judged
  missing goes back to its author once, and is stated if judged missing
  again. A judge that reports no distribution keeps its verdict.
- **Typing the welcome's demo name gives the demo again.** The welcome offers « Try:
  aggregate-by-key », a demo whose records travel inside it. With an intelligence chosen, that line
  reached the conversation's author, which asked for a data file to aggregate. A line that is
  exactly an exact skeleton's name (`aggregate-by-key`, `hello`) is now the compiler's to settle,
  with no model: the demo asks its one open value, the currency, and is proposed.
- **« Est-ce que c'est actif ? » is answered by the Session, and « active-le » works after a
  reopen.** Whether the saved workflow runs on its own (« est-ce que c'est actif ? », « ça tourne
  tout seul ? », « is it active? ») is now answered from `nika.yaml` and this Mac's units: not yet
  declared, declared without a trigger, or installed with its next run. The model no longer
  answers it, and a waiting proposal stays. After a reopen, « active-le » activates the schedule
  `nika.yaml` declares instead of answering, in English, that the workflow asked for no schedule.
  The activation's refusals now read in French too. The model is told when the Session saved a
  workflow, so it no longer offers to save one that is already saved.
- **« Pourquoi ? » at a run's validation says why it waits.** The aside repeated the gate's
  whole message, a whole digest included, under a card that already showed it. It now names the
  gate's question once, says the workflow asks a person at that step, and says that nothing it
  holds back happens without the answer.
- **`nika wire` no longer erases a client's server table.** When a config held its servers under a
  value that is not a JSON object (an array under `mcpServers`, `servers`, `mcp`,
  `context_servers` or `amp.mcpServers`), five writers replaced it with `{}` and wrote the file,
  and every server the user had listed was gone. Now each writer refuses such a value with « is not
  a JSON object » and leaves the file byte-identical. A TOML `mcp_servers` that is not a table was
  already refused and now says so the same way. The preview says `skipped` instead of « would
  update ». `wire detected` and `wire all` plan every client before the first write: one config
  that cannot be wired as it is leaves every config untouched (exit ENV, « nothing written »), so
  the first client is no longer written before the second is found invalid. Every write is read
  back, and a file that does not hold what was written is restored as it was.
- **« sans journal.txt » takes the file back.** The withdrawal reader knew « ne lis pas … », not
  « sans … »: « un fichier par soir seulement, sans journal.txt », Nika's own suggestion, was
  refused because the file stayed owed. « sans », « without », « pas de », « plus de » and « no
  more » before a file ending the clause now withdraw it; « sans toucher journal.txt » does not.
- **A stated endpoint route no longer stops a trial as a path outside the
  project.** Before a candidate rehearses, the Session observes the files
  the request names. A destination the request states as the route of an
  endpoint it names (`POST /notifications/stock` to the stated local sink),
  which the candidate sends to, is that endpoint's route and no file: it is
  left out of that observation, and the trial room is still handed it. An
  unstated route, a rooted or `..` file outside the project, and a route the
  candidate also writes as a file are still refused in the same words.
- **A written candidate's findings read the person's answers.** The findings the conversation's
  author receives when it writes a candidate judged the person's words alone, while the proposal's
  verification also reads their answers to its questions: a gate or a value the person picked
  could be reported as invented at the write and accepted at the proposal, sending the author to
  remove what the person chose. Both now read the same answers.
- **Your messages show your words, not the prompt or a machine key.** A line you sent was
  echoed after the prompt it was typed at (« action › Save and run once », « nika › /status »,
  and in the inline view « › nika › … » with two markers), and a model picked in the
  intelligence list could echo as « choice › 2 anthropic/claude-sonnet-5-5 », an index and an
  internal id you never typed. Your bubble now carries only your words, an offer you picked by
  its label, and an intelligence row as `Intelligence: <name>` even where the recommended row
  and the model listed under it share one key.

### Security

- **`nika check` refuses a bearer token written into the file.** A key
  pasted into a header (`Authorization: "Bearer sk-live-…"`) was declared
  nowhere, so SECRETS read « no declared secret reaches an effect » and
  the run sent the key. A literal `Bearer` token in an `exec:` or
  `invoke:` argument (an HTTP header is one), or in the `const:` or
  `with:` value such an argument names, is now a SECRETS refusal that
  names the argument and the repair: declare the credential in
  `secrets:` with the egress its effect needs, then write
  `Bearer ${{ secrets.<name> }}`. The template that references a secret
  is not refused, and the token is never printed.
- **`nika guard` judges every command a multi-line call carries.** Its
  lexer read a newline as a space and stopped at the first `#`, so a
  `nika run` on a second line, after a comment or after `a#b` passed as
  no opinion; so did one inside `$( … )`, backticks or `<( … )`, in
  `(…)` without spaces, in a function or `case` body, behind `timeout`,
  in `nika 2>&1 run`, and in the zsh forms `=nika` and `noglob`. Each is
  now judged. A heredoc body stays data, but its unquoted substitutions
  are judged, and nesting deeper than 64 levels is refused with a reason.
- **rustls 0.23.46 closes four TLS advisories.** RUSTSEC-2026-0346 to
  RUSTSEC-2026-0349 (published 2026-10-14) affect rustls 0.23.45, which
  the workspace, `nika-acp` and fuzz lockfiles resolved: client session
  `Debug` output exposing TLS secrets, buffered data sent to the outer
  server after an ECH rejection, a Brotli certificate decompression that
  can allocate 1 GiB before authentication, and an unauthenticated
  ServerHello downgrading later connections to classical key exchange.
  All three lockfiles now resolve rustls 0.23.46.
- **The async runtime is past its October soundness advisory.** `tokio` 1.53.3 makes `AsyncFd::new`
  and its related constructors respect I/O safety again (RUSTSEC-2026-0386), and the yanked
  `chacha20` 0.10.1 is replaced by 0.10.2, in the workspace, fuzz and ACP lockfiles.
- **TLS certificate checks and constant-time helpers are past their October advisories.**
  `rustls-webpki` 0.103.16 refuses distrusted intermediates (RUSTSEC-2026-0382), `webpki-roots`
  1.0.11 drops the distrusted emSign roots (RUSTSEC-2026-0381), and `ctutils` 0.4.5 makes its mask
  generation and `u128` comparisons constant-time again (RUSTSEC-2026-0385), in the workspace,
  fuzz and ACP lockfiles.
## [0.123.0-preview.1](https://github.com/supernovae-st/nika/compare/v0.122.0..v0.123.0-preview.1) - 2026-10-09

**Preview: honest scope.** 0.123.0-preview.1 is a pre-release of the 0.123 wave. It is not the
Latest release, it is not in the Homebrew formula, and npm carries it only under the `next`
dist-tag. Install it by its version: `install.sh --version 0.123.0-preview.1`, the release
tarballs, or the `ghcr.io/supernovae-st/nika:0.123.0-preview.1` image. Homebrew and the default
install script stay on 0.122.0.

What it brings:
- complete-document Session authoring, with typed clarification;
- judging context for the admitted components a candidate holds;
- executable reuse of an admitted Foundry component;
- a progress-aware ACP authoring deadline;
- the native workspace's review and settled-Run composition;
- an internal split of the compile unit into a separate behavior member (no behavior change).

What it does not claim: no general reliability or speed qualification. Preparing a workflow from
an intention currently takes minutes rather than seconds, and the verifier still holds some
legitimate requests. Several capabilities are still in progress, notably grouped answers, the
clarification pause, live role settings, Session Run Stop, and schedules bound to saved
revisions.

### Added

- **Compile records which door wrote the candidate and what each call saw.** The existing decision record now retains source ownership, request and response digests, consumed proposals, Foundry delivery evidence, calls with unknown usage preserved, and Check and Rehearsal evidence bound to the final bytes. Behavioral satisfaction remains UNKNOWN: no behavioral judge runs. Within the new forensic proposal projection, refused or ignored model output is kept by digest only; pre-existing native notes and round records are unchanged.
- **`nika compile` and `nika serve` try a candidate before READY.**
  A seated free-intent compile now runs each final candidate on a
  scratch copy of its stated inputs, in the observed room the Session
  uses; the trial's report reaches the judge and the repairs, and a
  failing trial is never READY. Serve tries it on the caller's
  `trial_inputs` (health `compileTrialInputs`).
- **Create and revise continuously in the CLI or TUI.** Preparation no longer
  imposes a default call count, repair count or monetary confirmation. It uses
  the selected connection and its technical limits, keeps usage and historical
  charges, and stops on completion, no progress, a refused or failed call, or
  the human's Stop. Explicit bounded callers retain their limits; workflow
  budgets and the separate Save/Run permissions are unchanged.
  **Keep decision-service usage separate from the author.** An explicitly
  selected Jev seat can assist the existing typed compiler decisions under
  API or subscription authoring without an implicit three-call cap. Each
  compile closes its consultation scope; unanswered sends and unknown invoices
  remain visible. Neither returned usage nor a configured model name proves
  a final bill or the model actually served. No API fallback is granted.
- **Workflows can remove one regular file with `nika:remove_file`.** It takes exactly `{ path: string }`, needs the tool grant and a `permits.fs.write` bound on the exact path, creates no parent and reads no content; a missing name, a directory, a link or a special file fails as the tool's own error, and an authority refusal stays `NIKA-SEC-004` even when the at-removal re-judgment denies what the first judgment allowed. `nika check` refuses an invalid literal path before any run and orders every same-path write, edit and removal through the precedence graph (`with:`, group folds, `after:`); an `unwind` edge is not order. Its output is untrusted, the returned path is not proof of disk state, and the check-then-unlink is not one atomic operation. There is no recursive, glob, force, missing-ok or `nika:delete` form.
- **The decision model now qualifies recalled Foundry knowledge before
  the author reads it.** Each reference the word and graph recall found
  is put to the selected decision model against the whole request; one
  it finds unrelated never reaches the author, one it cannot judge stays
  shown as a hypothesis. `decision.knowledge_qualification` records what
  was found, shown, discarded and unqualified, every answer, and which
  shown code the candidate kept. Without a decision model the recall is
  shown unqualified and the record says so.
- **A harness authoring call's record names the last protocol step it
  closed.** Beside its phase, a terminal ACP authoring record now says
  which step this side last completed: the stream opened, the agent's
  initialize accepted, its session created, the requested selection
  checked, the prompt written, or an answer chunk received. A call that
  stalls is localized to the step after it, without any adapter text; it
  says nothing about what the agent's model did, its other activity or
  how long anything generated, and the deadline is unchanged.
- **A harness authoring call's record says what it received after its
  prompt.** A terminal ACP authoring record now carries `activity`: when
  the prompt was written, how many complete frames arrived after it in
  fixed categories (answer, thought, usage, status, other updates, client
  requests, the answer or error to the prompt) and when the last did;
  another session's frames, stray responses, other notifications and
  unreadable lines are counted apart, so they never read as the call
  advancing. When the session ended, it also names how: completed, the
  transport, or the exact refused category (a token or request limit, a
  declined or called-off turn, a tool, media or other update, a
  permission or client request) that the safe message folds into one
  sentence. No prompt, answer, thought, method, identifier, path or error
  text is kept, and acceptance, deadlines, Stop and retries are
  unchanged. A thought or usage frame proves only that the adapter wrote
  it, and no frame after the prompt cannot tell a stalled adapter from a
  model reasoning without emitting anything.
- **ACP image evidence stays visible and bounded.** Images returned by an ACP agent are recorded in the run trace and shown in task
  details with their storage status. Received bytes can be saved in the project's
  content-addressed store; a reported file path alone is never opened or claimed
  as a saved image. Reported model selection remains distinct from served-model
  attestation and billing.
- **Add explicit, bounded private capture for returned Compile authoring Text.**
  Keep capture off by default, withhold resolved credentials, preserve compiler outcomes
  when storage is unavailable, and retain reservation and close facts. `CompileCommand`
  gains a `capture` field; its existing constructor keeps capture off. `CompileArgs` stays
  unchanged.
- **Filesystem backends can remove a regular file without following its name.** The kernel's file-writing interface gains a provided regular-only removal that existing backends refuse until they implement it. The host, room and in-memory backends implement it: a symlink, a directory, a special node, an absent name or a path naming no final file is refused and left as it was, the file is never read, and no parent is created. The check and the removal are two steps, not one atomic operation on the same file: a name replaced between them may be removed in its place, and a substituted symlink is unlinked, never followed. The existing removal is unchanged.
- **Scaleway has a distinct API provider and saved intelligence choice.**
  Its credentials and project endpoint remain separate from OpenAI. The exact
  hosted model keeps observed usage and an unknown price. The exported Rust
  `CANONICAL_IDS` array changes from 17 to 18 entries; consumers that name its
  array length must update with this release.
  Explicit compatible API endpoints remain supported by admission and SDK
  export; a selected ACP/harness path cannot borrow an unused API endpoint.
- **`nika serve --decision-model` seats a judge beside the author.**
  The `nika compile --decision-model` words (`typesafe/<jev>` or a
  direct `provider/name`): it judges every candidate and answers the
  finite choices in place of the author judging its own work. Health
  lists `compileDecisionSeat`; a seat that cannot open refuses startup.
- **A Serve answer round can be judged without authoring again.** After
  a native round asked questions, a client could replay it with its
  answers and no provider call, but nothing then judged the replayed
  workflow, so it stayed incomplete; getting it ready meant a new
  authoring round, which spent again and could write other bytes. A
  request with `cognition: "explicitProvider"` and the round's
  `replay_token` now replays the kept plan with the answers and asks the
  server's seat only to judge it. A workflow the seat accepts is ready;
  one it does not accept is held and its token forgotten, so those bytes
  are never put to the same judge again through it.
- **A remote compile sees the caller's files as `nika compile` does.**
  `nika compile --observe-only <intent>` prints the bounded observation
  of the files an intent states (headers, keys, short categorical
  values, never a row); `POST /v1/compile` generation 2 admits it as
  `observed_world` (health `compileObservedWorld`), so the seat, the
  grounding law and the judge read the real shape instead of asking.
- **`nika serve --sessions` serves the project's native Session over
  HTTP.** An operator who binds a listener can now name the Session
  routes (health `sessionHost`): the same Session bare `nika` opens, whose
  runs are the resident's jobs and run only the bytes the Session
  checked. Without the flag the listener serves no Session.
- **A Session's work snapshot says what the last answer line did.** When a
  line is typed for an authoring question, the snapshot now names that
  question and the act the session performed: the value it bound and how
  the line gave it (as typed, an offered key, a part chosen by the one
  reading call, or the seat an empty line took as the offered default), the round dropped, the request restated in words, the
  question still waiting with the reason, or the refusal's class. It is
  recorded where the act happened, so a bound value stays bound when the
  compile that follows does not finish, and it is absent after an aside, a
  read-only command or a line for another prompt. It travels in the shared
  Session work snapshot and its host projection.
- **A Session's work snapshot names each authoring call it made.** Beside
  the totals, every call the last compile sent now appears in call order
  with its role, the digests of its instruction and answer schema, the
  bytes it sent, how many references rode with it, its output and time
  bounds, its wall time, how it ended (the provider's stop reason or the
  engine's failure kind) and the reasoning and usage the provider
  reported. What the receipt does not record stays null, never guessed,
  and no prompt, answer, proposed object or error text is carried. Both
  the native workspace and the HTTP host read it from the same snapshot.
- **A Session's intelligence choice holds for its conversation.** A
  choice made in a Session, or named by its opener, is kept by that
  conversation's history and resumed over the operator's default; it is
  never written to the operator's kept choice. `nika session --json
  --intelligence <words>` and the HTTP open body (`intelligence`) name it
  in the census's own words; words the census does not read open
  nothing. Both doors advertise `sessionIntelligence`.
- **A created workflow carries its creation record in the Session.** A
  proposal from a fresh request now shows how the compiler made the
  document, written whole or composed from admitted components, with no
  base, bound to the proposed bytes and each component witnessed on them;
  the consent prompt says so. A revision keeps its record over its base,
  whether or not it replaces a saved file.
- **`nika session --json`: the Session for programs.** The same native
  Session as bare `nika` in this directory, spoken as one JSON object
  per line on stdio: a client submits a line against the snapshot it
  answers, reads the proposal and the questions, consents to Save and
  asks for a Run separately, and closes by ending its input. The
  engine identity lists the `sessionHost` capability.
- **An explicit source recovery after the sketch door's exhaustion (library policy, off by
  default).** `AuthoringPolicy::with_source_recovery(n)` (0..=3) lets the same seat write the
  whole `.nika` of a new workflow only when the sketch door ended without an accepted candidate
  and nothing is left for the human to answer. Each source faces the strict parser, the pure
  Check, the fidelity laws, the rehearsal when offered and the whole-request judgment before
  READY; refusals are repaired within the stated rounds, every request is charged to the same
  authority and receipt, and the recovery is recorded (route, `decision.native.recovery`,
  `authoring_recovery` finding). `native: only` stays retired, no host offers the policy yet,
  and a revision is never recovered from source.
- **Source recovery reachable from the product by explicit operator configuration.**
  `NIKA_AUTHORING_SOURCE_RECOVERY=<0..3>` (or a host's `AuthoringSettings::source_recovery`)
  is resolved by the shared authoring parser for the CLI and the Session (and its TUI): a count
  outside `0..=3`, or rounds under `off` or `only`, is refused. Serve stays unconfigured: its
  seat resolves only its named settings, never the environment, so its count is 0. The policy carries it on the same seat;
  the CLI receipt states `recovery_requests` and `worst_case_with_recovery` beside its allowance,
  and a Session unknown-cost review reserves them in the same account, stating the allowance and
  the theoretical worst case. Nothing changes when it is absent.
- **Explicit Claude ACP preparation.** Session can persist an explicit Claude ACP choice for conversation and workflow authoring, preserving native choices, bounded calls, unknown subscription billing and existing API exposure. The audited adapter profile disables tools before a prompt; unsupported adapters or incomplete answers refuse without fallback.
- **Open a task's child journal from its workspace detail.** The journal named
  by the parent's settle frame is captured once and verified; recorded head,
  source and outcome commitments are compared while absent facts stay explicit.
  Child execution identity and length remain not compared. Each opening asks
  its own read, and Backspace returns to the parent without starting work.
- **The workspace opens a run's outputs, current files and Proof.** Outputs
  come from its settlement; reported files are read now, without claiming they
  are unchanged since the run. Proof verifies one captured journal and binds
  it only when execution, source hash and receipt agree. Reopening repaints
  retained conversation and the last observed run as history; Proof is checked
  again on demand. Outputs and task rows are not restored, and nothing replays.
- **Stop a preparation, or send a correction, while Nika works.** In the
  terminal session the first `Ctrl+C` during a preparation asks the Session
  to stop it and keeps the conversation; a second press still leaves. `Enter`
  with words in the box asks the same stop and queues them as a correction,
  sent as the next line when the turn ends on the free prompt; a chain of
  corrections is sent one after another. A correction never answers a
  decision: after a proposal, question, gate or choice it returns to the box
  unsent, and after a cost question the box stays empty while the transcript
  keeps the correction whole. Every queued correction is kept in input history
  like a sent line. A Run is never stopped by these keys, and the row says so.
- **Inspect a task from the workspace Run face.** Select a task, open its
  observed state, failure, usage and output, then return to the list. Selection
  follows the execution and task identity through wrapping and resizing.
  Unobserved tasks and missing measurements stay explicit; inspecting a task
  does not start or authorize work.
- **Typed terminal replies answer the question actually in view.**
  In the workspace the question waiting for your reply stands right above the
  answer line, with as many of its words as the terminal has room for, its
  offers and `F2` for the whole text; status and lifecycle rows that would only
  repeat it make room for it. Offered keys and your own words are each sent
  once, with the identity of the question on screen; a stale reply cannot start
  a new request or grant Save or Run consent. A reply that was not taken returns
  exactly, ahead of newer unsent words, or keeps its offer selected; nothing is
  replayed and no applied state is inferred. When the Session reports the value
  it took, the conversation says `Answer taken` with that value and how it was
  read. Messages from one speaker share a bubble, yours on the right and Nika's
  on the left, while questions, proposals, approvals and failures keep a framed
  card that names itself when scrolled into part-way and its row has room for
  the heading. A short conversation rests against the decision or composer
  below it. The current proposal's
  review says first what a `yes` answers, then its changes and effects, and
  ends on the proposal's identity, while its object shows the inspected
  content; the status row says a plain `yes` means Save only. Below 100
  columns the restored object folds to a three-row strip while that review or
  the question needs the room, keeping your proportions and saving nothing.
  `F2` reads the complete question or proposal and returns to the same draft
  without sending it.
- **Bare `nika` opens the native workspace.** The current project, conversation and workflow inspection share the terminal. Source, Plan, Graph and Check use the same witnessed parent file; imports and run readiness stay UNKNOWN because this inspection reads the parent file alone. Opening a workflow performs no Save or Run. `NIKA_TUI=inline` retains the earlier presentation, and plain and pipe entry remain available.
- **Arrange the terminal workspace without losing the conversation.** Session and
  Workbench share the same work, with bounded mouse and keyboard resizing and
  host-owned display preferences. A contextual slash chooser and command palette
  keep insertion separate from sending, preserve the draft and focus, and treat
  paste as data. Recognized knowledge-admission refusals explain their scope with
  read-only raw details; refusal before authoring no longer claims generation.

### Changed

- **`nika-compile-behavior` (ADR-149).** The behavioural contract a
  request states and its judgment over rehearsals descend from
  `nika-compile-fidelity` at the 15k prod-LOC wall as a member of the
  `nika-onboard` unit (D-2026-07-09-N1), with the date-time shape
  classifier both crates read. `nika_compile_fidelity::behavior` and
  `nika_compile_fidelity::fidelity::instant_shape` remain and name the
  same items, so no import changes; a type's run-time name now names the
  member. No judgment, record, wire, budget or Stop behaviour changes.
- **An open request now takes its next useful action instead of a
  fixed escalation.** A request the deterministic reader composed whole
  is now checked by the selected judge before it can be ready, and the
  author repairs what the judge finds missing; readings a decision seat
  settled are checked the same way. When the author's plan holds a
  computation its typed steps cannot state, or reads a source field
  the request never names, the sketch door composes the request next
  instead of a separate program round or a question to you.
  `decision.agenda` records each action and what motivated it; the
  `--hot-policy` and `--authoring-strategy` flags and old receipts read
  as before.
- **A new workflow is asked of its author as one whole document.** Under
  the default strategy (`escalate`) and under `only`, the first authoring
  call of a fresh creation now asks for the complete `.nika` in the whole
  language, with the lent catalogue's admitted components composed by
  identity and receipted, instead of a private plan and a sketch that had
  to fail first. The document is judged, settled and repaired like any
  candidate; `sketch` keeps the sketch door and `off` the private plan,
  and `only` is no longer refused.
- **The embedded knowledge release offers a JSON record filter.** The
  current r2 release adds the admitted component
  `block:json-filter-records`, which reads a JSON array of records and
  keeps the ones a jq expression selects, whole and in source order; its
  path is the human's to bind, its expression the compiler's. Every
  checked row of the release is re-verified on the current engine. An
  explicit embedded pin to the release it replaces is refused by its
  identity; reopening a Session pins the new release and keeps its
  earlier receipts.
- **New authoring draws on the r2 knowledge release.** The build embeds
  the r2 Foundry release whole, from its own directory, and admits it
  against its issued snapshot and policy before anything is collected;
  CLI, Session and Serve authoring use it when nothing else is named.
  The a8 and R3 releases stay embedded, so a project pinned to either
  is still admitted against its own identity, and a pin naming a
  release this build does not carry is refused as an identity mismatch.
- **The terminal workspace keeps one adaptive conversation beside its object.**
  A bounded composer and one primary home for project and model facts reduce
  repeated chrome. Actual project entries and workflow graphs use compact cards,
  truthful dependency wires and a quiet violet palette; unsupported graph shapes
  retain exact dependency rows. The selected object expands through its local
  control or F4, with the conversation beside it on wide terminals. Manual
  separator movement preserves the requested width and draft. Folded panels
  remain reachable as Project, Conversation and Object. Diagnostics exclude
  underlying pointer actions, and navigation preserves pending Stop feedback.
- **A proposal under review keeps only what changes the decision.** Its
  card lists every change, effect, declared reach and uncertainty once, a
  wrapped line hung under its fact, and carries the proposal identity and
  the `F2` reader key on its bottom border; the status keeps the
  proposal's standing, its row under `Save? ›` names `save & run` beside
  `yes` and `no` when the Session admits one run, the object header names
  the workflow and its exact bytes once, and an earlier proposal is titled
  `Proposal`. A settled run states its outcome once in its header, a cut
  lifecycle rail keeps its newest stages, and the run's own result no
  longer opens with `Latest reply above`.
- **Clarify preparation selection and idle navigation in the workspace.**
  The conversation labels the selected preparation connection separately from
  observed activity. When idle, it keeps intelligence selection and panel/scroll
  controls visible, and explains how to focus the conversation and press End
  to return to the latest messages. Reopened runs name the action that reads
  their saved journal. The Session's status keeps leading its row;
  consent, Stop, cost questions and completion keep their own instructions.
- **The preparation model line names the semantic verifier.**
  The workspace and welcome view identify the selected verifier, including when
  the authoring model verifies its own workflow.
- **The verifier asks the parts of a request together.** When it
  doubted a workflow, the verifier asked each part of the request one
  after another, waiting for each answer before sending the next. A
  decision service now receives the parts of one step all at once,
  each still its own question, and a model seated for decisions answers
  them in one request whose answer names each part by its id. The
  answers are read in the same order as before, so what is judged,
  recorded and repaired is unchanged; only the waiting is shorter. A
  part whose answer was sent but never read, because an earlier
  question got no answer, is recorded as sent.

### Fixed

- **Workflow authoring judgments.** Whole-request verification distinguishes the workflow being authored from the files its program writes, keeps its stated name checked, and does not mistake an unsaved proposal for a missing self-write.
- **Repeated authoring findings.** When the same findings stop preparation with repair rounds still available, the refusal names those findings and explains that Nika stopped reopening them instead of claiming the allowance was spent.
- **Delegated agent tasks inherit the effective workflow model.** A task
  model override still wins, and a refused model never falls back to the
  native provider. Requested identity remains separate from the model
  reported by the harness.
- **An authoring answer is refused when the AI app moved the chosen
  model or effort during the turn.** Over ACP, an agent may switch the
  model or the reasoning effort mid-turn (a rate-limit fallback, for
  instance). Workflow runs already refused such an answer; authoring now
  does too, naming the move, while a move of a dimension nobody chose is
  kept in the call's record.
- **An ACP session that advertises a qualified model id is selected by
  that exact id.** A request for `openai/gpt-5.5` looked only for
  `gpt-5.5`, so a session advertising `openai/gpt-5.5` verbatim was
  refused before any selection. The exact requested id is now matched
  first, the provider-less name only after; a near name is never taken
  for the requested one.
- **ACP selection preserves complete advertised model variants.** Explicit
  names must match an offered ID or display name; unavailable variants
  refuse before prompting instead of silently selecting a family alias.
  Exact config choices and the harness default retain their usual paths.
- **A Session over an ACP seat carries an explicit reasoning effort.**
  A Session whose intelligence is an AI app reached over ACP refused a
  named effort (`max`) before any call, although the ACP session applies
  the effort through its advertised reasoning option and reads it back.
  Authoring calls and conversational turns now carry it; a direct seat
  still refuses it before any byte is sent, never dropping it.
- **A lost sign-in of the preparing app is told as one.** When the
  sign-in of the app preparing through ACP had expired, preparation
  said its transport ended before a complete answer. Nika now reads the
  app's own typed error kind and says that the app's sign-in has expired
  or was revoked and that signing in again in that app is the way on.
  The app's own words are still never shown, and nothing falls back to
  another model.
- **An answered path completes a placeholder list written without
  indentation.** A write permit declared as an empty placeholder in a
  block list whose dash sits at the key's own indent was never filled
  from the person's answer, so Check refused the answered path. The
  answer now completes it as it completes the flow form.
- **Authoring accepts the final answer beside reasoning.** Authoring reads the sole final text of a completed model response when separate
  reasoning blocks accompany it. Proposal, sketch, fill, source recovery, transform
  and judgment keep their existing validation and usage records; reasoning alone,
  multiple answers, tool blocks and incomplete responses are still refused.
- **`nika check --json` reports a parse refusal whole.** A workflow
  refused while parsing produced a JSON finding cut at its first line, so
  a diagnostic that quotes an authored value holding a line feed (or a
  carriage return and line feed) lost the rest of its message and its
  explain pointer. The finding is now rendered from the parser's typed
  error: its code and its whole message, never the source frame the
  human lane prints beneath it. The human output and the exit code are
  unchanged.
- **Codex prepares workflows again, its tools off before it starts.**
  Codex now runs with every tool-bearing feature disabled before the
  turn begins: shell, web search, apps, MCP servers, skills, sub-agents
  and images. The profile was measured on codex-cli 0.160, and another
  version refuses before any prompt is sent. The same rule now applies
  in the CLI and in a Session, so Codex can author in both.
- **A missing admitted component is located on the document, not a task.**
  When the whole-request judge finds a clause asking for an admitted
  Foundry component missing, its localization can now name the offered
  component the candidate does not hold (resolved from the lent release,
  its receipt witnessed on the current bytes and pinned by release version
  and digest), and the document door's repair composes it by reference.
  The judge's contextual no-fit lets that conditional clause's own
  alternative stand only when every offer was examinable; an offer the
  catalogue cannot resolve, or no choice, stays unknown. The candidate's
  own permits never decide which component fits.
- **A `typesafe/<jev>` decision seat sends each question at most once.** Its client
  no longer replays a request refused at the HTTP/2 protocol level, and a client
  that could retry is refused before sending. The receipt distinguishes this
  transport from a `provider/name` seat, which keeps its client’s protocol retries.
  An uncertain delivery may still be billed; this is not a price guarantee.
- **An explicit reasoning effort is admitted on the exact `deepseek/deepseek-flash`.**
  Its catalog entry now lists `low`, `high` and `max`, as the provider's model
  listing and documentation state for that exact name, so
  `NIKA_AUTHORING_REASONING=low` or `--authoring-reasoning low` is sent as
  `thinking.type=enabled` and `reasoning_effort=low` on its direct route, with
  the same output caps; it was refused before any byte. Nothing else inherits
  the levels: suffixed or dated names, old aliases, gateways and overridden
  endpoints still refuse an explicit level before sending, no default changed,
  and the effort a call was served stays unknown.
- **Let the verified transform express projected outputs defined by a
  computation instead of asking which source field an absent generated
  output means.** Keep source-field grounding and final candidate checks.
- **The document author's instructions no longer contradict two
  accepted behaviors.** They told the model to bind a component's holes
  only from values the request or an answer states, although a hole an
  owner binds from observed data is supported; they now bind each hole
  as its owner and contract state, ask only for what a human owner must
  provide, and still never invent a human choice. They also called
  saving and running separate human gestures, although an explicit Save
  and Run is one accepted gesture; they now say saving and running
  require the caller's explicit action.
- **The egress proxy no longer waits for stderr before it connects.** It
  wrote each journal line on the connection thread before dialing, so a
  run that held the stderr lock (`nika run --output json`, `nika test`)
  kept every CONNECT of a confined `exec` waiting until the run ended, and
  the child's client timed out (`curl: (28)` on any `permits.net.http`
  host). The line is now queued for the proxy's own journal thread and
  reaches stderr as soon as it is free.
- **An endpoint's route is no longer owed as a local directory.** A
  route the request sends to on an endpoint it states
  (`POST /notifications/stock` to the stated local sink) is realized by
  a send to exactly that URL. A send to another route or origin, or a
  GET, still leaves it owed; a local path the request reads stays owed,
  even after a sentence that writes; a file name with spaces keeps its
  exact extent.
- **A harness authoring call is no longer cut while its agent is visibly
  working.** An ACP authoring call's per-call time (600 s by default) used
  to bound its whole duration, both in the harness and around every
  compile authoring call, so a call still streaming its reasoning near
  that limit was timed out with no answer. It now bounds the call's
  silence: armed when the call starts, re-armed by each answer, thought,
  tool or plan update of the call's own session, so the call times out
  only once a whole allowance passes with no such frame, and its
  transport is given that same allowance per frame. The compile layer no
  longer wraps a harness route in a total of its own; API routes keep
  theirs. Usage and status updates, another session's or call's frames
  and stray lines never re-arm it; Stop still ends the call at once,
  nothing is retried, and the 408 timeout form is unchanged. The
  terminal record's `bounds` now say `deadline_ms: null`, the allowance
  as `idle_ms` and when an activity frame last re-armed it as
  `rearmed_ms` (null when none did). A direct (native) harness seat
  shows no frames and keeps its deadline.
- **A harness authoring call that runs out of time is reported as a
  timeout.** When the call's own deadline passed first, its error was a
  generic provider error (NIKA-339) and the per-call receipt said
  `provider_error` while the harness record said `timed_out`. It is now
  the established timeout form, API 408 under NIKA-330, which the receipt
  and the call observer both read as `timeout`, behind a call ledger or
  not. A refusal whose words merely say it timed out stays a provider
  error, and the deadline itself is unchanged.
- **Conversation recovery keeps an earlier uncertain operation in its
  historical position after later successful work.** Reopening does not
  append the same warning as a new failure; unresolved effects and charges
  remain recorded, and new uncertainty still receives a notice.
- **The authoring pack presents every Foundry row its recall reaches, whole.**
  The knowledge door kept at most three families, eight patterns, eight
  blocks, three examples and one skill, cut each block file at 6 KiB,
  its metadata at 1 KiB and the pack at 40 KiB, and gave a repair round
  three principles per code (six per message). These counts were not
  derived from any route. Every row the recall reaches is now presented
  whole, the block's version, status and proof first, with every repair
  principle of the codes found; callable contracts are whole sections,
  and the builtins named by presented blocks and examples get theirs.
  The pack builder is now `knowledge-door-v6`.
- **Check names the exact loopback grant a run accepts.** A task that
  fetches an exact loopback host (`127.0.0.1`, `localhost`, `::1`) was
  told no permit could admit it, although the run admits that host once
  its exact literal is declared in `permits.net.http`. The finding now
  says so and offers that one grant as its fix; a wildcard or another
  loopback host still does not grant it, and private, link-local and
  metadata targets keep the floor's refusal with no grant fix.
- **A stopped authoring states why it stopped.** When no candidate
  passed the checks, the conclusion now says whether the repairs stopped
  on no progress (a repair that named only findings already named), on
  a failed authoring call, on an answer that could not be read, or on a
  repair limit you set. « Within the repair budget » is said only for
  that limit: no limit applies by default.
- **A file name whose first word the request leaves open can be asked.**
  In « prépare exactement un payload out/notification.json », the words
  may name `out/notification.json` or a spaced folder. A candidate that
  asks it (a blank constant read whole as that task's path, one empty
  `permits.fs` entry on that side, a question whose label quotes the
  name) is no longer refused: the question offers exactly the name's
  readings, and the answer round bakes the chosen one into the same
  recorded candidate and completes that empty entry in place, beside the
  paths the candidate already grants, before its round's judge. Written
  whole, the name still realizes itself; unnamed or quoted, it is still
  owed exactly.
- **Unpriced preparation responses no longer imply an incomplete operation.**
  Successfully returned API responses no longer produce a misleading notice on
  reopen. Unknown charges remain visible, and unanswered or failed calls retain
  their uncertainty.
- **File-protection clauses no longer request an extra read during rehearsal.**
  When an intention reads a file and says not to modify its parent directory,
  the closed English and French protection forms leave that parent out of the
  requested inputs and outputs. Paths match whole literals, so a child path
  cannot give its parent a read role. Independent and shared reads remain
  inputs, and conditional or unrecognized clauses are not discarded. An
  explicit directory read still cannot supply a file's rehearsal witness.
- **Editor completion includes every canonical provider.**
  Scaleway and the previously missing Moonshot now appear in model suggestions.
  Membership is checked against the embedded canon; the presentation order and
  alphabetical order for additional providers stay explicit.
- **Keep authoring notes and refused Sketch and native question keys and gaps out of the public round journal, retaining their digest and shape.**
  Native ask rounds follow the same rule and retain admitted questions for the human. Report
  schema decode failures by class and position while preserving the internal repair
  diagnostic. Structural and admission diagnostics and the historical native candidate
  remain separate public paths.
- **A refund word inside a bound relative file name or a typed comparison
  value no longer invents a money-moving obligation.** Explicit refund
  requests and absolute paths that could name API endpoints retain the
  existing checks.
- **Trial runs of « Save ./out/x … » requests.** A path the request
  names after a bare verb, which the candidate writes and never reads,
  was required as an input, so the trial run never started (« the
  observed input … is absent »). It is now read back as the output.
- **A second Ctrl-C aborts `nika run --output json` and `nika test` at
  once.** Their fold held the process-wide stderr lock until the run
  ended, so every other writer waited for it. The signal thread prints
  its notice before it exits, so the abort waited for in-flight work to
  finish, and the egress journal stalled confined connects the same way.
  The fold now takes the lock one write at a time, like the default lane.
- **Save keeps proposals over nested record keys.** The check of a
  proposal's sources before Save counted only a document's top-level
  keys, so a candidate reading a key of the records inside one of its
  lists was withdrawn as if the file had changed. Those record keys now
  count as observed, and a key the records really lost still stops Save.
- **A new workflow is no longer written as whole source by a model.** Under the default
  `escalate` policy the private plan reads the attached knowledge as context (it no longer
  selects a source door), and a plan that ends without a candidate escalates to the sketch
  door: the model states the structure and its typed fills, and the compiler writes the source.
  An explicit `native: only` for a new workflow sends no request and names `escalate` or
  `sketch`; exact names, the support grammar, a reader refusal, a revision and the replay of a
  recorded source keep their doors. The request bound (`--authoring-max-calls`) is unchanged for
  `escalate` with repairs, and a typed `only` is never told to buy more requests. An answered
  endpoint grants its host only when a fetch url or notify target reads it whole. This shared
  route does not yet cover the CLI, Session and Serve entries' own mode handling.
  **The sketch door keeps what a graph states through its fills and its replay.** A `nika:jq`
  task bound to several edges now reads them all, as one input object keyed by their names (it
  read only the first, and a join could be READY over a table it never received); a semantic
  record compiled under an observed world stays closed, and its answer round replays under the
  same world; a question the request or the observed world already settles is refused while the
  sketch can still be repaired; and the record keeps a stated trigger in the request's own words
  (« Chaque lundi matin »), refusing a trigger that is not. A sketch may read a file the request
  names bare (`orders.csv`) where the compile observation places exactly one observed file of
  that name (`./data/orders.csv`), and its record replays only under that same observation; the
  placement never grants a write, a host or another name, and without one the path stays
  refused. Records written before this change for a multi-edge program or with a normalized
  trigger may refuse their replay: compile afresh.
- **The private Plan door now reads the context the compiler was given.** Its
  opening call, its one anchoring repair and the verifier's repair carry the
  attached knowledge pack's references, the callables they name, the observed
  world and the answers already given, as untrusted data beside the request. The
  merge still takes evidence only from the request's own words. Each such call's
  receipt entry names those references and a `semantic_context` marker (the pack's
  and the world's digests, or null). Onboard records the pack or the world as
  presented only when a call carrying them attests a return. Routes, modes and
  call counts are unchanged. A return proves neither use of the context nor cost.
- **An answer round keeps the sketch it answers.** A workflow composed from a sketch is now
  replayed on every answer round from its accepted graph and fills, under the same request, its
  answers and its observed world: named results, approval gates, agent and loop controls and the
  request's own duties survive, and a stored program text is never used. A record that was
  changed, written for another request, money, world or answer, or replaced by a new request is
  refused with a plain explanation instead of being reused, and a duty the workflow could not
  carry stays open whatever its answer. Reassembling a workflow is not approving it: a replayed
  workflow is ready only after the round's own check of the whole request. A host can also keep
  the exact authoring answers it was sent: a compile wrapped in the new scoped observer reports
  each authoring and repair answer exactly as received, including refused ones, while the
  compile's own record keeps withholding their text; a call that returned nothing is reported as
  a failure, never as an empty answer.
- **Semantic revisions can repair a candidate rejected by the judge.**
  Each refill preserves the accepted graph, uses the resolved requirements,
  and receives a fresh binding and verdict. Repeated defects and exhausted
  repair allowances stop preparation without replacing the saved workflow.
- **Keep a semantic proposal bound to the exact bounded project observation that compiled it, so Save can recheck its recorded source facts without running the workflow.**
  Meaning shows the semantic reading and its limits. Recognized literal reads remain partial
  coverage; source changes still withdraw affected proposals.
- **Serve preserves its one-request native authoring default.** Repairs and
  transport retries consume the server grant, callers cannot widen it, and
  receipts report the server's actual repair preference.
- **Serve uses the shared semantic creation strategy.** Native authoring and
  its request account now both resolve Escalate, allowing Plan and Sketch
  proposals to reach compiler-owned source emission. The default grant still
  permits one request; judgment and repair need an explicit larger grant.
  Historical edits and the limits of Cold Plan replay remain unchanged.
- **Account choice keeps the requested app explicit.** Choosing account access with multiple apps now asks for an explicit app and optional model, keeping the pending request and previous choice intact instead of selecting the first installed app.
- **An answer that is the question's own shape binds without a routing call.**
  A `provider/name` typed alone at the model question, or an offered key
  typed alone at a choice, was first sent to the turn classifier before it
  bound. Such a line cannot change the request, ask about the question,
  run or cancel: it now binds at once, and the route records it as an
  answer by protocol. A sentence around the same value is still read.
- **An unnamed account app is asked for, not refused.** With several
  apps that can answer, or none, `1` alone is now asked again as a
  question that keeps the pending request instead of being shown as a
  failure; a single app that can answer is still chosen by `1`, and an
  app named explicitly that cannot answer is still refused. The apps
  line labels each app `sign-in seen` or `no sign-in seen`, seen first.
- **A request that mentions a template, a model or a run reaches authoring.**
  The session answers from its own catalog only a closed engine question
  (the workflows here, the builtins, the providers, the gallery, a
  workflow's verdict, a code, the last run, a word of the language).
  Before, a word anywhere in a request turned it into a catalog answer:
  « Fill the template in ./submissions.json… », « Use a model to classify
  which tickets… » or « the running total » never reached authoring.
  Beside a waiting proposal, a question about it reads the proposal.
- **Continue a conversation after a completed unpriced preparation.** Reopening keeps the observed costs and completed calls visible while allowing a fresh preparation choice. It never restores spending authority from the previous session or treats missing usage as free.
- **A doubted workflow is repaired only from a defect the verifier
  locates.** When the verifier doubted a workflow, it was asked which
  part of the request was missing, and the workflow was repaired from
  that part, or from the whole request when none was named, even from a
  part the workflow honored, such as a restriction like « need no
  time-zone conversion » that no step broke. The verifier is now asked
  about each part of the request alone, in the request's own words; for
  a part it finds missing, which step fails it or, unless the part only
  forbids something, whether no step performs it; and when no part is
  missing, which step does something not asked, a step with no effect of
  its own (a read, a filter, a check) never counting as one. The
  workflow is repaired only from a defect located that way, and the
  repair is told the verifier's reason. A doubt the verifier does not
  locate, an abstention included, is never repaired from: Nika holds the
  workflow without proposing it, writes nothing, says what held it and
  what can decide it (a correction, another model or another verifier),
  and does not ask the same verifier about those bytes again in that
  compile. The configured verifier also reads, by default, what a
  Session trial run of those exact bytes read and wrote: a run that
  wrote every output it was read for can settle each open part its
  inputs exercise, then the whole request when they exercise every part,
  while a part its inputs never exercise stays open and no run clears a
  defect the verifier located in the workflow itself. A doubted workflow
  takes more verifier questions, one per part of the request and then
  the follow-up ones; a question that gets no answer ends them.
- **Conversation footers distinguish the latest reply from the last Run.**
  A refused revision no longer appears to inherit an earlier execution
  result, while pending Save and question prompts keep their own status.
- **Sessions without intelligence no longer create false inference records.**
  Greetings and local protocol fallbacks avoid creating project state for
  calls that never occur; actual intelligence calls retain their records.
- **Opening a Session pins its knowledge release once.** A host door's
  Session admitted this build's embedded release for a default
  configuration, then again for the one the environment names; it now
  admits it once, under the configuration it keeps, with the same strict
  admission, roughly halving host-session opening time in the measured
  repeated-open tests. A plain open is unchanged.
- **A replayed workflow the verifier doubts is never replayed to it
  again.** An answer round replays the workflow and judges it, but never
  repairs it: when the verifier found it unfaithful, the session stopped
  with « built but not proposed » and asked for the request again. When
  the verifier locates a defect (a part of the request it names the
  failing step for, or finds no step performing, or a step doing
  something not asked), the session now writes the workflow again under
  every answer already given, where the authoring round's own judgment
  and repairs run. A verifier that doubted the replay without locating a
  defect gives no defect to write again from: the replay stays held, and
  its record is dropped by the compiler, by the session round (whose
  retry with a stronger model then writes the workflow afresh) and by
  `nika compile`, which removes its plan record and says so, so no later
  round replays those bytes. An answer round over a COLD or WARM plan
  now judges the whole request again on the bytes it replays.
- **A request resumed or typed again reaches authoring as the goal.**
  After the intelligence choice, or after a session reopens with its
  goal restored, the same request was read as a turn beside its own
  goal: a classifier call answered « already working on that », and
  nothing was prepared. A request equal to the current goal now is the
  goal; a different request beside it is still routed.
- **Session calls ask their route's capacity during continuous preparation.**
  The turn classifier, the chat reply, the decision seat's choice and
  the reasoning calls carried fixed output ceilings (8,192 tokens, a
  label ceiling, 256 for a choice) that truncated long answers and
  forced a low reasoning effort on reasoning routes. They now ask the
  route's capacity; an explicit limit given by the caller is kept.
- **A Session's run runs only the world its check judged, children
  included.** A run the Session requested was bound to its workflow's
  own bytes, so a child workflow or a skill rewritten after the check
  still ran. The check now reads the workflow and every child it reaches
  once, with the run's own reader, and binds the request to that world's
  closure; the child run compares it after admission and refuses any
  other world before any task. A workflow the run cannot capture, such
  as a symlinked one, is no longer reported clean.
- **Revising a saved workflow keeps its file and admitted budget.** Session
  binds the revision to the saved file and its original bytes, refuses a
  changed base, and requires a fresh Save decision. An unsettled work line
  classified as a modification revises that file; new work can still create
  a separate workflow. Failed or unknown classification keeps the current
  state without authoring. A revision without a new amount inherits an
  unambiguous in-memory ceiling only for the same resolved file and bytes;
  stale bindings refuse. No execution consent is restored, and saved monetary
  constraints are not recovered across restart.
- **An answer typed for something that no longer waits is refused, never
  read as a new request.** A Session line typed while a host showed a
  question, a gate, a proposal or a run's cost review opened a new turn
  once nothing waited any more, so an answer to a question dropped since,
  or a second yes at an answered gate or a decided review, reached the
  classifier and, with an intelligence, the model as a fresh request. It
  now goes to that state's own identity door and is refused as answered,
  decided or stale; leaving and the read-only commands still pass. An
  authoring question's answer is also refused while a run's cost review
  owns the next line, and the question keeps waiting.
- **A sketched tool can no longer write or read another task's file.** When a workflow is
  composed from a sketch, every file argument a builtin takes (a chart's output or data file, an
  image's input, output directory, references or mask, a speech output directory, a decision
  bundle, a multipart upload) must be one of the paths its own task states, on the side it reads
  or writes. Another task's file is refused before a candidate exists, even when the workflow's
  permissions would allow it; a templated or malformed path is refused instead of ignored. A
  task that never states the file its tool always reads or writes (an edit stated only as a
  write, a chart with no output) is refused while the sketch can still be repaired, not after. A
  refused fill names unknown tasks, fields and keys by their position only, so text a model
  proposed is never repeated back.
- **A proposed fill can no longer vanish or redirect a sketched workflow.** The sketch authoring
  door now reads the proposed graph exactly and checks every fill against the holes of the
  accepted graph before it emits anything. A fill for a task or field the graph does not have, a
  second fill of one hole, a missing or wrongly typed value, an unfilled required hole, an
  argument object that replaces a path, input, bound content or channel the graph owns, and a
  content template that drops its bound input are each refused by name before a candidate
  exists, and repaired within the same bounded budget. Malformed graph fields and edge names
  that collide or shadow a gate or loop binding are refused instead of silently dropped. A
  lawful graph and fills emit exactly the same workflow as before.
- **A sketched workflow keeps every result and control the request names.** A workflow composed
  from a sketch can now name its results (`outputs`, each the result of one of its tasks)
  instead of exposing only the last task's output, state an agent's turn bound and its own
  effect-free tools, and state whether a loop stops at its first failure. A stated value is
  emitted exactly; a sketch that states none keeps its previous behaviour, and the record says
  which values were defaults. A misplaced or malformed control, a duplicate or dangling result,
  an effectful agent tool, and a write fed by several inputs without a template are refused at
  the sketch step, where they can still be repaired. A request made of independent copies (each
  source to its own destination) is no longer folded into one read by the plan: it continues in
  the sketch step within the same request budget, or is named when no sketch step is allowed.
- **Keep the original request when correcting a stopped creation before any
  workflow has been saved.** Explicit new work stays independent; cancelled
  candidates grant no Save or Run authority.
- **Trace verification bounds its custody, anchor and lease reads.** Reads
  use held regular-file descriptors and refuse final symlinks. Unavailable
  side inputs remain distinct from absent or malformed ones; an unreadable
  anchor reports UNAVAILABLE, never a claim of forgery. The selected parent
  may resolve through a link; contained project reads still refuse child links.
- **A command typed while Nika prepares no longer stops the preparation.**
  `/details`, `/status` or any other command the conversation knows was
  queued as a correction: Enter asked the preparation to stop. A command
  reads and never redirects the work, so it now waits in the box with a
  hint, and Enter sends it when it is your turn. Words that only mention
  a command, or a path starting with a slash, still correct the work.
- **The transcript stays at the reader's position when preparation ends.**
  The decision remains visible, and End returns to the latest reply.
- **The workspace activity card says what is under way, then how it ended.**
  One card per turn follows the Session's typed activity: its heading names
  the phase under way (Understanding, Generating, Checking, Repairing), one
  row keeps the step under way, repairs share one counted row, and the
  workflow author's calls (writing and model review) share one row that says
  in plain words what the call does (`write a step`, `review your request` …),
  the requested model (never a served identity) and whether it is running,
  returned or stopped. The heading counts author calls, repair calls and
  stopped ones, and says that conversation routing and decision-service calls
  are not counted there. A returned call is not shown as a success. When the
  turn ends the card reads `Settled`, `Stopped by you` or `Not completed`,
  with the time the terminal measured. While a turn works, the hint says that
  typing waits and that `Ctrl+C` twice leaves without recalling a call already
  sent; a scrolled-back conversation says `End` returns to the latest
  messages. No phase, model, percentage or usage is inferred from words.
- **Intelligence choices and preparation models stay visible.** The terminal intelligence chooser keeps all four numbered routes beside the composer on small screens. The `Prepare:` heading names the already resolved API or local authoring model when no model was explicitly configured; it does not claim that model answered a turn.
- **Reopened runs recover their recorded artifacts from one verified journal.**
  Run, Outputs and Files share the captured bytes and expose only the history
  the host adopted. Refused recaptures and declined adoption withdraw old
  projections while retaining Proof and its reason. Terminal output maps are
  recorded whole within 64 KiB, sized without payload above it, or withheld
  whole when secret scrubbing is needed. File contents are read now; opening
  a view starts no run and restores no approval.
- **Reduced-motion activity:** keeps measured elapsed time and the current work,
  Stop request and armed-exit facts visible with a still marker. Drafts remain
  available, no completion bell rings and idle terminal views stay silent.
- **A reopened footer tells an earlier run from this session.** Until a
  run is observed here, the rail reads `Run ○ (earlier ✓)` and the status
  row opens with `last run ✓ exit 0 in an earlier session`, so a kept
  success is no longer mistaken for a fresh check or run, or for none.
- **Resize and welcome animation keep the terminal responsive.** Fullscreen resize redraws the workspace without a cursor-position query, keeping
  the session responsive on terminals that do not answer that query. The welcome
  reveal stops waking the terminal after its last distinct frame.
- **A run's steps read once, in order.** The workspace no longer shows
  a run's steps twice: the live activity card gives way to the run's own
  task lines, which now read once after the check and the run
  announcement.
- **The interactive run stream preserves evidence of incomplete delivery.**
  Non-UTF-8 frames stop the child instead of being repaired. The workspace
  bounds event deduplication and marks late or out-of-order frames incomplete;
  a settled run alone does not establish a complete stream or verified Proof.
- **A scrolled transcript keeps its reading position at a turn's end.**
  Words typed meanwhile, a cleared spending-question draft or a Stop's
  queued correction no longer move the rows being read, nor does the
  correction while it is sent and worked on.
- **A verifier's rejection now holds for the rest of the request.** A
  workflow the verifier rejected was kept from it within one compilation
  only: writing the workflow again could yield the same bytes, and the
  same verifier, asked again, could then accept them. The session now
  carries the verifier's rejections into every later compilation of the
  same request, and `nika compile` keeps them beside its plan record, in
  `.nika/compile/<sha256>.declined.json`, carried even under `--fresh`:
  the same bytes under the same verifier, for the same request, answers
  and observed files, keep the earlier rejection, with no new question,
  and the CLI says so. The parts it found missing are repaired from, so
  writing the same workflow again no longer ends the round. A corrected
  request, other answers or changed files are judged afresh, and an
  abstention is not carried, so a new round may still decide it. When
  the verifier's questions stopped early, a call refused or failed, or
  when it waited for a trial run that a later round now has, the later
  round asks only what it never answered, never what it already did.
  Serve keeps no conversation and carries none. A replayed workflow is
  also never ready in an answer round that no verifier judges, unless
  the deterministic reader planned it alone: an `--answer` round with
  neither `--authoring-model` nor `--decision-model`, or a session
  answer round compiled without a model because the money allowance
  blocks one, replays the plan and stays incomplete until a verifier
  judges it.
- **Every clause the verifier checks on its own now sees an admitted
  component the workflow holds.** When the compiler asks the verifier
  about one clause of the request apart from the rest, that question is
  now told, like every other question about the workflow, which admitted
  catalogue component the workflow holds, whether it is expanded or
  invoked, and what its holes are bound to. A clause that conditionally
  asks to use such a component can be satisfied by it. Every other clause
  is still checked on what the workflow does.
- **An accepted request is checked against its trial run.** When
  preparation ran the candidate on a copy of your files, a verifier's
  « faithful » no longer ends the verification on the program text
  alone: each part of the request is judged again against what the
  run read and wrote. An output that contradicts a part (for example
  every overtime minute counted and no normal minute) becomes a
  located defect that is repaired, never a proposal; an uncertain
  answer over the run keeps the candidate unproposed. Answer rounds
  now run the trial before their judge reads the bytes too.
- **The verifier now sees an admitted component the workflow already
  holds.** A request may say to use an admitted catalogue component when
  one applies. When the reviewed workflow holds such a component, the
  question on each part of the request and the questions over its trial
  run are now told so: which component, whether it is expanded into the
  workflow or invoked as a child workflow, and what its holes are bound
  to. A held component can satisfy that one clause. Every other operation,
  target, threshold and output the request asks is still checked on its
  own. When the verifier first judged that clause missing, it can now name
  the held component instead of abstaining. That keeps the part open for
  the trial run or a correction; it never makes the workflow ready by
  itself.
- **The requested write is never an extra operation.** A verifier
  that named the task writing the very file the request asks for as
  « something the request does not ask » sent preparation into
  repairs that could not progress and ended with nothing proposed.
  Naming such a task now decides nothing; the trial run, when there is
  one, decides the disagreement.
- **The trial-run check keeps the verifier's own component finding.**
  When the verifier found that no admitted component could do a part
  the request conditionally asks to reuse one for, and let that part's
  own alternative stand, the question over the trial run now shows that
  finding as the verifier's history: the clause and the components it
  examined, bound to the same bytes and catalogue, with the same
  reading of how a document is built. It is history, never a fact: the
  alternative's runtime work stays required, and a part still named
  missing over the run keeps the candidate unproposed.
- **A revision's replaced clause is no longer asked as an obligation of
  its trial run.** When a revision changes part of the earlier request
  (for example an age threshold raised from 48 to 72 hours), each
  earlier part asked again over the trial run may now be answered
  superseded by a later correction, as the question over the program
  already allowed. The change and every untouched part stay required,
  and a part left without a decision keeps the revision unproposed.
- **The verifier's whole-request check also sees an admitted component
  the workflow holds.** The question that asks whether the workflow does
  everything the request asks is now told, like the questions on each
  part, which admitted catalogue component the workflow holds, whether it
  is expanded or invoked, and what its holes are bound to. A request that
  conditionally asks to use such a component is no longer judged
  unfaithful for it alone. Every operation, threshold and output is still
  required. A rejection recorded before the verifier was told this is
  asked again rather than repeated.
## [0.122.0](https://github.com/supernovae-st/nika/compare/v0.121.0..v0.122.0) - 2026-10-02

### Added

- **`nika compile --authoring-reasoning low|high|max` and `nika serve
  --authoring-reasoning` ask an explicit reasoning effort of every
  authoring and decision call.** `NIKA_AUTHORING_REASONING` names one when
  the flag is absent; the flag always wins and never falls back to the
  environment. Any other word, whichever names it, is refused before any
  request (`nika compile` exits 3) or before the Serve listener binds. The
  flag needs a seat to ask it (`--authoring-model`, `--decision-model` or
  both); without one it is a usage error, and the deterministic door never
  reads the environment's word. The effort never moves a cap: calls keep the
  operator's `--authoring-max-tokens` or the default, a truncated answer
  stays a failure, and with a level the decision call asks it under the
  declared authoring cap instead of its compact 256-token request. The level
  is sent only where the model catalog qualifies it: today
  `deepseek/deepseek-v4-pro` (low, high, max) on its exact direct DeepSeek
  endpoint, as `thinking: {type: enabled}` beside `reasoning_effort`.
  Another provider or model, a gateway, a base-URL override and the mock
  refuse before any byte leaves; no fallback runs. Without a level, a
  request keeps the bytes it sent before. Each call's receipt records its
  configured level, the reasoning keys read back from the body it
  dispatched (`unobserved` when no response carried them), the served
  effort as unknown, the reasoning tokens the provider reported (null when
  it reported none) and the model it named. The read-back is the adapter's
  own observation of its serialized request, not a network capture. A
  Session asks the same levels through `NIKA_AUTHORING_REASONING`.
- **A request's results now have a behavioural contract a rehearsal can be judged
  against.** From its reading of the request alone, never from a candidate, the
  compiler states which files the request wants written and what they must hold
  (filters, a sort with its tie rule, the first N rows, groups and totals,
  projections, duplicates), and judges what a rehearsal consumed and wrote by
  value: exact decimal numbers, `70` equal to `70.0`, rows as a multiset or in
  the stated order, any tied row at a cut unless file order is stated. Nothing
  passes on what the reading cannot prove: a write it cannot prove
  unconditional, an output name it cannot trace to the request, a sample, a
  truncated read, an unsupported operation or a case the request leaves open is
  reported unverified. A failed run never passes by what it did not write, an
  engine failure is a defect, a stop is never counted as the requested end (an
  error message never stands for one), a stop never hides a wrong value already
  written, and an invalid fixture or observation is reported as such, never as
  a verdict on the workflow. A request of the small closed form (read one
  file, keep or count the rows where a field is a value, write the result to
  one file) proves its write required and its count's name free or stated, so
  a right result can be certified. The engine and Session APIs now build two
  checked forms of the closed `copy SOURCE as is to TARGET` request and select
  by rehearsed output before consent. This path has been exercised on
  synthetic files; the other operations remain library contracts.
- **Arm a beat on the last day of each month, or every N weeks from a date.**
  A cadence can now say two things a plain cron cannot. `L` as the whole day-of-month field is
  the last day of each month (`TZ=Europe/Paris 0 9 L * *`: the 28th, 29th, 30th or 31st,
  whichever ends that month), and `every N weeks from DATE HH:MM` is an anchored interval
  (`TZ=Europe/Paris every 2 weeks from 2026-10-05 09:00`, `N` from 1 to 52), whose slots keep
  their civil time across a clock change. Neither is approximated: `1,L`, `L-2`, `LW` and an
  interval without its anchor date are refused by name, because the anchor says which week is
  on. systemd units say the month end exactly; launchd units, and both targets for the interval,
  wake a little more often and the firer fires only the real slot. `nika arm` readiness reports
  the zone and the next fire of both forms.
- **Read the last day of a month and an interval of weeks from its start date as a schedule.**
  A request whose trigger says « the last day of every month at 18:00 » or « le dernier jour de
  chaque mois à 18h » now proposes the cadence `0 18 L * *` on `requested_trigger.cron`, and
  « every other Monday at 09:00 from 2026-10-05 », « every 2 weeks on Monday at 9:00, starting
  2026-10-05 » or « toutes les deux semaines le lundi à 9h à partir du 2026-10-05 » proposes
  `every 2 weeks from 2026-10-05 09:00`, the forms the arming grammar holds. An interval of
  weeks without its start date is still asked, and the question now says the start date is what
  is missing; a start date on another weekday than the one named, a date that does not exist or
  a date not written YYYY-MM-DD proposes nothing. The binding adds the zone and validates the
  proposal with the cadence grammar, as for every other schedule. The deterministic reader
  keeps these words in the trigger head, a start date after « from », « starting » or « à partir
  du » included, even after the comma that closes the head.
- **An unknown cost exposure now has a supported recovery door.**
  `nika trace cost` shows, as data (`--json`), each earlier Run whose billing
  is unknown and the digest of its latest journal row.
  `nika trace cost reconcile` appends one explicit resolution (billed, not
  billed or still unknown) tied to that exact digest and to the inspected
  project. The resolution is attributed to the local OS account and recorded as
  the operator's unverified attestation. Nothing is deleted or rewritten;
  preflight refusals leave the journal untouched. An append I/O failure
  keeps the write outcome uncertain. `still-unknown` keeps blocking, and a
  final resolution only lifts the block: the next unknown-cost Run still asks
  its own fresh question.
- **Serve's cost-review door speaks version 2 for fans and authored retries.**
  A server started with `--cost-review` now also serves `POST /v2/cost-reviews`,
  `GET /v2/cost-reviews/{id}` and `POST /v2/cost-reviews/{id}/decision`, and
  health lists `costReviewV2`. A version-2 review carries the typed `dispatch`
  bound: the total of physical requests, the requests in flight at once, the
  authored-retry law and one row per task. The witness covers it, and one
  approval confirms exactly those limits for one `POST /v1/jobs`. A fan of
  zero items needs no review and sends nothing. Version 1 keeps its closed
  document and refuses a fan or an authored retry, naming the version-2 route.
  The versions never cross (ids, decisions and idempotency keys stay with the
  version that created them).
- **An unknown-cost Run can fan out and retry inside one finite, reviewed bound.**
  A `for_each` over a literal list or an input/const array (the operator's value
  before the default) and an authored `retry.max_attempts` are now reviewed
  instead of refused. The one fresh question shows each task's breakdown (items
  × authored attempts × calls, schema re-asks included), the original total of
  physical requests and the requests in flight at once. The approval confirms
  exactly those limits. Every reservation, sent or not, counts against the
  total and takes one in-flight slot atomically. A received 429 or 503 may be
  followed only by the workflow's own authored retry, inside the total; any
  other failure, a timeout or a cancelled send stops every further request.
  The transport itself never resends, and usage and USD cost stay unknown. A
  fan of zero items asks nothing and sends nothing. A count only the run
  decides (a task output), `on_error`, exec, agent and nested workflows stay
  refused. Session reviews and single-attempt Runs keep their exact behaviour.
- **nika:fetch can observe named HTTP statuses.** Explicit response.accept
  returns status_code, a sanitized final URL (or null) and the extracted
  body. The exact set contains 1–16 distinct integer statuses with no
  implicit successful statuses. Unlisted statuses and transport/security
  failures still fail. Malformed policies refuse before sending. `traverse`
  rejects `response` and `headers` at check and run; the new static header
  rejection requires the next minor release.
- **Compile:** Hosts can opt into rehearsal of final authoring candidates. Task failures and missing outputs feed the existing native repair budget; finalized candidates cannot be ready on a failed rehearsal. Rehearsal refusals remain explicit and grant no consent. Native creation and replay carry paths introduced by admitted question answers into the same rehearsal boundary; unrelated answer strings and saved path metadata grant no reads.
- **Providers own a provider route's public identity.** `route_origin` names
  an endpoint `scheme://host:port` from the `url` crate's WHATWG parse, the
  one the transport connects with, and refuses userinfo. `canonical_endpoint`
  accepts only an exact `https` serialization without userinfo, query or
  fragment. `route_label` and `durable_calls` project a route and per-dispatch
  call records to origins, with no endpoint path left in any field. Traces,
  the Run terminal receipt, new cost-journal rows, Session history and the
  review screens now name routes through them; pricing and in-memory
  records keep their exact endpoints.
- **`nika serve --cost-review` seats a one-time cost-review door.** A job whose
  exact route has an unknown USD cost can now run on a server: `POST
  /v1/cost-reviews` frames one fresh review with the same evaluator as `nika run`
  and holds the project's cost lease. `POST /v1/cost-reviews/{id}/decision` records one
  explicit `approve_once` or `decline`. A single `POST /v1/jobs` carrying the
  review id and its witness runs it, after every bound fact is re-observed. A review never creates a
  job, a run or a file by itself, lives 300 seconds, and survives no restart.
  Health lists `costReviewV1` only when the door is seated. The server's per-run
  ceiling stays a hard cap: `--run-cost-ceiling <USD|none>` sets it, `0` is a
  valid binding veto (a zero server ceiling no longer refuses at startup), and
  only an explicit `none` lets an unknown cost be approved. Unreviewed jobs now go
  through the shared evaluator, which binds the declared-free observer and
  still refuses an unknown-cost route before the worker starts.
- **A Session asks the reasoning effort you name for every LLM call it makes.** Set
  `NIKA_AUTHORING_REASONING` (`low`, `high` or `max`), or a host's typed setting. On a
  DeepSeek route whose catalog lists that level (`deepseek-v4-pro`), every authoring and
  repair request, every turn-routing label (a host's own classifier included) and every
  conversational turn is then sent with thinking enabled and that effort. Caps and
  temperature are unchanged, and `/status` says so. Any other word is refused. A route, a
  subscription seat, a reasoner or a classifier that cannot carry the level refuses it
  before anything is sent. The operator-selected TypeSafe decision seat is a separate
  backend: no effort is sent to it or claimed for it. With no effort named, requests are
  sent as before.
  **`/details` states each explicit effort as the receipt recorded it.** For every call,
  it shows the level asked, the keys read back from the body sent (`unobserved` when
  none was read back), the reported usage and model, and that the effort the provider
  spent internally is unknown. A call refused before sending is never counted as sent,
  and a call with no recorded answer is never counted as answered.
- **Native authoring previews.** Session-owned model authoring checks final candidates and, when rehearsal is admitted, previews their observed results from confined copies before consent. Live result previews share the turn rehearsal budget with copy selection, while save and run consent remain separate. Rehearsals refused before execution are shown explicitly as source-only. Native proposals can enter a fresh revision without carrying the previous rehearsal to changed bytes; cancelling or failing the edit restores the original proof only while its identity and files still match.
- **A session question survives a close.** When a session ends (quit, TERM
  or KILL) while the compiler's question waits, the next session names the
  request, the settled answers and the waiting question; `/meaning`, `/why`
  and `/status` read them without changing anything. `/restore` continues the
  same round only when asked: the money gate reads the request again, a
  revised workflow whose file changed is held with nothing compiled, and the
  recorded plan is replayed with no AI call and no workflow executed, so the
  question is asked again and the next answer is judged against the project
  as it is now. A kept round that was redacted, altered, oversized, of another
  schema or malformed stays as it is, is named, and is never continued; no
  earlier admission, consent or run is restored.
- **A trace directory can be surveyed without fail-open, and a paused run's
  lineage can be read.** `nika-dap`'s `store::survey` keeps every `*.ndjson`
  entry it cannot fold, every doubt about a folded journal (a torn suffix, a
  missing opening frame or run identity, conflicting identities) and every
  listing error; journals carry their identity (`run_id`, `project`), and
  `store::scan` stays its fail-open projection, unchanged. `nika-trace`'s
  `lineage` view folds a survey into which journals continued a paused run:
  `NoneObserved`, a `Chain` with its head, or `Indeterminate` with every
  reason (a fork is never ranked). It is read-only: no authorization, no
  verification, no exactly-once claim.
- **The terminal renderer paints through the engine theme.** Its block
  faces and markers now ask the shared theme roles for a meaning instead
  of naming a colour, so the renderer and the run frames use the same
  ANSI slots; the busy marker takes the accent (cyan) that running work
  wears everywhere else. The renderer also gains the workspace icons with
  their labels and ASCII twins, and the Supernovae butterfly sampled from
  the repository logomark, revealed once and shown whole at once under
  reduced motion. Nothing places them on screen yet.

### Changed

- **Single-brace dotted references refuse before execution.** Interpolation
  surfaces now report `NIKA-VAR-005` for `${ const.seed }` and related Nika
  namespace heads, including unclosed ones. Use `${{ ... }}` to interpolate
  or a CEL string literal to produce the text intentionally. Currency, shell
  parameters and quoted CEL strings retain their meaning. Unused-declaration
  hints no longer advise deleting a constant named by this typo. This tightens
  accepted workflow syntax and ships in the next minor release.
- **Track the terminal workspace roadmap.** Document project, conversation and
  execution UX scope and native acceptance gates in ROADMAP.md; implementation
  is tracked in #1752 and the default presentation is unchanged.
- **`nika compile --authoring-model` sends one authoring request unless
  `--authoring-max-calls N` authorizes more.** Escalation, repairs, samples
  and the sketch strategy run within that authority. A request past it is
  refused before any byte leaves, and the outcome states the refusal.
  Repairs, samples, or an escalate or sketch strategy typed beyond what the
  authority can honor under the resolved strategy are refused before any
  request (exit 2, `authoring_authority`), and the refusal names the number
  to authorize. Counts the compiler would run as others (repairs above 5,
  samples outside 1 to 5, a grant of 0) are usage errors at argument parsing
  (exit 2), with no `authoring_authority` document. A model-shaped candidate
  or plan is READY only once judged, and the judgment is a request too:
  under the default single request it is refused and the request stays
  incomplete, so a first round's judged READY needs `--authoring-max-calls
  2` or more (3 for `sketch`); a replayed plan costs no call. A typed value
  the strategy cannot apply is recorded as ignored. A direct API seat is
  counted per physical HTTP request on a single-attempt transport that
  follows no redirect, so a transport retry is a request too. An ACP harness
  is counted per invocation, and its own requests are reported as unknown.
  The authoring receipt's backend adds that account, the requested model,
  the models the responses reported and how many reported none; a seated
  decision model is stated outside the authority, and the receipt says
  whether its token totals are complete. No dollar ceiling is claimed.
  Serve's `POST /v1/compile` has its own grant, `nika serve
  --authoring-max-calls` (one request per round by default); the Session is
  unchanged.
- **Pin the canonical specification.** Align the embedded language reference
  and conformance fixtures. The authority contract requires fresh consent
  when approval lineage cannot be established; the coverage matrix keeps
  declared observation cases separate from qualified runtime behavior.
- **A stated sort orders every row, and one stated total can be written as a
  bare number.** « sort them by amount_usd, most expensive first » asked for
  a `top_n` count the request never implied. A sort that keeps no subset now
  orders every row, its superlative giving the direction; a ranking such as
  « sort them by amount and keep the most expensive » keeps its question. A
  request for one total written as a bare JSON number now writes that number
  alone instead of an object holding it; several totals, or a structured
  destination for one, are asked instead. Plans recorded by earlier versions
  keep their representation.
- **A Run on an exact catalog-declared-free route is now observed, and a
  shape that observation cannot admit is refused before any call.** Such a
  route had no Run admission: its calls reached the wire unobserved, and an
  agent loop, enabled thinking, vision, or a `max_tokens` missing, zero or
  above the tariff's output bound was called run ready and dispatched. `nika
  check` no longer calls such a workflow run ready, and `nika run` refuses
  it before any provider call (exit 3, the task and the shape named). A
  supported Run binds an observer on those routes only, with no project
  lease, journal row or cost review; paid, local and mock routes keep their
  own transport, and `--max-cost-usd` still applies. A plan that mixes a
  declared-free route with an unknown-cost one is refused by the
  unknown-cost review before any question. When a host account is attached,
  the terminal frame carries its receipt observation in a new
  `inference_admission` field; a declared-free observer's receipt says
  `scoped_to_declared_free`, so its subtotal never reads as the whole Run's.
  A response naming another model stays uncertain, and the next call is
  refused before the wire. A Run killed before its terminal frame leaves no
  receipt.
- **A fan-out's item table now tells a cancelled item from one that never
  started.** When `fail_fast` or a `timeout:` stopped a `for_each` batch, every
  item without a recorded outcome read `never_started`, including items that had
  already begun and sent their requests. A started item that is abandoned
  without a recorded outcome now reads `cancelled`. Only an item that never
  began keeps `never_started`. Recorded outcomes and outputs are unchanged,
  and the remaining items are never drained.
  Neither word says whether a provider billed a request (the ledger does). Paged
  tables gain an `items_cancelled` count, always present (0 included). Readers
  accept a paged table without that count only when it has no cancelled rows.
  An unknown status or a count mismatch leaves a paged table incomplete. This
  extends a closed trace vocabulary (spec 03/17), so it ships in the next MINOR
  after 0.121.
- **One strict admission for authoring knowledge on every door, against a trusted identity.**
  `nika compile`, the Session and `nika serve` admit a Foundry knowledge release
  (`nika-knowledge-release/2`, profile `nika-knowledge-release-profile/r1`, the contract the
  producer shares, with the same vectors) or refuse it whole with one typed cause. The host
  names the identity it trusts for the release (its manifest's sha256 and its policy) from its
  own release record; without one nothing is collected, so a root `--knowledge` or
  `NIKA_KNOWLEDGE` names is refused (`ADMISSION_UNTRUSTED`) until a qualified identity source is
  wired. The release is collected on held directory descriptors (the root's final component and
  every entry beneath it are never followed as links, the root's ancestors are outside this check;
  no FIFO blocking; Unix only) in a closed layout, bounded before any read; its manifest is closed
  and pins every file; every row is a canonical line of its kind's closed schema pinned to the
  target; only a block claims CHECKED, with a check receipt bound to the verifier that checked its
  bytes; lineage names retained sources; relations, licence texts and notices close. No permissive
  reader remains, nothing is read in part, and a historical snapshot directory is refused. A pack
  composed elsewhere (`--knowledge-pack`, `NIKA_KNOWLEDGE_PACK`) is refused before it is read.
  `--no-knowledge` (now on `nika serve` too) and the exact word `NIKA_KNOWLEDGE=off` turn the
  knowledge off; off beside a source on the same settings layer is refused; the explicit layer
  wins over the environment. With nothing named and authoring enabled, the
  default is an embedded release of three patterns and three workflow blocks,
  admitted against an identity built into Nika. Recall follows matching
  patterns to their blocks; an intent with no matching words gets no references.
  A named source that fails admission never falls back to this default.
  The pack builder is `nika-compile/knowledge-door-v4`. For Rust callers this
  is a breaking change in the 0.122 minor: `Snapshot::open` and `KnowledgePin::open` take the
  trusted identity (`None` is refused), `KnowledgePin::dir` is replaced by `origin`
  (`KnowledgeOrigin::Disk` or `Embedded`), `KnowledgeSource::Snapshot` carries `identity`,
  `KnowledgeError::NotASnapshot` and `KnowledgeError::Stale` are removed. Strict snapshot-admission
  refusals use `KnowledgeError::Unavailable` with its code. `CompileArgs` and `NativeAuthoringArgs`
  gain `no_knowledge`; callers constructing these structs must supply it.
- **Cost observations have a durable form, and unknown-cost routes are named
  by origin and bound only when canonical.**
  `nika_providers::project_observation` projects an account's cost
  observation (`nika/inference-cost-observation@1`) to `@2`: every endpoint
  becomes its origin; money, counters, states and ids are copied as written;
  and the named free text (a declared tariff's `billing_provider`,
  `provenance` and `version`, each attempt's `request_id`, `response_model`
  and `note`, and the `refusal`) becomes null when it holds endpoint
  material, with `withheld` naming the field by its instance pointer and
  counting unknown keys without naming them.
  `InferenceReceipt::durable_observation()` returns it while `observation()`
  keeps the exact `@1`. A well-formed `@2` projects to itself and a malformed
  one to nothing, and the admission reading law reads `@2` only when it is
  well formed. `project_route` and the `origin()` of a choice, an attempt and
  a billing route name an origin. The Run terminal receipt, new
  cost-journal observations and new Session history entries write `@2`;
  entries already recorded are kept as written. An unknown-cost route whose
  configured endpoint is not canonical (a form the URL parser would rewrite,
  or one with userinfo, a query or a fragment) is now refused before any
  review, naming at most its origin; configure the endpoint as the parser
  writes it, with a path. The review and challenge screens and the served
  review document name the route by the parser's origin, never its path.
- **Run traces name provider routes by origin.** A task's `inference_calls` and
  `pricing_route` fields now carry the durable projection of each call and its
  pricing provenance: a route is `{provider, model, origin}` and the requested
  endpoint is `requested_origin`, so no endpoint path, query or userinfo is
  written. Usage, estimates and states are kept as recorded, and `estimate_known`
  says whether the call was debited or counted unpriced. The named free text (a
  declared tariff's `billing_provider`, `provenance` and `version`, a call's
  `request_id` and `response_model`) is withheld when it holds endpoint material,
  and a `withheld` list names the field, never the text. Cost attribution keys
  (`cost_by_source`, `spend.by_source`, the `nika:inspect` cost view) read
  `provider/model @ origin`, and routes of one origin sum under one key; totals
  and call counts are unchanged, and pricing and identity keep the exact endpoint
  in memory. `inference_calls` no longer decodes as the in-memory call record.
  The terminal frame's `inference_admission` and new cost-journal rows carry
  the same origin-only projection.
- **Share Check’s monetary readiness judgment with the execution service.**
  The CLI host supplies provider configuration to the same route, declared-free
  shape and finite-request observations. Refusal messages and admission behavior
  are preserved; this observation never grants permission to run or spend.
- **A request that asks for an effect and bans it stays the human's.**
  « write 'hello' to ./a.txt but do not write anything » (and « write
  nothing », « n'écris rien », « ne rien écrire ») is now read as a
  contradiction: `nika compile` refuses it with both clauses quoted, no
  candidate, no unrelated model or path question, and no provider call
  under any authoring strategy, including a revision in words and a
  clarification that replaces the request. The refusal's decision
  record carries the typed ledger of the refused clauses, and a
  contradiction beside a clause the reader cannot settle is stated
  too, never left behind an unrelated finding. A negation inside quoted
  content or quoted source data (« write 'do not write anything' to
  ./a.txt ») is content, never a ban, a gate or a clause boundary, and
  neither is a quoted waiver, approval bypass, refund or indecision
  (« keep only the lines containing 'no need to ask me' » now keeps
  its filter instead of copying the whole file). A conversion that also
  states a filter, a stage or a comparison (« convert ./a.csv into
  ./a.json, keeping only the rows whose amount is above the agreed
  threshold ») is no longer compiled as a copy of every row. A
  recurrence is kept wherever the request states it: « Each weekday at
  8, … » and a cadence ending an earlier clause (« Read ./x every
  weekday at 8, keep … ») give the same program and the same schedule,
  still to be bound, as « Every weekday at 8, … »; never a one-shot.
- **Server authoring requires explicit authority for extra requests.**
  Native authoring defaults to one physical request, separates repair
  preferences from request grants, and records requested and observed model
  identities and grant usage. Caller limits can only narrow the operator
  ceiling. Redirects are disabled; provider retries and fallback requests
  consume the same explicit grant and appear in physical-request counters.

### Fixed

- **An approval is single-use for the run, whichever HOME resumes it.** A
  used approval was refused again only from the same HOME, so resuming the
  same paused run under another HOME ran the gated effect a second time.
  The claim is now also written in the run's project
  (`.nika/approval-claims`), the project a resume is already bound to, and
  a second use is refused from any HOME. A run resumed with
  `--resume-unverified`, or one recorded before runs were bound to their
  project, can still be resumed from another project under another HOME;
  its approval window (15 minutes) bounds that.
- **ARM readiness no longer implies activation.** The report distinguishes a registered
  schedule from a captured workflow with missing or invalid required inputs. `arm --json`
  exposes bounded readiness, binding sources and firing evidence. Both reports inspect
  history without creating sidecars or repairing caches.
- **Keep blank authoring model identities unknown.** Empty or whitespace-only provider model names count as unreported in the shared authoring receipt instead of appearing as observed models; the requested model and raw response remain unchanged.
- **Authoring receipts preserve what was observed.** Serve retains typed local
  admission refusals and unknown model counts. Partial or malformed token pairs
  remain unreported, and direct API authoring does not claim a price or invoice.
  CLI, Session and Serve name the configured endpoint without credentials or URL
  paths, and identify overrides as configuration evidence rather than remote identity.
- **Unknown numeric dependencies stay unjudged.**
  Source-basis checks now keep numeric records with a missing or unknown discriminator unjudged instead of treating them as no dependency. Existing recognized number policies retain their behavior.
- **Source assertions are rederived from the compile request.**
  Source-basis checks now derive an unobserved field assertion from the actual request and its source, not a recorded user_asserted label. The additive basis_for API preserves genuine question answers through the compiler grounding and replay laws, including subsequent answers after a complete replacement. Hosts retain the compile-round request beside the exact proposal bytes.
- **Builtin discovery names the tools only an agent may call.** Builtin
  discovery now identifies agent-only tools in both the human listing and
  JSON. `compose` and `done` share the same context restriction as Check;
  `compose` is accurately described as a static workflow checker.
- **Clarified requests carry their own budget spans.** A complete Create
  replacement is compiled as its own text, with its own monetary directives.
  Changing or omitting a budget cannot carry offsets from the earlier phrase.
  The selected seat and aggregate account stay; restatements bind directives
  to the combined text and refuse conflicting amounts.
- **Clarifying a request keeps monetary admission bound to the text the caller read.**
  - A changed replacement no longer carries the earlier request's admitted budget in its receipt,
    even when the new amount sits at the same byte offsets.
  - Repeating identical text keeps the already admitted directive out of the business reading,
    preserving the same ready workflow without a needless authoring call.
- **An `unwind` cleanup now spends under the run's own authority.** A cleanup
  task used to dispatch with no ledger, no budget and no guard. Under
  `--max-cost-usd 0`, a cleanup whose `model:` its producer's output decides
  reached the provider, while the same call as an ordinary task was refused
  (NIKA-1704). What a cleanup sent never reached the run's spend receipt, so
  a run could report `unmetered` after a paid request. A cleanup
  `invoke: workflow:` child started with no budget at all. A cleanup now rides
  the run's ledger like any task. It meets the same pre-send guard: the
  refusal comes before any byte and is journaled on the cleanup lane. Every
  request it sends is counted once: at its price when answered, or as an
  unknown charge when it failed or when the cleanup's own timer dropped it.
  A cleanup child runs under the run's remaining budget. Once the run's
  budget is crossed, a cleanup that can spend (a model call, an agent, a
  child workflow, image or speech generation) is refused before dispatch,
  while housekeeping cleanups still run. A cleanup stays best-effort: none
  of this fails its run. The remaining budget the guard reads is still a
  snapshot, never a reservation.
- **Isolated hook fixtures.** Keep clone-arming self-tests inside their disposable repositories when Git is wrapped by a session guard; use the discovered Git installation instead of copying the wrapper into the isolated environment.
- **Describe compile decision evidence across response generations.** Generation-1 contracts expose the shared compiler decision record, plan, strategy and suggested file; authoring counters state when they are partial observed sums.
- **`nika compile --help` states the exit a stopped authoring gets.** The
  help promised exit 3 for an authoring provider or call-ceiling failure,
  while such a compile has always ended as an unfinished outcome with
  exit 2, the code the SDK and scripts read. The help now says so, names
  the diagnostics and receipt that report the stop, and lists what really
  exits 3: a configuration or knowledge source that cannot be honored, or
  a compile error before any outcome.
- **Decide spelling drops with canonical relations.**
  Spelling checks confirm unmatched values in pairs, then decide a dropped spelling's cause
  with one private counterfactual: every string relation compares canonical (NFC) forms while
  every value keeps its bytes. A drop that disappears is a byte comparison and is refused
  however the literal is written, including one literal that also inspects its own bytes. A
  drop that persists, such as a requested length, threshold or encoding, is recorded for the
  semantic judges and is never a pass. The emitted program is unchanged, and the verifier and
  its probes share one jq engine. An earlier exchange of string constants also refused
  requested values of the literal itself; that overclaim is withdrawn.
- **Compose describes its Core check scope.** The agent tool checks an
  in-memory draft; `valid` does not resolve child files or admit execution.
  The saved draft and its children still require `nika check`. The canonical
  spec, embedded pack and tool description now state that boundary.
- **A confirm gate whose answer the effect never reads is refused before
  anything runs.** A gate whose answer was bound but whose `when:` decided
  on a caller input instead (`when: ${{ inputs.go == true }}`) passed
  `nika check` without a blocking finding, and after an explicit « no »
  the effect still fired. `nika check` and `nika run` now refuse that
  shape with `NIKA-SEC-014`, naming the gate and the effect, and the
  message teaches the fix: bind the answer and gate on it
  (`when: ${{ with.go == true }}`). A run paused before this fix is
  refused the same way when it is resumed, since the audit runs before any
  task. A gate that reads the answer in a shape the checker cannot
  evaluate still gets the advisory hint, never a refusal.
- **A quoted text written to a named file compiles without a model.**
  « write 'hello' to ./a.txt » (and « écris « bonjour » dans ./a.txt »)
  used to ask for a language model to draft the text. `nika compile`
  now writes the quoted text exactly as stated through `nika:write`,
  with no question, no model and no provider call: punctuation,
  instructions, template-like text (`${{ … }}`), escaped quotes, an
  empty value, Unicode and a line break inside the quotes are written
  byte for byte, and a path inside the quoted text is neither read nor
  written. A write gated by an approval (« … once I approve », « ask me
  before writing 'hello' to ./a.txt ») waits for it alone and shows the
  exact text, to the path as spelled; a banned or contradicted write is
  still never written. Translating or rephrasing the text, an unquoted
  or ambiguous object, or a JSON/CSV destination still asks.
- **A killed paid Run no longer blocks later unknown-cost Runs without a
  name.** A paid unknown-cost Run killed mid-dispatch (SIGKILL, a second
  signal, a host timeout), or one whose composition failed after its review,
  left its cost row `prepared`, and every later unknown-cost Run was refused
  with a message that named no Run and pointed at a gesture that did not
  exist. The Run now holds a writer lease beside its journal from before
  `prepared` until after `settled`, so the next review can tell a dead
  writer from a live one: it appends one `unknown` row naming the
  interrupted Run and keeps refusing until that exposure is reconciled
  (`nika trace cost reconcile`), and a live writer is refused as busy. A Run
  that ends without finishing settles what its account observed. Rows are
  appended, never rewritten, and nothing is retried. Separately, an
  unknown-cost Run whose `nika:write` declares `create_dirs: true` into a
  missing parent is no longer refused before its review with a bare
  « No such file or directory »; without the flag, the refusal names the
  parent and the flag.
- **Keep cost reconciliation behind the live writer lease.** Hold directory and journal locks alongside the legacy lock, refuse shared hard links, and verify that a successful reconciliation actually became the Run's current event. Append the newline with its row; uncertain writes remain explicit and old journal bytes are preserved.
  Hold a separate project-directory lock so replacing `.nika` inside a stable project cannot make a live writer look gone. Preflight refusals preserve journal bytes; post-append I/O failures explicitly leave the write outcome uncertain.
  Bind project-facing lease acquisition to the original project descriptor, before opening `.nika`, and refuse a moved or unrelated child. An empty custody file is administrative metadata, not a prepared Run or provider request.
  Keep reads, UNKNOWN derivation and settlement on the locked journal inode after a rename. A failed explicit settlement is not retried on drop; repeated successful finish appends nothing.
- **A contradictory cost settlement no longer clears an earlier Run.** A
  `settled` row that says its account is still open, counts unknown calls that
  no sent attempt records, or reports a negative or unbacked known subtotal is
  now refused as a conflict named by its digest, like a row from a foreign
  writer: the earlier Run keeps blocking and the next unknown-cost Run is not
  offered a fresh choice. A `prepared` row whose account already moved is
  refused the same way. Every row an engine writes reads as before, including a
  completed unknown-cost call whose USD price stays unknown.
- **Project durable cost observations through the provider.**
  The Run terminal receipt and new prepared/settled cost-journal observations now
  use the provider-owned durable projection: route origins replace full endpoints,
  while accounting fields keep their meaning. An unreadable projection is reported
  or refused, never replaced by the exact private observation. In-memory route
  identity and consent are unchanged. Existing history, its derived observations
  and reconciliations, and Session history are not migrated by this change.
- **Cost review details show the host evidence as its public view.**
  `details` on an unknown-cost decision printed the host cap evidence as
  a Rust debug dump. It now prints the same view the machine surfaces
  expose: whether the host allows the choice, and for each layer its
  class, origin and cap.
- **Serve's cost-review guidance names the right remedy and keeps its route.**
  The per-run ceiling's remedy (`--run-cost-ceiling none`) now accompanies
  only the refusal the ceiling itself causes. A review refused for another
  reason (an unsupported shape, a project `ceiling:` of zero, a held lease)
  keeps its own words. A refused job's bounded message no longer erases the
  review route it names (`POST /v1/cost-reviews`). Only this server's exact
  route literals survive the path scrub; every other path-like token is still
  dropped.
- **Totals and averages are exact, or the run says why not.**
  - A sum of `0.1` and `0.2` is written `0.3`, not `0.30000000000000004`; an average of `0.1`
    and `0.2` is `0.15`; totals of large integers keep every digit.
  - An average with no finite decimal expansion (`4` divided by `3`) stops the run and asks for
    a rounding; a rounding the request states is applied exactly, half away from zero.
  - Exact arithmetic is bounded: a value needing more than 1000 digits stops the run naming it,
    instead of silently dropping a tiny part (`1e-2000` beside `1` used to give `1.0`).
  - A result, or a column the request writes as a JSON number, that no JSON number carries
    exactly (`0.12345678901234567891`, or an integer past 2^64) stops the run naming the
    value and what it would have become, instead of writing a rounded number.
- **Every provider request a Run sends stays on its ledger, even when the task
  stops waiting for it.** When a `for_each` item failed, `fail_fast` aborted the
  siblings still in flight, and their requests, already sent, dropped out of
  the terminal `unpriced_calls` count. A `timeout:` did the same to the attempt
  it cut, and a provider's own 429 re-send could vanish with it. The count
  depended on which sibling happened to answer first: a three-item fan-out
  sent three requests, and the ledger said 1 on one build and 3 on another.
  Now each request is recorded when it is handed to the transport. A request
  whose task was cut is counted once: as an unknown charge if it never
  answered, never as a known zero, and by its own price if it had answered.
- **`nika doctor --ping` no longer takes an open port for a model.**
  `nika doctor --ping` now checks a bounded compatible model list separately
  from an open port. A mute listener, unrelated server or malformed response
  cannot establish model availability. The probe runs no inference, sends no
  credentials and downloads nothing; advertised models remain untested.
- **A `model:` decided at run time is admitted as the route it renders to.**
  `model: ${{ inputs.m }}` (a `--var`, a declared default, const or an
  upstream output) no longer bypasses Run admission. A value the inputs decide
  is judged before any effect, exactly as the literal would be. Free vision,
  thinking, agent loops, unknown-cost routes such as 0/0 catalog rows and
  uncataloged names are refused with exit 3. Values only the run decides are
  judged by the Run observer at dispatch, before any provider byte, including
  in answered legs and nested workflows (children share the Run's account).
  Paid, native, local and mock routes keep today's transport and policy. An
  over-bound declared-free reply is no longer priced as a known zero beside
  its unknown charge. Its `cost_unpriced` now says `usage_rejected` instead
  of `missing_catalog_price`: the tariff exists, and the reported usage broke
  the admitted bound or context, or named another response model.
- **The crate-size gate counts embedded jq code.** Raw asset lines, including
  comments and blanks, share the existing production Rust budget. An absent
  tracked manifest or source inventory and an unreadable source refuse a
  verdict instead of silently reporting zero lines.
- **Static exec permission checks** now judge bare immutable string
  constants in exec URL and script operands using the same rules as
  literals. Script permission inference uses the same known arguments.
  Replaceable inputs stay dynamic; shell expansion and computed working
  directories remain outside this check.
- **A fan-out's calls now reach its trace.** A `for_each` task writes one frame, and that frame used to carry no call records, so a fan-out's provider requests could not be audited per request from the journal. The fan-out's frame now carries `inference_calls` and `cost_unknown_calls` for every iteration that returned. Each call is recorded once, in item order, under the same origin-only projection as any task. A retried item keeps each physical request. A request dropped in flight (a cancelled sibling or a timed-out attempt) has no call record, and none is invented; the ledger still counts it. Totals, counters and settlement are unchanged, because the calls were already debited when each item dispatched.
- **A `fail_fast` fan-out now stops at the first failure to complete, not
  the first in input order.** With `max_parallel: 2`, a held first item and a
  second item failing after 70 ms used to run on until the first item's
  `timeout:` (20 s), then record the held item as the failure and the real
  one as `cancelled`, its error lost. The fan now stops the moment any
  iteration fails. Items still in flight are dropped (`cancelled`), queued
  items never start (`never_started`), and every iteration that completed
  before the stop keeps its own row: a failure stays `failed`, and a success
  stays `ok` even when an earlier item was slower. Successful outputs, item
  rows and spend still read in input order. `fail_fast: false`, recovered
  items, `max_parallel`, per-iteration `timeout:` and the paged item table
  are unchanged. A dropped request still counts as sent, with an unknown
  cost, never a refund. Operator cancellation (Ctrl-C) is a separate
  contract that this fix does not change.
- **Keep fetch authentication out of extracted document URLs.**
  Links, metadata and article extraction resolve against a landing URL without
  its username or password, including a response-supplied same-origin redirect.
  The request still carries its original authentication; derived outputs and
  traces no longer inherit those credentials from the resolution base.
- **Realize a bare file name where the observation places it.**
  A request can name a file bare (`orders.csv`) while the project keeps it elsewhere
  (`./data/orders.csv`). The fidelity laws' path law then realizes the name when the compile's
  observation places exactly one file of that name, `permits.fs.read` covers it, and a task opens
  it. A native candidate that reads the observed file is then no longer refused as
  `UNREALIZED PATH`. The refusal stays when there is no observation, when two observed files
  share the name, when only another name is observed, or when no task opens the file. A
  destination keeps its own law. The native door passes its observation to the laws through
  `fidelity::laws_observed`.
- **Stop asking which observed field a key means when the observation already answers it.**
  A compile no longer asks which observed field a seat key means when the request states the
  key value and the host observed that value in that key alone. « Sum integer amount_cents of
  paid rows by customer » names `paid`, never `status`: the seat reads it as `status == "paid"`,
  as a typed clause or as a verified program comparing `.status` to `"paid"` literally, and the
  host recorded `paid` among the values of `status` and of no other column, yet the round asked
  « Which observed field does `status` mean? ». The key is now bound by the observation: the
  grounding entry records `bound_by: observation` and the witness literal, the key keeps its
  grade, and an answer to its question is still read first. The question stays when the value
  is recorded in two columns or absent from the recorded sample, when the column has no
  recorded values, when the request never states the value, when the value also names a
  column, when the key is not observed, when the rule only tests containment, or when a program
  holds the value anywhere but in that comparison. A type the rule needs, such as an instant
  window, is still asked.
- **Read « request human confirmation before writing » as the approval it asks for.**
  A request that asks to « request human confirmation before writing », or to seek or solicit an
  approval before an effect, now holds that effect for a human's yes, as « ask for human
  confirmation before writing » always did. The reader used to miss that approval. So the gate the
  model put over the write was refused as invented, and the next candidate, without the gate, was
  refused for dropping the requested confirmation. A request for something that is no approval
  (« request the file before writing »), a confirmation that is a thing (the confirmation email)
  and a waiver (« no need to request confirmation ») still hold nothing.
- **Explicit HTTP authorization has one owner.** Explicit Authorization replaces URL-derived Basic authentication instead of sending conflicting credentials; ambiguous explicit field variants are refused before the request.
- **Failed HTTP builtin calls report their status as data.** A `nika:fetch`
  failure now carries `details.status_code` in `tasks.X.error`, in the
  terminal frame's `outcome` and in the sealed trace, plus `details.accepted`
  when the call declared `response.accept`, including an extraction failure
  after an accepted status. Only these typed facts cross: provider text,
  headers, bodies and URLs never do, a transport failure reports no status,
  and an error without details keeps its `{code, message, transient}` shape.
- **Keep redirect credentials within their authorized origin.**
  HTTP redirects remove target URL credentials when crossing origins, so a
  response cannot reintroduce Basic authentication after sensitive headers are
  stripped. Invalid redirect diagnostics omit the response's Location value,
  keeping its credentials, path and query out of errors and traces. Same-origin
  relative redirects retain caller-supplied Basic authentication.
- **Stop asking for a cross-run state file when a request removes duplicates within its rows.**
  « Déduplique par customer et invoice_id, première occurrence conservée » or « Deduplicate by
  customer and invoice_id, keeping the first occurrence » was read as « no second effect for the
  same incoming identifier », and the round asked which JSON file keeps the identifiers already
  processed. A clause that scopes the removal by named fields and states the occurrence kept is
  now read as an operation when the request holds no cross-run cue: the seat's `distinct_by` or
  its program carries it, the final judge still checks it on the final bytes, the plan records the
  clause as an `in_data_dedup` binding, and an Applied finding says that no state across runs is
  asked. A removal beside a cross-run cue (« already processed », « déjà traité », « never
  twice », « between runs »), over events, callbacks or webhooks, or naming no kept occurrence or
  no field, keeps the obligation and its state-file question.
- **Resolved secret values are masked in inline and paged item evidence,
  task notes and terminal error messages.** Item indexes, statuses, error
  codes and verifiable journal structure are preserved; machine settlement
  messages use the observed diagnostic without changing downstream data.
- **Refuse non-finite numbers in `tonumber` and share one set of jq std shadows.**
  `tonumber` now emits exactly one finite number. `NaN`, `Infinity`, `-Infinity` and an
  overflowing text such as `1e400` stop with the named error `tonumber: not a finite number`
  before any predicate, comparison, sort, minimum, maximum or aggregate reads the value. Before,
  `select(. > 5)` dropped NaN, `select(. < 0)` kept it, and a sum became an infinity; the
  message prints no cell text. An explicit `try` or `?` still skips the operand. The `nika:jq`
  builtin, output bindings, the static checker and the compile verifier now load one definition
  (`nika_cap::JQ_STD_SHADOWS`), so output bindings gain the global `scan` they lacked, and all
  four run one probe set (`nika_cap::JQ_STD_SHADOW_PROBES`). Limits: `fromjson` still reads
  NaN, the infinities and overflowing decimals, and values a program computes (`infinite`,
  `1 / 0`, `pow`) are not guarded.
- **Refuse a candidate whose jq orders observed date-times with offsets as text.**
  A `nika:jq` comparison or sort over a record field compares text, and text order is not time
  order across offsets: `2026-09-01T02:30:00+02:00`, which is 00:30 UTC, sorts after the upper
  bound `2026-09-01T01:00:00` of the hour it lies inside, so a first-hour total came out 0
  instead of 8. When the host observed the field's values as ISO-8601 date-times in more than
  one offset or form (`Z` and `+00:00` count as two), or the compared bound is a date-time in
  another offset or form, the candidate is now refused (`TEXT ORDER ON INSTANTS`) with the
  repair: compare `fromdateiso8601` instants against a bound written with its offset. Values
  that share one offset and one form against a bound of the same offset, converted instants, a
  date-only bound and fields that hold no dates stay admitted. The evidence is the categorical
  values the host records, so a column whose sampled values are all distinct is not judged yet.
- **Refuse a candidate whose jq reads a document key on one of its records.**
  A seat's `nika:jq` expression that reads a key of its input document inside the iteration over
  that document's records, such as `.window_start` inside `.records[]`, reads null on a record:
  a window compared against it keeps nothing and the total is silently 0, or a conversion of
  the null fails at Run. When the host observed the records' file and its columns do not carry
  the key, the candidate is now refused (`RECORD SCOPE`) with the file, its columns and the
  repair: bind the document before the iteration (`. as $doc`) and read `$doc.window_start`.
  A column of the same name, a variable bound before the iteration and a read at document
  level stay admitted, and nothing is judged without an observation of the records.
- **Read number texts in the compiled laws without tripping the finite `tonumber`.**
  The number law of a compiled workflow and the order and arithmetic laws that read a decimal
  text now read an accepted text with `fromjson`. A text such as `1e999` stops with the law's
  own named error (`amount` is "1e999", not a number) instead of the generic
  `tonumber: not a finite number`, `1e400` keeps its exact digits for ordering, and an integer
  that no finite number carries is written as no number instead of failing to parse. Every
  finite value reads exactly as before.
- **A lookup by identifier never picks a record by input order.** « Look up
  ticket 42 in ./tickets.json and write it to ./ticket-42.json » (or « find
  ticket 42 » with a model's help) used to write whichever record with id 42
  came first: two different records gave A in one order and B in the other,
  and the run succeeded both times. The workflow now resolves exactly one
  record: when several different records carry the identifier (including
  the text `"42"` beside the number `42`), the run stops before writing or
  posting anything and says how many records matched. Exact copies of one
  record still count as that record, no match still stops the run, and a
  duplicate added to the file after the compile is caught at run time too.
- **Patch the media renderer dependency.** Pin the media tooling's
  transitive Next.js dependency to 16.3.6, including its matching platform
  packages, to address the ImageResponse security advisory.
- **Business amounts stay business; stated money binds every door.** A money
  word inside a business clause (« rows whose budget is 1500 USD », « rows
  where cost is under 5 USD », « rows with a budget of 1500 USD », a refund of
  50 USD, `cost` anywhere, a negative value) is read as data, never as a
  ceiling or an invalid amount. An explicit directive is a sentence of its own
  or a closing phrase attached to the work (« … ./out.csv with a budget of
  2 USD », « Le budget est de 2 dollars. »). The CLI now reads the money its
  operator states, and every seated door reads a request with its admitted
  directives blanked before HOT: a zero ceiling opens no authoring seat, and a
  positive ceiling on the CLI never dispatches an unpriced seat. A skeleton's
  name beside its ceiling (« hello budget 0 USD », « chain budget 0 USD ») and
  a revision's `--change` keep their money too. A consent line changes money
  only as a whole money amendment.
- **The native door reads one candidate when the seat fills both answer
  fields.** In 0.121.0 a seat that filled both `candidate` and
  `candidate_lines` stopped the native door with
  « answer carries two candidates » before any judgment (4 of 4 live runs of
  one seat). Two byte-identical texts are now one candidate, judged with no
  extra call; different texts are refused as conflicting, and nothing is
  chosen or bought. `candidate_lines` reads as its elements joined with a
  line feed, and `candidate` reads as sent. The same rule holds for the JSON
  objects of one seat text, in the native, sketch and proposal decoders: two
  different answers are refused instead of reading the first, an identical
  repetition is one answer, and template or prose braces no longer buy a
  syntax repair.
- **A workflow the authoring model writes itself is READY only once it is judged against the whole request.**
  - When the authoring model writes the workflow (the native door), or its tasks and programs
    (the sketch door), the compiler's own checks only admit it: a valid workflow that kept the
    wrong rows, such as the lowest amounts where the request asks for the highest, was READY.
    The finished workflow's own bytes are now judged against the whole request by the same
    bounded judge as a workflow compiled from the model's plan, asked through the authoring
    model.
  - A workflow the judge finds unfaithful, or cannot judge, is not READY: the request stays
    incomplete, naming the part it misses, and nothing of it is kept to replay.
  - The judge's calls are authoring calls: counted in the receipt with their usage, and held
    to `--authoring-max-calls`. A judge call the limit refuses is never sent, and the request
    stays incomplete.
  - The number of authoring requests a compile may need now counts every judge question.
    That number is shown in its review and refuses typed repairs, samples or strategies the grant
    cannot honor:
    - `3 + repairs` for the native door;
    - `4 + repairs` for the sketch door;
    - `2 × samples + 14 × repairs + 12` for a plan compiled from the model's proposals.
  - One check asks at most 8 clause questions. A clause past them is not asked: the request stays
    incomplete, and the message says why.
  - Typed repairs under `--authoring-strategy off` now count.
  - A typed `only` or `escalate` strategy needs `--authoring-max-calls 2` or more, and a typed
    `sketch` needs 3.
  - Limits: the judge is a model, so its approval is bounded evidence, not proof.
- **A workflow the authoring model wrote is READY after an answer round only once that round judges it.**
  - When the model writes the workflow itself (the native or the sketch door), its first round
    can end with a question, such as the model the workflow runs on. The answer round then
    baked the answer in and was READY with no judge at all.
  - The answer round now keeps the whole request pending on the finished workflow. It is READY
    only when a judge permitted in that round finds it faithful to the whole request: the
    authoring model, or a decision seat.
  - The judge's calls are authoring calls, counted in the receipt with their usage and held to
    `--authoring-max-calls`. One judge request settles a faithful workflow.
  - Without a judge, the answer round is incomplete: the finished workflow is only a preview, and
    the message names the judge to permit. A workflow the judge finds unfaithful stays
    incomplete, naming the part it misses.
  - The answer round of a revision in words works the same way.
  - Limits: the judge is a model, so its approval is bounded evidence, not proof.
- **Numbers stay exact through generated workflows, or the run stops before anything is
  written.**
  - A workflow that reads a JSON file no longer changes numbers silently between its steps. A
    very large identifier used to be rewritten as `1.2345678901234568e29`, and a fine decimal
    such as `1.000000000000000001` as `1.0`, with the run still succeeding.
  - Any number the workflow may read or write now either passes unchanged or stops the run at
    the decode, naming the number and what it would have become. When one generated rule is
    the records' only consumer and fixes what it writes, only the fields it reads are
    checked, so a column the output drops no longer stops the run.
  - Records a lookup selects are checked the same way.
  - Ordinary numbers (integers, decimals like `0.1`, `2.5e-3`, `1e2`) pass exactly as before.
- **Rankings, filters and sorts compare numbers exactly.**
  - « Keep the top 2 rows by points » over `1.000000000000000001`, `…003` and `…002` used to
    keep a different wrong pair depending on the order of the input rows. It now keeps `…003`
    and `…002` whatever the order.
  - A threshold is compared as the request states it.
  - When a ranking's cut falls between different records with the same value, the run stops
    instead of picking one by input order, unless the request states that file order breaks
    ties: that order is then kept through the limit. Exact copies of a record still count as
    that record.
  - Plans saved before this change replay unchanged and gain the exact comparison.
- **Fully read JSON carries complete key observations.**
  Whole small JSON files now carry complete key observations into compilation and proposal freshness checks. A missing asserted field cannot stay ready merely because the host mislabeled the whole read as a partial sample; bounded and unavailable observations remain partial.
- **A count stated over a filter now counts.**
  - « Count the rows where status is paid » used to compile to a workflow that wrote the paid
    rows instead of their number, while its checks and runs succeeded. It now writes
    `{"count": n}`: 0 when no row matches, with several conditions, with a numeric threshold,
    and with the rows' own noun (« count the orders where … »). « The number of rows whose … »
    and « compte les lignes dont … » count too.
  - Words before a filter that the compiler cannot account for (another operation such as a
    sort, or a qualifier like « the paid rows where … ») are no longer dropped: that clause is
    left to the authoring model instead of compiling a narrower filter.
  - A plan saved with the old reading is refused when it is replayed; compiling the request
    again gives the counting workflow.
- **Operations run in the order the request states.**
  - « Keep the 2 rows with the highest amount, then keep the rows where status is paid »
    used to filter first and rank second, so it could write two paid rows the request never
    kept. It now ranks, then filters the two kept rows; « keep the paid rows, then the 2
    with the highest amount » still filters, then ranks, and « count them » after a top-N
    counts the kept rows.
  - A filter stated after a sort or a total now runs after it: a malformed number that the
    sort or the total reads stops the run, as the request's order implies, instead of being
    filtered out first while the run writes.
  - A step the compiler cannot run in the stated order (a filter on a column after a total,
    or after a grouping on another column) is left to the authoring model instead of being
    run in another order.
  - Plans saved before this change keep their bytes; an older binary refuses a plan that
    records ordered steps.
- **A filter the compiler cannot read is never taken for a description of the data.**
  - « Keep the rows whose status is a » compiled READY into a workflow that wrote every row:
    the value `a` kept the compiler from reading the condition, and the clause was taken as
    a sentence about the file. It is now reported as work the compiler cannot carry and no
    workflow is produced; with a value it reads, the same request still filters.
  - With an authoring model configured, that clause goes to the model instead of a question: the
    model's filter over the request's own value runs beside the sort the compiler reads.
- **Each operation the request states is checked against the program that runs.**
  - The compile record lists every filter condition, count, order and cut the request
    states, with the request's own words, its place in the stated order and the fields it
    reads. Each is marked done only when the compiled program does it with those
    parameters, never because a step is named after it.
  - A proposal that ran the paid filter before « keep the 2 rows with the highest amount »,
    or left the filter out, compiled READY and wrote a paid row outside the top 2, or an
    unpaid one. The reading of the request's own clauses now replaces such a proposal, and
    a program that misses a stated operation is never READY.
  - Words the compiler cannot read are listed as unverified, not as done.
  - An operation the request does not state is never run: a proposal that added the paid
    filter before the top 2 as well as after it ranked only the paid rows, READY. The reading of
    the request's own clauses replaces it.
- **A line typed before a question is shown never answers it.** In the plain session loop,
  a line typed while Nika worked (compiling, or running a workflow) answered the next
  question as soon as it appeared: a `yes` typed during a compile applied a proposal the
  person never saw, and a `y` typed while a run waited approved its gate and let its write
  happen. On a terminal, that typeahead is now discarded before every question waits: the
  proposal's `apply? ›`, a gate's `answer ›`, an authoring `reply ›` and the intelligence
  choice. The in-process gate ask of `nika run` on a terminal does the same, and a terminal
  it cannot drain leaves the run at its durable pause with its resume line taught. The idle
  `nika ›` prompt keeps a line typed early, the cost question keeps its own drain, and a
  pipe keeps its scripted lines.
- **Saved compiler plans recheck computation invariants.** Malformed rules
  and slots refuse as a whole. Numeric operands must have closed numeric
  syntax and come from the request; slots must be declared, and programs
  cannot override typed clauses. Required fields are no longer silently
  defaulted. Aggregation replay refuses missing source columns, duplicate
  output names and precision outside the generated domain. Historical
  optional lines/program fields remain readable; refused plans emit no
  candidate. Pending and verified transform records written before keep
  their identity and replay as they did, and a verified program stays
  anchored through the computation it realizes, whatever words the
  computation's detail uses. A regeneration whose replay refuses the
  verified program is reported refused, never accepted. Every recorded
  rule must be re-derived from its words by the law that created it: a
  record that changed what a rule computes, or put a program where the
  words state a typed rule, is refused and the rule named. A seat's
  typed computation is bound to the law that admitted it, not yet to its
  meaning: its values and numbers must be stated in their own clause (a
  schedule's hour is no threshold), but another comparator, aggregate
  or listed field can still pass. A conversion's identity is recorded
  and replays on its answer round (« convert ./a.csv into ./a.json and
  write a summary of it … » could never apply its model answer), bound
  to that very conversion: a record that replaces a filter by the
  identity is refused.
- **The local preflight dials only the host and port it parsed.** `nika doctor` and the run gate for local engines now derive the address from the same URL parse the transport uses. A base URL written with backslashes, or with a query or fragment right after the port, used to put its path text into the dial address and into the gate's « local endpoint … nothing answers there » refusal; the gate then called a live server silent. Only the host (IPv6 in brackets) and the explicit or default port are dialed or printed now, and the path is never. An IPv6 URL without a port now dials port 80 or 443. A URL that does not parse no longer passes as an address: nothing is dialed, and the transport reports the error.
- **`--max-cost-usd` now prices a `for_each` over an input at the items the
  invocation gives it.** With `inputs.xs` declaring a one-item default, a run
  given five items (`--inputs-json` or `--var`) used to be priced at one call,
  so it started under a cap that five calls cross. With a five-item default,
  a run given one item was refused although that call fits. The run's launch
  gate and the CLI's own preflight now bind the input as the run itself does:
  the given value replaces the default, and it never falls back to it. The
  floor counts the given items, so the first run is refused before any task
  (NIKA-1709) and the second is admitted. An explicit empty list prices zero
  calls. A value that is not a list is an unknown count, never the default's;
  the CLI already refuses such a mistyped value before any gate. `--model`
  still seats the envelope first. Literal lists, consts and inputs left to
  their default keep their counts.
- **A `model:` the invocation decides now meets its literal twin's budget floor
  and MODELS rung before the first task.** `model: ${{ inputs.m }}` bound by
  `--var`, `--inputs-json`, a declared default, a const or a `with:` alias used
  to run a prior task and then dispatch a paid route that `--max-cost-usd 0`
  refuses when written literally, and a rendered reasoning seat under
  `max_tokens: 256` escaped the check's refusal. Both twins now refuse before
  any task: NIKA-1709 for the cost floor, NIKA-1707 naming the MODELS
  findings, exit 2 on the CLI (the documented FILE code, never the « engine
  contract breach » a run-start cost floor would print). A library embedder
  now meets the MODELS rung for literal seats too. A task's own `model:` still
  wins over `--model`, and `--model` still replaces the envelope. Mock and
  local seats still run under any cap. A `model:` only the run decides (an
  upstream output, an answer, an item) is now judged when it dispatches,
  before its request: the same MODELS laws (NIKA-INFER-004 for a reasoning
  seat under its cap floor, NIKA-INFER-001 otherwise) and, under a cap, the
  call's own floor against what the ledger still holds (NIKA-1704). That
  refusal fails the task, is never retried, sends nothing and leaves earlier
  tasks' effects in place. The remaining budget it reads is a snapshot, never
  a reservation: siblings started together can still cross the cap together,
  where the run's budget abort stops the run. The budget warning names such a
  seat « decided at run time » instead of « unpriced ».
- **A replacement request cannot inherit an old money admission.** The cognition
  conflict path and pre-consent source-basis replay discard admitted monetary
  spans when the input text changes, including when a new budget has identical
  offsets. Unchanged bytes and a fresh admission keep their spans; genuine field
  answers after a replacement remain usable.
- **Restated clauses keep budget admission consistent.** Session checks
  the budget in the rebuilt request against the amount admitted for the
  answer. Conflicting readings are refused before compilation; business
  prices remain data and do not change the account ceiling.
- **`nika arm` reports a schedule readiness receipt per beat.** Each beat reads READY, UNREADY or DORMANT for its current configuration only. The receipt checks the captured program, the trigger binding (policies every fire refuses, such as `manqué: rattraper`, and expired pauses), the required inputs with their sources and unbound names, and model and cost admission of an unattended fire; a model the bindings decide is judged as the literal it renders to. OS activation and authority are never implied: activation stays `not_verified`, and unknown routes stay unknown, never ready. Firing evidence is bound to the beat by its recorded slot and generation. A copied or foreign record is refused as unattributed, a record from an earlier binding reads as history, and a current record proves the generation and slot, never the project or host. Every binding failure names its own input and reason. An environment value that does not fit is withheld from both reports and from the fire's error. Human and `arm --json` (now `schedule_readiness_version` 2, keeping the version 1 keys) render every beat and both exit 3 on refused or unattributed evidence.
- **Stages a proposal states over a plain filter are kept.** When the
  request's own reading of a clause was only a filter, a projection,
  number columns, an order or a limit that the proposal stated over the
  same clause were dropped, so the workflow wrote whole rows with amounts
  as text. They now replace the plain filter when both keep the same rows,
  and a proposal whose filter reads the clause differently leaves the
  request incomplete instead of silently narrowing it.
- **An `outputs:` entry that reads a secret itself is refused, even with
  `egress: [{ to: outputs }]`.** `nika check` accepted such an entry
  although the export always masked the value (`***`), so the sanction
  promised a flow the engine never delivers. The engine never writes a
  secret's own value on any surface, the outputs export included, so
  `to: "outputs"` declassifies values derived from a secret, such as the
  response of an authenticated call. A direct `${{ secrets.<name> }}` in
  `outputs:` is now refused with `NIKA-SEC-007`, and its message names the
  removal as the repair.
- **A rule reads only keys its source is known to hold.** `nika compile`
  now grounds every key a typed rule reads over one file and records how
  in the decision (`decision.grounding`): a CSV header, keys seen in the
  bounded sample of a JSON file (never proof that a key is absent), the
  request's own column list, or a human answer. A request word the file
  does not spell (« id » over `sku`, « quantity » over `units`,
  « expiry » over `expires`) is asked as a choice of the observed keys,
  never mapped by similarity; the answer only counts for the revision
  of the file it was given for, and is asked again after the file
  changes. With nothing observed, a key the request only names is asked
  for its exact spelling instead of being written into the program. A
  key present in only some records keeps the request open until it
  says what happens to the records lacking it. Keys observed in the
  request's own language stay READY with no question. `nika compile`
  now observes the files a request states (headers and keys, bounded,
  under the working directory) without an authoring model too, so a
  keyless compile stays READY when the file holds the key; library and
  Serve callers pass what they observed as knowledge.
- **A schedule the cadence grammar cannot hold is asked, never narrowed.**
  « Every other Monday at 09:00 », « every 2 weeks », « un lundi sur
  deux », « tous les quinze jours », « twice a week » or « every 5
  hours » was READY with a coarse cadence label (`weekly`, `daily`,
  `hourly`) the request never stated. Such a period now keeps no label
  and no cron, and the compile asks its cadence before READY: a
  cadence a schedule binds (« every Monday at 09:00 ») or « manual »
  resolves it; another alternate period is refused as an answer.
  **A number a rule reads is read under one explicit law.** A compiled
  filter, total, average, minimum, maximum or ranking parsed its column
  with jq's lenient `tonumber`: « 1,5 » became 1, « Infinity » an infinite
  value, an empty cell silently dropped its record, and a ranking put
  null last and any text above every number. Every such value is now a
  finite JSON number or a text in the JSON number grammar (« 150 »,
  « -3.5 », « 1.5e2 »); an overflowing value (« 1e999 »), `NaN`,
  `Infinity` or any other text stops the run with the column and the
  value named, before anything is written. Plans recorded by earlier
  versions replay unchanged.
  **A column holding values that are not numbers is asked, not guessed.**
  « keep only the rows whose amount is above 100 » over a file whose
  amounts include null, true, « n-a » or a list was READY and then failed
  at run; « keep the 2 rows with the highest points » over null points
  ranked them lowest without saying so. The observer now counts the kind
  of every sampled value (never quoting one), and when a column a rule
  reads as a number holds anything else, the compile asks what such a
  record does before READY: skip it (the comparison is false for it, and
  a ranking or total leaves it out) or fail the run naming the value. An
  average, minimum or maximum of no number stops the run instead of
  writing 0 or null, and a skipped record never counts in an average. The
  answer is tied to the file's revision and asked again when the file or
  its kinds change.
  **A stated text also matches its observed canonical spelling.** « keep
  the rows whose statut is livré » over a file spelling « livré » with a
  combining accent (e + U+0301) was READY and wrote a header only:
  equality is byte-exact. Where the observed values of the column hold a
  spelling canonically equivalent (Unicode NFC) to the stated one, the
  filter now also matches exactly that spelling, and the decision records
  it. Equality itself is unchanged: case, compatibility forms and
  spellings the sample did not show still compare byte for byte.
- **A workflow the authoring model shapes is READY only once it is checked against the whole request.**
  - A candidate compiled from the model's plan could be READY while it missed, reordered or
    changed part of the request, because only the duties the compiler extracted, or the
    words a step restated, were checked. Every clause no deterministic law reads from the
    workflow's bytes, and the whole request, is now judged against the workflow's own bytes
    by a bounded judge that reads the full request, its answers and the observed files; task
    names, labels and the model's confidence count for nothing. A clause the request states
    more than once is judged at each place it is stated.
  - A part the judge finds missing is sent back to the model with the judge's findings,
    within `--authoring-repairs`, and a computation the repaired plan still needs is
    regenerated with them. A judge that abstains or fails, or repairs that do not settle it,
    leave the request incomplete, naming the part; no question asks for what the request
    already states.
  - The judge's calls are authoring calls: counted in the receipt with their usage, and held
    to `--authoring-max-calls`.
  - A saved plan replayed on an answer round keeps what the compiler checks by itself, with
    no call; what only a judge can settle is judged in that round, or stays incomplete
    without a judge. Nothing in a saved plan or an answer is read as a judgment.
  - A computation the authoring model writes now holds where no row is kept: it is run on a
    source with no row and on each one-row source built from the model's own example rows,
    and a program returning null there is refused. When the clause starts with a sum or a
    count word and the model's example returns a number (or one field holding one), the
    program must also return exactly 0 on the source with no row and a number on each one-row
    source; an error there is refused. This covers that phrasing and shape only, not every
    sum. An average, a minimum or a maximum of no row may stop with a stated error, and rows
    of no row are an empty list.
  - A refused program goes back to the model once, with its program and the defect, within
    `--authoring-repairs` for the whole request; with no repair allowed, or when the call
    limit refuses the repair before sending it, the request stays incomplete. A program
    regenerated after a field answer is held to the same checks and repair.
  - A computation the model writes now compares text as the file spells it. When the observed
    file spells a value the request states with other bytes for the same text (« é » as one
    character, or as « e » followed by a combining accent), the program must match both, as
    the compiler's own filters already do; otherwise it goes back to the model naming both
    spellings, within `--authoring-repairs`, and with no repair left the request stays
    incomplete. A program matching both spellings is no longer refused as inventing a value.
    Case differences and look-alike characters are not the same text.
  - Limits: the judge is a model, so its approval is bounded evidence, not proof. The empty
    checks read values on the model's own example rows, not on every source; the spelling
    check reads the values the file observation sampled.
- **Scheduled workflow refusals stay visible on their own status.** API
  schedules report the same bounded finding as project schedules. Equal
  labels in the two origins keep separate diagnostics, and removing a
  project schedule clears its old refusal before that label is reused.
- **A round that states its budget can be answered after a restart.** When a
  Session reopens over a history that saw money, a request that states its own
  ceiling, typed again or a kept round continued with `/restore`, now reaches
  its proposal: its answers state no money and keep that ceiling. Session
  inference stays blocked (no allowance is inferred from the unknown earlier
  cost), the stated ceiling still bounds the proposal and its Run, and new work
  that states no ceiling is still refused.
- **A field you named by answering keeps its proposal valid at the yes.** A
  proposal's sources are judged for the exact request that compiled it: its
  answers and the observation its round read, kept beside its bytes, never an
  observation made later. A field you named for a file the project does not
  hold yet no longer withdraws the proposal as unjudgeable while that file is
  still absent; once the file's header lacks the field, the proposal is
  withdrawn and nothing is written.
- **A yes no longer saves a proposal whose sources changed under it.** A
  proposal records the source facts its program relies on (the columns a rule
  reads, a number field observed as numbers only); at the yes, before anything
  is written, the session observes those sources again and the compiler judges
  them. A column renamed or removed, a source gone or unreadable, a key some
  records now lack, or a value no longer a number withdraws the proposal with
  the changed fact named: nothing is written, no consent or money is recorded,
  and saying the request again builds it over the project as it is. New,
  removed or reordered rows and another column order keep it valid. A kept
  proposal is re-derived without AI and lands only when that gives its exact
  bytes; a proposal with no source fact to judge says so instead of claiming
  freshness.
- **Preserve durable cost observations in Session history.**
  A Session's project record (`.nika/session-state.json`) now keeps each new cost
  observation in the provider-owned durable form: route origins replace full endpoints,
  while the accounting fields keep their meaning. The line recorded before an unknown-cost
  dispatch names the route's origin instead of its endpoint. Entries already recorded are
  kept as written, and the live account's exact route, consent and authority are unchanged.
- **A paused gate continued elsewhere is never answered as it was.** When a
  session reopens, a run it saw pause is offered again only while no journal in
  `.nika/traces` continued it: a continuation that ended, still runs or cannot
  be judged is named and nothing waits, and one that paused again offers its
  own question. The journals are read again before any answer is sent, so an
  answer to a gate that another run overtook is not sent. Before any answer,
  the question now names the completed tasks a resume is sure to run again
  (their journal records cannot be served back); saying none promises nothing
  more, since a completed task is served back only while its definition and
  inputs are unchanged.
- **The session grounds a rule's keys in the project on every round.**
  The interactive session now observes the files a request names under
  its project root on its deterministic rounds too — the first reading,
  an answer or a change read again, and a round compiled while a
  spending limit blocks the intelligence — not only when an
  intelligence authors. A key the file holds is ready with no call, a
  word the file does not spell is asked as a choice of its keys, and an
  answer given before the file changed is asked again. For library
  callers, `compile_in` on a deterministic seat now observes under the
  project root its context names; `compile_deterministic` and
  `compile_through` stay pure.
- **The Session says what a held answer round is waiting for.**
  - When the authoring model writes the workflow itself, an answer round that finishes it
    is ready only once a judge that round can permit finds it faithful to the whole request.
  - With an authoring model, the Session asks that model as the judge. This is one bounded
    call (two when the verdict is unfaithful), counted in the receipt and admitted like any
    authoring call.
  - Without an authoring model, the round stays incomplete and the built workflow is only a
    preview. The Session now says so: "The workflow is built but not proposed…". It no longer
    says an authoring step failed on Nika's side, and no longer says the request cannot be
    built. It names why (no authoring model, or no judgment in this round settled it) and the
    way on (`/intelligence`, then state the request again · `/meaning`). Nothing is written.
  - The Serve and CLI compile doors keep a `deterministicOnly` answer round at zero calls, and
    it stays incomplete with its preview.
  - `/details` no longer says an answer round made zero calls. The knowledge line now reads
    "this answer round replayed it and presented the pack to no call", and the round's own
    receipt shows the judge's call when it made one.
- **A Session with no reasoner answers a workflow's model question
  again.** An explicit “none” conversational intelligence choice can answer
  a workflow's model question again. The host's factory is no longer
  mistaken for an available classifier; genuine failed or unknown
  classifications still bind nothing, and the proposed workflow waits for
  consent before writing or running.
- **A Session no longer reads its own protocol lines as work.** In 0.121.0 a
  mistyped slash command staged the paid authoring cost review; « why » or «
  what happened? » at a question or a proposal staged a review or bound as
  the pending answer; declining an unrelated cost review discarded the
  waiting proposal; and a routing reply that named two turn labels (« not
  MODIFY, this is DISCUSS ») started a paid revision. A command-shaped line
  is now served, or refused with the known commands it nearly spells. Why,
  meaning and what happened answer before anything is discarded, with no
  model call, also in French typography (« pourquoi ? », « qu’as-tu compris
  »); a why with nothing waiting answers from the last recovery card, as
  what happened does. A declined review cancels only its own call, and a
  reply naming two labels reads as unknown. With no intelligence to read
  replies, a value question binds only a value that stands alone (one token,
  a JSON literal or a quoted value), so « tell me more » is no longer taken
  as a destination path; a quoted answer or run input binds its content
  without the quotes. An activation's time zone is judged by the schedule
  grammar when it is given: « /bogus » and « /Europe/Paris » are refused,
  and « UTC » now answers. When Session cognition is blocked, a free line at
  the consent prompt keeps the proposal and states the account's own reason.
  `/meaning` counts the ledger entries it cannot read instead of claiming
  that no clause was recorded.
- **An admitted budget survives a business-clause restatement.** Monetary
  text before or after the changed words keeps its admission; replacement
  text never inherits monetary authority.
- **Expire abandoned question labels when reopening a Session.**
  The recovery notice expires input questions and labels that no readable
  kept authoring round owns, and asks for the request again. A kept authoring
  round names its questions separately; they become answerable only after
  `/restore` continues it. Historical records remain intact; the next state
  write no longer presents abandoned questions as answerable. No model call,
  consent or workflow write follows from opening the Session.
- **A restored round names your request as you typed it.** When a clause you
  answered in words rebuilt the request, the reopening notice, `/meaning`,
  `/why`, `/status` and `/restore` now name the sentence you typed beside the
  rebuilt one, and `/restore` keeps it as typed across later closes. A trailing
  line break no longer shows inside « »; the kept bytes are unchanged, so rounds
  kept by earlier sessions read as before.
- **A renamed column no longer loses the answer round.** « keep only the
  rows whose state is open » asked which observed field `state` means; the
  file then renamed `status` to `state`, and the answer `status` came back
  as « No current question owns this answer »: Session dropped the round.
  Now the answer is found stale and asked again over the file's current
  columns on the same request, and only a fresh explicit answer builds the
  proposal. Session and `nika compile --answer` carry the refreshed
  question forward; a plan recorded by an earlier version says so and is
  asked again once, never looping.
  **A budget stated with the work is the ceiling, never part of the
  work.** With a model chosen, « … write them to ./open.csv. Budget: $0. »
  was refused as « no further cognition admitted »: the budget read as an
  unfinished requirement only a model could build, and the zero ceiling
  forbade the model. « …, budget=0 » even added a filter on a column
  named `budget`. Session now reads the ceiling (« Budget: $0 »,
  « budget=0 », « --max-cost-usd 0 », « with a budget of 0 USD »,
  « plafond de 0 dollars ») and the compiler builds the rest of the
  request without it: the proposal or the field question comes back with
  no model call. A field named `budget`, a price, a quoted value or a
  path stay data and are no longer refused as a malformed ceiling; a
  malformed, negative, non-finite or conflicting ceiling still refuses
  before anything happens. « budget=0 » over a file that has a `budget`
  column reads both ways: nothing is built, and the reply says why
  instead of the bare « no further cognition admitted ». The same holds
  on a model reached through a gateway whose cost is unknown: the $0
  request was refused before its deterministic reading (« unknown-cost
  admission requires an exact HTTPS route », « the explicit zero
  constraint forbids this call »); it is now proposed with no call.
  **An incomplete `nika compile` says the file it left in place.** A
  compile that asks a question writes nothing, but the destination it
  was given may still hold an earlier file: `--json` now adds
  `existing_destination` and the text ends « existing destination
  remains at <path>; this compile did not write or remove it ». The file
  is not read, followed, removed or rewritten, `--force` included.
  Integration preserves compact trailing currency ceilings, validates malformed
  attached currency before filename exclusions, and reads joined ceilings and
  explicit old-default references together. Bare currency needs a separate
  segment; an `and`/`et` business range never loses its upper bound to a ceiling.
- **`trace outputs --json` now reports recorded task causes and terminal
  error codes/messages without borrowing evidence from an earlier task
  occurrence.** Its projection is version 2: recovery consumers must read
  `recovered_from` instead of the former `error_code` alias. A recovered
  success has no terminal error, and a new failure or running task no longer
  inherits recovered status.
- **Keep the session renderer under `--ascii` and draw its own glyphs in ASCII.**
  Bare `nika --ascii` opened the plain line loop; it now opens the same terminal renderer as
  bare `nika`, and the renderer's own glyphs take their ASCII twins: its block faces, its loader,
  its live prompt marker, its hints, the focus rule and the title the door gives the terminal.
  The Session's own words (the banner, replies, the status line, the lifecycle rail) and the
  echo of a sent line are shown as written, so the screen is not pure ASCII. `--plain` and
  `NIKA_TUI=0` keep the plain loop.
- **Keep queued terminal input visible across rapid Unix resizes.**
  Fresh consent boundaries also drain bytes still waiting in the terminal
  before accepting a new answer.
- **Keep the terminal honest in bare `nika`.** A word wider than the composer (a
  path, a URL, a hash, a sentence without spaces) now wraps instead of being
  typed out of sight, and the composer grows by the rows it really paints;
  `SIGHUP` restores the terminal before leaving, as `SIGTERM` does; `--color` or
  `CLICOLOR_FORCE` under `NO_COLOR` shows its colours; and the inline view is
  cleared as it opens, so a partial line left under the cursor never shows
  inside it.
- **Keys typed while Nika works no longer answer the decision after it.**
  In bare `nika` on a terminal, a line typed during a compile or a run was
  replayed once the turn ended, so `yes` and Enter typed ahead could
  consent to a proposal or answer a question or a gate. The composer now
  stays usable while Nika works: what you type shows at once, Enter sends
  nothing until it is your turn, and the page keys scroll a full screen
  (the answer brings the transcript back to its end). When the turn ends
  on a decision, the draft stays in the box unsent and a dim notice says
  so; only an Enter pressed once the decision is on screen sends it. The
  two spending questions still take only a fresh answer: a draft typed
  meanwhile is cleared, and a notice says so.
- **`--max-cost-usd 0` now refuses a priced task that no token ceiling
  bounds.** An agent, or an `infer:` without `max_tokens`, on a priced
  model passed a zero budget with only a warning, and with a key its first
  call would have been sent and billed. A zero budget now refuses such a
  task before the run starts (`NIKA-1709`, exit 2) and names the task: set
  `max_tokens` (`max_tokens_total` for an agent) so the floor can price
  it. Mock and local models are not metered and never trip the refusal; a
  budget above zero keeps the documented warning and the in-flight guard.

### Security

- **Keep control characters out of the terminal title.** Bare `nika` names the
  terminal window after the project directory; an escape or bell byte in that
  name could end the title sequence and start one of its own (a clipboard write
  under tmux). Control characters (C0, DEL, C1) are now dropped before the title
  is set.
## [0.121.0](https://github.com/supernovae-st/nika/compare/v0.120.3..v0.121.0) - 2026-09-25

**A conversation from the request to an inspectable result.** Open `nika`,
describe the work, review and correct the proposed `.nika` workflow, save it,
then choose Run explicitly. The Session keeps the request and earlier
requirements through corrections and restores pending drafts for fresh review.
DeepSeek is the priority API path for authoring and summaries.

Check, admitted access, recorded execution and the actual output remain separate
proofs. The [installed qualification](https://github.com/supernovae-st/nika/blob/v0.121.0/docs/qa/delivery-a-2026-09.md) records finite
synthetic journeys on its identified macOS development candidate; it does not
establish arbitrary-request correctness or Linux conversational qualification.

**Compatibility:** use SDK `0.121.0` with engine/Serve `0.121.0` for the expanded
Compile question protocol. Bare `nika` opens the terminal Session; use `--plain`
for its line interface (the previous `--tui` flag is retired). Older executables
refuse the newer Run history records: rolling back a binary does not migrate
history backwards. Foundry snapshots and Jev remain optional; public installers
do not distribute the operator's private knowledge snapshot or provider keys.

**Run cost compatibility:** the informational price catalog does not by itself
authorize an OpenAI-compatible API route. DeepSeek's admitted direct routes work
without an unknown-price review. Other routes, including default OpenAI and
Mistral endpoints, require a fresh, bounded Run cost review when their exact
route and model are not admitted; unattended invocations without that review
refuse before dispatch. Unknown-price review supports HTTPS OpenAI-compatible
text routes only. HTTP API overrides and overridden native Anthropic/Gemini
gateways refuse, including in interactive runs. Priced native routes at their
default endpoints and explicit local-provider lanes retain their own admission
rules. See [Spending](docs/usage/conversational-session.md#spending).

### Added

- **The resident binds a schedule's `inputs` on every fire (#1370 · the Serve
  door · prerequisite of #1719).** `PUT /v1/schedules/{id}` accepts
  `inputs: { key: <scalar> }` (string · number · boolean, one per declared
  input key), stores them with the definition, and folds them into the
  schedule revision only when bound, so every schedule written before the key
  existed keeps its exact revision, integrity bytes and store row. At fire the
  resident coerces each text by the workflow's declared type (`"7"` on an
  `integer` becomes `7`, the same `--var` law `nika arm fire` applies) and
  judges the result with the literal admission validator `POST /v1/jobs`
  uses; the bound values reach the run as `ApiCaller` inputs. A project beat's
  `inputs:` ride the same path: `nika serve` and `nika arm fire` now bind the
  identical values for one `arm:` line. Judged twice, named once: an unknown
  key (with the declared set), a value the declared type refuses, a missing
  required input (`NIKA-1708`) and the `@env:` channel (the CLI edge's, never
  a server's environment) refuse the `PUT` as `schedule.inputs`, and a file
  that stops declaring the key between the arm and the slot refuses the fire
  contained to that schedule (`schedule.admission`), the resident keeps
  running. `GET /v1/schedules/{id}` projects `definition.inputs` as the
  `--var` text it stores. OpenAPI `SchedulePut.inputs` documents the wire.
- **A value the request alludes to without stating it is a slot the compiler asks for.**
  « les capteurs dont la température dépasse le seuil d'alerte », « sorted by the column we
  agreed on », « el recargo acordado »: the seat compares a column to the words and lists
  them as unknown, and the candidate was refused as unresolved work (18 seeds of the sealed
  lane, which the corpus expects as a typed `const.*`/`inputs.*` question). A typed clause
  whose text value is one of the seat's unknowns now compares to a slot: the plan records
  it (`slots`, replayed), the assembler asks it as a mandatory `const.<slug>` (a literal for
  a numeric comparison, text otherwise), bakes the answer as a const and hands it to the
  rule's jq beside the records (`$in.slots.<slug>`). Nothing is guessed; the words are never
  compared. The recorded plan (`provenance.plan`) gains the additive `slots` list; the
  contract fixtures carry it; compile_version is unchanged.
- **The seat repairs an evidence it misspelled with one bounded call.** When a COLD
  proposal cites an evidence the request never wrote (a model answers `extraits` for a
  request that wrote `extrais`), the compiler sends the seat's own answer back with the
  verifier's counterexample, once, under the same output cap and timeout; the repaired
  proposal is judged by the same merge, a second miss is refused as before, and the receipt
  counts both calls (`provenance.authoring.calls`, the route `cold: repair N`, the sample
  record's `calls`). Measured on eco-60 with gpt-5-mini before the change: 4 of 52
  proposals were refused on that defect alone.
- **Compile gains a private candidate-retrieval layer with measured recall.**
  `nika_onboard::compile::retrieve` ranks the 22 canonical skeletons and a
  compact projection of the spec's 220 pattern families (Apache-2.0
  development knowledge embedded under `assets/`) with BM25 over one
  normalized token stream: French diacritics fold, function words drop, a
  light stemmer and a closed English/French alias table map everyday
  operation words onto the pattern vocabulary. `retrieve_by_ops` takes the
  operation words of a semantic plan. A hit is a candidate to read, never a
  selection verdict or authority; the hermetic recall test prints recall@1 and
  recall@5 on 30 seen example intents and 10 unseen paraphrases.
- **A conversion between two structured files is the identity over the parsed records.**
  « convert ./fleet/mileage.csv (columns vehicle, driver, km) into ./out/mileage.json, a JSON
  array with one object per row using the column names as keys, same row order » (sealed
  sv3-14): the reader recognized nothing and the seat parsed the CSV with a model. The
  reader now reads the conversion family (a conversion head, two structured files of two
  formats): a read, the identity rule over the records, a write in the destination's format,
  no language step; the merge turns a seat's extract or draft that names the conversion
  between such a read and such a write into that computation.
- **The copy family and a written object clitic at the deterministic door.** « Copy
  ./a.txt as is, byte for byte, to ./out/b.txt », « copie ./a.txt tel quel, octet pour octet,
  dans ./out/b.txt » (six languages) compile READY as a read of the source and a write of
  what was read, no language step, no model; « Lis ./a.txt et écris-le tel quel dans … »,
  « escríbelo tal cual en … » write the material read instead of drafting « -le tel quel ».
  Measured on sealed-v3: a byte copy read as a draft, asking a model and the output path.
- **Duplicates by stated key columns are a typed stage of the computation.** Sealed sv3-02
  (« vire les entrées qui ont le meme titre ET le meme artiste qu'une entrée précédente (garde
  la 1ere), garde l'ordre ») never compiled on any lane: the seat's typed computation could
  not say the key (the shape knew whole-row duplicates only), the write had no producer and
  the order constraint no carrier. The shape gains `distinct_by`, lowered right after the
  filter as a reduce that keeps the first occurrence in place with every column, recorded and
  replayed; the seat's instruction and schema name it, and a key is admitted only when the
  request names the column. A constraint that keeps the row order (« garde l'ordre », « keep
  the order », « mismo orden », six languages) is carried by the compute task, which keeps the
  source order by construction.
- **Opt into one bounded authoring call with `nika compile --authoring-model`.**
  An injected kernel provider proposes a closed private semantic plan; the
  deterministic motif assembler owns source, bindings, authority and Check.
  Stable clarification answers resume the authoring loop without hidden state.
  Default Compile and Serve stay deterministic, and exact skeletons and EDIT
  never call a model. Provider attempts use an explicit generation-2 usage
  receipt; generation-1 byte shape stays unchanged. Invalid plans, recognized
  effect omissions and unsupported requests fail closed. The finite EN/FR
  backstop does not prove arbitrary-language preservation or model completeness.
- **One compiler, three internal resolutions.** `nika compile` now reads a free intent through a deterministic EN/FR clause reader (HOT: zero seat calls when every clause is consumed), settles a small finite ambiguity through an explicitly seated bounded-decision capability (WARM: `--decision-model typesafe/<jev>` through System One, or any `provider/name` constrained to a closed enum with `none`), and otherwise asks the one explicitly authorized generative call for a private semantic plan (COLD: `--authoring-model`). All three end in the same deterministic assembler and the same Check: lookups, searches, fetches, extraction, classification, drafting, code rules, dedup state, bounded retries, revision rechecks, local file reads and writes, and external effects reached only through an explicit endpoint answer, a blocking human gate when asked, never when prohibited, a question when undecided, a refusal when contradictory. The machine document gains additive `provenance.strategy`, `provenance.plan` and `provenance.decision`.
- **A line filter over a text source is a computation the compiler writes.** « extrais
  toutes les lignes de titre markdown (celles qui commencent par un ou plusieurs #), telles
  quelles, dans l'ordre, une par ligne → ./out/titres.txt », « keep only the lines
  containing ERROR », « las líneas que terminan en ; »: the lines kept are those whose text
  starts with, contains or ends with a stated literal (six languages), a rule that runs over
  the lines of the source and writes them back as they are, in order — no model reads the
  file. The reader also reads a clause led by its source (« ./rando/guide.md : … »), an
  arrow as a destination, and a line filter as the object of an extract or of a write; a
  seat's `extract` over such a clause becomes the computation, and a draft over nothing but
  the destination and a structure law is folded. Measured on the sealed lane: two model calls
  where the corpus expects zero.
- **An automatic money movement is one closed choice, never the catch-all clarification.**
  A refund, a payment or an order the request states without a human approval before it
  asks `effect.<verb>.approval` (`human_first`: a person approves each one in a blocking
  gate; `forbidden`: the workflow never runs it and the work before it still runs), on the
  deterministic path and under a seat alike; the answer sets the effect's policy at
  assembly while the recorded plan stays as it was read. The composer no longer judges such
  a candidate infeasible, and the backstop no longer files it as unknown work. Measured on
  eco-60 with gpt-5-mini: 5 of 60 requests ended in `intent.clarification` on that law.
- **The deterministic door reads the stages of a computation stated in a sentence.** A
  rename (« rename the country column to region », « renomme la colonne country en
  region », six languages) lowers to `with_entries`; a grouped total behind a computation
  head (« compute the total of the amount column per client ») is read by the closed grammar
  instead of failing the explicit-object law; a filter followed by a sort in one sentence
  (« keep only the rows whose status is open, sort them by priority ») is cut at the stage
  and read as one computation; a keep-family opener (« keep only … », « conserva solo … »)
  is a computation when the grammar reads it whole and a constraint otherwise; a bare path
  after « write » is the destination of what a computation produced; the Spanish plural
  write heads (« escríbelas ») split their clause. Season 2's wave 32, ported onto main's
  reader; what the grammar cannot read (« count the open tickets ») still asks.
- **Compose bounded support workflows with explicit policy and bindings.**
  EN/FR whole clauses build ordinary source from a private typed plan and reusable
  motifs, then run existing Check. Optional refunds need explicit endpoint and
  literal policy, a blocking human gate, and approval of the exact minimal POST
  payload. Original facts remain separate from generated drafts. Missing lookup
  records and invalid refund proposals fail without invented recovery. Exact
  skeletons and source-preserving EDIT remain unchanged. This deterministic
  development grammar does not qualify arbitrary natural-language understanding.
- **The closed grammar reads « top five issues by rating, highest first, same columns ».** A
  number word counts as a count (five, cinq, fünf), the entity the rows are (issues, clients,
  corredores) stands where a row noun stood when a measure follows, « first » after a rank
  word is a filler, and an identity tail (« same columns », « mêmes colonnes ») closes the
  stage instead of refusing it. Measured on sealed-v3 (sv3-16): the deterministic door had
  asked a jq expression for a five-row ranking the request states whole.
- **A schedule's binding values are asked beside the candidate, as choices.** A request that
  states a cadence (« every weekday at 8, … ») now carries four optional questions next to
  `requested_trigger`: `trigger.timezone` (text), `trigger.missed` and `trigger.overlap`
  (closed choices spelled by the project and cadence grammars: `rattraper` ·
  `rattraper-une-fois` · `sauter`; `sauter` · `file` · `remplacer`) and `trigger.ceiling`
  (a positive number, USD). They never block a ready candidate; an answer is admitted against
  the grammar's spellings and echoed on `requested_trigger` (`timezone` · `missed` ·
  `overlap` · `ceiling`), a wrong one is a finding and the question stays. The wire gains
  `"type": "choice"` with `options: [{key, label}]` on such questions, and
  `provenance.suggested_file` (a kebab file name for whoever saves the candidate). Ten
  contract fixtures under `crates/nika-compile/tests/fixtures/contract/` record the
  document of each supported state; a test refuses any drift from the live wire.
- **A computation the typed stages cannot state is a program the seat writes and the compiler
  verifies, never a jq question to a human.** Fifteen of sixty sealed seeds on the best lane
  asked `const.rule_expression` for a set difference, a self-join or a string rewrite that jq
  expresses. For each such compute step (at most two per request) one bounded call asks the
  seat for the program, the columns it reads, an example input and the output it expects; the
  compiler runs the program in-process with the runtime's own jq stack and capability policy
  (the same withheld symbols as `nika:jq`), refuses a program that does not parse, reads an
  undeclared column, carries a literal or a number the request never wrote, or does not return
  the seat's own expected output on its own example, and binds the rest as a rule that runs as
  the compute task behind the same guard and admit as a typed rule, visible at the task,
  recorded and replayed with zero calls. A refused program is recorded with its counterexample
  and leaves the assembler's own question. Experimental treatment B of the compiler's A/B/C
  comparison; the compile wire is unchanged (the sample record gains `transforms`, the recorded
  rule may carry `program`).
- **Compile composes a finite candidate set and judges it before any seat.**
  After COLD sampling, the private composer turns the distinct admissible
  plans into at most eight candidates and runs a deterministic feasibility
  filter against the reading's floor and the request text: every element
  anchored, no unresolved work, every recognized operation, effect and
  obligation kept, a human gate never removed, a prohibition, indecision or
  contradiction never resolved by a model, money never moved automatically,
  and every literal carried verbatim with none invented. Exactly one
  feasible candidate is used with zero seat calls; several with a seat is one
  closed choice over the feasible candidates (each described by its signature
  and what differs) or `none`; several without a seat is the documented
  support-weighted medoid with ties to the first; none is a human question
  that names each reason. An infeasible candidate is recorded, never offered.
  The machine document gains the additive `provenance.decision.candidates`
  (index, source, signature, feasibility, reasons, plan), `feasible_count`,
  `selected_candidate` and `compose.pattern_dimensions`: the fan-out and
  fan-in dimensions the recalled candidates suggest are recorded as
  inexpressible today, because the assembler emits one linear chain per
  invocation and no variant nobody can assemble is composed.
- **A compute step is stated as a typed computation, never as jq the model
  writes.** The proposal states a row filter (clauses, keep/drop polarity,
  junction), a group column with aggregates (sum, count, avg, min, max) under
  the output names the request states and the decimals it rounds to, derived
  outputs (arithmetic over other outputs), a sort and a projection. The compiler
  validates every column, literal and output name against the request and lowers
  the stages in one fixed order to jq; the guard still proves every source column
  on the first record. A CSV written from a grouped or projected computation
  carries the produced columns; totals are exposed one by one as the outputs the
  request named. The closed rule grammar stays as a fallback only.
- **The outcome states a trigger requirement beside the candidate (nika#1720).**
  A request that opens with a cadence ("every morning", "tous les matins",
  "at 9:00") or an outside event ("when Stripe sends payment_succeeded", "dès
  qu'un ticket arrive") compiled to a program that ran once per invocation and
  said nothing about the clause. `CompileOutcome.requested_trigger` (wire:
  `requested_trigger`, nullable, `compile_version` unchanged) now carries
  `{kind: schedule|webhook|event, source_hint, event_hint, payload_input,
  status: requires_binding}`; the program bytes stay trigger-agnostic (no
  cadence, hook id or secret), binding is the operator's or the product's
  gesture through the schedule contract, and the obligation ledger records the
  clause as a `trigger` duty realized by that requirement. A distributive
  trigger ("for each row") and a sequencing head ("once all three are done")
  state no requirement: the structure carries them.
- **A stated cadence is a trigger requirement beside the candidate.**
  « Every morning at 9, read ./inbox/*.md and write a digest to ./digest.md »
  no longer drops its first clause into a Ready: the trigger is deployment,
  not workflow, so the candidate's bytes stay trigger-agnostic and the
  outcome carries `requested_trigger` next to `requested_boundary` (`kind`
  manual · schedule · webhook · event, the phrase verbatim, the cadence and
  time of day the words state in five languages, the payload input an event
  supplies, `status: requires_binding`), projected on the wire and the Serve
  schema and named in an `Applied` diagnostic for whoever binds it through a
  schedule or an ingress. A phrase with neither a cadence word nor a time of
  day is an event, never a guessed cron.
- **`nika check` hints a tight `max_tokens` on a reasoning seat.** A legal
  cap between 256 and 4096 on a catalog-known reasoning seat (the envelope's
  model, a task's, a templated seat's default, or a `--model` override) is
  named before a paid call as the `reasoning-cap` hint with its
  `nika explain` row: a hint, never a refusal, silent when the author
  declared a `thinking` budget or disabled it, when the floor already
  refuses the cap, or when the seat does not reason.
- **A stated bound on the drafted text is verified at run, not only prompted.**
  "3 bullets", "12 lignes max", "under 150 words", "genau 5 Zeilen" reached the
  language step as prompt guidance and nothing checked the result. The bounds a
  request states on a measurable unit of the text (lines, bullets, words,
  sentences, characters, paragraphs; six languages; exact, minimum, maximum,
  strict) now lower to a jq law over the drafted body (`draft_bounds`) and an
  assert (`draft_bounds_admit`) the write waits for, and the obligation ledger
  records each such duty as realized by that law ("verified at run"). A bound
  on a unit nothing measures at run (a page, a token) stays prompt guidance and
  the ledger says so.
- **A classification of each record routes the records.** « Read
  ./tickets.json, classify each ticket as bug or feature, and write the bugs
  to ./bugs.json and the features to ./features.json » runs the classify per
  parsed record with one record in its prompt, and each write carries the
  records routed to the category its clause names (a jq over records and
  categories, never the bare category word); « write the results to
  ./out.json » carries every record with its category. One write naming two
  files (« write them to ./bugs.json and ./features.json ») is one write per
  destination, the later path sharing the earlier object, the category read
  from the clause's prose with the paths stripped, then from the file's own
  stem. A draft asked as bullets or points is laid out one per line.
- **A combined brief, a field list per file and a translation compile as
  asked.** « write the combined brief » after a draft refers back to the
  pieces the draft produced instead of demanding a second draft; « extract
  the supplier, the date and the amount of each one » is an explicit field
  list that runs per read item, is judged by a per-item anchor law and
  folds into one object per item keyed by the field names; a draft led by a
  translation head (translate, traduis, traduce, traduci, traduza,
  übersetze) is admitted by a nonempty body since no translated sentence
  can anchor verbatim in its source.
- **A context sentence and a structure law bind no operation.** « Le fichier
  ./x.csv contient les colonnes a,b,c », « which has the columns … », « both
  requirements are checked on the produced file » describe the material; « nothing
  else », « rien d'autre », « nada mais », « sonst nix », « nessun altro file »,
  « no language model », « a single HTTP request, not one per fine » bound the
  shape of the workflow. Both were read as format duties that needed an operation
  to carry them, so a read→transform→write request ended INCOMPLETE or in the
  catch-all question. The obligation ledger now records a `context` duty realized
  by the material itself and a `structure` duty realized by the emitted shape: a
  closure and « no other file » hold by construction, « no language model » holds
  only when no step infers, « a single request » only when exactly one outbound
  effect is sent once; a law the shape breaks stays unresolved and the candidate
  is not READY, with the reason named. The closure and « no model » markers are
  read in six languages by the deterministic door as well.
- **A facet of a fetched page is the fetch's own mode, never a draft.**
  « Fetch https://example.com/ and write the page title to ./title.txt »,
  « save the article text to ./page.md » and « écris le titre de la page
  dans ./titre.txt » compile with no model: after a fetch, an object made of
  page words, facet words and links names a facet of the fetched page, and
  each facet is one extract mode of `nika:fetch` (`metadata` for the title
  and the description, `article`, `text`, `markdown`, `raw`, `links`); the
  assembler fetches in the modes the writes need, `permits.net.http` is the
  fetched host and nothing else, and a page with no title fails the write
  loudly rather than writing a guess. `save` and `store` join the English
  write heads.
- **A gate naming the action gates the stated endpoint effect.** « Read
  ./report.md and post it to https://hooks.example.com/notify, but ask me
  before sending » is one gated post, not a post plus a phantom `send` that
  asked for a URL the sentence already stated: send, publish and notify are
  one family, and a gate phrase naming the action by its verb alone gates
  the kindred effect that has a destination, in either order. An endpoint
  effect whose object refers back to material the plan holds is a carry
  (`nika:notify` on the `webhook` channel with the nearest text result as
  its message), dominated when gated by a `nika:prompt` review that shows
  the exact content and endpoint; a cleartext endpoint that is not loopback
  is refused under the effect's own question.
- **Italian and Spanish clauses are read without a seat.** « Leggi
  ./notes/brief.md, scrivi un riassunto in 3 punti e salvalo in
  ./out/riassunto.md » and its Spanish twin compile on the deterministic
  door: closed Italian and Spanish head tables with their imperatives,
  infinitives and clitic forms (`salvalo`, `guárdalo`, `léelo`) as words of
  the table, ` e `/` ed `/` y ` as weak connectors and ` poi `/` luego ` as
  strong ones, the IT/ES articles, fillers, retrieval cues, number words,
  bound words, gate and prohibition markers. A save head with a path and a
  destination is the write it names; a locative (`in`, `en`, `nel`, `su`)
  is a destination only when the path follows it immediately. `resume` is
  deliberately absent from the Spanish table.
- **Native authoring reads the engine's output conventions.** The native and sketch system
  messages now carry an engine-owned section after the spec's card
  (`crates/nika-compile/assets/native_output_conventions.md`). A text file is lines that each
  end with a newline, read with the assembler's own `LINES` law and written back with
  `join("\n") + "\n"`. A shape the request names is the shape written: « la liste des
  <champs> » or "only <field>" is an array of values, and « par <clé> » or "per <key>" is one
  object keyed by each value, unless the request names another shape. An unnamed shape stays
  the source's, and the seat states its choice in `notes`. Receipts name the digest
  (`identity.conventions_sha256`).
- **The text of a read is not records (fidelity Law 23).** A candidate whose `nika:jq`
  receives the untouched text of a single text-mode `nika:read` and applies a record operation
  first was admitted by Check and failed at Run with NIKA-BUILTIN-JQ-001. Examples are `.[]`,
  `.[0]`, `.field`, `map(…)`, `select(.field …)`, `group_by(…)`, `keys`, `add` and `first`; each
  listed form was measured to fail on a string. It is now refused before READY as RAW TEXT AS
  RECORDS, with the repair: `fromjson` first, or `nika:convert` for a CSV. The law is narrow on
  purpose: string operations, a parse first, `try`, `?`, `//`, fanned-out reads, binary reads
  and any unknown form are left alone.
- **A stated data shape is the code the workflow runs.** « count the rows
  per client », « merge them on the id column », « remove the duplicate
  lines and write the unique ones », « keep the 2 rows with the highest
  amount », « sort the rows by amount descending », « trie les lignes par
  montant décroissant » and « keep only the id and title of each ticket »
  compile on the deterministic door with no model: a closed grammar of the
  stated stages (a count or an aggregate per column, a sort with its key
  and direction, a top-N with its measure, a projection of listed fields, a
  removal of duplicates, a join of the read sources on one column) lowers
  into one typed shape, a headless clause the grammar reads whole is a
  compute step carrying its rule, a sort on a source column compares the
  number a CSV cell holds, a removal of duplicates over a text file runs
  over its lines, and an exclusion lead (« exclude », « drop », « supprime
  … ») is read as nothing, never inverted. A form that lacks its key, its
  measure or its column is asked, nothing is guessed.
- **A stated filter or aggregate is the code the workflow runs.** « keep
  only the tickets whose status is open », « compute the total of the
  amount column », « la moyenne de la colonne montant » and the French
  restriction « ne garde que les lignes dont amount dépasse 200 » compile on
  the deterministic door with zero questions and zero seat calls: every
  constraint the closed rule grammar reads whole becomes a compute step
  carrying its parsed rule, one stated aggregate over a column lowers into
  the shape after the filter, and the jq is visible on the task and recorded
  in the provenance. A prohibition (« never keep closed tickets », « ne
  garde pas … ») stays prose and is asked, never run as its complement; a
  cue inside a parsed rule is a literal the predicate compares, never a
  verb.
- **A stated folder or file inside an object is the material it reads.**
  « fais-moi un digest des notes dans ./notes et écris-le dans ./digest.md »
  and « Traduis ./notes/brief.md en anglais et écris la traduction dans
  ./out/brief-en.md » compile on the deterministic door: a make head
  (`fais-moi`, `fammi`, `hazme`) drafts only when its object opens with a
  produced-content noun; a local path inside the object of a draft, extract,
  classify, validate or compute is the material the operation consumes when
  it is not a destination, so a read step of that path is emitted and no
  phantom `inputs.item` is declared; a folder is read as every file directly
  under it (`./notes` → `./notes/*`), baked into the candidate where the
  human sees and may edit it.
- **A key rename and a row limit are typed stages of the computation, and a ranking without
  its count asks for it.** « rename item to product », « the top 3 by units », « les 5 plus
  vendus » had no typed form: the seat fell back to a language-model draft that kept the
  old keys or invented rows (sealed v2 key-rename and ranking seeds), and « die
  meistverkauften Artikel » with no count compiled to a full descending sort. The typed
  computation now carries `renames` (a source column to a name the request states, lowered
  as `with_entries`) and `limit` (a number the request states, as digits or as a word,
  lowered as `.[:N]` after the sort); a descending sort under a ranking word with no count
  asks `const.top_n` instead of assuming one, and the answer bounds the sort. A renamed
  header is never overwritten by the source's column order.
- **Document the qualified conversational delivery A scope.** Record installed CSV, DeepSeek summary, revision/recovery, Jev and variant journeys with output oracles and bounded cost evidence. New Run-scoped history is readable by this candidate but not older executables; downgrade and gate behavior are documented in `docs/qa/delivery-a-2026-09.md`.
- **The transport's account of a call is stamped on the frame and read by
  the peek.** A seat that answered only after the bounded backoff is
  readable in the sealed trace: `task_completed` carries `attempts` whenever
  a wire call happened, and `waited_ms` and `retried_on` only when the
  transport re-sent (a first-time answer reads `attempts: 1` and nothing
  else; a harness seat or an agent loop reports no transport and gets no
  field). `nika trace peek` folds the three fields into the task row
  (« 2 attempts (waited 2.0s on 429) »); one attempt says nothing, and a
  frame from an older engine renders exactly as before.
- **A revised proposal says what the words changed in meaning.** When a
  change said at the consent prompt settles into a new proposal, the
  compiler's ledger of the revised reading is read against the base
  reading's, clause by clause (a clause is its kind and its evidence): the
  clauses the words added (« + « Tuesday to Friday » · external
  requirement »), the ones no longer asked (« − « every weekday » »), the
  ones whose fate changed (« ~ « a short brief » · needs your answer →
  represented »), and how many were kept as they were — in the Meaning
  view's own words, never a score. « Nothing changed in what the compiler
  read » is said when the words changed nothing the compiler reads.
- **Consult an explicitly selected decision model from Session.** The compiler can
  use the shared TypeSafe adapter for finite operation choices, including NONE.
  Calls remain bounded and their unknown cost is recorded separately; a numeric
  allowance never silently admits this unpriced service.
- **`/details` — how the last workflow was built, on demand.** The third
  level of disclosure, never in the ordinary conversation: the authoring
  backend and model with its calls, tokens and time (or « none: the
  deterministic reading »), the strategy, the decision route and seat, the
  ledger's size, the engine and spec identity, the last run's trace — read
  from the compiler's own provenance, and said to be no proof (`/proof`
  judges a run, `/meaning` shows what was kept).
- **A run asks the declared inputs it needs before it runs.** In the native
  session, « run it » on a workflow that declares a required input with no
  default no longer dies at launch (NIKA-1708): each such value is asked on
  its own `reply ›` line (key `input.<name>`), a `name=value` written on the
  run line is honoured, the values are bound as `--var` pairs, and only then
  is the run requested. `cancel` drops the request, an empty line is not a
  value, and the pending input is its own state, never an authoring answer
  nor a consent.
- **The lifecycle rail.** The terminal session keeps a rail on the row above
  the status — « Draft ✓ · Saved ✓ · Checked ✓ · Active ○ · Run ○ » —
  compiled from the session's own facts at every turn: the proposal that
  waits, the workflow saved at consent and its check (clean, or findings),
  the schedule declared in `nika.yaml` (declared ◐ is never active;
  suspended ⏸), the gate that waits, the last run (done, failed, refused,
  paused). Five facts, never one badge: saved is not run, declared is not
  active. The plain door's words already carry them (« Saved · checked ·
  not active · nothing has run »).
- **The routing corpus under a real seat (the Arena seam).** An ignored
  live test routes a JSONL corpus (`NIKA_ROUTING_CORPUS`: id · state ·
  line · expected · optional automation and last prompt · milestone rows)
  through the real `ReasonerClassifier` over `NIKA_ROUTING_MODEL`, prints
  one receipt line per row and writes them to `NIKA_ROUTING_RECEIPT`; the
  routing milestone rows must route exactly, the rest is measured. The
  corpus is authored beside the lane (45 rows · EN/FR/ES · typos · mixed
  lines · gate and question phases).
- **The renderer shows work is active before a turn runs (`nika --tui`).**
  A turn is synchronous, so the busy state is drawn before it starts, with
  the conversation's own name for the work (« working through your words »,
  « landing the exact bytes and checking them », « answering the gate »,
  « seating the intelligence you chose »), and the turn's first word clears
  it; a slash command draws none. `/help` is answered by the engine inside
  the viewport, proven on the real binary through a PTY.
- **`nika --tui`: the session behind the terminal renderer (ADR-139 · UX-2).**
  On an interactive terminal, `nika --tui` opens the same native session as
  bare `nika` (the same census and kept intelligence choice, the same
  history, the same runtime) behind the inline viewport: every outcome of a
  turn maps to the renderer's typed beats one to one, the composer's line
  goes to the choice, the consent, the gate or the turn by the state the
  plain loop reads, the first screen is asked through the composer with the
  census's own law. A run keeps the plain path: the shell hands the terminal
  back, `nika run` prints below the viewport as it always has, the
  observation returns into the viewport with a fresh inline anchor. The loop
  is synchronous by design (the run path builds its own executor; one cannot
  start inside another). Proven on the real binary through a PTY: a French
  sentence becomes a proposal, `oui` lands the exact bytes and the real check
  runs, « run it » produces the file, the observation is committed above the
  composer, `/quit` restores the terminal; `--tui` on a pipe keeps the
  concierge and writes no escape sequence. Bare `nika` and its goldens are
  untouched.
- **The terminal renderer proof (ADR-139 · UX-1 · `nika-tui`).** The
  session's future face joins the workspace as a WIP L4 crate: one owner of
  the terminal (raw mode, bracketed paste, focus events, the probed keyboard
  protocol and the alternate screen enabled in one fixed order and restored
  in reverse from one place, the panic hook restoring BEFORE the message
  prints), an inline-first presentation whose finished blocks go into the
  terminal's own scrollback through `insert_before` with scrolling regions
  (history stays copyable, tmux and SSH stay ordinary), a focus presentation
  on the alternate screen entered with `Ctrl+T` and left with `Esc` and the
  draft intact, one event broker paused around every cursor-position query,
  and a composer (`ratatui-textarea` behind a wrapper) where `Enter` sends,
  `Alt+Enter` breaks a line, a bracketed paste is data (a pasted `yes` or
  `/quit` acts on nothing) and history recalls only at the buffer's edges.
  The `nika-tui-proto` binary drives the shell over a canned conversation
  in both presentations; the PTY suite proves the terminal is restored on
  the normal close, two `Ctrl+C`, a panic inside the loop and `SIGTERM`,
  and that a pipe is refused with exit 2 and no escape sequence. Bare
  `nika` is untouched: the plain line loop and its goldens stay byte for
  byte until the next wave wires the session through the same typed beats.

### Changed

- **The seat is told what a draft is not and what a confirmation is.** A draft is language
  work: never a draft to prepare, format, serialize or write the rows a compute step
  produces (they are written as they are); a confirmation the requester asks before an
  effect is that effect's `human_first` policy, never a `revision_check` obligation.
- **A seat's `unknowns` are unmapped meaning, never the values the compiler asks itself.**
  The authoring instruction now says so: connection details, credentials, endpoints,
  locations, field names, formats, thresholds, criteria and open policies are the
  compiler's own typed questions or bindings outside the program, and an effect the
  requester leaves undecided is an effect with policy `unspecified`. Measured on eco-60
  with gpt-5-mini before the change: 29 of 52 proposals ended in the catch-all
  `intent.clarification` because the seat listed such values as unresolved work.
- **Resolve exact support clauses before any authoring call.** With
  `--authoring-model`, an intent the bounded EN/FR grammar resolves is
  assembled deterministically with zero provider calls and keeps wire
  generation 1; the opted-in provider interprets only what the grammar
  cannot.
- **`nika-compile` (ADR-137).** The stateless Compile core descends from
  `nika-onboard` at the 15k prod-LOC wall as the second member of the same unit
  (D-2026-07-09-N1). `nika-onboard` re-exports it at its historical
  `nika_onboard::compile` path; no caller, plan or provenance format changes.
- **`nika-compile-reader` (ADR-138).** The frozen deterministic reader and the
  typed plan it produces descend from `nika-compile` at the 15k prod-LOC wall as
  the third member of the `nika-onboard` unit (D-2026-07-09-N1). `nika-compile`
  reads them at their historical module paths and keeps its whole public
  surface; no caller, plan or provenance format changes.
- **`nika-compile-cognition` (ADR-140).** Seat authoring ascends to its own member;
  deterministic compilation and native record replay stay in core. Existing explicit
  imports through `nika_onboard::compile` remain available. Direct
  `nika_compile::{Cognition, NoProvider, compile_with_cognition, compile_with_provider, decide}`
  imports must move to `nika_compile_cognition` or the onboarding facade. Core adds the
  public `surface` module, mutable request and authoring-policy fields, and receipt/retrieval
  constructors. The extraction introduces no new Compile wire generation or SDK options.
- **`nika-compile-fidelity` (ADR-141).** The laws a candidate document is judged by, the
  seat's sketch and the plan a candidate states ascend from `nika-compile-reader` at the 15k
  prod-LOC wall as a member of the `nika-onboard` unit (D-2026-07-09-N1). `nika-compile` reads
  them through the shared compiler unit, and the reader depends on `serde_json` alone
  again. Direct Rust users must move `nika_compile_reader::{candidate, fidelity, sketch}`
  imports to `nika_compile_fidelity`. Existing `nika_onboard::compile` entry points and
  the Compile machine wire remain available; the move introduces no new wire generation.
- **One gesture: bare `nika` opens the renderer.** On a real terminal
  `nika` now opens the session behind the inline viewport, as the agent
  CLIs a human already knows do; the `--tui` flag is gone. The plain
  line loop stays one gesture away for flat text (`nika --plain`, or
  `NIKA_TUI=0` in the environment: a screen reader, a recorder, a
  harness), and it remains the automatic fallback when the renderer
  cannot take the terminal (`TERM=dumb`, a terminal that never answers
  the cursor report), said once on stderr. A pipe still gets the
  deterministic concierge.
- **Save ≠ Check ≠ Run ≠ Activate, and « activate » declares a schedule
  only through the human's gestures.** After a yes the session says
  « Saved · checked · not active · nothing has run » and names the two
  distinct next lines: « run it » (one run, a ceiling announced first) and,
  when the request asked for a schedule, « activate ». Activating asks the
  three values a sentence rarely states, one line each with the consequence
  of the answer (the IANA time zone the cadence follows · what « missed »
  means: run once when back, skip, replay every one · the ceiling per
  scheduled run), then proposes the declaration as a project change —
  the `arm:` entry `nika.yaml` gains (`cadence: "TZ=<zone> <cron>"`,
  `plafond`, `manqué`), the file created when absent, appended when it has
  no `arm:` list, printed for the human otherwise — validated by the
  cadence grammar before it is shown, written by a yes and never by an
  answer. Declared is not active: the report and the status line say a
  firer must run on this machine (`nika serve`, or the OS unit `nika arm
  --emit launchd --write`) and that only `nika arm` proves what fired.
- **The session's authoring budget is the compiler's own ceiling.** One
  seated authoring call may spend 8192 output tokens and 120 seconds, the
  bounds the compiler itself accepts, so deep work has room; a budget that
  ends early is told as such, apart from a provider failure, a semantic
  incomplete and a policy refusal.
- **A question explains itself and holds; a failure leaves the goal
  intact.** Beside an authoring question or a run's gate, `why?` (or
  `pourquoi ?`) answers from the machine's own state — what the value is
  for, which hole it fills, what the gate would let happen — and the
  question or gate keeps waiting (`TurnOutcome::Aside`); the raw key no
  longer prints at the prompt (it is in the explanation). When the
  authoring model or the conversational intelligence does not answer, the
  session prints a recovery card — what happened, what it still has (the
  request, the answers given, the last decisions), that nothing was
  written or sent, the three ways on — and « what happened? » (« de quoi ? »)
  repeats that card from memory, never through another call.
- **Bare `nika` authors through the ONE compiler; a reply never becomes a
  file.** In the native session, a line that describes work reaches the
  canonical typed Compile CREATE: the deterministic ladder first (zero
  calls), then one explicitly permitted call on the model the human chose
  with `/intelligence` (an API or a local engine; a harness seat or no
  intelligence keeps authoring deterministic — ambient keys are never
  consent). A typed compiler question owns the next line (`reply ›`), the
  answer is typed to the question's shape and bound to its key, and the
  compiler's own continuation is replayed on every answer round (zero
  provider calls). A Ready candidate is reviewed from the engine's facts
  (the parser's task list, the requested boundary, the check facade) and
  proposed as exact bytes at a fresh destination (`<id>.nika`, a numbered
  twin when the name is taken, never over a link); `yes` lands those bytes,
  the real check follows, and consent is never a run: an explicit `run …`
  line runs the accepted workflow (or one named) through the same path as
  `nika run`, only when its check on disk is clean; a paused run asks the
  human and the same run resumes. Each pending state gives a `yes` exactly
  one meaning (an authoring answer · a consent · a gate answer). A bare
  greeting is the conversation's, not the `hello` lesson. The route where
  a reasoner's fenced YAML became a proposal is retired, with
  `ProjectChangeSet::from_reply` and the prose splitter; the typed set is
  now built by `ProjectChangeSet::workflow_at`, which witnesses the
  destination with the no-follow primitive the write uses. The door prints
  one truthful line while the compiler works under a seat; an exhausted
  authoring budget, a provider failure, a semantic incomplete and a policy
  refusal are four distinct sentences. A product e2e on a real PTY proves
  the organs are connected: French copy intent → review → consent → check →
  explicit run → artefact (the landed bytes are the compiler's candidate);
  a fan-out over a folder; a gated run answered on the terminal whose
  effect happens exactly once.
- **Bare `nika` opens on the human's question, and asks for an intelligence
  only when a turn needs one.** The session no longer stops at a first
  screen before any value: it opens on « What do you want to automate? »,
  the engine's facts and the deterministic compiler answer with no choice
  made, and the first line only an intelligence can answer (a conversation,
  or work the reader cannot settle alone) asks the first screen in context,
  names why, keeps that line and resumes it exactly as typed once the choice
  is made (`TurnOutcome::Resumed`); a typo keeps the request waiting and
  `cancel` continues without a choice. The banner's engine facts (root,
  intelligence and where the context goes, authoring seat) move to
  `/status`; an explicit choice this machine cannot serve stays the one
  warning on the banner. Same law in the plain loop and behind `nika --tui`;
  a pipe keeps the concierge.
- **Open language is routed by one typed decision, never a word list.**
  Whatever the human types that is not a closed protocol token (`yes`
  `no` `cancel` `why` `/quit`…) is open language: the typed session state
  (idle · a proposal waits · a question waits · a gate waits) and the RAW
  line go to one bounded classifier (`turn::TurnClassifier` — a door's
  decision seat, else the session's own intelligence answering one label,
  else the conservative fallback) that says which act it is: DISCUSS ·
  MODIFY · NEW_WORK · ANSWER · REQUEST_RUN · MIXED · UNKNOWN. The runtime
  acts on the act with the human's own words: « does it write anything »
  and « can you explain what it writes? » are answered with the proposal
  held; « actually write it to ./out/copie-2.md instead », « what I
  actually want is ./out/final.md » and « can you write it to
  ./out/final.md instead? » revise it; « run it, but only on Fridays » is
  a change before any run, never a run; « yes but change the file first »
  is MIXED, never a consent; a change said at a gate is refused with the
  way on (answer `no`, then say the change). A classification never
  grants a consent: authority stays with the closed tokens and the typed
  state. Without any intelligence the route is UNKNOWN and the automation
  is kept unchanged, said in words with the protocol forms. Every route is
  recorded (the phase, the act, the method, the line's hash) for
  `/details`. The multilingual word lists that guessed « a change » or
  « a question » are gone: a new phrasing needs no new dictionary entry.
- **The result, the gate and `/proof` read the run's own trace.** After a
  run the session leads with what the frames prove — « Done · `x.nika` ·
  49 ms · 3 tasks ran (1 from cache) · nothing sent elsewhere », then one
  line per fact: `produced ·` (the `fs write` permit decision, the file's
  size as it is now), `read ·`, `sent ·` (a `net` decision or a notify
  task), `asked ·` (the model an infer task named), `approved ·` (the
  approval frame, never an inference) and an honest `cost ·` (« nothing
  metered · no model was asked » · a measured total · UNKNOWN when a call
  was unpriced) — the door's observation line stays beneath as the
  remembered fact. A failed run names the task, its detail, what ran
  before it and what never ran. A paused run (exit 4) shows what ran so
  far, the gate's question, what a yes lets happen from the workflow's
  bytes — the control edge `after:` or the data edge the compiler writes
  (`with: { approved: tasks.<gate>.output }`) — and what a no does.
  `/proof` judges the chain through the ONE verify door (`nika trace
  verify`, never a second walker), names the workflow's two identities,
  the boundary the seal covers (declared · exercised · escaped · permit
  checks), the digest of each written file RE-READ as it is now, and says
  what the proof does not cover: that the content is right, or that
  anyone outside this machine trusts the key.
- **The review reads in sections, and Meaning shows what the compiler kept
  of the request.** A proposal now says what the workflow DOES (the tasks,
  first what runs first), when it RUNS (by hand, or the schedule the request
  asked for, which saving never activates), what it CAN TOUCH (what the
  bytes reach, the human gates), what CHANGES on disk, what it still NEEDS,
  and that nothing has run yet; every line has an owner (the parser, the
  check, the change set, the compiler's requirements), none is prose a
  model wrote. `/meaning` (or « what did you understand? ») lists the
  request clause by clause from the compiler's own obligation ledger,
  with each clause's disposition (represented · needs your answer ·
  external requirement · not expressible · refused) and what holds it (a
  task that runs · a human gate · a prompt line, a guideline, not a check ·
  a binding outside the bytes); beside a proposal it holds it, and a missing
  ledger renders « unavailable », never an invented coverage. The renderer
  gains a status row with where the automation stands (« Ready for
  review », « Saved · checked · not active · nothing has run », « Waiting
  for your answer »), compiled from the session's own facts.
- **The conversation speaks in the human's words.** Asked « Tu peux m'aider
  à faire un workflow ? » under an API seat, the session's first answer was
  a questionnaire of Nika fields (« Entrées (`inputs`) … Accès nécessaires
  (`permits`) … jusqu'à ce que le checker soit clean », the morning
  audit's case A1). The identity core the conversational model reasons
  under gains the human-words law: say what Nika will read, produce, write
  or send and the one or two things it still needs; name a Nika field only
  when asked; a first answer is never a questionnaire of fields, and Nika
  compiles the workflow itself once the outcome is clear.
- **The product law: Nika keeps working, a change revises the proposal,
  the root is the working directory.** Three defects the independent
  audit and the mandate named. (1) A request the chosen seat could not
  settle came back as the compiler's own clarification (« Supply a
  complete replacement request… », « rephrase with what to read… »): a
  machine-owned failure shown as the human's problem. The session now
  tries once more with the provider's stronger model (`openai/gpt-5.2` ·
  `xai/grok-4.7` · `deepseek/deepseek-v4-pro` · `mistral-large-latest`;
  « Still working · a stronger model reads it… ») and, when that cannot
  settle it either, says in its own words what stopped it and what helps
  (« Nika cannot express this automation yet — nothing was written · what
  stopped it: … · what helps: say the outcome in one sentence, or split the
  work »). (2) At the consent prompt a sentence that is neither a consent
  nor a question (« actually only Tuesday to Friday and put urgent tickets
  first ») is a CHANGE: the compiler revises the pending candidate through
  its edit door (the base bytes + the change in words), the new proposal
  replaces the old one; when the revision cannot settle, the old proposal
  still waits and the words say so. (3) The session's root was the git
  root when one held the working directory: under a monorepo every
  project shared one context, one history and one workflow walk (the
  audit's leak). The root is the working directory; the git root stays a
  fact beside it.
- **What Nika is doing now, and what just finished, from typed truth.**
  The session's activity is typed (`activity::Activity` · `Phase`:
  understanding · knowledge · authoring · checking · repairing) and comes
  from the machine's own facts — « ✓ understood 6 requirements » from the
  compiler's ledger after the deterministic reading, « ● authoring ·
  openai/gpt-5.2 » at the seat call, « ↻ still working · a stronger model
  reads it » at the escalation, « ● revising with your change » at a
  revision — never a percentage, never a phase read back from prose. The
  plain loop prints the lines as they happen.
- **The composer completes a slash command, the door stays quiet unless
  it has something to say.** `Tab` completes a `/command` from the
  session's own list in the help card's order (one match fills the line,
  several show their candidates in the hint row until the next key);
  `NIKA_REDUCED_MOTION=1` stops the seconds tick of the busy row and the
  bell; a turn longer than five seconds ends with one bell so the human
  who looked away is called back; the terminal's title reads
  `nika · <project>` while the door is open. A line with an accent, an
  emoji and CJK goes through the composer and comes back whole.
- **An interruption is heard while the renderer runs a turn.** A seat
  call that never returned held `nika --tui` until it did: Ctrl+C and
  SIGTERM were queued behind the turn. The turn now runs on a detached
  worker thread (the conversation travels with it and comes back with
  the result) while the shell keeps reading the terminal: one Ctrl+C
  warns in the busy row (« interrupted: the call cannot be recalled ·
  Ctrl+C again leaves now »), a second one or SIGTERM leaves at once
  with the terminal restored and the call left to die with the process;
  keys typed ahead wait for the turn. The busy row counts the seconds
  (« working through your words · 12s · Ctrl+C twice leaves »). The
  plain session keeps the line discipline's own Ctrl+C.
- **`nika --tui` never leaves a dead door: a terminal the renderer cannot
  take gets the plain session.** The renderer's entry is now two steps
  (`app::enter` takes the terminal · `app::run_on` drives it), and the CLI
  decides what a refusal becomes: `TERM=dumb`, or a terminal that never
  answers the cursor-position report the inline viewport anchors on
  (bounded by crossterm's wait), is said once on stderr — « the renderer
  cannot take this terminal (…) · the plain session opens instead » — and
  the same session opens as the plain loop, with everything the renderer
  had enabled restored first. The terminal matrix is proven on a PTY: the
  renderer opens, helps and closes at 60×20, 80×24 and 120×40; a resize
  while a proposal waits re-anchors the viewport and redraws the consent
  prompt; `TERM=dumb` writes no cursor query and no CSI sequence; a mute
  cursor report falls back within the bounded wait.
- **The busy row keeps the finished phase; the title says action required.**
  The renderer's busy row keeps the last completed phase beside the
  current one (« ✓ understood 6 requirements · ● authoring »), the loader
  turning beside the current one only. The terminal's title reads « nika ·
  <project> · action required » while an answer, a consent, a choice or a
  gate waits on the human, and returns to « nika · <project> » once
  resolved (the title stack is pushed once, popped on exit).
- **The busy row's loader turns; the armed row says what a second press
  does first.** While a turn runs the marker beside the busy label turns
  (ten braille frames, the next every 100 ms — the terminal's usual loader,
  never a percentage); it stays the still dot under `NIKA_REDUCED_MOTION`.
  After one `Ctrl+C` the row read « <label> · 12s · interrupted: the call
  cannot be recalled · Ctrl+C again leaves now » and was cut at column 80
  before the promise; it now reads « Ctrl+C again leaves now · the call
  cannot be recalled · <label> · 12s ». The stalled-seat scenario waits a
  few frames and asserts the loader turned.
- **The run shows inside the renderer's viewport.** « run it » in
  `nika --tui` used to hand the terminal back: the plain run path
  printed below the viewport, then the viewport was re-taken (a cursor
  report asked again). The door now runs its own machine lane
  (`nika run --json`) as a child whose pipes never touch the terminal:
  each frame becomes one line of the run's story in the busy row
  (« → read_source · invoke · nika:read », « ✔ read_source · 3 ms ·
  1/2 », « ◇ paused · `approve` asks you »), the story is committed as
  one block when the run settles, then the result view. A human gate
  pauses headless and returns as the gate view with its own prompt; the
  answer resumes through the same lane. A run still in flight when the
  door leaves is ended with SIGTERM (the engine cancels, the trace says
  so), never orphaned. The plain session keeps its own run renderer.

### Fixed

- Apply Run cost admission to the production Serve backend. Named jobs, snapshot
  jobs and resident schedule fires refuse API routes that need a fresh monetary
  review before any model or tool effect. Queued jobs settle as
  `failed` / `admission_refused`; no HTTP review protocol is introduced.


- Preserve the agent replay veto through provider cost observations. A connection
  failure after a completed tool cannot replay the whole task; an observed
  connection failure before any tool remains eligible for the authored retry.


- **Resume judges an access change before monetary review.** A continuation
  that silently switches lanes retains its `NIKA-1807` explanation. An explicit
  access pin names the change, then still faces cost admission; it grants no
  spending authority. Durable approval claims are attached only after the cost
  and budget checks, so a refused continuation leaves that store untouched.

- **An answered rule is the literal program the Check preview compiles.** The morning audit of
  2026-09-22 saw a jq expression asked to a human accepted without validation, `nika check`
  clean, and the run failing: the assembler bound the answer as `${{ const.rule_expression }}`,
  a templated program the static jq compile-check (NIKA-VAR-005) never reads. The answer is now
  the compute task's own literal expression, so a program that does not parse refuses the
  candidate at compile time with the analyzer's one-line reason; the const disappears.
- **A workflow compiled from a fresh intent produces the artefact the intent
  asked for.** A clean-shell gate on seven fresh intents produced zero requested
  artefacts; the defects were the deterministic assembler's, not the model's.
  The corpus is now what the steps consume: a read file, a fetched page or a
  looked-up record is the material, and an incoming `item` input exists only
  when the request is invoked per item or supplies no other material, so a
  file → transform → write workflow no longer declares a phantom required
  `item` nor pastes it into every prompt. Every anchor law (extract and draft)
  checks against that whole corpus instead of `inputs.item` alone, so a
  correct extraction no longer dies on `NIKA-BUILTIN-ASSERT-001`. A path
  literal is one path-shaped token: prose never becomes a constant or a permit,
  a directory asks for a glob (`const.source_glob`) and fans out through
  `nika:glob`, a placeholder asks for the exact files (`const.source_paths`),
  and several explicit files become a bounded `for_each` read (with
  `max_parallel` taken from an "at most N at a time" constraint) folded into
  one document with a heading per file, one permit entry per path, never a
  `;`-joined literal. A verb whose target names a local file (merge … into
  `./out/x.md`) is a write to that file, never an endpoint question. Every
  write effect is its own task bound to the nearest upstream result of its
  kind (a structured target takes data, a prose target takes text), two writes
  to two files stay two effects, a file the request names that nothing writes
  is a question (`effect.write_<stem>.include`), and a write with nothing
  upstream is a finding instead of an invented input. A structured source
  (JSON, CSV, YAML, TOML) is decoded once for code rules, and the
  `const.rule_expression` question names the exact input object the rule
  receives.
- **`--authoring-model` and `--decision-model` ride the provider client.** The CLI seated
  an authoring or decision call on the default fetch client: its 30 s idle-read guard cut
  every buffered cloud call at 30 s whatever `--authoring-timeout` asked (a reasoning seat
  answered 408 after 30 s), and its SSRF floor refused a local seat on `127.0.0.1`. The
  seats now use the runtime's provider client (`nika_runtime::compose::provider_http`, now
  public): the same fixed endpoint allowlist, the transport ceiling above the requested
  timeout, no SSRF floor. A local seat reports its socket's own refusal.
- **Admit bounded authoring runtime consumers.** Admit the two explicit L4 authoring Tokio consumers in the dependency wrapper policy: nika-onboard owns the bounded provider timeout and nika-cli-host owns the opt-in executor. Existing layer bans remain unchanged.
- **A bypass phrase inside a prohibition is a gate, not an approval bypass.** « rien ne doit
  partir sans mon accord », « never send without asking » forbid the effect until the
  approval; a negation or a prohibition before the phrase in its own sentence, in six
  languages, keeps the backstop from refusing the request (sealed-v3 treatment lane: one
  gated seed was refused as reusing an approval it never mentioned).
- **A computed summary carried to a webhook is posted as its JSON text.** The carry law
  already serialized the computed rows, the extracted fields, a validation and the records
  through a `<slug>_text` stage; the compute summary (a count, a total) is one of them.
  Measured on the sealed-v3 lane: a request posting the number of affected tanks checked
  clean and failed at run because `nika:notify` refused a message that was an object.
- **An unknown carried by an element that asks its own question is not unresolved work.**
  « in die übliche Datei schreiben », « sorted by the column we agreed on »: the seat listed the
  words as unknown and the merge filed them as unresolved, handing the request back for a
  rephrase where the corpus expects a typed `const.*` question (sealed sv3-48, sv3-19). A
  write whose target names no file asks its output path; a computation with no rule stated
  asks its jq — the element asks for what it needs. An unknown carried only by a read, or by
  nothing, stays unresolved.
- **Three composer and merge laws measured on eco-60 under gpt-5-mini.** A constraint that
  restates a clause the plan carries elsewhere (the trigger, an obligation's words, an
  effect's own clause) is not a free constraint that needs an operation; the reader's
  `search` and a seat's `lookup` over the same source are one retrieval family; a `write`
  a seat proposes as the twin of a `create` over the same words, naming no file, is that
  create and never a second effect. Three requests had ended in `intent.clarification`
  with their only candidate judged infeasible on those laws. The merge files no constraint that restates a clause the plan carries (the read
  clause listed twice): the ledger had refused READY for it as a silent obligation.
- **A draft of the computed number alone, or one that composes a CSV body, only serializes.**
  « écrivez ce nombre seul dans ./out/fermees.txt » beside the count (sealed sv3-03) and
  « Comporre il contenuto CSV con intestazione esatta … » beside the extracted rows (sv3-37)
  were kept as drafts, and the candidates asked a model where the corpus expects zero calls.
  The serialization-draft law gains the compose and build verbs (six languages) and the
  computed number when the request wants it alone (« seul », « solo », « only »); a number
  beside prose stays a draft.
- **Two laws of the composer and the merge measured on the sealed-v3 treatment lane.** A
  `draft` the reader guessed over a write clause (« write just the number, nothing else, to
  ./out/x.txt ») is accounted for by a candidate that computes and writes in that sentence;
  the written content must still be produced by a step. A `revision_check` a seat proposes
  over a gate phrase (« pídeme confirmación antes de enviar ») is the human gate the effect's
  policy already carries, recorded as applied, never an obligation with nothing to recheck.
- **A proposed constraint that is the gate phrase itself is the gate the effect's policy
  carries.** On sealed lane9 (gpt-5-mini), sv3-03 « Demandez-moi confirmation avant tout
  envoi ; rien ne doit partir sans mon accord. », sv3-13 « Please ask me for confirmation before
  writing the file, I want to approve it first. » and sv3-23 « pero pídeme confirmación antes de
  enviar » each came back as a proposed constraint beside the send or write the reading had
  already gated; the ledger filed it as a format duty, no element carried it, and READY was
  refused for a silent obligation. A constraint that is a named gate, a final gate or a negated
  waiver beside a human-first effect is now folded as that gate.
- **A gate phrase that names sending gates the outbound effects; a waiver is no gate.**
  « Demandez-moi confirmation avant tout envoi ; rien ne doit partir sans mon accord » gated
  the send and then the write, each phrase taking the last automatic effect (sealed sv3-03);
  « Non serve chiedermi conferma. » was read as a gate over the send the request waives
  (sv3-33). A phrase naming sending (six languages) gates the last automatic outbound effect,
  and a phrase restating a gate the send already carries takes nothing else; a waiver opener
  followed by an asking verb or an approval noun is a policy clause that gates nothing — beside
  a contrary prohibition the compiler's bypass judgement still refuses.
- **A language step over the trigger clause, and any step inside a safeguard's words, are
  folded whatever their details name.** On another seat sample of the eco-60 lane (E04A), an
  `extract` of « the callback and record ids from the button's payload » anchored on « bouton
  Slack de validation » was assembled and READY, and a lookup over the revision-check words
  whose detail named the record kept a second element the request never asked (E05B, E09B).
  An event is not material to extract from, and a clause inside a safeguard's words is that
  safeguard; the region discriminator stays for a clause that spans more than the region.
- **A lookup by identifier selects its record in the file the request already reads.**
  « Read ./tickets.json, find ticket 42 and write it to ./ticket-42.json », settled as a
  lookup by a decision seat, asked for a second « directory » (`const.ticket_42_directory`)
  although the read clause locates the material. The lookup now binds the read file, asks
  only which field holds the identifier (`const.ticket_id_field`), reads the file once and
  writes the selected record. In a lookup detail a bare number after a word (« ticket 42 »,
  « order 1002 ») is the identifier; everywhere else a bare number stays a count or a bound.
- **Preserve explicit authoring intent and sampling uncertainty.** Explicit authoring no longer treats absent English/French approval vocabulary as a contradiction. The finite backstop vetoes recognized conflicts or omissions while leaving unfamiliar language to the opted-in model. Per-ticket program semantics are distinguished from durable scheduling, and generation-2 receipts identify omitted sampling parameters with unknown provider defaults. Clarification now explicitly requests a complete replacement intent, so corrected authority does not inherit a stale contradiction.
- **A source the request names is opened, or the candidate is not READY; a destination the
  compiler asks and an hour the trigger binds are not unresolved work.** The morning audit of
  2026-09-22 found « Chaque lundi matin, envoie-moi un récapitulatif des tickets ouverts de
  ./tickets.json » READY through the deterministic door on both lanes: read as one `send` over
  the whole clause, the file was named by the send's own words and never opened, the recap had
  no producer (the producer law exempted every effect whose target contained a file), and the
  candidate posted `{action, target, facts}` to the endpoint. The reader now refuses HOT when a
  path the request states as a source (an occurrence no destination connector introduces) is
  named by no step, read by no rule, fired on by no trigger and refused by no prohibition, and
  the producer law exempts only a target that IS one bare path; the cold merge files such a
  source as unresolved work. A path stated only as a destination (« into a single ./out/x.md »,
  « belongs in ./out/totals.json ») keeps its write laws and its named-output question. The
  same wording under gpt-5-mini, in six languages, ended in a catch-all clarification because
  the seat listed the destination (« Destino y canal para 'envíame' ») and the hour (« Genauer
  Zeitpunkt von 'Montagmorgen' ») as unknowns: an unknown that only names where an outbound
  effect goes is bound by that effect's own endpoint question, and one that names a schedule's
  hour or zone by the trigger's binding questions. Six languages, tested on the seat's own
  wordings.
- **A near-miss citation names the request span.** The seat cited « pregúntame y espere mi
  aprobación » where the request wrote « espera »; the repair call did not fix it and the
  candidate was refused for an unanchored effect (sealed sv3-26). A citation of at least 24
  characters at most two edits away from exactly one span of the request, one of whose ends
  it reproduces, names that span: the request's own words are used, never the seat's. A short
  citation, a farther one or one that could name two spans is still refused.
- **A negated waiver is the gate it denies waiving.** « lis ./draft.md et écris-le dans
  ./final.md, mais pas sans me demander » read « sans me demander » as a waiver and turned the
  write automatic (the clause-drop probe on the fifth-wave binary, one false READY). A waiver
  opener preceded by a negation (« pas sans », « not without », « no sin ») gates the last
  automatic effect of the family the phrase names, as the gate it is.
- **The serialization cue is read on the request's own words, not only on the seat's
  detail.** On sealed lane9 (gpt-5-mini), sv3-11 « write just the number, nothing else, to
  ./out/kingfisher.txt » came out READY with the count computed by jq and a `draft` whose
  detail said « draft text containing only the numeric count, no other text or labels » — no
  serializing verb, so the number-alone cue missed and a model was asked to write a number the
  computation had produced (one call where the corpus expects zero). The cue now judges the
  citation as well: a request that asks for the number alone folds the draft whatever the seat
  called it, and a request that asks for prose keeps it.
- **A number the request spells beyond ten is a literal of the request.** « duzentos »,
  « cien », « twenty », « zweihundert » in six languages: a candidate that writes the
  threshold as digits is no longer refused for inventing it (sealed-v3 treatment lane:
  two seeds ended in `intent.clarification` on « the literal `200` is not in the request »).
- **A constraint an obligation carries needs no operation, and a language step inside a gate
  sentence is the gate.** Read on the eco-60 lane of the final binary against the tenth-law
  binary: E04B lost its only carrier when the `validate` over the dedup constraint folded, and
  the composer's rule 12 refused the candidate — « Déduplique les événements entrants par leur
  identifiant » restates the dedup obligation the plan already carries through its admit task,
  which the rule never counted; E20B assembled a `validate` cited as « validation humaine de ce
  dossier précis, avant son exécution », the fragment of a gate sentence, and came out READY
  with an operation the request never asked. Rule 12 now counts a constraint that restates an
  obligation of the plan (a dedup, a revision check, a retry bound) as carried; the gate fold
  judges the sentence the clause lies in, not the clause alone.
- **One clause is one effect: a twin effect differing by a period and a pathless write over a
  stated constraint are folded.** On the eco-60 lane of the tenth-law binary, E09B assembled a
  `send` beside the `publish` over « Poste ensuite la réponse dans le fil Slack » — the two
  citations differed by a trailing period — and a `write` with no path over « conserve un état
  à reprendre manuellement », a constraint the reading carries as guidance; E17B the same write
  over « puis conserve un état à reprendre manuellement. ». Effects now compare by their clause
  key, a second effect over a clause a stated effect contains is that effect, and a write naming
  no place over a stated constraint's words is that constraint.
- **One clause is one step: the request's words decide what is supplied, and a second
  language step, a validate over a constraint, a step over an effect's clause or a read over
  the event are folded.** On new seat samples of the eco-60 lane, E16C came out READY once
  more because the seat's read detail said « les disponibilités fournies » — a word the request
  never wrote; E11A with an `extract` over the draft's own clause; E09B with an `extract` over
  the search's clause, a `validate` over « Si les passages ne suffisent pas, la réponse doit le
  dire », an `explore` over the send clause and a `read` over the event clause; E17B with a
  `validate` over a constraint differing by a trailing period and an `extract` over the refund
  clause. The supplied-material check now reads the citation, never the seat's detail; clauses
  compare by their key (punctuation trimmed); a language step over a clause a producing step, a
  search or a lookup already carries, a validate or an explore over a stated constraint, an
  extract, an explore or a validate over an effect's clause, and a read the seat lists over the
  event clause naming no place are folded.
- **One clause is one element.** A step a seat proposes over the trigger clause is the
  trigger, a step over an obligation's words (a lookup over « Vérifie de nouveau la version
  courante ») is the safeguard, an effect over a language step's own words (« rédige un
  compte rendu » as a create or a write, naming no file and no endpoint) is that step, and
  two effects with kindred verbs over one clause (a publish and a send over « Poste ensuite la
  réponse dans le fil Slack ») are one effect. Measured on eco-60 under gpt-5-mini: three
  requests had been assembled with operations and effects the seat double-listed.
- **One clause is one step.** A seat that lists the same clause under several operations
  (« écrire ces lignes … dans ./out/retards.csv » as a validate, an explore, a fetch, a
  lookup, a classify, an extract and a search at once, measured on the sealed-v3 lane under
  gpt-5-mini) states one thing several times: the first stands, the twins are not assembled,
  and a retrieval or a validation over a write clause is the write the proposal already
  states. The request compiles READY as a read, a filter and the write, with no model, where
  it had asked a directory, a search root, a URL and a rule.
- **A proposed read of records named by their owner is a lookup.** « Lis mes disponibilités
  et celles des participants » (eco-60 E16C) was read by the seat as a `read`; with no path
  the assembler bound it to the material an invocation supplies and drafted three slots from
  an input string, READY. The reader's retrieval cues now settle a proposed read that names
  no path and no supplied material: a store, a calendar or a possessive object is a lookup
  (a corpus a search), and the assembler asks where the records live.
- **A Portuguese schedule is a trigger.** On sealed lane9 (gpt-5-mini), sv3-56 « todas as
  manhãs às 7h, lê ./coworking/reservas.csv … » never became the trigger: the reader's trigger
  prefixes, the daily cadence words and the time-of-day introducer knew no Portuguese, the seat
  filed the schedule as a constraint, and the ledger refused READY for a format duty nobody
  carried. « todas as », « todos os », « sempre que », « assim que » open a trigger clause,
  « manhã(s) » and « noite(s) » state a daily cadence, and « às » introduces the hour: the
  clause is recorded as the requested trigger, daily at 07:00.
- **Select provider token budgets from model capabilities.** OpenAI-compatible requests now use the shared model capability catalog to choose the token-budget parameter. The observed OpenAI `gpt-6-astra` contract uses `max_completion_tokens`; compatible peers retain their existing parameter, without new reasoning or sampling capability claims.
- **The quotes around a value are not the value; a body is data; a draft over the write
  clause with no language word is a serialization.** On the sealed lane6, « no » reached the
  jq with its guillemets and kept no row (sv3-26, a READY that wrote an empty file), a draft
  « preparar cuerpo POST con las estaciones filtradas » stayed a model call (sv3-23), and a
  draft over the very write clause « ./out/esiti.csv con le colonne esito,numero » beside the
  computed rows asked a model to write what the rows already are (sv3-36). A typed value is
  read without « », “ ” or ‘ ’; a body or payload is a data word; a draft whose clause is a
  write clause and whose detail carries no language word, beside produced data, is folded.
- **A renamed column keeps its place in the written CSV.** « benenne die Spalte kwh in
  energie_kwh um (sonst nichts ändern) » wrote `anlage,datum,energie_kwh`, the sorted keys of
  the rows, because the source's header order reached the CSV stage only when the rule renamed
  nothing (sealed sv3-41). The header order is now mapped through the renames the rule states
  under a `<stem>_columns` jq stage the CSV stage reads.
- **A mandatory clause of the request survives compilation: realized,
  questioned or refused, never dropped into READY.** Three product repros
  returned READY after silently losing a transformation ("write a 3-bullet
  summary to …" became a copy), a write and its human gate ("ask me to confirm
  before writing it to …" vanished behind the read's path) and an explicit
  approval ("only after my explicit approval" left the publication automatic).
  Four general laws close them: what a clause still says after its settling
  path re-enters the reader as a clause of its own; the object a write names
  before its destination refers back to produced content or is new content (a
  draft for prose, an unresolved clause for data); a human gate is read from
  its shape (a binding connector, a requirement word or an asking verb, a
  person, a word meaning approval), and a prohibition bounded by an approval is
  that gate; a constraint needs an operation that carries it, in the reader and
  in the composer. The composer also refuses an automatic effect on the clause
  or endpoint of a human-first effect, and an effect whose readable excerpt
  carries no word of its family; a listed column never spells a verb. The
  anchor corpus of a drafted step holds each fact as the prompt renders it.
- **A retrieval proposed over an outbound effect's clause is that effect.** « envíalas con un
  POST a http://…/reposicion » was listed by the seat as a `fetch` beside the human-first `send`
  over the same words, and the candidate performed a GET on the endpoint before the gate
  (sealed sv3-23). A fetch, a lookup or a search over a send, publish or notify clause is folded
  into the effect: one clause is one element.
- **A revision check over a search reruns the search just before the action.** The
  recheck only knew a lookup's record; a request that retrieves passages from a guide, drafts
  an answer and asks to recheck the current version before posting was refused for want of a
  retrievable source (eco-60 E09B). The reader admits a search as that source, and the
  assembler reruns the grep under `revision_reread`, compares the hits with the first ones
  and lets `revision_admit` gate the action; changed hits are a changed version.
- **A stated rule stands for a seat's paraphrased detail.** The sentence-coverage law of
  the previous slice held a seat's own paraphrase (« Group the rows by roast_level and sum
  weight_kg … . Output exactly two columns … ») to the request's sentence law, so five
  sealed-v3 seeds with the right typed rule recorded still asked `const.rule_expression`.
  Coverage now applies to a verbatim detail only, and a plain twin of a shaped rule (the
  promoted constraint beside the seat's typed rule over the same clause) is one rule.
- **A format the rule states is carried by the compute task.** A duty whose words lie in a
  rule's own text (the clause the rule was read from, promoted beside it) or an ordering
  phrase (« del más rápido al más lento », « highest first », « croissant ») when the rule
  sorts is realized by `compute` instead of blocking READY as a silent obligation; a single
  digit in a language step's paraphrase (« cycle de correction 1 ») is an enumeration, not
  an invented literal. Measured on the sealed-v3 lane: sv3-21 asked a rewrite beside the very
  rule that computes it; sv3-15 and E19B were refused for the literal `1`.
- **A draft that only serializes computed rows is not assembled.** A seat proposes « prepare
  the filtered CSV content for writing », « serialize the resulting array as JSON », « schreib
  das Ergebnis nach … » beside a computation: that is no language work, the write takes the
  computed rows as they are, and no model is asked. A detail that names language work (a
  summary, a note, a digest, headings, a reply, a translation) stays a draft. Measured on the
  sealed-v3 treatment lane: three such drafts ran under gpt-5-mini with a 4096-token cap and
  failed at runtime; three more waited on a `model` the request never needed. A format such a request states (« avec les mêmes colonnes et dans le
  même ordre », « mismas columnas ») is realized by the compute task, which keeps the source
  columns by construction, instead of waiting on a draft's prompt guidance.
- **Stable answer rounds.** `nika compile` records the private plan a free intent produced under `.nika/compile/<intent sha256>.plan.json` (a self-ignoring directory: the plan, the engine and the intent hash, never the candidate or a key), and every later `--answer` round of the same intent replays that plan through the additive `CompileRequest::with_plan` (route `replayed plan`, cognition `deterministicOnly`, zero provider and zero seat calls, the same candidate) instead of sampling the model again, so an answer can no longer belong to no question; `--fresh` reads or samples the intent again, `provenance.plan` names its `strategy`, `provenance.decision.intent_sha256` names the key (`nika_onboard::compile::intent_sha256`), a record that does not parse or is not anchored is a `recorded_plan` finding, `-o` is the short `--output`, a destination whose parent directory is missing is created, and `nika compile --help` documents the exit ladder.
- **A superlative states the `1` of a limit.** On sealed lane9 (gpt-5-mini), sv3-15 « name the
  incident with the most minutes by its id and its line » had the seat sort by minutes with a
  limit of 1, and the composer refused the candidate because the digit `1` is nowhere in the
  request. « the most », « le plus », « el mayor », « die meisten », « o maior » name one row:
  the literal rule now reads a superlative as the request's own statement of that `1`.
- **A validate over nothing but format words the computation keeps is folded.** « mismas
  columnas y mismo orden » listed by the seat as a `validate` beside the drop-filter made the
  candidate ask a model to check what the jq guarantees (sealed sv3-24, where the corpus
  expects zero calls). A validate or an explore whose detail is only same-columns or
  same-order phrases (six languages) or a lines-mode tail is not a step: the computation
  carries the format by construction.
- **A lookup by identifier binds its JSON file and selects the one record.** A
  lookup detail that names one JSON file and an identifier token (digits
  beside letters, `-`, `_` or `#`, or an email; never a bare number, a date, a
  path or a URL) binds the file without a directory question, keeps the
  identifier as `const.<slug>_id` (`ticket T-4471 in ./data/tickets.json` →
  `const.ticket_id`), asks only which field holds it (`const.<slug>_id_field`,
  a stable question), and selects the record with a jq that reads an array
  directory by field and an object directory by key. A literal lookup is the
  corpus: no `inputs.item` and no `inputs.record_id` is declared, and the
  classification, the draft and every endpoint payload see the record alone,
  never the whole file. The revision recheck reuses the same selector.
- **A numeric rule is an operation, and a structured destination receives its
  format.** A digit beside a comparison cue (greater than, above, below, at
  least, plus grand que, supérieur à, inférieur à, mayor que, minore di,
  größer als, `>`, `≥`…) that a proposal demoted to prompt guidance is
  promoted to a compute stage anchored in the request, inserted right after
  the sources so the draft sees the computed rows, and withdrawn from the
  prompt; a size unit (words, lignes, bullets…), an attempt or turn bound and
  the concurrency bound stay guidance. A `.csv`, `.yaml` or `.toml` destination
  whose content is data gets a `nika:convert` stage (`<stem>_csv`) feeding the
  write instead of JSON text; a `.json` destination stays JSON; prose stays
  prose. A structured source is decoded only when a code rule, an endpoint
  payload or a structured write consumes it, and a `compute_summary` stage
  (`{count, totals}` over the numeric columns, rounded) gives every count or
  total a language step claims a deterministic anchor.
- **Per-file drafts fan out and fold back with one heading per file.** A
  request that distributes its draft over the read files (a heading word
  beside a distributive or file-name cue, or a draft clause or trigger led by
  "for each", "pour chaque", "para cada") is structure now: the fan-out is
  zipped into `{path, text}` items (`draft_items`), the draft runs `for_each`
  item under the concurrency bound with a prompt that sees only
  `${{ item.text }}`, a per-item law judges every body and anchor against its
  own item, and `draft_fold` joins the bodies under `## <file name>` headings
  in item order; the order and heading instructions leave the prompts, and the
  folded `documents` corpus is emitted only when another step reads it.
  Distributive words inside one draft's object with a single file and a single
  length cap stay one draft. A per-item request whose write target is a
  placeholder path (`./out/<name>.md`) is refused with `intent.clarification`
  instead of being lowered to one guessed file. The realized topology is
  recorded as `provenance.decision.shape` (`linear`, `fan_out_fold`,
  `fan_out_fan_in`, `multiple_outputs`, `human_gated`, with its flags).
- **Every effect that names content has a producer, and a revision check has a
  source.** The composer's rule 10 now reads every effect, not only a write: a
  `send`, `publish`, `notify`, `create`, `update` or other effect whose target
  or evidence names produced content (a reply, a report, a summary, a digest, a
  brief, a note, a message, a blurb, a draft, a translation, a recap, a memo,
  and their French, Spanish, Italian, Portuguese and German forms) needs a
  draft, an extract or a compute step, or, under a copy cue (copy, forward,
  verbatim, tel quel, as is, attach…), a source step whose material it carries
  unchanged; the reason names the noun and the target. Rule 11 refuses a
  `revision_check` obligation without a lookup to reread. The strict HOT
  admission applies the same two laws, so a deterministic reading that would
  send a reply nobody drafted escalates instead of inventing the reply.
- **A compiled CSV keeps the requester's column order.** `nika:convert`
  (`to: csv`) accepts an optional `columns:` list, the header order to emit:
  the listed columns lead in that order (a listed column absent from every
  row is still emitted, empty), every unlisted key follows in the sorted
  order the default emits, and the formula guard still applies at write
  time; without `columns:` the header stays sorted. The assembler derives
  that order from a CSV source's first line (`source_columns`, a jq over the
  read text: `\r` trimmed, surrounding double quotes stripped) and binds it
  into the `<stem>_csv` stage of a `.csv` destination, so a filtered
  `order_id,customer,amount` file is written back as
  `order_id,customer,amount`; a source that is not a CSV leaves `columns:`
  out.
- **A numeric or equality rule the request states in words is the jq the
  workflow runs; `const.rule_expression` is no longer asked for it.** The
  compiler-arena tournament (40 sealed seeds) asked `const.rule_expression` for
  13 rules the intent already stated ("keep only the rows whose amount is
  strictly greater than 100", "cuya cantidad es menor que 10", "whose status is
  refunded"). A compute step over one parsed source (CSV, JSON, YAML, TOML) is
  now synthesized deterministically from a closed grammar: the FIELD is an
  identifier token, a word of the columns hint the request states ("columns
  order_id,customer,amount,status", "colonnes …", "(sku,nome,quantidade,minimo)"),
  the noun phrase between a relative pronoun ("whose", "dont", "cuya", "la cui",
  "cuja", "deren") and the comparison, or the word left of a symbol; the
  COMPARATOR is a symbol or a multilingual cue (EN · FR · ES · IT · PT · DE,
  including "at least / au moins / al menos / almeno / pelo menos / mindestens"
  and their "at most" twins), with a copula alone reading as equality and a
  negation as inequality; the VALUE is a number (compared after `tonumber`), a
  quoted or bare word for equality (exact, case-sensitive), or a second column
  (`.quantita < .soglia_minima`); clauses join through one conjunction ("and /
  et / y / e / und", "or / ou / o / oder"). The compute stage becomes
  `[.records[] | select(<predicate>)]`, preceded by a `compute_guard` jq and a
  `compute_admit` assert that fail loudly, naming the column, when the first
  parsed record lacks a referenced field, so a wrong column never filters
  everything in silence; the summary stage keeps counting and totalling the
  filtered rows, and `provenance.decision.rule` records the text, fields,
  comparator, value, jq and `synthesized: true`. A count-or-total request folded
  into the same rule ("and how many rows were kept and the total of their
  amounts", as a live authoring seat wrote it) is what the summary stage
  computes: the rule is still synthesized and `{count, totals}` becomes the
  `summary` output. Anything outside the grammar
  (a grouping in the same sentence, a number bounded by a size or attempt unit,
  a field no column names, mixed conjunctions) still asks `const.rule_expression`,
  and an explicit answer always wins over the synthesis: nothing is guessed.
- **Veto recognized approval-bypass omissions in explicit authoring.**
  The finite EN/FR backstop now matches approval-bypass phrases as whole
  words and refuses a semantic plan that reports no effect while the
  intent says `without asking`, `sans accord`, `do not ask` or names a
  prior approval, so a dropped store-credit or payout effect never becomes
  a lookup-and-draft candidate. `fichier` no longer reads as `hier`.
  `automatic` wording alone still vetoes only an inserted human gate.
- **Keep rejected support binding answers resumable and qualified.** A
  glob directory or an invalid refund endpoint re-asks its stable question
  beside the Missed diagnostic instead of leaving `questions` empty, and
  the `model` answer must name `<provider>/<model>`: a bare id such as
  `gpt-4o` no longer compiles to a Ready candidate that the host Check
  refuses as NIKA-PROVIDER.
- **Check the committed ADR rationale.** A new crate may arrive with a completed existing ADR in the same commit. The admission hook reads staged document contents, so an unstaged mention cannot satisfy the requirement.
- **The DeepSeek aliases stay priced.** `deepseek-chat` and
  `deepseek-reasoner` left DeepSeek's model list and pricing page, and the
  2026-09-23 refresh followed; chat/completions still serves both and
  answers `deepseek-flash`. A human naming the alias was accepted at the
  seat question and refused at the run door as unpriced (NIKA-1709). Both
  aliases are priced as deepseek-flash again, with the probe named in the
  refresh script.
- **Preserve the whole source name after clarification.** The compiler asks when a file name is ambiguous and binds the user's exact answer. Fidelity recognizes that whole name without forgetting a separately named file or broadening filesystem permissions.
- **Keep source clarification separate from destination occurrences.** Check the candidate filesystem boundary without treating a source answer as a destination. A source answer cannot cover a missing destination permission; a suffix inside a longer stated path belongs to that path, while a separately named file remains required. Regression tests exercise native authoring, sketches and deterministic assembly.
- **Unnamed output files require a destination.** A request that asks for a
  file without naming it (« Résume mes notes dans un fichier », « summarize
  my notes into a file ») no longer compiles READY as a draft that writes
  nothing. The deterministic reader records the write, and the compiler asks
  its exact path (`const.output_path`) before any candidate or grant exists.
  A plan recorded by an earlier engine gains that question on its next
  answer round. The native and sketch doors refuse a candidate that drops
  such a write (`UNWRITTEN DESTINATION`). An answer that names no file
  (prose) keeps the path question open instead of leaving the compile with
  nothing to answer. A named destination, a file the request already has («
  dans le fichier », « in my file ») and quoted words compile as before.
- **Contradictory bounds on the produced content are refused, never run.** A
  request asking for a report of "exactly 5 lines" that is also "at least 12
  lines long" compiled READY and ran on a prompt that silently obeyed one of
  the two. The bounds a request states on one unit of its content (exact,
  minimum, maximum, in six languages) are now read as intervals; two that
  cannot meet contradict each other, the outcome is refused with both bounds
  named, and the obligation ledger records both duties as contradicted.
- **A glob and a spelled number derived from the request are anchored, not refused as
  invented.** `./recettes/*.md` from « les .md de ./recettes » and `3` from « trois
  puces » failed the composer's literal law (« the literal is not in the request »).
  A glob star is structure, never a literal, so the path is derived once its folder
  and extension appear; a number word in six languages anchors its digit (never
  one, an article far more often than a count), and the same words let a stated
  bound (« tre punti », « drei Zeilen », « cinco viñetas ») be verified at run.
- **Preserve distinct computations during authoring.** A filter and a separate
  total can no longer collapse into the first rule while claiming both outputs
  complete. The normal authoring route escalates to a full native task graph
  when the single-binding assembler cannot represent the recorded calculations.
- **A fan-out over an empty corpus fails loudly instead of running green on nothing.**
  A `source_glob` that matched no file let the fan-out iterate zero times, the fold
  write an empty document and the run finish with exit 0 and no model call. The
  assembler now emits `glob_found` (`length > 0`) and `glob_admit` (`nika:assert`)
  between the glob and the reads, so an empty match stops the run with its reason.
- **A human gate is read from its form in six languages, and one approval is one
  gate.** « demande-moi confirmation avant d'écrire », « pídeme confirmación
  antes de escribir », « chiedimi conferma prima di scrivere », « frag mich
  bevor du schreibst », « pergunte-me antes de enviar », « solo después de mi
  aprobación » were not read as gates while their English forms were: the gate
  matcher now knows the approval nouns, approval verbs, persons, connectors and
  asking verbs of Spanish, Italian, German and Portuguese, and a clitic person
  glued to the verb (`demande-moi`, `chiedimi`, `pergunte-me`) counts as the
  verb and the person it addresses. A request stating one approval for several
  effects ("only after I say yes: do the POST, then write the receipt")
  compiled to one prompt per effect, so a single human answer could not finish
  the run; the gated effects now share one `approval_review` that lists every
  action and shows the first one's exact content or payload, while two
  approvals each naming one effect stay two gates. A gate read in a language
  whose effect verbs the deterministic reader does not know no longer blocks a
  model proposal that names the effect: the gate finds its effect there.
- **Give open generation its selected context immediately.** Complete deterministic
  readings and bounded decisions retain priority; generation receives knowledge before
  spending a preliminary under-informed call. Changed candidates can use remaining
  repairs, and reported truncation may raise an explicitly lower initial token limit
  within the original ceiling. Technical failure preserves the request and diagnostics.
- **The knowledge door keeps relevance, a secondary obligation's block and an honest
  receipt (builder `knowledge-door-v3`).**
  - Patterns and blocks were deduplicated in a map, then cut to their caps in id order.
    A pattern the request matched word for word could lose its slot to generic rows
    whose ids sort first. The leading family's blocks could also crowd out the block
    of a second obligation.
  - Both are now taken in turn, per recalled family and then by direct match, and
    each source's best-covering block comes first.
  - A row the byte cap left out was still recorded as selected, as if presented. The
    receipt now separates available, selected, excluded with a reason, and presented.
    It states `no_match` when nothing is recalled, and the seat then reads the card
    alone.
  - A block is presented with its row's holes, effects, authority, capabilities,
    callables, known failure modes and version, beside its code (at most 1 KiB).
  - The record names its selector: the door's Rust BM25 over the Foundry graph, not
    the Foundry producer's selection.
  - The shared reader lives beside authoring in the existing `nika-onboard`
    member; the CLI-host compatibility path is preserved without duplicating logic.
  - The bounded decision adapter is hosted beside the shared TypeSafe transport;
    Session retains its monetary admission and persisted observations.
- **A seat's draft over nothing is asked, and anchors are verbatim.** A
  seated plan whose steps are all language, with no read, fetch, lookup or
  search, no effect, no trigger and no material the request names as
  supplied at invocation (« build me a digest of the docs ») stays
  incomplete with `intent.clarification` instead of a Ready candidate around
  an invented `inputs.item`. The draft and extract prompts ask each anchor
  as a verbatim copy of one contiguous span of the corpus, name which field
  is the claim and which the anchor (a paraphrase in the anchor still
  refuses the draft), and the draft and extract schemas describe each
  property to the seat.
- **Native authoring repairs complete malformed JSON within its existing
  budget.** Native authoring can use its existing repair budget to correct a
  complete, metered response with invalid JSON syntax. Truncated, unmetered
  or repeated malformed responses remain terminal; no extra allowance or
  automatic model substitution is introduced.
- **Keep uncertain effect readings contestable.** Indirect negations and separately
  targeted bans no longer force the same interpretation on every candidate. Open
  readings remain visible in review; exact destination bans, approval requirements
  and execution permissions retain their checks.
- **A JSON body whose keys the request states is exactly those keys over
  produced values.** A sealed seed computed `{tickets, total_cents}` correctly
  and then posted the generic `{action, target, facts}` envelope: run green,
  wrong body. A brace list in the effect's own words (`with the JSON body
  {tickets, total_cents}`) is now the payload's shape: a total the typed
  computation produced under that name, a fact of that name, or, for one key
  left beside one drafted text, that text. A key nothing produces ends
  INCOMPLETE with a diagnostic naming it; a payload never carries an invented
  value. Without a stated key list the envelope stays as before.
- **A trigger over the request's own material never declares `inputs.item`.**
  Two sealed seeds compiled READY and died at run time on a missing
  `inputs.item`: "once all three are done" over a read brief and "pour chaque
  ligne de niveau critique" over a read CSV both declared an input no run could
  supply. The item is the material of an invocation only when the request
  supplies none. Two obligations that input was hiding are now asked instead
  of dropped: an outbound effect stated inside a distributive trigger's own
  sentence ("for each critical row, send a POST") repeats per item, which one
  workflow does not build yet, and several files bound to one drafted text
  would receive identical content. Both end INCOMPLETE with a diagnostic that
  names the gap, never READY on wrong content.
- **A question is a conversation, never a rule read whole.** « Which ending
  is gentler? » compiled to an incomplete asking for the jq of that sentence
  because the headless clause consulted the closed rule grammar, which knows
  « which » as a relative and « is » as a copula. A headless clause that
  asks (closed by `?`, or led by an interrogative in EN, FR, IT or ES) is
  never handed to the grammar; it falls to the conversation with the
  clarification alone. A headed request keeps its meaning whatever its
  mark.
- **The language-step cap is sized from the catalog on a reasoning seat.**
  A structured draft on `openai/gpt-5-mini` died on `NIKA-INFER-002` because
  the reasoning trace ate a `max_tokens: 1200` cap before any answer was
  visible. The assembler knows the seat at Ready and reads the catalog
  there: a catalog-known reasoning seat gets at least 4096 on every language
  step (validate · extract · classify · per-record classify · draft ·
  per-item draft); any other seat, and `mock`, keeps the step's own cap. A
  cap is a ceiling the run never exceeds, never a spend.
- **A truth value matches the boolean and its spelling; a quantified set the request never
  locates is asked for, never invented as an input.** « explicito == false » compared a
  boolean column to the string `"false"` and jq kept no row, so the run was green on an
  empty file: a truth word in six languages (`false`, `faux`, `falso`, `falsch`, `vero`,
  `wahr`, `verdadeiro`…) now compares as `(.f == false or .f == "false")`, whichever way the
  file encodes it. « For each invoice, extract … » with no file, folder, URL, search or
  record named compiled to a program with a required `inputs.item` the run could not supply;
  the compiler now asks where the items live (`const.source_glob`) and fans out over the
  answer. An arriving item (« each incoming brief », « chaque nouveau ticket ») is the
  material of one invocation and stays the item, as before.
- **A stated approval now holds its effects to a human's typed yes.** Both approval laws
  (Law 3, an approval the reader binds to an effect, and Law 3b, a final approval it binds to
  none: « prépare son envoi à … · demande-moi avant de l'envoyer ») accept an approved effect
  only when its own `when:` affirms the answer of a confirm `nika:prompt` whose output it
  binds whole, judged with the analyzer's refusal substitution (Check's affirmative-consent
  reading, NEP-0020): false on a « no » and on a skipped prompt, not dead on a « yes ». An
  `after:` wait, a guard a « no » or a skip passes (`== false`, `!`, `||`, `!= false`), a
  quoted name, an unrelated binding, a derived value, a choice or input prompt, a
  `default: true`, an `on_error:` or a fan-out on the prompt are refused as APPROVAL ORDER;
  no prompt is MISSING APPROVAL. A stated final gate is no longer called INVENTED GATE over
  the final effects, and still is over an earlier one. An `mcp:` tool, a process, a child
  workflow or an agent with effect tools, whose effect the compiler cannot read, is held to
  the same guard or refused as APPROVAL UNPROVEN. `nika-check-analyzer` gains
  `gates::human_confirm` and `gates::affirmed_by`.
- **Refresh the converged authoring API snapshots.** Record the canonical Ubuntu renderings for shared knowledge loading, Session decision routing, authoring limits and fidelity checks, preserving the existing CLI-host knowledge re-export. The snapshots use nightly-2026-08-24 and cargo-public-api 0.51.0 from the public-api CI artifact.
- **Short DeepSeek JSON calls use low thinking effort by default.** On
  catalogued routes with effort control, a structured request capped at
  8,192 output tokens or less asks for low effort, leaving the same finite
  token limit and cost admission in place. Explicit caller settings win;
  other routes and ordinary text generation retain their defaults.
- **Current DeepSeek drafts reserve room for reasoning.** Recognize the
  default thinking mode of the exact DeepSeek `deepseek-v4-pro` and
  `deepseek-flash` API models. Generated language steps now use the existing
  reasoning token floor, leaving room for the structured answer instead of
  applying the smaller plain-chat budget. Legacy aliases and gateway routes
  keep their separate capability and cost-admission rules.
- **Allow bounded reasoning output.** Compiler-generated inference limits allow 16,384 output tokens for catalog-known reasoning models, bounded by model capacity and run admission. Explicit task limits stay unchanged; structured summaries have room to complete after reasoning.
- **The `group.<name>` fan-in fold resolves at run time.** A task declaring
  `group: probes` joined the checker's `fan-in` edges and scheduled its
  consumer after every member, but the runtime bound no `group` root, so
  every `${{ group.probes }}` binding died at the boundary with
  `NIKA-VAR-001` — `nika check` green, `nika run` red. The `with:` renders
  now bind the declared membership and the fold reads one array of member
  records `{ id, status, output, duration_ms, error }` in declaration order;
  a member without a settled record keeps the read loud instead of folding
  a smaller array.
- **A harness probe takes its wrapper's grandchild with it.** `nika doctor`
  (and every census) probes the `codex` seat through its npm wrapper
  (`node …/bin/codex-acp -c model=…`), which forks the real adapter binary
  as a grandchild; the probe killed the wrapper alone and the grandchild
  lived on. Measured 2026-09-22 on a machine whose editor extension polls
  `nika doctor`: ~1.7 orphaned `codex-acp` per second, the process table
  full within the hour (« fork: Resource temporarily unavailable » for
  every shell). Every probe child is now its own process group and the
  group ends with the probe, on every path (the handshake answer read, a
  timeout, an exit); a test forks a `sleep 600` grandchild behind a fake
  wrapper and proves it is gone after the probe.
- **Preserve CSV headers during native authoring.** Native authoring now receives the existing CSV column-order parameter and the instruction to preserve observed headers when filtering rows.
- **Preserve other outputs during destination revisions.** A conversational destination replacement can recall an unchanged secondary output. The compiler records a replacement only when the complete candidate preserves every other value and task; an exact substitution no longer needs a model-written gap or a redundant repair call. Native revision guidance treats the change as an update to the original request. A structurally replaced path explicitly recalled in the change stays a pending business decision; document equality alone does not prove that the user meant to replace it. Revision prompts identify reader observations instead of imposing superseded destinations, and a duplicated write of the same content triggers repair rather than passing as a replacement.
- **A seat the catalog limits to `json_object` is asked only for that.**
  The OpenAI-compatible wire forwarded `response_format: json_schema`
  verbatim and DeepSeek refused it at the door (HTTP 400, no token sampled),
  so the seated compile never answered. The wire now reads the catalog's
  per-model `json_mode`: `Object` sends `json_object` with the schema
  rendered into the last user turn and a generic instruction that every
  enum, every required property and nothing outside the schema is the law;
  `Unavailable` sends no `response_format`; `Schema` or an absent fact keeps
  the native mode. Enforcement stays local, in the verb's gate and the
  compiler's decoder.
- **A model the seat prices is the seat's own model.** `openai/gpt-4o` was
  refused at check as « not an openai model, served by azure » because the
  wrong-seat rule consulted only each provider row's short model list. The
  rule now asks the pricing snapshot first: a model the seat prices is never
  a wrong seat, while `groq/grok-3` stays one.
- **The transport backs off on a rate-limited or overloaded seat, on the
  run's declared clock.** A 429, 503 or 529 means nothing answered and
  nothing was billed, so the provider layer re-sends the identical request
  at most three times (`Retry-After` honoured up to 30 s, from the header
  or Gemini's body-level `RetryInfo`, else 1 s · 2 s · 4 s), never on
  another 4xx, an exhausted quota, a dropped connection, another 5xx or a
  schema failure; the error surfaces unchanged past the bound so an
  authored `retry:` may still fire. The sleep rides the kernel clock seam:
  the composition injects the run's declared clock, so `run: { clock:
  virtual }` and a seeded run never sleep real seconds. Each attempt is
  boxed so a workflow invoking a workflow fits its stack.
- **Provider quota exhaustion is terminal and sanitized.** Shared HTTP failures
  retain safe status, recognized code/type and Retry-After metadata, distinguish
  exhausted credit from transient rate limits, and discard raw provider prose.
  Usage and billing remain unknown on failures; existing strict wire schemas
  are unchanged. Hermetic tests cover buffered and streaming rejection paths.
- **Publish large release notes.** Large releases link their complete tagged changelog when it exceeds the release-page allowance, preserving the full record while leaving room for GitHub's generated pull request index. This prevents draft creation from failing after an immutable version tag has already been pushed.
- **Unknown-cost Run approval covers bounded structured sequences.**
  Explicit unknown-cost Run approval now supports bounded sequential
  structured inference with project-file input and output. Check and Run
  share the request-bound analysis, including schema repair calls, while
  filesystem containment, current consent and per-request admission remain
  enforced.
- **An activation's value waits on its own prompt.** While « activate »
  asks the time zone, the missed policy or the ceiling, the plain loop
  printed `nika ›` and the renderer showed a free prompt, as if nothing
  waited; the runtime now exposes the waiting key (`pending_activation`),
  both shells read it (`reply ›` · a Question wait) and the status line
  says « Needs one value to declare the schedule · `project.timezone` ».
- **An answer and a restatement climb the same ladder as the request.**
  Under a provider seat, a request the seat could not settle was read by
  the provider's stronger model before Nika said what it could not
  express; an answered question or a clause restated in words was
  compiled once and settled as it came (« the request names no operation
  I can read »). Both now climb the same ladder.
- **An unpriced cloud model is refused at the question, in words.** When
  the compiler asks which model runs the language steps and the answer
  names a cloud model Nika's catalog does not price (the seat an empty
  line takes included), the session says so at once — « `deepseek/
  deepseek-flash` is not priced in Nika's catalog: a run under a spending
  ceiling would refuse it (NIKA-1709) · priced for `deepseek`: … » — and
  the question keeps waiting, instead of a saved and checked workflow
  whose first run refuses. A local engine is unpriced by nature and
  passes; a line that is not a model is left to the compiler.
- **A change is applied by restating the request; new work always reaches
  the seat.** At the consent prompt a change (« actually write it to
  ./out/copie-2.md instead ») is applied by restating the request with the
  change — one bounded call to the chosen intelligence, shown as « read
  as: « … » » beside the new proposal so a paraphrase can be corrected —
  and reading it again through the same door; the Meaning delta says what
  changed. A request the deterministic reader did not recognise but the
  route calls new work goes to the authoring seat whether or not it names
  files; without a seat the first screen is asked in context and the line
  is kept — never a conversational plan that nothing builds.
- **A failed route keeps its reason.** When the session's intelligence could
  not read a line (a failed call, a blank answer) the route said « Failed »
  and nothing else: an outage read as a night of UNKNOWN outcomes with no cause on
  any receipt. The decision keeps the failure's own words now (bounded),
  `/details` shows them beside the route, and the routing receipts carry them.
- **A gate lists every task it holds back, at any depth.** The aside beside a
  paused run (« what your answer lets happen ») listed the gate's direct
  dependents only: behind « gate → format → send » the human saw the
  formatting and never the send. It now lists the closure — every task that
  follows the gate through an `after:` edge or a `with:` binding, and every
  task that follows one of those — in the workflow's order. Two effects
  behind one gate are both shown (acceptance A10).
- **A reply is words only, and the identity says so.** A line read as
  conversation was answered « Je vais d'abord lire le fichier … Je lance
  la lecture », a promise a reply cannot keep. The seventh law: from a
  reply Nika cannot read, run or start anything, never says it will, and
  when the human asks for work it says how to ask for it.
- **A rule the compiler can only ask as code is asked in words, never as
  code.** « Read ./sales.csv, compute the total and write it to
  ./total.txt » reached the human as « Which jq expression implements
  `the total` over the input object … » (the morning audit's case B:
  accepted unvalidated, then a run failure at `compute`). The session now
  asks the clause in words (« One thing I need from you, in words: how to
  do « the total » … your words take the place of « the total » in your
  request and Nika reads it again. No code is needed »); the answer
  replaces the quoted clause in the request and the compiler reads it
  again (« the total of the amount column » → Ready). A clause that stays
  code after the words, or one the request does not carry as quoted, is an
  honest incomplete that names the way on (« it would need a rule I can
  only write as code, and I never ask you for code »); the round is
  dropped, nothing written. `AuthoringRound` gains `restatements` (bounded
  to one).
- **A seat that cannot answer is never offered as an intelligence.** The
  first screen used to list every AI app installed and signed in
  (`gemini-cli` · `claude-code` · `kimi-code` · `qwen-code`) under « Use an
  AI app I already have », and a kept choice on one of them failed at the
  first conversation line with the harness's own refusal (« seat gemini-cli
  is not infer-grade for text ») wrapped in a recovery card whose headline
  was doubled (« I couldn't use I couldn't use … for this part for this
  part »). The census now carries whether Nika can get an answer through a
  seat (the same infer-grade admission `nika run` applies; `codex` today):
  an app seen but unable to answer is named as such on the screen (« seen
  but not usable here yet »), refused when named (`1 gemini-cli`) with the
  ways on this machine holds (the API keys present · the local engines
  reachable · install Codex), and a kept choice on it opens the session
  with the problem on the banner. The first line that needs an
  intelligence under such a choice — a conversation line, or work the
  reader cannot settle alone — is kept and the first screen asked in
  context with the reason and the ways on; the app is never called; a
  choice that answers resumes the very line and the kept choice moves to
  it. The recovery card's headline reads once (« I couldn't use mistral API
  (the conversational intelligence) for this part — … »).
- **Session bounds reasoning labels explicitly.** Session gives
  catalog-known reasoning models a finite 4,096-token label allowance,
  preserving monetary admission and explicit infer limits without retries or
  provider fallback. Ordinary and unknown models retain 1,024 tokens.
- **Whole file names and explicit model choice.** Copy authoring preserves quoted Unicode paths, asks for a missing destination, and retains an explicitly selected authoring model. The intelligence chooser accepts an explicit provider/model or engine/model selection and rejects trailing input it cannot interpret.
- **Keep the current request in recovery.** A greeting no longer becomes the automation goal shown after an authoring refusal. Recovery retains the current work and its budget guards; a failed conversation keeps its own words without replacing the saved automation goal.
- **One admission allowance across Session cognition.** Session inference now reserves catalog-priced exposure before each supported native request and keeps one allowance across routing, conversation and authoring. Missing, contradictory or duplicate usage fields retain an unknown charge instead of permitting another paid attempt. Gate answers and workflow Run ceilings cannot reset that allowance; reopening a session conservatively refuses fresh paid work when prior exposure cannot be recovered.
- **Interrupted Session inference keeps its monetary exposure visible.** A
  Session request under an explicit monetary account that may be in flight
  is now recorded before it can leave: `.nika/session-state.json` carries a
  line saying the request may have been sent and billed, and only the write
  after its settlement removes it. A session that leaves during the call
  (two `Ctrl+C`) restores with that exposure and replays nothing. Its
  refusal now names the supported way on: restate a saved workflow's Run
  with an explicit ceiling. The conversation history records the same
  uncertainty when a call ends without usable settlement.
- **A lease held for a fork window is not a foreign owner.** The
  conversation history's lease is a BSD flock; a sibling thread forking a
  run duplicates the descriptor until the child's exec closes it, so a
  second opener a few milliseconds early was refused as if another human
  held the project. `History::open` now waits a bounded grace (250 ms in
  5 ms steps) on `WouldBlock`; a lease still held past it is refused with
  the same message.
- **Priced Session calls remain visible without a budget.** A Session on a
  priced route with no budget no longer spends invisibly. Every call it
  makes (conversation, labels, routing, authoring, revisions) is observed
  without any allowance or cap: `.nika/session-state.json` says a request
  may have been sent before it leaves, then keeps its usage and catalog
  estimate, or says its charge is unknown. `/status` shows the no-budget
  observation, and a later explicit budget never counts those calls as
  covered. The chosen model still answers with no ceremony, but each call is
  now bounded (an explicit output limit, one attempt, no automatic retry or
  redirect), and a reply whose usage contradicts the catalog is refused. A
  restart names an interrupted call, replays nothing and asks for no
  reconfirmation.
- **The Session's seat is told the project, and its budget and review are one
  bound.** A seated Session compile (a fresh request, its answer rounds, a
  revision) now attaches the same bounded project observation `nika compile`
  uses (`compile::observe::world`, now public): the header columns, keys and
  short categorical values of the files the request names — every column, not
  only the ones the words mention — observed under the Session's own project
  root for the intent the compiler reads (a revision reads its base request
  and its change). Containment is judged on the real location: a file or a
  folder reached through a link that leads outside the project is reported
  `outside_project` and never read, for `nika compile` and the Session alike.
  The Session's authoring policy is aligned with its quality-first mandate: a
  32768-token hard ceiling, a 16384-token first native generation that a
  reported truncation widens with one of its three repairs (never a transport
  retry), and 180 seconds per call. A fresh unknown-cost review built for the
  Session now admits exactly what one authoring turn may send — seven requests
  (the turn's classification, the COLD plan and its evidence repair, the native
  candidate and its three repairs), each at most 32768 output tokens and 180
  seconds — and says so; a Run review keeps its 8192 tokens and 120 seconds per
  request, and a numeric allowance is unchanged: it still reserves each call at
  its full catalog ceiling and admits only what it covers. When authoring
  fails on Nika's side the card names the precise cause (a cut answer is named
  as the model's output limit, not the request) and keeps the request, the base
  and the change: it no longer asks to rewrite the request, split it in two, or
  describe the whole automation again.
- **A pasted burst on the plain session is one datum.** « yes ⏎ run it ⏎
  /quit » pasted at the consent prompt applied the proposal, ran it and
  left in one gesture (the live campaign's X13 case). The plain loop has
  no paste bracket, so it reads the line discipline's tell: when the next
  complete line is already waiting the instant the first was read, nobody
  typed it; the lines join as one datum (line ends become spaces) — one
  line that is not a consent, and the proposal still waits. Best effort:
  a paste the terminal delivers in slow pieces can still split. The
  renderer keeps its bracketed-paste law unchanged.
- **`/proof` reads the chain right on a machine without the signing
  key.** Where `nika trace verify` exits 3 because the seal cannot be
  judged (no key custody: CI, another operator), the proof view said
  « chain · not judged » on the same line that reported the chain
  intact. The chain line is now the judge's first line whatever the
  exit; the seal line says « not judged on this machine » when the judge
  prints no seal tier.
- **Leaving is always one line away, and a stray `yes` is refused.** `/quit`
  at the consent prompt was answered « that line is not a consent » and the
  human could not leave without killing the process; it now drops the
  proposal (nothing written) and closes, as it does at the first screen
  (no choice made) and at a human gate (the gate keeps waiting in its
  trace and in the record). A bare `yes`, `ok`, `oui`, `no` or `non` with
  nothing pending was sent to the compiler as work (« I read this as work
  but cannot build it yet »); it is now refused as a wrong state — a
  proposal asks `apply? ›` first — and never reaches a model.
- **Keep a pending draft when quitting its review.** `/quit` and `/exit` from a proposal now use the ordinary close boundary: previous consent expires, while reopening can offer the exact draft for fresh review and explicit save without another model call.
- **The review names the reach the bytes declare.** The consent surface
  read only the check's inferred floor, which leaves a loopback host out by
  design, so a webhook to `127.0.0.1` rendered « external effects · none ».
  The review now joins what the candidate's permits declare (`net.http`
  hosts, the exec grant) with the inferred floor, shows a declared host the
  floor does not carry, and says when a face could not be pinned instead of
  folding it into « none ». The human accepts the bytes; the bytes are the
  boundary.
- **Answer a revision's clarification before saving.** Session retains the exact base, change and original request while a revision asks a question, then replays its candidate with the answer. The earlier proposal cannot be saved while that question waits; cancellation restores it, and Save remains separate from Run. Rust callers constructing the private foundation's `AuthoringRound` directly should use `AuthoringRound::new` instead of a struct literal, as revision state is now internal.
- **Conversational revisions preserve the original request.** Session keeps
  the request, workflow and raw change together through the compiler edit
  door. If the edit cannot settle, it keeps the previous proposal or saved
  workflow instead of generating afresh from a model paraphrase.
- **Keep explicit Run ceilings separate from Session inference.** A closed Run request validates its own spending decision without amending the conversation account; a missing or invalid Run ceiling does not install a persistent Session restriction. Existing zero allowances, unknown charges and restart restrictions remain in force for cognition.
- **Clear stale Run evidence when saving a proposal.** Saving a new workflow proposal clears the previous workflow’s Run status, including when the saved path is reused. Save no longer appears to have executed the newly saved bytes.
- **The conversation and the authoring seat ride the provider client.**
  The session's reasoner and its authoring seat built the FETCH client
  (`ReqwestHttp::new`: SSRF enforced, 30 s), not the engine's provider
  client (`nika_runtime::compose`: SSRF off on purpose, the transport
  ceiling): a local engine on `127.0.0.1` (`ollama` · `lmstudio` · …) or a
  seat behind a loopback endpoint answered « SSRF blocked » at the first
  conversation line, and a long local answer was cut at 30 s. The two paths
  now build the provider plane's client (SSRF disabled — the endpoints come
  from the fixed provider profiles, never from workflow data — and the
  600 s transport ceiling; the per-request deadline stays the wire layer's).
  The stalled-seat scenarios (a loopback endpoint that accepts and never
  answers) were false passes until now: the call failed at once and the
  recovery card's « say it again » satisfied the needle; they stall for
  real and prove the door leaves at once on `Ctrl+C` twice and `SIGTERM`.
- **The proposal's Does list says what a builtin does, never its id.**
  « parse_source · nika:jq » read as machine words to the human who asked
  for a brief; the review says « shapes the data », « reads a file »,
  « checks a condition », « asks a human », and `/show` keeps the bytes.
  An MCP tool or a builtin newer than the list keeps its id.
- **The escalation knows Gemini and never crosses a gateway; the delta
  lists what stayed.** A Gemini flash seat that cannot settle a request
  escalates once to Gemini pro; a seat served through an OpenAI-compatible
  gateway (a base URL override) escalates nowhere, and the card says what
  stopped it instead of a 404. A revision's Meaning delta lists the clauses
  kept as they were beside the added, dropped and changed ones, when they
  are few.
- **The failure card names the seat it failed on.** « provider endpoint or
  model not found (HTTP 404) » said nothing about which model at which host;
  through a gateway it was the provider's default the gateway does not serve.
  The card now carries « seat: openai/gpt-5.2 · through api.scaleway.ai » (the
  authoring seat's model, the gateway host when the base URL is overridden).
- **The failure card says its headline once.** When the authoring model or
  seat could not answer, the card read « I couldn't use I couldn't use the
  authoring model for this part for this part — … »: the recovery template
  wrapped its own « I couldn't use … for this part » around a caller that
  already said it. The caller's words are the headline now; the template
  adds the reason, what is kept, what did not happen and the ways on.
- **The first screen takes a model with the provider.** « 2 openai/gpt-oss-120b »
  was read as a provider named « openai/gpt-oss-120b » and the call went out
  as model « default »: a human who wanted a gateway row or a cheaper seat
  could not say so. The name splits now: the provider before the slash, the
  model kept whole (`openai/gpt-oss-120b`), for an API (2) and a local engine
  (3); « 2 mistral » still takes the provider's default.
- **The gap card never says « rephrase ».** Under « I read this as work but
  cannot build it yet », the hint said « rephrase with what to read, what to
  produce and where to write it »; it says « say what to read, what to produce
  and where to write it » now, the words the pack allows.
- **The intelligence screen names the gateway the bytes go to.** When a
  provider's base URL is overridden (an OpenAI-compatible gateway such as
  Scaleway's, a local server), the first screen lists « openai (through
  api.scaleway.ai) » and the locus line reads « openai-compatible gateway ·
  api.scaleway.ai · metered · project context you ask Nika to reason over is
  sent to api.scaleway.ai, not to openai » — where the data goes, said
  before the first provider-bound request.
- **The route, read against its own evidence (four quick wins).** Without
  any intelligence, a question about the pending question (« what
  happens if I leave it empty? ») is explained, not bound as its answer —
  a trailing `?` decides only in that fallback, a hint never a veto.
  `/details` lists the routes decided this session (phase · act · how ·
  the line's hash). « ● reading your line » is said while the
  intelligence routes an open line. The label call rides its own ceiling
  (1024 tokens, temperature 0) so a thinking model can reason inside it,
  and an intelligence that fails or answers blank is a FAILED route said
  in its own words (« the intelligence could not read it — say it again,
  or in other words »), never « no intelligence is available ».
- **The seat is never refused at the model question.** When the compiler
  asked which runtime model should run the language steps and offered the
  seat (« Enter takes your seat »), taking it was refused as unpriced
  whenever the seat's name has no catalog price (a gateway model, a legacy
  name the vendor still serves), and the question looped. The seat the
  human chose on the first screen passes; another unpriced cloud model is
  still refused in words; the priced hint now names models as the reasoner
  speaks them (`deepseek/deepseek-flash`, never a catalog row id).
- **The seat's offer says before Enter when the seat is unpriced.** Under
  the model question, « Enter takes your seat `…` » carried no price; the
  human took an unpriced seat, saved a clean proposal and heard NIKA-1709
  for the first time at « run it ». The offer now says « is not priced in
  Nika's catalog: a run under a spending ceiling would refuse it
  (NIKA-1709) » with the priced models of the provider. Enter still takes
  the seat.
- **What stopped an authoring, in words.** The compiler's fidelity
  reasons (« Candidate 0 is not feasible: dropped the recognized operation
  `draft` … », « the literal `00` is not in the request ») are said at the
  human's level: what the draft lost (« the draft lost « draft a short
  brief » (the draft step) »), what it dropped (« nothing reads or writes
  it any more »), what it invented (« a value (« 00 ») your request never
  gave »). Other reasons stay as the compiler said them.
- **A run refused before its first frame names its reason inside the
  viewport; the terminal's title returns; `Tab` on an empty composer
  lists the commands.** In the renderer a run refused at check (a
  workflow with no `permits:` block) or before the start (`NIKA-1709`, a
  file that cannot be read) showed only « run observed · exit 2 »: the
  machine lane prints those refusals as the check verdict document or the
  error envelope, lines without a `kind` the story dropped. The story now
  folds them into one line (« ✖ refused before the start · [NIKA-AUTH-006]
  invoke `nika:read` … · 1 more finding(s) — `nika check` lists them »,
  « ✖ refused · NIKA-1709 · … »). The title (`nika · <project>`) was set
  and never restored: the previous title is pushed on the terminal's
  stack (`CSI 22;0 t`) before ours and popped (`CSI 23;0 t`) by the same
  restore the panic hook and every exit path run. `Tab` on an empty
  composer shows every command in the hint row and inserts nothing. The
  lane's story fold and the child driver gain unit tests (a `/bin/sh`
  child proves the fold, the exit code, the trace and the pid slot).
- **A failed provider call names the seat, the wait and the fix.** Under
  the one spec code `NIKA-INFER-001` the infer verb now reads a failed call
  in three shapes: the transport's bounded backoff spent on a rate-limited
  or overloaded seat (the seat, the round-trips and the wait, still
  transient for an authored `retry:`); a schema refused at the door while it
  travelled natively (the seat, the wire, the provider's own identifiers,
  and the fix: simplify the schema or seat a model the catalog lists with
  `json_mode: schema`; the reply was never sampled); everything else as
  before. On success the receipt carries the transport's account
  (attempts, waited, statuses), summed across schema-repair round-trips
  like usage is.

### Security

- **Refuse credential-bearing and cleartext refund endpoints.** The
  bounded support composition rejects a refund endpoint whose query
  carries a credential-like parameter (`api_key`, `token`, `secret`,
  `sig`, `auth`) and a plain `http` destination other than a loopback
  development host, so a literal URL can never smuggle a secret into the
  workflow or POST a refund in cleartext.
## [0.120.3](https://github.com/supernovae-st/nika/compare/v0.120.2..v0.120.3) - 2026-09-19

### Added

- **Serve authoring door (foundation).** `POST /v1/compile` is the
  authenticated, bounded, synchronous HTTP transport of the same stateless
  Compile core as `nika compile`: exact-skeleton CREATE, constant EDIT from
  inline source and explicit literal answers return the candidate,
  questions, unknowns, requested boundary, source-only Check preview and
  provenance as data (HTTP 200 for `ready`, `incomplete` and `refused`). It
  creates no job, run, approval or trace, writes no file, names no host
  path and contacts no provider; ambient keys are never consent, and any
  cognition other than `deterministicOnly` is a typed refusal. The preview
  is a review, never admission: `POST /v1/jobs` judges a candidate again.
  The machine document is now projected once, by
  `nika_onboard::compile::outcome_document`; the CLI adds only `written`
  and its `compile_version` 1 output is unchanged. Both doors advertise an
  additive `compile` capability from their own separate lists, so clients
  can refuse an older resident instead of compiling locally with a
  different core. General language assembly, HOT/WARM/COLD resolution,
  setup requirements and suggested bindings remain absent.

### Fixed

- **Pending human approvals render task bindings.** Headless prompt messages and choices now use the same secret-marker renderer as the approval hash, so reviewers see resolved `with:` and `const` values before answering. Secret references stay masked; CLI and Serve wire shapes are unchanged.
## [0.120.2](https://github.com/supernovae-st/nika/compare/v0.120.1..v0.120.2) - 2026-09-19

### Fixed

- **The release train also tags `vX.Y.Z` on the same GHCR manifest.** The
  release page prints `v0.120.1` but the registry only carried `0.120.1`, so
  `docker pull ghcr.io/supernovae-st/nika:v0.120.1` answered 404. The publish
  step now converges the v-prefixed alias before the version tag, which stays
  the commit marker: a failed alias leaves the version absent so a re-run
  recovers, and an alias occupied by different bytes refuses with zero writes
  instead of moving it. `latest` is unchanged; already published releases keep
  their tags until an operator adds the aliases. Refs #1634.
- **Compile EDIT keeps the source around an edited constant.** Changing one
  constant replaced the whole accepted workflow with a re-serialized document,
  dropping the licence header, comments, key order and line endings. EDIT now
  replaces only the literal's own byte range for single-line scalars, flow
  collections and the `value` of a typed constant; a semantic no-op returns
  the exact source. The candidate must agree with both literal readers, so
  DEL, the C1 controls and U+FFFE/U+FFFF are written as `\uXXXX` and a later
  unrelated edit still works. Block collections, multi-line scalars and a
  value written by omission are refused with the source unchanged, including
  block forms CREATE itself emits; comments inside a replaced flow literal
  are part of the replaced range. Refs #1663.
- **Compile refuses integer answers it cannot hold exactly.** An integer
  literal above `u64::MAX` or below `i64::MIN` was decoded to a rounded f64
  before any guard ran and came back Ready, even into a `type: integer`
  constant: `18446744073709551616` was emitted as `1.8446744073709552e+19`.
  Every answer door (CREATE answers and the text, answer and structured EDIT
  inputs) now judges the answer's own text and refuses an integer token
  outside the exact `i64` range at any depth, naming the token and leaving
  the source or skeleton unchanged. Fraction and exponent answers remain
  floats and quoted digits remain text; this is a refusal, not arbitrary
  precision.
- **The ecosystem coherence bot reads live and served surfaces.** It compared
  the retired `supernovae.nika-lang` editor listing (frozen at 0.116.3) instead
  of the live `supernovae.nika`, and the site rows read raw files of a
  repository that is no longer publicly readable, reported as a permanent WARN.
  The bot now queries the live extension identity on both registries, reads the
  deployed site's engine version from `https://nika.sh/llms.txt` and its spec
  pin from the served well-known document, and a tag-pin or immune surface that
  stays unreadable past the 24-hour cascade window is a FAIL instead of a
  permanent WARN.
### Maintenance

- **Local commit hooks accept checkout paths containing spaces.** Hook arguments
  stay intact, so the required commit-message validation runs on the right file.
- **The benchmark runner targets the current checker crate.** It now invokes
  `nika-check`, so the checker benchmark runs instead of failing on the retired
  package name. This repairs the measurement path; it is not a performance claim.
- **Build dependencies and CI actions are refreshed.** The workspace keeps its
  existing Rust compatibility requirement.

## [0.120.1](https://github.com/supernovae-st/nika/compare/v0.120.0..v0.120.1) - 2026-09-18

### Added

- **Compile derives private pattern facets from the AST.** A comment that
  names `nika:fetch` is not network egress; a `permits.fs` key is not a
  task id; a real `nika:fetch` invoke is. Index cards require negative
  scope, including the reserved NONE / NO_COMPATIBLE_PATTERN miss. This
  is compiler metadata for #1666, not a YAML key, fifth verb or SDK noun.

### Fixed

- **Project schemas follow canonical program names.** The JSON Schema accepts
  `.nika` workflow references and preserves the project parser's relative-path
  restrictions. Source paths reject URI sources and control bytes in parent
  components as well as basenames. Native Windows paths keep their existing
  caller policies. Pack synchronization prunes excluded repository READMEs
  instead of embedding stale navigation.

### Security

- **A value read of a stage that CERTAINLY skips on « no » is a
  `NIKA-SEC-014` refusal.** A refused confirm settles `success`/`false`; a
  stage gated on the answer then settles `skipped`, and a value edge admits
  the skip (the binding reads defined-null), so a task that only read the
  stage's output still reached its verb on « no » under a clean `nika check`.
  The consent walk now continues past a closed gate over the value-carrying
  edges and judges each task with two readings of one GATE-v2 fold: cancelled
  in every refusal run is silence (a same-producer `after: { stage: success }`
  cancels the reader); its verb reached in every refusal run is the refusal
  (the finding names the skipped stage) — which requires the stage to skip
  FOR SURE: plain-read bindings and a `when:` that is false with no step able
  to error first, with or without a `for_each` (the gate runs before the
  fan-out expands). Everything else stays the advisory hint, never the code:
  a laundering hop, an independent `after: { x: success }` prerequisite, a
  `when:` that may error before it decides — and a gated stage whose OWN
  bindings navigate or compute (`tasks.merge.output.report`), where the
  refusal can still reach the reader and its effect stays observable. That
  gap is reported, not closed: no verb is ever assumed to succeed, and routes
  that cross no closed gate keep their verdicts and wording unchanged.
## [0.120.0](https://github.com/supernovae-st/nika/compare/v0.119.0..v0.120.0) - 2026-09-18

### Added

- **Scheduled beats carry per-beat inputs.** An `arm:` entry may declare
  `inputs: { tenant: acme, limit: 5 }` — the `--var KEY=VALUE` pairs every
  fire binds to the workflow's declared `inputs:`, so a tenant-parameterized
  workflow is armed once per tenant instead of rendered once per tenant with
  hardcoded defaults (`NIKA-1708`). One scalar per key, coerced by the declared
  type at admission exactly as a run's `--var` is; a key the workflow does not
  declare refuses by name before any claim is written. A beat without inputs
  keeps its exact generation and schedule revision.
- **A resumed leg names the trace it continues.** `nika run --resume <trace>` journals `resumed_from` (the resumed journal's trace id) on its boot manifest, says it on `run_settled`, and `nika trace ls --json` lists it, so a continuation renders as one leg chain instead of a nonce lookup.
- **Serve named-job inputs.** Accept literal JSON input values on named job
  requests, validate declared keys, types and required values before
  admission, and carry them through durable recovery to the production runtime.
  Bind input values into job evidence, record the API caller origin, preserve
  access pins and frozen workflow bytes, and reject snapshot overlays, null
  input maps and unknown request fields.
  Advertise `jobInputs` so clients can refuse older residents before sending
  values those residents could silently ignore.
- **Literal native run inputs.** `nika run --inputs-json -` accepts bounded JSON-object stdin with typed validation and `api-caller` origins; `--sdk-identity` advertises `inputsLiteral`, while existing `--var` semantics remain unchanged.
- **Stateless Compile foundation.** Add structured in-memory requests,
  outcomes, stable questions and source-only Check previews. Exact embedded
  skeletons accept explicit answers; unsupported intent stays incomplete.
  Textual and structured constant edits share one operation and guarded
  assembler, preserving canonical literal values and unrelated semantics.
  Compile performs no workflow effects, credential probes or model calls.
  This is a bounded foundation for #1663; natural-language composition,
  Graph and SDK/Serve adapters remain separate work. The CLI authoring
  door is `nika compile` in this release.
- **Offline text-only agent probes.** `mock/text` returns deterministic text
  even when tools are offered, allowing completion and budget refusal paths
  to be exercised without a paid provider. `mock/echo` keeps its existing
  tool-call behavior.
- **Eight bounded native authoring skeletons and their shared lessons.**
  Add bounded batch, record validation, snapshot comparison, deduplication,
  field projection, parallel review, optional-file recovery and aggregation.
  Their filled lessons are generated from the same canonical sources used by
  the documentation, with golden outputs and runtime boundary cases.
  `nika compile` names a skeleton's filled precedent, and MCP `nika_template`
  accepts `filled: true` with an exact template name. The native authoring
  gauntlet now runs in CI. Generic filler words no longer count as evidence
  for selecting a specific workflow.

### Changed

- **One Compile authoring door.** Replaced the retired authoring command and wizard with `nika compile`, using the stateless Compile core for exact skeletons, explicit constant edits and the offline hello lesson. Structured questions remain incomplete without substitution or implicit writes; Ready candidates require an explicit destination and overwrite requires `--force`.
  The adapter and atomic materializer use the existing CLI host member; the
  compiler core remains independent in onboarding. The native authoring
  gauntlet now consumes structured previews and explicit answers.
- **Canonical program files are `*.nika`.** Live disk discovery, CLI
  capture, Serve registry names, cadence references, DAP inventory,
  session grounding and Compile materialization accept lowercase
  `.nika` only. `.nika.yaml` / `.nika.yml` are retired with an
  actionable rename diagnostic; `nika.yaml` remains the project file
  and `.nika/` remains runtime state. Parser source-string and stdin
  APIs stay filename-independent. The embedded pack is vendored from
  nika-spec `e255dbf72336bcb98c8163cd8c087e023051a5ab` via
  `scripts/sync-pack.sh`.
- **Agent examples and authoring guidance.** The agent-loop skeleton and
  code-review example now teach explicit completion and bounded result repair.
  Guides distinguish cumulative input/output token budgets from per-request
  context windows and monetary cache pricing. Workflow values and existing
  golden outcomes are preserved.
- **Explicit agent completion (breaking).** From the 0.120 development train,
  an `agent:` task whose effective whitelist grants `nika:done` requires an
  explicit completion call. Text-only plans receive feedback to continue or
  finish within the existing turn and token budgets. Without the sentinel
  grant, natural text completion remains available; exclusions are respected.
  This prevents a plan-only run from falsely reporting success (#1519).

### Fixed

- **The codex infer seat is re-attested at spawn.** PATH presence admitted
  the seat and an 8-line shell script named `codex` that spoke the event
  shape received the full prompt and was believed. The one-shot now probes
  `codex --version` before any prompt is written: the answer must name
  `codex-cli` and sit inside the 0.149 floor, the attested version rides the
  outcome, and the output schema lands owner-only instead of world-readable.
- **`weekly-radar` and `pr-review-fanout` run green under the macOS
  seatbelt.** The confined `git` cannot read a `.git` no `permits.fs.read`
  names, and granting it would complete the NIKA-SEC-009 trifecta. Both
  examples now recover an explicit "unavailable" value the prompt repeats and
  the outputs carry, never an empty week or a clean bill of health.
- **The mock agent plan never invents a filesystem path.** The offline
  rehearsal called the first granted tool with `path: "mock"`, a path outside
  every lane a workflow could declare, and the boundary refused it hard
  (NIKA-SEC-004), so `snippets/delegate` died under `--model mock/echo`. A
  first-granted tool that reaches `permits.fs` now defers to a granted
  `nika:done`, or answers in text when no sentinel is granted.
- **The hygiene privacy scan judges tracked text consistently across platforms.** Arbitrary compressed GIF/MP4 bytes no longer masquerade as private source paths under Linux Git. The mutation suite proves Git's binary exclusion while preserving the existing text mutation cases and public-path exceptions. Classification follows Git, not file extensions; this scan does not inspect readable strings inside files Git treats as binary or claim format-aware inspection of media.
- **Changelog assembly preserves permissions on GNU and BSD systems.** The mode lookup discards output from a failed `stat` invocation before its fallback, preventing Linux filesystem metadata from reaching `chmod` and blocking release tooling. Disposable-repository tests prove native and partial-output fallback folds retain mode 640 and consume the fragment from the working tree and index.
- **Check immutable exec programs before launch.** Resolve bare const-backed argv programs, including indexed references, against `permits.exec` even when later arguments are computed. Input defaults remain replaceable at run time; the permissions panel explicitly defers computed programs to runtime enforcement.
- **Explain reuses value-authority lessons.** Offline explain reuses the parser’s value-authority teaching for retired vars/env forms and presents exec-shape guidance on both CLI and oracle doors.
  Scalar exec bodies and string commands share the full grammar and migration guidance with explain. The lesson stays intact in parse-fatal JSON without including the source frame.
- **Exec shape refusals teach both command forms.** Scalar exec refusals and offline explain share pasteable command-argv and explicit-shell examples, with the check --fix migration pointer.
- **Authentication failures teach the offline route.** Provider authentication refusals share the INFER-001 explanation: present keys are not pre-probed, a mock rehearsal requires removing per-task model pins, and another configured access path can be selected explicitly. Mocked streaming and non-streaming provider matrices retain a single request and terminal auth classification.
- **Run help states the scope of a model override.** `--model` replaces only the current workflow’s default model. Task pins and invoked children keep their own models, and choosing `mock/echo` does not make their calls or other effects offline.
- **Model overrides explain the model selections they leave in place.** Check names explicit infer and agent pins and child workflow invocation sites. Human runs with `--model` repeat that admitted scope before provider dispatch, after task selection; the chosen models, access planning and machine output formats remain unchanged. Quiet mode retains its existing announcement policy.
- **Unpriced cloud models and preview budgets are explicit.** The check cost
  table distinguishes unpriced catalogued cloud models from local models and
  unknown provider/model names. The `run --dry-run` help names its budget
  exemption; previewing does not judge `--max-cost-usd`.
- **Keep unresolved exec grants comment-only.** `nika check --infer-permits` no longer substitutes `exec: ["sh"]` for a shell body that the runtime cannot admit under a program allowlist. Human and JSON output teach an argv rewrite or explicit program resolution without printing a maximal grant.
- **Secret-output refusals teach both repair choices.** Remove the output or explicitly sanction its export while preserving existing egress rules. Human and JSON findings share the repair. Local secret usage reports declared egress rules instead of falsely claiming no effect; external sanctioned flows retain their warning.
- **Exec-floor refusals name the script permissions.** Interpreter repairs name both the executable allowlist and the script's read grant; SEC-001 explains the blocked classes and a confined script-file invocation, without suggesting an internal bypass flag.
- **Trace show and replay expose recorded gate decisions.** The human read shows each gate's question, answer, decision, source and declared operator in journal order, including refusals. Older missing fields remain explicitly unrecorded. Values are quoted to escape terminal controls, retained without truncation, and read without changing the journal or consulting today's workflow or operator.
- **Name the correct file for composition permission repairs.** `nika check`
  distinguishes absent and empty child permissions from a refusing parent.
  Conservative intersection refusals name both declarations without falsely
  blaming either side. The permission intersection and runtime authority are
  unchanged.
- **Refuse agent tools with no filesystem authority.** A granted filesystem tool now reports an empty required read or write side before the run, teaching either a scoped path grant or removal of the tool. Nonempty path coverage remains a runtime judgment; pure and call-dependent tools retain their existing rules.
- **Shared fix success messages name the live shape.** The shared fix ladder describes the task map it actually repairs, so CLI and oracle success messages no longer invent a workflow object or rely on CLI-only string replacement.
- **Fix repairs retired task fields without guessing shell commands.**
  CLI and MCP repairs map invoke.params to args, sequence-shaped exec.argv
  to command, and scalar/list for_each collections to items. Conflicting
  or opaque keys stop the migration pass; payload text, comments and line
  endings stay intact. Unsupported layouts keep their original finding.
- **Doctor explains an alternate HOME even in captured output.** Compare HOME with the account database instead of guessing from temporary path names; if the account is unavailable, say the comparison is unknown. HOME selects Nika’s home but does not clear other environment variables. The warning preserves doctor’s exit status and stays off its JSON surface, including on a terminal.
- **Actionable HTTP authentication failures.** Serve authentication errors distinguish an absent credential from an invalid or mismatched bearer token, without exposing credential bytes or changing authentication checks.
- **Discoverable health endpoint.** Serve unknown-route errors teach the canonical public `GET /health` endpoint while preserving authentication on `/v1/` paths.
- **Hello scaffolds teach a small local model and the inference timeout.** The optional local seat is qwen2.5:0.5b instead of a reasoning model. Buffered timeout errors retain their actual duration and explain the 300s local / 30s cloud defaults, the task-level `timeout: 7m` override, and the separate streaming idle guard. New workflows keep their existing offline rehearsal default; transport deadlines and retry classification are unchanged.
- **Filesystem permit refusals explain path spelling.** The diagnostic names
  the requested path and declared boundary and explains possible aliases such
  as `/tmp` and `/private/tmp` on macOS. It teaches consistent spelling before
  changing grants, without resolving symlinks or widening permissions.
  The failure plan projects filesystem refusal facts instead of recognizing
  diagnostic prose, and preserves `NIKA-AUTH-006` for an absent boundary.
- **Explain missing cadence time zones on the HTTP API.** A zoneless
  schedule cadence now produces an English refusal with the exact
  `TZ=<IANA zone>` repair on the public wire.
- **Serve shutdown has an explicit queue and recovery contract.** The shared
  30-second drain on SIGINT/SIGTERM, interruption at grace expiry, and queued
  snapshot recovery are documented and covered by forty-job and isolated
  signal/SIGKILL tests. The systemd unit allows 45 seconds for drain and cleanup;
  filesystem or backend cleanup is not claimed to have a hard deadline.
- **Large fan-outs retain their item evidence within the journal bound.**
  Large tables use ordered `task_items` pages and a terminal summary;
  trace readers reconstruct them only when every page and count agrees.
  Small tables keep their inline shape. The 1 MiB line and 256 MiB file
  bounds remain in force, including for oversized individual outputs.
- **The approval claim store is pruned.** A resume that opens `~/.nika/approval-claims` removes the claims whose ticket expired more than the trace retention window ago, and says how many it removed; a claim inside the window stays a live replay guard.
- **Expose resident store formats and pin v3 evidence.** The public
  `/health` response reports `storeFormatVersion` for jobs and schedules
  from the stores' own version constants. A frozen jobs v3 fixture pins
  queued and settled records, receipts, event hashes, the writer stamp and
  incarnation without rewriting evidence on read.
- **Prove named admission across path replacement.** Deterministic HTTP
  route tests replace files and directories with symlinks between lookup
  and capture. Both refuse before creating a job or entering the backend;
  receipts retain the captured snapshot digest when regular files change
  before or after capture.
- **Resident journal loss is visible without changing execution status.**
  Jobs and SSE expose a durable `evidence.status: mirror_lost` with a
  bounded reason after journal open, write, finalization or record refusal.
  Lost mirrors advertise no chain head; `nika doctor` reports the affected
  jobs. Historical records without loss metadata make no new claim.
- **Expose uncertain trace liveness.** `trace outputs --json` reports the writer lease as alive, dead or unknown separately from run settlement, with null liveness after settlement. Human `trace ls` marks an unjudgeable writer as `running?`; existing machine state words remain stable.
- **Task-relative nested timeout regression.** The nested-workflow timeout regression now measures the parent task interval from its timeout receipt instead of including process startup and preflight. It also verifies the timeout code, child journal and absence of successful child completion.
- **Proven prompt gates avoid redundant hints.** A blocking human gate credited by the Trifecta judge no longer adds a `headless-prompt` advisory, allowing the gated workflow to reach zero hints. Uncredited prompts retain their guidance, and a prompt with `default: false` still cannot mitigate `NIKA-SEC-009`.
- **`nika:grep` refuses files outside its read grants.** A directory-only
  grant now returns `NIKA-SEC-004` before reading an ungranted file, instead
  of reporting no matches or partial results as success. Grant both the
  search root and its files, for example `./notes` and `./notes/*`.
- **Expression errors list the callable forms the engine accepts.** Unknown
  global and method calls now teach `size(x)`, `has(x)`, `x.size()`,
  `x.contains(s)`, `x.startsWith(s)` and `x.endsWith(s)`, as does
  `nika explain NIKA-VAR-005`. The help derives from the definitions used
  by both parsers and runtime dispatch; accepted syntax is unchanged.
- **Value-shape guidance for data tools.** Teach `nika:jq` and `nika:validate` callers that input is a value, never a file path to read, and explain explicit JSON decoding when an object or array is intended while preserving legal string values.
- **Isolated release-train rehearsal.** `nika try release-train` now stages an isolated demo release and supplies its rehearsal version, reaching the conductor gate offline instead of failing on a missing input. Explicit `--var` values retain precedence; the canonical example and `nika compile` keep the required production version without a demo default.
- **Model overrides preserve admission refusals.** Model overrides now revalidate workflow composition and MCP server configuration on both check and run, refusing missing servers instead of returning a successful check report without execution. Human MCP diagnostics retain the same registry explanation as JSON.
- **Unwind cleanups resolve their own `with:` bindings.** Tasks joined by
  `after: { parent: unwind }` now materialize bindings before their `when:`
  gate and verb, using the run's value authorities and the parent's fresh
  record. Invalid bindings are journaled without dispatching the cleanup
  or changing the parent's outcome; subsequent cleanups still run. Resolved
  values retain their provenance and remain subject to workflow permissions.
  Exercised cleanup taint lifts record the cleanup identity, justification,
  and resolved value digest; skipped or unresolvable cleanups record no lift.
  Live display and trace replay attribute cleanup witnesses to their declared
  unwind rows and distinguish success, failure, skip, timeout, and an attempt
  without a recorded outcome; cleanup does not inflate main-task settlement counts.
  Shared cleanups retain each parent's outcome using the execution lane's
  attachment indices; a successful attachment cannot erase another's failure
  or supply a result to a following cleanup. Final cards use the same main-only count.
- **Unknown command-form panics carry no command payload.** The five forward-compatibility refusals in command scanning, static argv analysis, permission checking and inference keep their failure signals without formatting command data into panic output. Both current command variants remain handled explicitly.
- **`nika:jq` binds the keys of an object `input:` as jq variables.** An
  identifier-shaped key becomes `$key` (the `jq --argjson` shape), so « stamp a
  sibling onto every row » is `$rows | map(. + {batch: $batch})` instead of the
  `. as $in` dance or the silent `null` that `.batch` read inside `map` yields
  under jq's own semantics, which are unchanged; `.` stays the whole input and
  the run-start clock variable is never shadowed (#1578).
- **The xai catalog entry describes the models it lists.** The provider
  advertised "Grok-3, Grok-4" and a `vision` tag while its list carried only
  grok-3 and grok-3-mini-fast, both text-only per xAI's docs; an author
  reading the prose would pin `xai/grok-4`, which `nika check` then names as
  outside this binary's snapshot. The description now names the listed
  models, the `vision` tag is dropped until a listed model accepts image
  input, and a catalog test pins the rule for every provider.
- **Doctor no longer prints the unset media fallback as a listener.** The
  image and tts rows rendered `local → http://localhost:8080 default` under
  `ok` when `NIKA_IMAGE_LOCAL_URL` / `NIKA_TTS_LOCAL_URL` were unset,
  reading as a wired path on the most contended local port. Doctor never
  probes the media planes, so the rows now name the backend as unset,
  disclose the engine fallback as unprobed, and mark a set URL as
  configured, never reachable.
- **The pricing row says how old its snapshot is at every level.** A
  47-day-old price table rendered as an unqualified `ok`, so every cost
  ceiling derived from it read as current; the identity line now carries `N
  days old` (or `age unknown` when the clock cannot be compared), and the
  stale branch keeps its threshold and its upgrade fix.
- **A present cloud key is a path a run can start on.** `nika doctor --json`
  and `nika welcome --json` reported `seats_ready: []` on a host whose
  `XAI_API_KEY` was set and whose `best` path named xai: the list held
  harness seats only. It now names every path a run can start on today, the
  ready harness seats first (ratified order) and then the configured keyed
  cloud paths; the `--access` pins keep their own reader, so the adoption
  ladder and the seat-escape tail never mistake a key for a seat, and a
  keyless local seed still never enters (presence is not detection).
- **`nika:convert` reads a string input as JSON text under `from: json`.** A
  JSON document handed over as a string — an exec stdout, a `nika:read`, a
  `recover:` literal — is parsed the way every other `from:` format reads its
  text, so `to: csv` no longer refuses it with « CSV output needs an array of
  objects »; a string that is not JSON text stays the string value it always
  was (#1584).
- **Shallow `welcome --json` reads the trace store for `nothing_has_run`.**
  The field was a router constant (`true`) while the same cwd held hundreds
  of sealed traces and `--deep` counted them, so an agent following the
  short door would offer `nika compile` to a project that had already run and
  spent money. It is now `true` only while `.nika/traces` is empty (the same
  count the adoption ladder climbs on), and the machine mirror carries that
  count as `machine.recorded_runs`.
- **A foreign journal refuses on resume.** `nika run <file> --resume <trace>` now refuses (exit 3, the cross-project posture) when the journal names another `nika:` id, saying both workflows and both content hashes; the « file CHANGED » notice is kept for the same id with edited bytes.
- **Run machine refusals use compact JSON lines.** `run --json` emits one
  compact object for Check and budget refusals, preserving real finding codes
  before execution. Successful and failed admitted runs keep their NDJSON
  lifecycle stream; human rendering and `check --json` are unchanged.
- **Agent exclusions no longer demand authority.** Negative tool rules such as
  `!nika:done` no longer produce a spurious permission refusal during static
  checks or runtime dispatch, or appear as required grants in inferred
  permissions and task capability projections. Positive tool grants retain
  their boundary checks.
- **Stable incremental builds.** Build identity watches only existing Git
  paths. An absent `packed-refs` file previously made every Cargo invocation
  rebuild the runtime, including every CLI probe in the WASM differential.
  Packed branches watch their existing ref directory so a new loose ref still
  refreshes the embedded commit. Both build-script consumers also watch their
  shared helper source so edits invalidate cached build scripts.
- **Build identity follows the current worktree.** The runtime and runtime-laws build scripts resolve Cargo's current package directory when executed, so a cached script cannot stamp a neighboring checkout's Spec pin into the build; a relocation regression exercises both real scripts across two distinct pins and rejects missing or inconsistent identities.
- **Unix cancellation keeps its signal subscriptions for the whole run.**
  SIGINT/SIGTERM are registered before dispatch and retained between the
  graceful cancel and immediate abort, closing both subscription windows.
  CLI signal and cross-door settlement tests hold a task on a controlled
  FIFO and wait for cancellation acknowledgement before releasing it, with
  exact task counts and sealed-trace checks instead of timing sleeps.
- **Agent guidance loads the details relevant to the task.** Workflow
  authoring uses focused references, and `nika init` includes those
  resources so generated projects can follow every skill link. Contributor
  and plugin prompts preserve scope, authorization and completion while
  clarifying mock effects, cost estimates and trace evidence.
- **Actionable hygiene failures.** The dashboard preserves complete multiline
  diagnostics in quiet tables and JSON, including embedded pipes and quotes.
  A successful first child can no longer hide a later failing self-test.
- **Reliable project initialization.** `nika init --wire detected` preserves
  the detected-client scope instead of substituting `all`. Both init paths
  propagate wiring failures; a refused wire no longer produces a ready panel.
  New projects receive a human `NIKA.md` guide, file-purpose receipts, Git
  guidance and an explicit offer for shared project settings. Claude project
  hooks ship beside Cursor hooks, with project-root paths and canonical scripts.
  Existing files remain preserved. The optional `nika.yaml` receipt carries
  its status marker before the next-command block.
- **Manual issue proof checks read the issue.** Workflow dispatch fetches one
  current closed-issue snapshot instead of judging empty event fields. The
  body, labels and close reason reach the same proof gate as normal close
  events. Fetch failures and invalid snapshots stop without reopening or
  commenting on the issue; an actual missing proof still refuses the close.
- **Private OIDC failure diagnostics.** A failed npm release publish distinguishes rejected OIDC exchange from publication refused after successful authentication. Diagnostics use fixed messages and remove private debug logs without printing their contents.
- **Interrupted gates stop safely.** An interrupted pre-push gate now exits after its active child finishes instead of releasing its lock and continuing. Interrupting lock acquisition also cleans up a newly acquired lease without leaving later pushes blocked.
- **Manual release replay reuses the original signed payloads.** Native
  archives, their checksum manifest, and the npm tarball and sidecar are
  fetched by stable release asset IDs, with missing or changed inputs
  refused. A single selected payload feeds all downstream consumers;
  replay attestations are checked before publication, while tag pushes
  retain their generated bytes and all existing release barriers.
- **Runtime conformance models.** The check/run verdict oracle preserves a
  fixture's declared root `mock/*` variant on both sides. Its blanket
  `mock/echo` override previously changed the new text-only completion and
  budget probes into tool-calling runs. Live catalog models still run with
  the offline echo override.

### Security

- **Reject TLS 1.3 handshake messages across encryption-level boundaries.**
  Update rustls to 0.23.45 in the engine, fuzz and ACP quarantine lockfiles
  for [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html),
  with rustls-webpki 0.103.15. Existing dependency policy remains enforced.
## [0.119.0](https://github.com/supernovae-st/nika/compare/v0.118.7..v0.119.0) - 2026-09-12

### Added

- **The card names the prompt side of the bill.** The totals row said ` · 1 tok` for a 5015-token prompt answered in one token, so a cold run and a warm-cache run were the same sight; it now prints ` · 5015 in · 4992 cached` beside the historical `tok` segment when the frame carries the split, and renders byte-identically to before when it does not.
- **Executable file-read hints.** `nika check` hints when `grep`/`rg`/`ag` names a literal file operand: if that program opens the cwd-resolved path for reading, check `permits.fs.read`. `-e` patterns, `echo`, and `touch` stay silent. The hint does not assert a missing grant.
- **The OTLP projection carries the `GenAI` usage counters.** `nika trace export` now emits `gen_ai.usage.input_tokens` · `gen_ai.usage.output_tokens` · `gen_ai.usage.cache_read.input_tokens` · `gen_ai.usage.cache_write.input_tokens` · `gen_ai.usage.reasoning.output_tokens` (semantic-conventions v1.37.0) with `nika.tokens.*` mirrors, plus `gen_ai.response.model` and `gen_ai.response.id` when the provider reported them. Counters only — an unreported meter is projected as nothing, never as a zero.
- **Durable per-job access pins.** A `POST /v1/jobs` by-name body may carry `access`, the same pin as CLI `--access`. Absent, the job inherits the resident's unpinned plan. A pin is a pin: a failing seat is the job's refusal, never a silent substitute.
- **Restore private project conversation history.** Bare `nika` restores the local project's conversation after reopening. Private history detects corruption, excludes concurrent writers and keeps interrupted operations visible; previous proposals and gates require fresh validation instead of replaying effects.
- **Every shipped template now owns a declared-code counterexample.** The five existing negatives stay; nine skeletons (`chain`, `fanout`, `gate-and-act`, `agent-loop`, `api-upload-and-create`, `docker-report`, `etl-state`, `media-asset-pack`, `website-brief`) gain a specimen that fails for the law the skeleton actually teaches (DAG hoist, fan leash, secret egress, agent grant, argv exec, trifecta, undeclared write, SSRF). The family test requires a negative for every `nika_pack::template_names()` entry, not a hand-typed five-name list.
- **The token usage split rides every metered trace frame.** `task_completed` and `task_failed` now carry `tokens_in` · `tokens_out` · `tokens_cache_read` · `tokens_cache_write` · `tokens_reasoning` · `model_served` · `response_id` beside the `tokens` they always carried (which keeps its meaning: the completion count). A reader can recompute `cost_usd` from the split × the pricing table the run pinned at boot, so a warm-cache call at `$0.000378` and a cold one at `$0.00075285` are no longer the same sight; an unreported meter stays absent, never a fabricated zero.

### Changed

- **« chosen over … » names the seat it beat.** The `nika check` ACCESS rung and the `nika run` announce list the outranked ready paths with the witness the plan built (``chosen over api (ready · ranked below `codex` (harness outranks api))``) instead of a bare count, so a user learns which seat lost — and why — without opening the JSON.

### Fixed

- **An ancestor `nika.yaml` this process may not read is a hint, never a
  refusal.** A nested `nika check` under an exec sandbox (the Lab's own L0
  campaign, a CI job in a monorepo) met the repository's root project file
  with `EPERM` and exited 3 on `project.unreadable`, masking every finding
  of the workflow itself; `nika run` refused the same way. The walk now
  reports the unreachable ancestor (`↳ HINT [project] … is not readable from
  here`, `project_unreachable` in `check --json`, a `project:` note on the
  run's stderr) and that file's `ceiling:` simply does not govern from
  there. A file that reads but will not parse, and every other read error,
  keep their refusal (#1494). Closes #1547.
- **The access-harness CI leg runs one process per test.** The feature battery now uses cargo-nextest like the tests leg, so a fixture that enters a temporary project cannot change the ambient context of a concurrent `check` test; the selection and `--lib` scope are unchanged.
- **Model-proven access readiness.** A harness seat is ready only when proven for the model asked. Installed and signed-in are weaker rungs: they rank below a key-backed api for an unpinned model. A pin stays a pin.
- **Typed access-refusal evidence.** `access_refused` on a terminal frame is a proven seat/access refusal (NIKA-1800..1805, an infer harness-access miss, or a harness error wrapped as agent inference). A tool, max-turns, or schema failure after a seat already ran is not a pin.
- **`nika check` accepts cumulative agent budgets above a model's context
  window.** `max_tokens_total` bounds usage across turns, while the context
  window bounds one request. Comparing them rejected valid multi-turn
  budgets, including 120,000 tokens on a 64,000-token seat (#1518).
  Per-request `infer.max_tokens` capacity checks and the agent's runtime
  token accounting remain unchanged; this does not certify that each
  growing agent request fits the seat.
- **A typed `agent:` task's `nika:done` definition keeps an internal `$ref`
  resolvable on the wire.** The declared `schema:` rides nested under the
  sentinel's `result` parameter, and a JSON pointer such as
  `"$ref": "#/$defs/row"` resolves against the document root, which on the
  wire is that wrapper: the definition now hoists the schema's
  `$defs`/`definitions` to the wrapper's root and drops a `$schema` keyword,
  so a seat that validates its tool input follows the pointer to the
  definition instead of to nothing. A schema without definitions renders
  exactly as before, and local validation is unchanged.
- **Typed agent completion keeps definitions inside their schema resource.**
  When the output schema has a resource `$id`, `nika:done` keeps its `$defs`
  and `definitions` with that resource so local references resolve in the
  exposed tool definition. Schemas without a resource ID retain the existing
  wrapper projection; final-output validation is unchanged.
- **Typed `agent:` final-text repairs respect `max_tokens_total`.** When
  the final text does not match the task schema, each additional repair
  checks the cumulative token budget, including usage from earlier
  `nika:done` repairs. An exhausted budget returns `NIKA-AGENT-002` with
  the last assistant text and observed usage instead of requesting another
  answer. This partial output stays separate from the `nika:done` result
  being validated and updates with each text repair. An empty current message
  is preserved even when an earlier tool-loop reply contained text.
  A conforming answer still succeeds at or above the budget. This also
  covers result-less, string and null `nika:done` answers that need the
  final-text repair path.
- **An `agent:` loop no longer spends past `max_tokens_total` on `nika:done`
  repairs.** A `result` that misses the declared `schema:` is fed back for a
  repair, and that repair is one more provider request: when the tokens
  already spent meet the budget, the request is not made and the run ends on
  the budget verdict (`NIKA-AGENT-002`), the same gate a tool dispatch
  passes. Previously the repair turns bypassed that gate, so a run could
  exceed the author's budget by up to `DEFAULT_SCHEMA_RETRY_BUDGET` requests.
- **An `agent:` task's `schema:` reaches the seat on the first request, and
  a `nika:done` result that misses it is repaired instead of fatal.** The
  loop-owned `nika:done` definition now carries the declared schema on its
  `result` parameter, the one binding every wire sends verbatim (including
  the seats whose API has no structured-output mode), so the model reads
  the exact shape instead of guessing it from the prompt. A `result` that
  fails validation goes back as that call's error observation and the
  model finishes again, drawing on the same `DEFAULT_SCHEMA_RETRY_BUDGET`
  the free-text re-ask uses, and the NIKA-464 verdict now says how many
  repairs were tried. Previously the first request carried no schema, and
  a non-conforming `nika:done` result died at once while a prose answer
  got two repairs.
- **An `agent:` task's `timeout:` now governs every provider call of its
  native loop (#1516).** Each turn's request, the `nika:done` repair turns and the
  final tools-off re-ask carry the task budget to the transport deadline,
  the way an `infer:` task already did, so a slow seat is no longer cut at
  the transport's 30 s cloud default on its first turn (measured on 0.118.7:
  agent tasks declaring `timeout: "840s"` failed with `NIKA-INFER-001` at
  30 002 ms while the same seat under `infer:` completed). Without a
  `timeout:` the transport's per-provider default still applies; a seat-routed
  (harness) agent is bounded by the task's own deadline, not per call.
- **Bounded commit changelog preview.** The optional post-commit preview stops after a three-second work budget, with bounded child reaping, so a stalled git-cliff cannot hold the commit indefinitely. Missing tools and preview errors keep the hook optional.
- **The failing `check` verdict carries the boundary summary too.** The one-line plain-words blast radius (tasks · waves · permits glance · est · hints · risk grade with its cause) was printed only once a file was already clean, so the over-broad workflow — the one an ops lead most needs summarised — got no boundary line and no grade at all; the red verdict now carries the same tail from the same derivation, still marked `✖`, never the word `audited`.
- **`risk unbounded` names the grant it was graded on.** The audited line and the `--profile operational` footer blamed « no dollar meter for a local/unknown model » (and « uncapped autonomy ») on any Unbounded file, including a builtin-only `mock/echo` workflow whose only ceiling-less thing was `write: ["./out/**"]`; the handle now names the wildcard grant (`fs.write ./out/**` · `exec: true` · `net.http *`) with the `--infer-permits` door that narrows it, and speaks of a meter only when spend is unbounded (`nika_check::wildcard_grants` is the shared projection).
- **`nika check --json` says `clean: false` whenever it exits 2.** Under `--native-strict` and `--profile operational` the lane's refusal is now a typed `findings[]` row (`kind: native_strict` with the hint's `native-first/00N` code, task and fix · `kind: operational` with the grade or the access blocker, each only when its own gate failed) and `clean` is computed from the same rows the exit code reads; `native_strict_clean` and `operational_clean` stay and repeat it. Measured on 0.118.7: a human-gated ship whose check ran `curl` answered `clean: true` beside exit 2, and the operational footer told a low-grade file with a refused access pin to cap its spend.
- **`run ready` no longer reads `○` on a workflow that never dials.** A file with no `infer:`/`agent:` task shared its glyph with a file whose model only arrives at run time, so a workflow that ran 3/3 green was told `access ready ○ · run ready ○` with no blocker named and no flag able to move it; the moot question now reads `access ready n/a · nothing dials` and lets the three answered layers settle RUN READY, while the genuinely unjudged shape keeps `○` and defines it on the same line.
- **Check reports invalid ambient project configuration.** Workflow checks
  retain the nearest project's diagnostic and exit 3, including scaffold
  and snapshot export callers. Valid project budgets and direct project
  checks keep their existing behavior.
- **Isolate the local test fallback.** Without cargo-nextest, run library tests serially so temporary project directories cannot change a concurrent test's ambient context. Nextest and the required CI test scope remain unchanged.
- **`nika check` names a documentation host before the run refuses it.** A literal `nika:fetch` to `example.com` or a `.test`/`.invalid` name (RFC 2606/6761) carries a `documentation-host` hint at check that names `NIKA-BUILTIN-FETCH-001`; the boundary is unchanged, so `--infer-permits` still grants the host (the runtime allowlist judges it before the transport declines to dial it) and the inferred block re-checks clean.
- **`--dry-run` previews the boundary, and its `blast` line no longer means something else.** The line labelled `blast` reported scheduling fan-out (`grab blocks 1` — how many tasks stall when one fails), which reads as blast radius to every operator who types the flag, and the preview printed no permits and no risk at all; the fan-out is now `stalls  \`grab\` fails → 1 task blocked · a blocked task never runs, so its effects never happen`, the capability escapes keep the name `escapes`, and a `boundary` line carries the check card's own permits glance and risk grade from the one shared derivation.
- **Cancel owned exec process groups.** On Linux and macOS, cancellation, timeout and dropped exec futures now signal the command’s dedicated process group, including when a descendant holds output after its parent exits. The unreaped parent retains the group identity until collection ends. Cancellation registrations and post-confinement scratch are released on drop; this does not claim cleanup acknowledgement or containment of descendants that detach from the group.
- **Confinement path diagnostics.** A seatbelt confinement refusal names a path only when stderr identifies it. `sandbox-exec` `file-read`/`file-write` evidence is distinct from a `prog: path: EPERM` line (class unknown). A named path is not proof a grant is missing (OS ACLs can deny a granted path). `nika explain NIKA-SEC-001` tells the author to check read/write authority and OS access; unknown stays unknown. A `unix://` URI on a denial line names the socket. The docker-report template does not promise Linux socket reachability.
- **`nika explain` names the nearest code when yours is a typo.** A code no rung could serve printed the allocated ranges and stopped there, so a mistyped `NIKA-PARSE-01` left you guessing at a registry you cannot list; the 404 now ends with `did you mean \`NIKA-PARSE-001\`?` when the canon's own `error_codes` table holds a near neighbour, and stays silent when nothing is close enough (the engine's one `did_you_mean` metric decides — a wrong suggestion is worse than none).
- **`nika explain` no longer suggests `--model mock/echo` over task-level pins.** On a file whose tasks pin their own `model:`, the run section prints the caveat the envelope-model hint already states instead of a rehearsal line that would leave the pinned seats live and metered.
- **Explicit provider refusals stop before repair or tool dispatch.**
  Buffered OpenAI and Anthropic refusals stop `agent:` and `infer:` after
  recording incurred usage, even alongside valid structured content.
  Ordinary text without a refusal signal keeps its existing behavior.
- **`mode: article` extracts the same article in every process.** Readability broke candidate score ties by its hash map's per-process iteration order, so one page could yield two different articles from one run to the next (WCXB dev 0545: 40 identical runs through the door → 30/10; dev 0847: three variants). The engine pins a `dom_smoothie` revision that keeps candidates in their first-scored order (readability.js parity) until upstream releases it; 20 runs over the 1497-page dev split now agree byte for byte, and the F1 is unchanged (dev 0.7796 → 0.7797 · test 0.8225 → 0.8225).
- **`mode: article` reads the server-rendered `<noscript>` fallback when the page itself is an empty shell.** With scripting enabled the HTML parser keeps a `<noscript>` subtree as raw text, so a JS-rendered page whose whole body ships in that fallback (the Discourse forum shape) extracted to nothing at all. The cascade now re-runs on that source when, and only when, all three stages starved on the served markup AND nothing of the served page would be lost — the fallback carries the served prose within it, or the page rendered no text in any content zone at all (a shell). A page that extracted cleanly is never overridden by its own "enable JavaScript" notice, and neither is a short-but-real one: a 170-character news brief beside a large notice keeps its body. Measured on the WCXB dev split (1,497 pages, the benchmark's own scorer): forum word-F1 0.487 to 0.628, overall 0.7799 to 0.7906, article and documentation unchanged; the guard above costs 0.0002 of that at the lane head (one page whose shell renders "Something went wrong" inside its own content zone — the server did render it, so it is kept). A page carrying no `<noscript>` at all no longer pays a second parse to find that out.
- **`mode: article` stops trusting a content zone that carries a sliver of the page.** The rule cascade believed any semantic container clearing the 250-character floor, so a teaser `main` or a byline `article` on a long page won over the body itself and the extraction returned a few dozen words. A zone must now also carry at least 5% of the pruned page's visible text; below that the cascade abstains and readability scores the whole tree instead. Measured on the WCXB dev split (1,497 pages, the benchmark's own scorer): overall word-F1 0.7906 to 0.7982, article 0.914 to 0.925, service 0.742 to 0.763, documentation unchanged.
- **The HTML depth guard stops refusing shallow pages.** It counted an element as still open until it met a matching close tag, so a page of SVG shapes (`<path … />` inside `<svg>`, the shape of every syntax-diagram page) or a long list written without `</li>` climbed thousands of levels and the whole document was refused as a DoS attempt, for every mode that parses HTML. The scan now acknowledges the self-closing marker in foreign content, closes the elements whose end tag HTML makes optional, and generates the implied end tags a close tag carries. Each rule is a strict subset of what the parser itself closes, so the count can only over-estimate depth, never under-estimate it: `<div/>` still nests, and a slash ending an unquoted attribute value is still not a marker. Each implied-end rule is now the intersection over insertion modes, measured against the pinned html5ever rather than recalled: `<option>` closes an open `option` and never its `optgroup`, `<optgroup>` closes only an `option` (outside a `<select>` the parser nests them, so a flood of `<optgroup>` is genuinely deep and is refused again), and a `<tbody>` closes an open `<thead>`. Two real pages in the WCXB dev split (sqlite.org documentation, stripe.com product) went from a refusal to an extraction.
- **Briefs repeated in metadata are preserved.** Article extraction keeps short bodies repeated in a meta description instead of mistaking them for page furniture.
- **`mode: article` recovers the body a sliver pick stranded, and shells stop posing as articles.** Three extraction-cascade fixes, each measured on WCXB dev (1,497 pages, official scorer) with the frozen test split (511) run once on the final candidate: **dev F1 0.7991 → 0.8124, test F1 0.8322 → 0.8504**. (1) The recall-floor override: the cascade's "first non-thin wins" rule stranded real content whenever a decorative container or a readability mis-grab barely cleared the 250-char floor; a boilerpipe reconstruction that is decisively richer (≥2×, flat over a measured 1.5–4.0 plateau) now wins instead — never a fallback past 30k trimmed chars, which is the template flooding back, not a recovered body. (2) The furniture veto: a thin extraction whose every word already lives in the page's own `<title>`/meta description is a shell's title bar, not a body — `article` now honestly reports empty instead of serving the masthead. (3) A page that merely HAS a search box (`role="search"` rides in most templates' headers) is no longer classified as a search-results page when real content structure exists.
- **`NIKA-PARSE-024` and `nika check --fix` now read a `depends_on:` the same way, shape by shape.** One quote-aware predicate on both sides — `[a]`, `["a"]`, `['a']`, a `-` list and `[]` (an empty list declares no edge, so the dead line is dropped) are the migratable shapes, while a scalar, a map entry, a nested list or any other string is named as the author's to rewrite; the finding also says out loud that a readable shape still stops the whole file when a producer may skip (`when:` · `for_each:` · `on_error.skip`) or is read only through its status, and `nika explain NIKA-PARSE-024` tells the same story — the promise and the repair no longer contradict each other on one screen (wave 3 · persona 02).
- **`nika:glob` says what it left out.** A pattern that also matched a directory (a folder named `item-07.md` under `*.md`) dropped it in silence: the batch fanned over 11 of 12 candidates and the trace read `succeeded`. The file list a consumer receives is unchanged; the task's terminal frame now carries the OBS-E `warning` naming the left-out directories (`nika:glob returns files only · 1 directory also matched …`), the run's close and `nika trace show` print it as `⚠ <task> · …`, and `nika trace outputs --json` projects it per task. The channel is the tool seam's own — `ToolResult::with_warning` and `InvokeOutput::warning`, additive, `None` for every existing tool.
- **Approval evidence and plain run summaries.** Prompt answers reject conflicting duplicate flags and invalid shapes or choices with explicit diagnostics. Approval traces record the declared operator and the resolved question and answer. Piped run summaries retain task, wave, retry and token totals and the explore hint shown in the terminal.
- **Vector 49 proves on macOS.** The hygiene self-test runner now shims GNU `sha256sum` with `shasum -a 256` when the binary is absent, and the publication-barrier fixture does the same in its fake PATH. Local pre-push no longer dies on a missing GNU hasher while the guards themselves still pass.
- **Tool return contracts.** `invoke: tool` now checks its final output against
  the task's `returns:` contract before publishing success. A violation raises
  the recoverable, non-transient `NIKA-TYPE-101` error without discarding the
  completed call's attestation or reported cost. An optional string field may
  be absent, but a present null or number is rejected; tools without `returns:`
  are unchanged.
- **`nika:jq` and `nika:validate` explain JSON containers passed as strings
  (#1520).** A type error on an encoded object or array now names the input
  shape and teaches explicit `fromjson` decoding after `nika:read`, without
  repeating the input's contents. String operations, string schemas and
  explicit decoding retain their behavior; validation keeps its structured
  report and error paths. No implicit parsing or file access is added.
- **Release proof lookup** now separates inline YAML comments from CI job names in the wiring ledger. Quoted hashes, missing proofs and unknown jobs remain refused; the hygiene suite exercises both acceptance and rejection.
- **Traversal robots certificates.** Fetch traversal certificates reserve both
  seed-origin and landed-origin robots probes, so a cross-origin root redirect
  cannot undercount logical GET calls.
- **The OpenAI-compatible stream reads the same usage as the non-stream door.** The SSE translator built a bare prompt/completion pair and dropped `prompt_tokens_details.cached_tokens` and `completion_tokens_details.reasoning_tokens`, so a streamed cached prompt would have priced at the full input rate; both doors now share one parse. DeepSeek's top-level `prompt_cache_hit_tokens` lands in the cached split too, so a cached DeepSeek prompt prices at the catalog's cache-read rate instead of the input rate.
- **The order-law refusal describes the route it actually walked.** `NIKA-SEC-015` fires over reachability (`with:` data edges ∪ `after:` control edges), but its card said `X shells on content Y fetched` and offered « cut the route so the fetched value never reaches `X` » even when the only thing joining the two was an `after:` entry and the shell's argv held no fetched value at all — a data-flow claim the judge never made, and a repair naming a route the file did not have; the refusal is unchanged (the law is unconditional) and the sentence now names the edge kinds the route crossed, states that no `with:` chain carries the producer's output into the sink when the graph holds none, and points at the hop to delete (`cut the `after:` edge `save` → `measure``), while a route whose every hop binds a value keeps the content claim — and is preferred as the witness wherever one exists, so the weaker sentence is never printed over a file where the value really does flow.
- **The content-free OTLP projection carries no payload text.** Without `include_content`, a failed span's status keeps the error code alone (the `detail` message half stayed before), a success warning no longer rides, and the redacted evidence pack now masks a fan-out's `items` and the `warning` field like the other payload keys.
- **`nika trace export` admits a journal before reading it.** A file past the writer's 256 MiB journal bound or a non-regular path is refused by size or shape, never read whole into memory; the export is published by rename so an interrupted write cannot leave a half-written file claiming to be complete.
- **`nika trace peek` delivers the item table when the value was not checkpointed.** `nika trace peek <trace> <task>` on a fan-out whose aggregate value was never checkpointed (no resume stamp: a runtime collection, a secret in a rendered input) delivers the recorded item table (index · item · status · code · message) instead of refusing with « recorded no output (ok) »; the refusal that remains (`--raw`, or a task with no table) says the value was not checkpointed and why (wave 3 · persona 10).
- **Permit purity and sandbox path identity.** Pure internal calls now keep their permit exemption under declared empty or unrelated permit blocks, while path-carrying decide bundles still require tool authority. macOS sandbox profiles resolve healthy ancestor aliases, reject protected-root aliases and unresolved ancestors, and preserve directory intent without granting adjacent SQLite sidecars. Existing and new exact files retain their journal family; final symlinks and special entries are refused for that extension. Canonical grant paths that cannot be represented exactly as UTF-8 fail closed instead of naming a replacement-character path.
- **Share the isolated test runner with pre-push.** The local push gate now uses the same nextest selection and serial fallback as the test script, preserving its library-only scope and refusing failed tests before publication.
- **Keep project verdicts valid JSON.** Escape project paths, names and diagnostic strings with the JSON serializer, including control characters in filesystem paths. Preserve the compact envelope and field order for existing project verdicts.
- **Read argument errors no longer recover as missing files.** Check rejects
  literal nonstring `path` and nonboolean `binary` values, while whole-value
  bindings remain checked at runtime. Invalid arguments report
  `NIKA-INVOKE-002`; `NIKA-BUILTIN-READ-001` remains exclusive to missing
  files, preserving first-run recovery and the existing read permissions.
- **Run JSON preserves error codes containing underscores.** Failed runs
  retain codes such as `NIKA-BUILTIN-JSON_MERGE_PATCH-001` in `error.code`
  when they appear in the diagnostic, so consumers can classify the refusal.
- **The seam-discipline hygiene vector excludes `#[cfg(test)]`-declared module files.** It promised to mirror the house `rs_prod_files` rule and delivered only the `tests.rs` basename half, so a test module carved out of `lib.rs` into its own file read as unmarked `std::fs::` bypasses; both halves now, with a six-case self-test in throwaway repos (on the vector as it was, exactly the two cfg(test) cases fail).
- **SECRETS findings print their wire code on the human lane.** A secret leak or an output egress now reads `[NIKA-SEC-006]` / `[NIKA-SEC-007] …` like every other rung, so `nika explain` can be pointed at it.
- **Present access pins require strings.** A by-name job request rejects a present non-string access pin, including JSON null, before registry capture. Only an absent access field inherits the resident plan.
- **An interrupted serve-door job closes its journal and releases its lease.** When a cancelled run outlived its grace the resident dropped the journal sink without a terminal frame, so the journal read `INCOMPLETE` with a dead-writer lease and the `.lock` sidecar survived beside it. The resident now writes the terminal settlement envelope (`run_settled` · `status: interrupted` · `cause: operator` when the operator asked) before the sink goes, so the chain walk reads a lifecycle end and the lease leaves with the sink; the runtime's own settlement is never invented.
- **A serve-door run's journal is sealed at settlement.** The resident handed its journal sink to the execution driver, which dropped it unsealed: a door journal always read `UNSEALED — no run_sealed frame`, however the machine's run key stood. The resident now keeps the sink, seals it where the settlement is built (the same `seal_journal_with` the CLI's `surface_trace` calls, before the fsync, with the workflow hash and the teardown facts the door holds: proves · certificate · outcome · the settlement's budgets · the SDK receipt binding · the memory fold) and names the chain head on the job's receipt.
- **Access pins fail closed.** Serve `access: ""` is NIKA-1802 (CLI vocabulary) and never becomes an unpinned job. A backend that does not override `execute_with_access` refuses a nonempty pin (NIKA-1801) instead of running unpinned.
- **`GET /v1/jobs/{id}/trace/verify` verifies the journal the resident wrote.** The route used to answer `unavailable · trace_journal_unavailable` for every job without looking for a journal; it now locates the job's journal under the served project (by the job's execution and trace identity) and verifies it through the same verifier `nika trace verify --json` runs, answering the CLI's vocabulary (`ok` · `sealed` · `anchored` · `replayed` · `incomplete` with the writer's liveness · `tampered` · `broken` · the refusal classes) with the CLI's document beside it (`exit` · `chain` · `seal` · `anchor` · `replay` · `lines`); `unavailable` stays the honest answer only when no journal exists, and no filesystem path ever crosses the door (measured on the public 0.118.7 binary through the serve door).
- **Bound and redact named session context.** The native session bounds context-file reads before allocation and redaction, and masks repeated credentials and private-key bodies in named context files.
- **Observe the session's own workflow trace.** Return the exact trace from
  the existing run path for initial and resumed executions. A newer unrelated
  trace no longer hides the session result or its human gate. Real workflow
  tests cover effect, observation and reopening without replay.
- **Keep session diagnostics free of payloads and refuse FIFO histories.**
  Persist only an outcome category beside the redacted dialogue; escaped Debug
  text could otherwise retain a value masked in the raw reply. Contained file
  opens reject a FIFO without waiting for a peer, so malformed history fails
  visibly instead of freezing the terminal.
- **Retire the signal listener when its run ends.** A terminal session joins
  each run's listener on return or unwind, including after cancellation. An
  old listener can no longer interpret a later run's first Ctrl-C as its own
  second signal and abort the process without settling the current run.
- **Report uncertainty after a failed file replacement.** The native session reports that a failed file write may already have changed its target, preserving confirmed earlier writes and stopping later files.
- **The crawl digest passes the same depth admission every HTML mode passes.** A depth-bomb page reaches no parser through `traverse:`: the root refuses loudly, a descendant becomes an honest `{url, status, error}` entry and the crawl continues. The digest used to go straight to the DOM parser.
- **Crawl discovery is no longer capped by the digest preview.** The frontier reads every link a page carries; the per-page `links` facet stays the ≤30 preview the spec fixes. The 31st link on a page used to be unreachable.
- **A crawl reads its robots probe the way RFC 9309 does.** `nika:fetch` `traverse:` treats a 5xx or a transport failure on `robots.txt` as *unreachable* (§2.3.1.4 · complete disallow: the crawl refuses loudly before a page is spent, transiently) and only a 4xx as *unavailable* (allow-all); a root that lands on another origin re-reads that origin's robots before any descendant is enqueued. It used to read every non-2xx and every error as allow-all and to govern the landed host with the seed's rules.
- **A lethal-trifecta refusal names a defaulted prompt as the reason no gate exists.** When the only `nika:prompt` on the path carries a `default:`, `NIKA-SEC-009` now says so and asks for the default to be removed (answer at launch with `--answer`), instead of asking for a gate the author had just added; the credited gate's own `headless-prompt` hint no longer recommends `default: false`. The two judges contradicted each other on one file.
- **`N recovered` counts repaired items, not rows — on every door.** A fan-out that recovered two of twelve items now says `2` in the meter, the verdict card AND the run's settlement (`tasks_recovered` on `workflow_completed`, `--json` and `nika trace show`), the same number its task line prints; every one of them said `1` before.
- **A task fed by untrusted content says where it was born, not « recovered ».** The run storyboard, `nika trace outputs` and `nika trace peek` now print `untrusted input from <origin>` for a task whose value carries the F-O1 integrity label (a fetch, an exec, an `inputs.<name>`); « recovered » stays reserved for a task an `on_error.recover` actually repaired. Four personas read the old wording as a repair on runs that repaired nothing.
- **Local gate readiness** now resolves the effective hook path through Git, including linked worktrees and custom hook directories. Only an executable hook counts as reachable, and bootstrap verifies the installer's result before reporting success.
- **Respect resolved fetch retry safety.** Direct `nika:fetch` failures now respect the resolved HTTP method and idempotency header names when applying task retries. A templated mutating request without an idempotency key stops after its first failed attempt even when `retry.on_codes` matches, preserving the error, metered spend and commit evidence.
- **Preserve concurrently created files.** `nika:write` with `overwrite: false` now refuses a destination created after its initial absence check. Existing filesystem adapters compile with a refusing default and can implement exclusive publication; ordinary replacement writes retain their behavior.
- **`nika:write` says a path names a directory instead of failing twice.** `out/replies/`, `.`/`..` and a name that already is a directory are refused before any filesystem effect with the file-inside form and `create_dirs: true` spelled out; the tool description now says it writes a FILE. The two verdicts were `path not found` then `Is a directory (os error 21)`, neither actionable.
- **`nika:write` names the file standing where a directory is needed.** A write beneath a path that is a FILE (`out/replies/002.txt` when `out/replies` is an empty file an earlier call left behind) used to die `path already exists: out/replies` for the rest of the run, with and without `create_dirs`; it is now refused before any effect with the blocker, its size, the fact that `nika:write` never deletes, and the mistake that usually put it there (an empty write meant as a `mkdir`). The tool description teaches the same at call time.
## [0.118.7](https://github.com/supernovae-st/nika/compare/v0.118.6..v0.118.7) - 2026-09-05

### Fixed

- **File journals refuse bytes beyond the verifier's existing bounds.**
  Check final encoded lines and cumulative bytes, including newlines,
  before writing. A refusal stops that journal and reports lost evidence
  while preserving the primary output and runtime settlement. This does
  not provide complete proofs for oversized runs or resolve #1458.
- **Hash arguments agree across check and execution.** Literal null content and invalid algorithm or encoding choices are refused before execution; omitted options keep their defaults, and accepted content keeps its original digest. Tool schemas expose the same closed choices. Gemini tool declarations carry the canonical JSON Schema through `parametersJsonSchema`.
- **Incomplete trace diagnostics describe evidence, not runtime failure.**
  A missing terminal frame and an unheld writer lease no longer claim a
  crash or an unsettled run. An invalid final line also does not exclude
  intentional modification. A file journal can stop while the primary
  run still succeeds; verification tiers and exit codes are unchanged.
- **Agent guidance reflects readiness and effect evidence.** The four skills preserve existing execution authorization and distinguish missing decisions from check readiness. Authoring uses examples for unfamiliar structures; debugging explains resume eligibility, uncertain remote effects and the upstream tasks included by `--task`. Operating guidance preserves secret host boundaries and separates definition pins from trust in a server. Plugin descriptions now state the limits of metered budgets and trace delivery.

## [0.118.6](https://github.com/supernovae-st/nika/compare/v0.118.5..v0.118.6) - 2026-09-05

This version includes the One Door source changes recorded in the preceding
0.117 and 0.118 sections. The 0.118.5 train passed native, SLSA and OCI payload
checks and published WASM npm, but its release-body update orphaned the
GitHub draft before asset staging. Earlier tags and registry bytes are not
rewritten; companion SDK, editor and release-record gates remain separate.

### Fixed

- **Authoring guidance follows composition and cleanup contracts.**
  Compose checks a draft; child execution uses normal admission. Unwind
  cleanup applies to started producers, and predicate names have one table.
- **Cancellation publication has a discriminating model test.** A separate
  payload is checked before joining its writer. Diamond CI runs the library
  model and refuses an absent test; weakening either ordering is detected.
- **Preserve the release coordinate in metadata writes.** The OCI marker and
  final publication PATCHes explicitly carry their already-verified tag and
  target SHA, avoiding the body-only update that orphaned the 0.118.5 draft.
  Post-write identity drift still refuses without rebinding or retrying;
  ambiguous writes no longer claim that nothing committed.

## [0.118.5](https://github.com/supernovae-st/nika/compare/v0.118.4..v0.118.5) - 2026-09-05

This version includes the One Door engine work recorded in the preceding
0.117 and 0.118 sections. The 0.118.4 train built and attested all four native
archives, staged its eight GitHub assets and published WASM npm, but its
OCI payload check failed on the runner's classic Docker image store.
Its GitHub release remained a draft; existing tags and registry bytes are
not rewritten. Companion SDK, editor and release-record gates remain separate.

### Fixed

- **The editor hook refuses an unexpected guard exit.** Permission-looking
  stdout from exit 1 no longer reaches a host as an allow. The shim accepts
  only the engine's three verdict codes. Judged responses are preserved;
  an unavailable judge uses the hosts' blocking exit 2, never a guessed
  scope or JSON dialect. Healthy unrelated commands still receive no opinion.
- **The guard has one scope judge.** The shell shim no longer guesses
  command ownership or hook dialect from raw substrings, which escaped
  commands and decoy markers could defeat. Missing, broken or unavailable
  judges block the hook action, including ordinary commands until repaired;
  unsupported payload shapes are integration errors rather than no opinion.
  Stdin reaches the engine's bounded reader without a shell-side copy.
- **OCI payloads use their bound child digests.** Release verification pulls
  each platform by the child digest selected from the validated OCI index.
  This avoids classic Docker's
  multi-platform parent-digest collision without changing daemon storage,
  deleting image references, executing image content, or weakening either
  native binary hash comparison. Invalid parent indexes refuse before pulls.
- **Migration and debugging skills distinguish simulation from effects.**
  Effecting ports use authorized isolated rehearsals and artifact assertions,
  not a golden the simulated plane refuses. Paused runs do not authorize an
  agent to choose an answer, and concurrent failure order is not causality.

## [0.118.4](https://github.com/supernovae-st/nika/compare/v0.118.3..v0.118.4) - 2026-09-05

This version carries the One Door engine work recorded in the preceding
0.117 and 0.118 sections: one captured admission world, runtime-owned
settlement across CLI and resident, by-name HTTP admission, opt-in SDK
snapshots, canonical `nika` executable, and the custody and cancellation
corrections. Those tags did not produce a complete public GitHub release;
0.118.2 and 0.118.3 did publish their WASM npm packages before failing.
The full history remains in this changelog; existing tags and registry bytes
are never rewritten. Companion SDK and editor publication has its own gates.

One Door is not a claim of unlimited evidence or fully durable sessions:
[large fan-out evidence](https://github.com/supernovae-st/nika/issues/1458)
and [durable session state](https://github.com/supernovae-st/nika/issues/1464)
remain explicit follow-ups.

### Fixed

- **OCI release images keep their bound BuildKit attestations.** The release
  barrier distinguishes its two Linux images from their two metadata
  descriptors. It retains provenance and refuses foreign or duplicate
  subjects, missing metadata, extra platforms,
  malformed descriptors and multiple JSON documents before publication.
- **Release assets rejoin the successful provenance lane explicitly.** The
  deliberately skipped alternative no longer suppresses asset convergence
  or stable-pointer jobs through GitHub's transitive skip rule. Every direct
  prerequisite must still succeed; failed or skipped proofs never authorize
  publication, and prereleases never update stable pointers.

## [0.118.3](https://github.com/supernovae-st/nika/compare/v0.118.2..v0.118.3) - 2026-09-05

### Fixed

- **Draft reads stay with the release owner.** Keep Docker and SLSA verification read-only, route the initial digest and replay statement through the existing draft preparer, and independently reject marker drift in the finalizer before publication.
- **Audit all Rust lock families.** Update the Linux event-listener path and fuzz anyhow pin to their RustSec fixes, reject unsoundness as well as vulnerabilities, and scan workspace, fuzz and excluded-crate locks without hiding tool errors behind a second scan.
- **Git push gates receive every ref proposal.** Tag-only and unchanged-tree
  pushes now reach the ref-aware gate and protected-branch guard; only the
  gate's explicit deletion-only decision can skip its checks. Real
  Lefthook/local-remote regressions cover refusal and stdin delivery.

## [0.118.2](https://github.com/supernovae-st/nika/compare/v0.118.1..v0.118.2) - 2026-09-05

### Fixed

- **Retain the draft release ID returned by creation.** A committed draft
  no longer depends on immediate visibility in the release list. The POST
  response owns the next read, which rechecks its immutable ID, exact tag,
  prerelease state and resolved tag commit before publication can proceed.
  Delayed-list and malformed-response regressions reproduce the failure of
  the unpublished v0.118.1 train; existing tags remain immutable.
- **Queued replays cannot own another execution.** The resident claims and
  refuses only queued admissions under the store lease. A delayed duplicate
  cannot resume a paused leg, interrupt the original run, or retire its
  cancellation registration. Known stale entries no longer reopen their
  snapshots. Explicit paused-leg store transitions remain available; this
  does not claim exactly-once external effects or global shutdown liveness.

### Security

- **Validate public custody before disclosure and preserve existing keys.**
  Trust output and rotation now reconstruct decoded public keys, dropping
  untrusted comments and trailing bytes. Signing also binds the public key
  and its key number to the opened secret. Broken explicit custody refuses
  fallback; non-forced initialization preserves corrupt or orphaned files
  and refuses concurrent writers. Known path aliases cannot collapse the
  two key slots. One guarded keyring constructor and one public-box decoder
  serve signing, trace and evidence readers. Retired records keep their
  historical fingerprints; older imported custom-comment seals require
  their original public enrollment record after canonical retirement.
  Engine-generated public boxes are unchanged. File pairs are not atomic.

## [0.118.1](https://github.com/supernovae-st/nika/compare/v0.118.0..v0.118.1) - 2026-09-04

### Fixed

- **One admitted world across root, child and answered execution legs.**
  Static model resolution, thinking and known capacity are checked for the
  entire captured workflow closure before execution, with the root override
  never replacing an explicit task or child model. Child workflows retain
  the attempt's captured access facts and pin while owning their own lane
  plans. Each answered CLI leg is readmitted from the original snapshot and
  receives fresh execution and trace identities, including with a fixed
  clock or a changed or deleted source file. Public nested settlement
  errors use the existing redaction boundary. The authorized service runner
  requires a frozen plan, and the model-less gate honors a legal envelope
  override without waiving an unrelated task's missing model. Check and
  runtime now share that predicate; an unrelated admitted lane cannot
  produce ACCESS READY when a mixed workflow still needs a model.
- **The resident preserves the runtime's actual result across cancellation,
  pause and replay.** Cancelling an active job acknowledges the request;
  the runtime may still succeed or fail, and a missing result after grace
  is interrupted rather than fabricated cancellation. Queued cancellation
  and execution claim have one leased winner. Durable GET, idempotent
  admission replay and SSE expose the stored settlement; a pause closes
  the observation with that leg's outputs and receipt while the job stays
  resumable. Ordinary event append cannot inject a pause boundary, and
  malformed pause results are rejected without committing a mutation.
- **The native session grounds commands and inventory in installed facts.**
  Retired `graph`, `tools`, `fix` and the nonexistent `version` command are
  no longer accepted as installed capabilities; the active `inspect`,
  `catalog --tools`, `check --fix` and `--version` surfaces remain. Project
  snapshots retain both workflow-list and filesystem-walk truncation, and
  deterministic answers and model prompts disclose incomplete inventory
  instead of turning an unreadable scan into a claim that no workflows exist.
- **The release train starts again (`v0.118.0` died at its own draft).**
  `prepare-draft-release.sh` created the draft, then looked it up through the
  by-tag endpoint, which returns published releases only: a fresh draft
  answers `gh: Not Found (HTTP 404)` there, and the train stopped with four
  green builds, an empty draft and no assets (a dead tag, never reused). The
  lookup now reads the release list, which carries drafts, matches the tag
  exactly, treats only an empty list as absence and any failed answer as the
  barrier; `scripts/release/tests/draft-release.test.sh` proves it against a
  fake `gh` that hides drafts the way GitHub does, and its by-tag mutant reads
  RED. The 0.118.0 changelog section stays as the record of what that tag
  carried; this train ships it as 0.118.1.
## [0.118.0](https://github.com/supernovae-st/nika/compare/v0.117.1..v0.118.0) - 2026-09-04

### Added

- **A `for_each` names every item's terminal (wave 7 · #1276 · #1397).** The fan-out's terminal frame carries an additive `items` field: one row per item in input order with `index` · `item` · `status` (`ok` · `recovered` · `failed` · `never_started`) · `code` and `message` when an error was recorded. Failures 2..N reach the journal with their own codes (only the first casualty used to survive), and a hard-failed batch says which items ran, failed or never started. `nika trace peek <task>` prints the item table on a value peek and on the autopsy, `nika trace show` tallies it per fan-out, `nika trace outputs --json` carries the rows.
- **Project changes from the session (ADR-126 · wave 5).** A reply that carries a workflow (a fenced block naming its path) becomes a typed change set: the session previews the exact bytes it would land — a create in full, an update whole with the current file witnessed — with the engine's own check of those bytes (findings · hints · what the workflow reaches when it runs: reads · writes · network · programs · tools · models · secrets · spend · human gates) and the fix ladder's repairs listed; nothing is written until the next line says `yes`; a stale target applies nothing; every workflow written is checked for real after it lands; « create it and run it once » runs it through the same path as `nika run`, only when that check is clean, and the session reports what it observed. Paths outside the root and files you never named are refused before any preview. « What happened in the last run? » is read from the trace, never from memory. A run that pauses at a human gate returns to the session as the gate's own question; your answer resumes it, and nothing answers for you.
- **`nika spec --schema --project` (wave 6 · W0-F3).** The project file (`nika.yaml`) has a machine schema: a JSON Schema (draft 2020-12) in English — the project's name and ceiling, the `arm:` beats with every key the parser reads and every value form it accepts, the trace retention policy, the registry provenance floor — owned by the grammar's crate and proven against its parser's closed key sets and enum spellings, so editors validate what the engine refuses.
- **The terminal frame carries the run's summary (wave 7 · #1247).** `workflow_completed`, `workflow_failed` and `workflow_cancelled` now carry what the human card computes: `status`, `elapsed_ms` (the run clock, read through the kernel seam), and the task tally (`tasks_total` · `tasks_ok` · `tasks_failed` · `tasks_recovered` · `tasks_skipped` · `tasks_cancelled`) next to the cost fields — a `--json` consumer no longer re-derives the summary from the task frames.
- **`trace ls --json` and `trace outputs --json` (wave 7 · #1247).** The two trace verbs whose content is structured data speak JSON on request: `ls` gives the store's facts per trace (name, path, workflow, state, the awaiting task when paused, bytes, mtime, the newest-of-its-workflow marker); `outputs` gives the per-task projection a machine consumer needs (id, verb, status, cause, error code, and the original error a recovered task was repaired from — the projection the engine carried with no verb to print it).

### Changed

- **One access plan is the execution authority.** `nika run` resolves the
  access plan once per attempt (the effective models with their verbs,
  this machine's provider and seat rows, the `--access` pin) and then
  executes exactly that plan: the seat comes from the plan, the announce,
  the `--dry-run` preview, `check --json`'s `access_plan` rows and the
  boot manifest are projections of it, and every `infer:`/`agent:` task
  routes by its own lane. A model with no ready path refuses before the
  first task (`NIKA-1800`, with the witnesses) instead of failing inside
  a task with a provider error; an ACP-only seat never serves an `infer:`
  lane; one seat holds a run. On the shipped 0.116.2 the announce could
  name a seat the run never rode and the run could dial the API with a
  dead key while the seat was ready (the census-B divergence).
- **The freeze audit's fixes (One Door · OD-F12).** Ten proven slices, each
  the smallest correct owner of a gap the audit found:
  (1) The resident projects the run's settlement whole (ADR-128):
  `execution.settled` and `execution.cancelled` carry `settlement` (`status` ·
  `cause` · `elapsed_ms` · `tasks` · `spend` · `error`), the SSE frame
  projects it, the OpenAPI names it (`RunSettlement`), the job's status is the
  settlement's own state, and the SSE terminal set is the record's
  (`JobStatus::is_settled`).
  (2) A retry finds its job before the registry is read again (ADR-132 · G1):
  `POST /v1/jobs` looks the `Idempotency-Key` up BEFORE capturing, so a
  lost-response retry replays the ORIGINAL job even after the served workflow
  changed, vanished or went red, and never executes changed bytes; the
  resident's own `schedule:` key namespace is refused to a manual caller.
  (3) The resident stamps its stores after it holds the lease (ADR-132): a
  second `nika serve` that loses the server lease never rewrites the live
  resident's writer stamp; opening a store never stamps it.
  (4) Words never above the proof: a digest a caller sends is a
  caller-supplied integrity digest, never an « attestation » (ADR-131
  amended); the resident's status words are proven equal to the settlement's
  (ADR-130).
  (5) `nika check --sdk-snapshot` is public: the SDK's producer of the
  snapshot body, still an adapter of `check`, never a verb.
  (6) The session decides a proposal only once it landed (ADR-133): a stale
  apply leaves it undecided (a retry reads `wrong_state`, never a false
  `already_consumed`), and the check after an apply is the same composed
  judgment `nika check` makes.
  (7) The local door says what evidence it left and never resumes a run in
  flight (ADR-129): `run_settled.evidence` (`sealed` · `unsealed` · `lost` ·
  `none`), and `nika run --resume` on a trace whose writer is alive refuses
  (ENV · the writer named).
  (8) Unknown cost is never a zero on a human line (ADR-128 · #1278): the
  closing card and the live meter say `unmetered` or `unpriced (N calls)`
  instead of `$0.00`; `nika trace session` says « no spend metered »; the cost
  replay prints the journaled qualifier.
  (9) `nika-tui-core` reads graph format 3, pinned to `nika-graph` (ADR-130):
  a node knows its `kind`, a cleanup unit is never seated on the board, and
  the wasm doors refuse a format they do not speak, naming both numbers.
  (10) The seat words never above the rung (ADR-134): `nika doctor` says « its
  login command reports signed in », the welcome line and the escape hatch say
  a seat is « present (its login is judged at run) », a local endpoint that
  answered a ping « answered ».
- **A dead writer is told from a run in flight (ADR-129 · #1442).** The run that writes a journal holds a lease beside it (`<trace>.lock` · owner-only · released by the kernel when the process ends, however it ends); `trace ls` asks the lease and prints `dead` — on both faces, with `liveness` on the machine one — for a running trace whose writer died, `running` for a live writer or one this host cannot judge, never a guess. `trace verify` exits the new INCOMPLETE class (5) for a journal that never reached a terminal frame and names the writer's liveness, so a monitor wired on the exit code can no longer green a dead run; FILE (2) stays the broken chain, ENV (3) the missing input. A dead process proves incomplete evidence, never a failed run: no door invents a terminal frame. The resident's `interrupted` is published as an evidence state (ownership lost · the journal INCOMPLETE), never a run state.
- **`check` answers four questions and `run` refuses what `check`
  refuses.** The audit now carries an ACCESS rung and a layers line
  (VALID · ACCESS READY · CAPACITY FIT · RUN READY); `--json` adds a
  `verdicts` object beside `clean` (which keeps its meaning). New CAPACITY
  laws judge the seat against the declaration from the catalog's positive
  knowledge: an `infer.max_tokens` above the seat's max output, a
  `schema:` on a seat without a JSON mode, an `agent.max_tokens_total`
  above the context window, a `vision:` input on a text-only seat.
  `check --access <pin>` judges the plan under the pin `run --access`
  takes, and `--profile operational` folds an unready lane into exit 2.
  The MODELS rung's judgments (resolution · thinking · capacity) now gate
  `run` before task 1 too. One lane-row shape rides `check --json`
  (`access_plan`), `run --dry-run --json` (`access.plans`) and the boot
  manifest; the text dry-run always prints the plan plus one access line
  per lane; « key present » reads « key present · not validated ».
- **The native session (ADR-125 · wave 4).** Bare `nika` on an interactive terminal opens a grounded conversation over the installed engine: the first run asks how Nika should think with you (an AI app you already have · an API · a local engine · none — in that order, in human words) and keeps the answer at `~/.nika/session-intelligence.json`; each path names where your project context goes before the first turn; an explicit choice this machine cannot serve is refused with its fix, never replaced. The session observes the project once, answers Nika facts from the engine (the workflows · the builtins · the providers · a workflow's verdict · a code · a shape) without asking any model, hands the chosen intelligence only a minimal bundle (the six laws · the project facts · the files you named, inside the root, secrets redacted · never the environment), and reads every reply through a guard that corrects any builtin, model, code, MCP server, verb or workflow field the engine does not carry. No temporary workflow, no trace for a chat turn, no hidden shell. A pipe keeps the concierge; `nika thread` is gone.
- **One vocabulary, one owner (ADR-130).** The historical task-record twin (`nika-runtime-laws::compat_record`) is deleted: `nika_runtime::{TaskStatus, TerminalCause, TaskErrorRecord, TaskRecord}` are the `nika-dataflow` owner's types, re-exported (an exhaustive match outside the crate now needs a wildcard arm). The resident's `JobStatus` is a projection of the settlement's `RunState` through one `From` (the four shared words equal by construction, `JobStatus::run_state` names which statuses are run states at all — `queued` · `running` · `interrupted` are the job's own). `nika-tui-core`'s copied frame kinds are pinned to `nika-event` by a test.
- **One oracle facade (ADR-124).** `nika check --json` and the MCP `nika_check` tool are projections of the same typed audit (`nika_cli_host::oracle`): the same MODELS rung (a templated `model:` judges as its declared default on the oracle too), the same layered `verdicts`, the same `access_plan` rows, the same hint rows; the oracle's payload says what it could not judge (`judged.composition` · `judged.skills`). The oracle's `fix: true` runs the CLI's prepass (a bare `exec:` scalar · a `needs:` list) — « the same ladder as `nika check --fix` » is now true. `nika_explain` is the CLI's four-rung ladder, worded for an agent without a shell. The plugin's example table names only living examples (six dead `tN-` slugs gone), pinned by a test.
- **The session machine's answers are typed (ADR-133).** A refusal carries a class a host acts on (`no_intelligence` · `intelligence_refused` · `not_allowed` · `wrong_state` · `stale_revision` · `already_consumed` · `empty_answer` · `io`), a proposal and a paused gate carry an identity, and `consent_to` / `answer_gate_for` judge a consent or an answer by that identity — a stale one applies nothing, a decided one stays decided — so a remote host drives the same machine without parsing prose.
- **A resume cannot switch access silently, and the resident executes the
  same plan.** `nika run --resume` judges the lanes the trace's boot
  manifest recorded against the plan this machine resolves now: a moved
  lane refuses on the environment exit, naming both paths and the two
  explicit `--access` flags; an explicit `--access` names the change and
  proceeds with a notice. The lane an `infer:`/`agent:` task rode joins
  its resume identity, so a task served by a seat is never served from
  the trace on another path. `nika serve` resolves the frozen access
  plan for every resident job through the one resolver the CLI uses
  (`nika_service_execution::access`) and attaches it to the run — a job
  with no ready path refuses before its first task.
- **The run's laws descend to `nika-runtime-laws` (ADR-127).** `nika-runtime` stood one line from the 15k wall; the laws a run obeys before and after it executes — the one-voice error, the typed contracts, the record mirror, the input origins, the engine identity, the record integrity, the secret custody, the sandbox verdict, the event stamp seams, the resume field names — now live in the `nika-runtime` unit's second member (`publish = false`), re-exported at every historical path. No public path moves; the runtime keeps real headroom for the terminal summary, the per-item `for_each` terminals and the V7 credential seams.
- **The run's faces say the whole truth.** A failed task terminal now
  carries the lane that failed (`model` · `provider` · `access` ·
  `access_id` · `billing`, and a note naming the model instead of `?`);
  `run_settled` carries an `error` on every failed frame, a launch
  refusal included (`NIKA-1800` · `NIKA-1801` · a missing input), and the
  `access_plan` rows of the lanes the run executed; `nika run --help`
  ends on its exit-code ladder; the resume that would switch access
  silently refuses as `NIKA-1807` (with `nika explain`); « wrote
  .nika/traces » prints only when a trace exists; `check --help` no
  longer claims a mistyped flag exits 3.
- **One settlement, every door (ADR-128).** The runtime builds the run's settlement once at the boundary that ends the run — the state (`succeeded` · `failed` · `paused` · `cancelled`), why (`normal` · `human_gate` · `task_failed` · `output_contract` · `budget` · `operator` · `refused`), the elapsed time, the task tally (now with `never_started`), the spend with a `cost_qualifier` (`priced` · `partially_priced` · `unpriced` · `unmetered`) and the failure named — and writes it on the terminal frame; `run_settled` carries it flattened (`cause` · `tasks` · `spend` beside `status` and `error`, a launch refusal settling as `failed` · `refused`), the resident's status and the CLI's exit code are projections of it, `trace outputs --json` reads it back through the one reader and carries a `settlement` object, and `trace ls` prints `succeeded` where it printed `completed`. The invented `recovered` run state is gone: recovery is a tally on the settlement and a fact on the task row.
- **A harness seat is admitted by presence; its confinement stays the next program (#1253).**
  The access plan says how far a path's identity is proven (`declared` ·
  `discovered` · `observed` · ADR-134) and every human line now says what was
  checked (a seat « present », its login « judged at run », a status command
  that « reports signed in »); nothing yet hashes, pins or sandboxes the
  seat's binary, so an executable that impersonates a seat on PATH runs with
  the user's rights. Pin the seats you trust on a machine you control;
  `attested` stays reserved until a handshake proves an identity.
- **The resident's job door is public (ADR-131 · #1441).** `POST /v1/jobs` and `POST /v1/check` admit a workflow BY NAME from the served registry (`{"workflow": "<name>"}` · the names `GET /v1/workflows` lists): the resident captures its world through the one `ExecutionService`, exactly as a schedule fires. The snapshot form stays for a remote world — it is the body `nika check <file> --json --sdk-snapshot` prints — and its digests are now optional caller-supplied integrity digests (a content assertion, never a signature): absent, the resident computes them; present, they must match or the request is refused as `snapshot_tampered` with honest words (an integrity digest that failed, the producer named). The OpenAPI documents both forms, the unit `kind` legend and the producer; the listen banner and `serve --workflows` say it; `nika explain snapshot_tampered` (and every resident code) answers with the engine's voice.
- **Every access lane carries `trust` (ADR-134).** `declared` (a profile or a pin says the path exists) · `discovered` (a key in the environment, an adapter on PATH — presence, never identity) · `observed` (an explicit probe answered) — on `check --json`, `run --dry-run --json`, the trace's boot manifest and the human announce, derived from the probe's evidence and never above it; a harness seat found on PATH reads `discovered`, which is what it is, and a refused lane says `null`.
- **The pre-flight tells the truth about a seat (wave 3.b · the W3 gauntlet).** A harness seat is two binaries: the product an infer-grade seat spawns (`codex`) and the ACP speaker an agent-grade seat talks to (`codex-acp`); the probe row now carries both, and a pin is judged for the verbs the workflow carries — a seat whose product binary is gone refuses on `check --access`, on `run --dry-run` (printed as REFUSED, exit 3) and on `run` before task 1 (NIKA-1803), where it used to print « admission satisfied » and die in dispatch. An `infer:` that names no model rides a seat or nothing: unpinned, `check` says ACCESS READY false with the two fixes, the dry-run and the run refuse before task 1 (NIKA-1800), `--profile operational` is red. The lane row names the ready paths it outranked (`outranked[]` · `candidates`). The COST rung says when a model is seat-served (unmetered · the dollar figure is the API counterfactual). `check --help` carries the layers legend and the `--json` gate keys. The oracle's clean answer names the child workflows it did not read, `verbose: true` returns the verdict object on a clean answer, and its next actions name `nika_explain`. The operational profile prints its footer on green; the mock lane reads « never dials ». The exit-3 lane is one JSON object on stdout under `--json` on both verbs.
- **The resident's writer stamp (ADR-132 · #1352).** Both resident stores (`jobs/state.json` · `schedules/state.json`) carry the engine that last wrote them and the machine-protocol generation it spoke; a store is re-stamped at every open by a different engine, and one last written by a NEWER protocol refuses to open, naming both engines (its state is not ours to reinterpret). `nika doctor` gains a `resident` line: the stamps beside the server lease — `alive · engine X (this binary)`, `⚠ alive · engine X — this binary is Y: restart the resident`, `✖ newer than this binary`, or `not running · stores last written by X`.
- **The public executable is born `nika` (ADR-135).** The bin target of the
  `nika-cli` package is named `nika` and the package runs it by default:
  `cargo build --release --locked --bin nika` yields `target/release/nika`, the
  release builds, signs and stages that same file (no rename at packaging), the
  flake installs it without a `postInstall` rename, the tap, the image and
  cargo-binstall are unchanged, the integration tests read
  `CARGO_BIN_EXE_nika`, and the scripts that probe a built binary probe
  `target/{debug,release}/nika`. Two gates keep the identity from splitting
  again: `tests/public_binary_identity.rs` (cargo metadata · exactly one bin
  target named `nika`, owned by `nika-cli`, `default_run`) and the ratchet
  `check-public-binary.sh` (the manifests, the release line, the flake, the
  tests · self-tested against seven mutants). The « `nika` is reserved for the
  L5 composition root » comment is retired: a future root takes the target by
  moving it, never by adding a second executable.

### Fixed

- **The pre-tag projection asks the estate question.** `scripts/ci/next-tag-project.sh --check` refuses a stale estate manifest, the same question the release workflow asks on every build leg after the tag exists: `v0.117.1` regenerated the manifest one commit too early and died there. The ceremony now hears it before the tag.
- **A cancelled run ends with terminal frames (wave 7 · #1353).** The runtime observes the operator's cancellation at every wave boundary: in-flight work completes and is counted, the unstarted tasks settle as cancelled by the operator (`terminal_cause: operator`), the run ends with `workflow_cancelled` and the outcome says so; the service driver carries the cancellation into the runtime and names the status (`Cancelled`); the resident gives a cancelled run a five-second grace to reach that boundary before it drops it mid-flight.
- **Ctrl-C cancels a run instead of being lost (wave 7 · #1438).** A `nika run` always listens: the first SIGINT (Ctrl-C) or SIGTERM cancels at the wave boundary the runtime already visits · in-flight work completes and is counted, the unstarted tasks settle as cancelled by the operator, the run ends with one `workflow_cancelled` terminal and the trace seals; the card and `run_settled` say `cancelled`, `trace ls` and `trace outputs --json` too, and the exit code is 130 (the cancelled class, documented in `run --help`). A second Ctrl-C aborts mid-flight and says the trace is incomplete. Before, a run had no listener at all: from a terminal the process died without a terminal frame, from a script it ignored the signal and completed.
- **A task fed by a recovered fallback says so in prose (wave 7 · #1444).** `nika trace outputs`, `nika trace peek` and the storyboard note read « input from recovered <task> » on a task whose input came from an upstream `on_error: recover` fallback · the lineage the JSON already carried (`integrity_source`) · and `trace outputs --json` names the source.
- **The MCP lane is reachable at run time; a trace is bound to the project that wrote it (wave 7 · #1374 · #1367).** The captured execution world now packs `.nika/mcp_servers.json` and `.nika/mcp_pins.json` whenever a workflow names an `mcp:` tool, so a configured server is admitted at run time instead of every `mcp:` workflow fail-closing as « not configured » while the registry and the pins were right; a project with no registry still gets the honest refusal by name. The opening frame carries the fingerprint of the project root that wrote the trace, and `--resume` from another project refuses with the teaching (« a trace is not a bearer artifact: resume it from the project that wrote it ») instead of replaying the first project's cached outputs; an older trace with no fingerprint resumes as before.
- **One ledger for two firers (wave 6 · #1377).** The resident (`nika serve`) claims a project beat's slot through the ARM ledger — the same per-beat lock `nika arm fire` takes, the same history `nika arm` reads — and lands the receipt there when the run settles. A slot the CLI edge already answered, or holds right now, is not the resident's to fire, and a slot the resident answered is skipped by the edge: one slot, one firer, whichever claims it first. `nika arm` reports the resident's fires as proven instead of calling the beat « never fired ».
- **The rehearsal explains itself before the run, and doctor says whether a seat is usable now (wave 7 · #1445).** A run whose lane is `mock/echo` prints « rehearsal: mock/echo answers by echoing the prompt — not a real answer » with the two doors to a real one before the first frame; `nika doctor`'s codex line reads « usable for `infer:` now · `agent:` needs the ACP speaker » instead of a warning that looked like a refusal.
- **One bad schedule is contained; a broken edit keeps the last valid registry (wave 6 · #1351 · #1354).** A schedule whose workflow cannot be admitted at fire time (the file changed or vanished) is a finding on that schedule (`schedule.admission` on its status) and never fatal to the resident: every other schedule and the HTTP API keep running, and the next slot re-tries once the file admits. An edit that breaks `nika.yaml` no longer unschedules everything for the pass: the last registry that loaded whole is retained and keeps firing, each retained schedule names the finding (`project.invalid` · « the last valid registry is retained · fix the file; nothing was unscheduled ») until the file loads again. Decision memory now outlives a declaration edit: the persisted last slot is the schedule's watermark, keyed by its identity, so editing a workflow path keeps a consumed `once` consumed and editing a cadence keeps the missed-slot floor (catch-up never re-answers slots the old declaration already answered); a `SlotId` is local to one slot and never the continuity key.
- **A resume judges its project first, refuses on both machine faces, and never replays a human decision it cannot verify (wave 7 · the security-auditor gauntlet).** A trace written by another project refuses before any other judgment (no « the current bytes are what runs » notice for a run that never happens); every resume refusal now reaches the `--json` stream as well as the `--output json` envelope (the stream printed nothing); under `--resume-unverified` every recorded `nika:prompt` decision re-asks — a recorded decision is a credential, and the chain that bound it to the run is waived — and the door says the project binding is unverified too. `run --help` documents the project binding and its exit.
- **`serve --workflows` scopes the served registry (wave 7 · #1369).** The listener exposes (`GET /v1/workflows`, its metadata) and schedules only the workflows under the `--workflows` directory, named from the project root the resident serves; a schedule naming a workflow outside it is refused with the teaching (`schedule.workflow_outside_registry`). The resident's own root — `nika.yaml`, the ledger, the beats — is unchanged, and a served root that is not inside the project stays a project of its own.
- **A resident job leaves its trace journal; one cancellation terminal (wave 7 · #1381 · #1350).** A job admitted over HTTP now leaves the same NDJSON journal a `nika run` leaves, under the project's `.nika/traces/`, named by the trace the receipt names, so `nika trace verify` can seal it (the service driver mirrors every event into the journal the resident supplies; the receipt's own record stays the primary). A cancelled run settles as `execution.cancelled` from the worker and the cancel route alike — one kind for one terminal whichever writer wins the race — and a failure that lands under a pending cancel settles as cancelled: cancellation has precedence over failure.
## [0.117.1](https://github.com/supernovae-st/nika/compare/v0.117.0..v0.117.1) - 2026-09-02

### Fixed

- **The release train starts again.** `v0.117.0` failed at startup: the
  `provenance` job granted `contents: read` while the SLSA generator's nested
  `upload-assets` job declares `contents: write`, a declaration GitHub
  validates when the reusable workflow is called, before `upload-assets:
  false` skips it. The caller now grants what the callee declares; the
  authority never runs. `v0.117.0` stays a tag with no release; `v0.117.1`
  ships the same tree plus this fix.
## [0.117.0](https://github.com/supernovae-st/nika/compare/v0.116.2..v0.117.0) - 2026-09-02

### Added

- **The serve OpenAPI document ships as a committed file.**
  `crates/nika-serve/openapi.json` is the live `GET /v1/openapi.json`
  document, pinned by a test, so the docs site publishes the real contract
  instead of a starter template.
- **`nika test --case <name> --var KEY=VALUE`.** One workflow carries a
  whole rule table: each case binds its inputs through the same door
  `run --var` uses and pins its own golden as `<file>.<name>.golden.json`.
  `--var` without `--case` is refused with the reason (a case is a file), and
  the no-golden hint echoes the flags a re-run must repeat.
- **`trace verify --json`.** One JSON document per trace (`verify_version`
  1): the attained `tier` (`ok` · `sealed` · `anchored` · `replayed`, or
  `broken` · `unchained` · `empty` · `unreadable` for the non-ladder
  verdicts), the `exit` class, the chain facts, one object per leg (`seal` ·
  `anchor` · `replay`) and the ladder `lines`; several traces stream as
  NDJSON. A CI gate on « at least SEALED » reads a field, never a prose line.

### Fixed

- **Release replays now preserve published bytes.** A global publication lane
  serializes every version; occupied GitHub Release assets must compare
  byte-for-byte, SLSA upload authority is isolated, and GHCR images carry exact
  source, version, and revision labels.
- **Close future release visibility and token-bleed gaps.** Hold GitHub Releases behind
  release-ID, SLSA, npm, and payload-bound GHCR checks; persist the proven
  digest before immutable tag convergence,
  heal only from that marker, fail closed on mixed registry errors, and keep
  delayed stable recovery from regressing GitHub Latest. Split exact-asset
  writes, immutable external proof, and final publication into disjoint jobs so
  registry verifiers never receive release-write or tap authority, and bind
  every asset census, download, and upload to the immutable release/asset IDs
  with tag/SHA revalidation around writes. This is a forward-only visibility
  barrier across independent registries, with the unavoidable administrator API
  TOCTOU documented as residual authority rather than an atomicity claim.
- **Concurrent cancellation no longer starves terminal settlement.** The
  resident store keeps HTTP mutation ingress bounded while terminal execution,
  shutdown, and abandoned ARM-preparation controls use reliable backpressure,
  so overload cannot terminate the server or strand a run as running.
- **`overlap: replace` is a typed refusal, not a silent no-op.**
  `PUT /v1/schedules/{id}` with `"overlap": "replace"` now answers 422
  with a `schedule.overlap` finding naming the policy, and a project beat
  with `chevauchement: remplacer` surfaces the same finding instead of
  firing with the overlap ignored.
- **`overlap: queue` is a typed refusal, not a silent no-op.**
  `PUT /v1/schedules/{id}` with `"overlap": "queue"` now answers 422
  with a `schedule.overlap` finding naming the policy, and a project beat
  with `chevauchement: file` surfaces the same finding instead of firing
  with the queue ignored.
- **`afterSkip: on_completion` is a typed refusal, not a silent no-op.**
  `PUT /v1/schedules/{id}` with `"afterSkip": "on_completion"` now answers
  422 with a `schedule.after-skip` finding naming the policy, and a
  project beat with `après_saut: à-complétion` surfaces the same finding
  instead of consuming the skip durably and never re-firing.
- **`tolerance` is a typed refusal until the (m,k)-firm law exists.**
  `PUT /v1/schedules/{id}` with a well-formed `"tolerance"` now answers
  422 with a `schedule.tolerance` finding, and a project beat with
  `tolérance:` surfaces the same finding, instead of persisting a
  documented (m,k) semantics nothing enforces.
- **`nika serve` projects a refused project beat instead of burying it.**
  A `nika.yaml` beat whose declaration the planner refuses (hash jitter
  today) is planned at load, surfaces as a finding on
  `GET /v1/schedules/{id}` with `origin: "project"`, and is never carried
  as a live beat that silently never fires.
- **An uncataloged model id no longer meters $0 past an armed budget.**
  The `--max-cost-usd` admission walk judged only *priced-ness*, and its
  unpriced-cloud arm spared any provider the catalog does not know — so a
  workflow pinned to a bare or misspelled id (the gauntlet's
  `claude-opus-4.1`, never a catalog row) floored at $0, passed any cap,
  and ran with zero budget protection. The walk now judges every resolved
  infer/agent id through the MODELS rung's own predicate
  (`nika_providers::resolve_refusal`): an id this binary cannot resolve
  refuses NIKA-1709 before the prologue, quoting the resolver's repair
  (the `<provider>/<model>` contract · the pasteable catalog seat ·
  `nika catalog`). Local seats (ollama & friends) and mock stay admitted
  — free by construction, never by silence — and the priced-floor refusal
  (`anthropic/claude-opus-4-1` at $0.057600 over a $0.02 cap) is
  unchanged.
- **The effect-safe retry law: a keyless mutating `nika:fetch` is never
  retried by default.** A `POST`/`PUT`/`DELETE`/`PATCH` fetch without an
  `idempotency-key` header now types EVERY failure `transient: false`
  (status-table and transport alike) — the failure may be ambiguous (the
  server may have committed before the socket dropped or the 500 was
  emitted) and a blind replay doubles the effect: measured on 0.116.2, a
  post-commit 500 under a declared `retry×3` fired 3 calls and 3 charges
  the run never admitted. A declared `retry:` on such a call is now the
  static `NIKA-SEC-016` refusal at `nika check` (one finding per task,
  teaching the key), and the admission trust gate refuses the run before
  any socket. The check and the run judge ONE predicate
  (`nika_types::net::retry_is_effect_safe`) — check ≡ run. With an
  `idempotency-key` header the declared retry keeps working (the receiver
  dedups the replay), and `GET`/`HEAD` retry behavior is unchanged.
- **`nika trace verify` states an UNSEALED journal and can require the seal.**
  A journal whose `run_sealed` line was cut used to verify « OK · chain intact »
  with the SEALED line simply gone and the same exit as a clean run. The ladder
  now prints `UNSEALED — no run_sealed frame …` naming the three honest causes
  (a keyless run, a run killed before its seal, a journal cut after it), and
  `--sealed` makes a missing seal the same exit-3 refusal `--anchored` gives a
  missing sidecar, so CI can demand the signed tier.
- **`nika thread` `/run` leaves its journal.** A workflow run from inside the
  conversation now writes its hash-chained trace under `.nika/traces/` and
  prints the trace line, exactly like `nika run`; the thread used to strip the
  accountability layer (no trace, no cost line, no seal). Staged conversational
  turns stay journal-less.
- **A sanctioned secret egress is stated, never erased.** A declared secret
  reaching an external destination by `egress:` sanction now takes the warn
  posture on SECRETS with one named row per flow, counts on JOURNEY, and rides
  the audited line; a `nika:fetch` whose literal host carries a templated
  query names that host (the journey said « 0 destinations »). A sanction that
  pins no `host:` over a net destination grades High (refused under
  `--profile operational`); the pinned form `egress: [{ to, host }]` now also
  clears a literal host followed by a templated query.
- **The first TRIFECTA refusal states the whole dominance rule.** A blocking
  `nika:prompt` must dominate every path to the egress task, data edges
  (`with:`) included; the refusal now names every entry task the gate must
  precede (the judge had already computed them) and the whole repair shape in
  one sentence: the gate in `permits.tools`, its answer bound with `with:`,
  the effect gated with `when:`.
- **A value that looks like a reference and is not one is named.** The
  mustache island `{{ inputs.topic }}` and a whole `with:` value shaped like a
  shell sigil (`$a`) used to pass check silently and reach the model as
  literal text; a `silent-literal` hint now names the literal and the one
  reference form (`${{ inputs.topic }}` · `${{ tasks.a.output }}`). Real
  islands, dollar amounts and the shell's own `$HOME` in argv stay silent.
- **`nika explain NIKA-EXEC-001` no longer claims check catches it.** The
  closer draws the same line check's EXEC row draws: a literal argv the floor
  refuses is check's; a templated program name and a non-zero exit status are
  the run's verdict.
- **One provider count, every surface.** The card, the catalog header and
  the check refusal now speak the same wired facet, split the same way
  (« 16 wired in this build (5 local · 11 cloud · plus mock) ») instead of
  15, 15 and 16 for one binary. `moonshot` (Kimi K2 · K2.5, the international
  endpoint, `MOONSHOT_API_KEY`) is wired, so the canon's seventeen and the
  binary's seventeen are the same list.
- **A TRIFECTA finding says why the legs are legs here.** One clause names
  the grant arming each leg (an exec output is untrusted content · an exec
  grant reaches anywhere · a net grant · a write outside `./`), so a purely
  local shell pipeline no longer reads as an unexplained exfiltration. The
  bypass sentence names the sink's PARENT that skirts the gate, never a
  second « source » that contradicted the first.
- **Foreign terms name their mechanism.** Airflow and GitHub Actions keys
  that reached the generic field list now teach the replacement inline:
  `schedule_interval` → the project file's `arm:` · `default_args` → per-task
  fields and `inputs:` knobs · `dag_id` → `nika:` · `on_failure_callback` →
  `after: { x: failure }` · `trigger_rule` → the `after:` outcomes · `retries`
  → the `retry:` mapping's fields · `if` → `when:` · `continue-on-error` →
  `on_error:`.
- **`run --json` ends on the whole verdict.** The terminal `run_settled`
  frame of a failed run now carries `error: { code, message, task }` (the
  first failed task), so the last line a machine reads says why; a
  succeeded or paused run carries no `error` key.
- **`check --help` and `test --help` carry their exit-code table.** The
  house taxonomy is spoken on the verb: 0 the report holds · 2 the FILE (a
  grammar refusal or findings · `--json` `kind` tells them apart) · 3 the
  ENVIRONMENT (a missing or unreadable file, an unreachable registry, a
  misused flag) · never 1 or 4 on `check`; the golden test names its 3 (no
  golden yet).
- **`nika guard` lets `nika run --help` through.** The hook-side guard treated
  `--help`, `-h` and `--version` as a bare run and refused them as « names no file »
  or « several workflows live here »; they print and exit, so nothing runs and
  nothing is judged. Three gauntlet personas hit it while trying to read the
  verb's flags.
- **A `pauseUntil` in the past wakes the schedule under `nika serve`.**
  The serve planner judged `active: false` as paused forever and never
  read the declared bound. It now evaluates the expiry the arm-fire way —
  the date strictly before the decision instant's own civil date — so an
  expired pause plans as active and fires, while a future one stays
  visibly paused.
## [0.116.2](https://github.com/supernovae-st/nika/compare/v0.116.0..v0.116.2) - 2026-08-31

### Changed

- **0.116.2 supersedes the unpublished 0.116.1 tag.** No GitHub Release
  or assets were produced because estate freshness stopped all four
  builders; the immutable tag remains a historical record. This train
  carries the full gauntlet close with a final-tree estate projection.

### Fixed

- **Relative permit paths keep stable identity during concurrent ancestry
  changes.** A sibling creating the first relative ancestor between grant
  and target resolution can no longer change the permit decision.
- **Resident schedules settle before their durable store shuts down.**
  `nika serve` joins scheduler authority after prepared runs and terminal
  receipts drain, preventing live-once settlement from racing store shutdown.
- **`nika try` names a missing host tool in the sandbox.**
  `standup-digest` (git) and `03-exec-pipeline` (cargo) print a recover
  tip instead of an opaque seatbelt, even under `--model mock/echo`.
- **Night gauntlet close (PR 1320).** `exec.shell` host reads and
  computed file-plumbing are NIKA-SEC-004 at check and confine; mock
  images name the rehearsal and paint a red band; `groq/grok-3` is a
  wrong-seat MODELS refusal; live HTTP does not dial RFC 2606
  documentation hosts; the postcard stays six lines; pause teaches
  `nika run --answer`; `--help --all` names the one free path (a real
  answer needs a key, a signed-in seat, or Gear One — else a mock);
  journal recover skips the 0.116.0 `run_settled` envelope (not an Event).
- **`--answer task=yes` stays a string on `mode: input`.** Confirm
  (the stdlib default) still takes `yes`/`y`/`no`/`n` as the TTY
  boolean; an input gate binds `"yes"` so resume completes instead of
  re-pausing on a boolean the prompt cannot fill.
- **`nika explain FILE` no longer says checks clean on a red check.**
  The human line and the JSON `clean` flag follow `CheckReport::is_clean`
  (PERMITS-red files say `check red` / `"clean": false`).
- **`nika check --fix` wraps a bare `exec:` scalar into live dialect.**
  Inert tokens become `command: ["prog", …]`; shell metacharacters
  become `shell: "…"`. The 0.102 `command:` + `shell: true` pair is
  gone (it PARSE-019'd).
- **A task-level GitHub Actions `run:` names `exec:`.** Envelope `run:`
  stays `{entropy, clock}` at column 0. `params:` names live `args:`.
- **Pause card teaches a string on `mode: input`.** Confirm still
  shows `=true` (boolean, not yes). Input/choice show
  `--answer task="your answer"`, so the loud `answer:` line matches
  the resume line instead of burning the ticket.
- **Oversized HTTP uploads now return their typed 413 response.** Nika drains
  authenticated bodies with constant memory and the existing request timeout
  before closing, so Node clients no longer lose the response to `EPIPE`.

### Security

- **Secret-bearing workflows stay out of test and fallback diagnostics.**
  Panic and assertion paths no longer format raw workflow, command, report,
  parser, or runtime content; sentinel regressions close 16 cleartext-log flows.

## [0.116.1](https://github.com/supernovae-st/nika/compare/v0.116.0..v0.116.1) - 2026-08-31

**Lineage note.** Tag `v0.116.1` was created but never published: no GitHub
Release or release assets exist. Its contents are delivered and documented
under `0.116.2` above.

## [0.116.0](https://github.com/supernovae-st/nika/compare/v0.115.0..v0.116.0) - 2026-08-31

### Added

- **One SDK gains a durable resident HTTP authority.** `nika serve`
  admits immutable execution snapshots, persists job identity, outputs,
  receipts and ordered events, supports idempotent cancellation and replay,
  exposes contained workflow discovery, status, schedule CAS and typed trace
  verification, and publishes the owning OpenAPI contract. Hidden CLI
  identity and snapshot probes let the TypeScript client prove local/remote
  compatibility before admission; receipt job, execution and trace bindings
  fail closed across event and durable settlement paths.

### Changed

- **The One SDK contract is machine-complete at its live boundaries.** Health,
  workflow discovery/metadata, and the SSE event projection now carry owning
  OpenAPI schemas instead of description-only 200 responses. The engine
  release kit under `.agents/` is explicitly engine-owned and mirrored
  downstream from immutable tags; the client-registry resync can no longer
  overwrite it from a moving plugin branch.
- **The MCP oracle closes the repair loop.** `nika_check` gains
  `fix: true`: the same transactional repair ladder as `nika check --fix`
  (typed renames · dead-form migrations · the VAR-021 hoist) runs IN
  MEMORY over the submitted source, re-audits, and answers JSON —
  `repairs`, `applied`, `changed`, the repaired `workflow` text and the
  plain `verdict` of that text. The caller writes the text back; nothing
  on the server writes a file (the tool takes source, never a path, and
  the same catalog rides the HTTP transport). The three codes that
  prescribe `nika check --fix` are now reachable by a no-shell agent.
  `nika_examples` gains `builtin:` — one JSONL row per embedded example
  that calls one `nika:*` tool. The server instructions teach the repair
  door and are pinned ⊆ the catalog: every tool named is served, every
  served tool is named, a declared `fix` is taught, and a read-only /
  never-run claim is checked against every tool's annotations.
## [0.115.0](https://github.com/supernovae-st/nika/compare/v0.114.0..v0.115.0) - 2026-08-26

### Added

- **`nika check --json` carries one-obvious-way lints.** `hints[]`
  rows with `kind: "one-obvious-way"` and `code: "one-obvious-way/NNN"`
  (advice starts with the rule id), the same door native-first already
  had. Warnings, never errors — `clean` stays true.
- **The next tagged binary includes the harness access class.**
  `release.yml` builds `--features local-infer,access-harness`. The
  160 KB `nika-harness` crate has been on main, API-frozen, since
  2026-08-08, and was compiled out of every downloadable binary.
  `agent:` tasks can sit on a detected harness via `--access <seat>`
  once that tag ships. Infer-grade harness (P4 · `infer:` on a seat)
  stays parked. `crates/nika-acp` stays a quarantined workspace (the
  official SDK's `preserve_order` must never unify into the engine);
  Diamond CI now runs its five batteries against `nika-harness` over
  a process boundary. `metal` stays off (candle 0.10 kernel dies at
  first token).
- **One-shot `infer:` tasks can use a proved Codex subscription seat.** The
  adapter runs `codex exec --json` with schema enforcement, rejects extra
  turns or implicit tools, and records subscription quota without inventing
  a token count, USD price, or responding-model claim.
- **Every shipped example now runs in CI, not just audits.** The 53-example
  pack gained a manifest-driven family gate (`pack_examples_family`): each
  example is launched through `nika try` (or a staged `nika run` for the
  human-gated ones) under the offline mock seat, hermetically. Skips are
  explicit and counted — the seatbelt-confined git/cargo examples run as
  known-fail legs that fail the gate the day they heal.

### Changed

- **`capture: structured` no longer turns a jail EPERM into a green run
  (#1068).** A confinement denial (`cat: …: Operation not permitted` /
  `Permission denied`, a `sandbox-exec:` / `bwrap:` line, status 126) is
  `NIKA-SEC-001` in every capture mode. A program's own non-zero stays
  data under `structured`. Seatbelt and bwrap share the same stderr table
  so Linux cannot re-open the hole the macOS path already closed.
- **A `for_each` failure names the item.** The parent note and the
  error message carry the compact item identity (and which values
  recovered when `on_error: skip` nulled a slot). The trace no longer
  records only a count.
- **OpenAPI lists the live POST statuses.** `GET /v1/openapi.json` names
  400, 408, 409, 413, 415, 503, and 507 on `POST /v1/jobs` next to
  200/202/401/422. `info.description` names that `POST /v1/run` is
  absent. `GET /v1/jobs/{id}/status` stays `{status}` only; diagnosis
  lives on `GET /v1/jobs/{id}` and SSE.
- **Failed HTTP jobs name a NIKA code.** `GET /v1/jobs/{id}` grows an
  optional `{error:{code,message}}` on `failed`. SSE settled/refused
  frames may carry the same redacted pair. Paths and secret-shaped
  fields stay dropped. Succeeded jobs omit `error`.
- **POST `/v1/jobs` 422 names the capture diagnosis.** A parse-fatal or
  check-fatal world returns `{error:{code,message}}` with the NIKA code
  when the engine stamped one, including analysis codes (AUTH/SEC)
  that live on `finding.code`. Symlink and other capture refuses stay
  `admission_refused`. Paths stay dropped.
- **Token-file refusal is typed.** `ServerError::Credential` now names
  unreadable, not a regular file, insecure mode, or invalid material.
  `nika serve --bind` still prints the openssl mint and never echoes
  bytes. Missing `--token-file` is unchanged. Paths stay dropped.
- **`nika doctor` uses the same token-file policy as `nika serve`.** A
  short, non-graphic, or symlink `.nika/serve.token` is a fail with the
  openssl mint, not an owner-only green. Group/world-readable still
  names `chmod 600`. The row stays silent when the file is absent.
- **`nika serve --bind` prints the token mint instead of an opaque
  credential refusal.** Missing `--token-file`, a short secret, or a
  group/world-readable file all teach
  `umask 077 && openssl rand -hex 24 > .nika/serve.token && chmod 600
  .nika/serve.token` and never echo the bytes. The HTTP door still
  refuses to mint a secret on its own.
- **The listen line names the next hop.** After bind it prints
  `GET /health`, authenticated `GET /v1/openapi.json`, and
  `POST /v1/jobs` with Bearer plus Idempotency-Key. A non-loopback
  bind adds that the blast radius is every workflow in `--workflows`.
  `GET /health` JSON stays the ADR-117 identity allowlist.
- **Action dogfood no longer runs on tags.** `install.sh` resolves the
  latest published binary, which lags the tagged tree until release.yml
  finishes. The smoke workflow now lives outside the checkout so project
  discovery cannot walk into this engine's `nika.yaml`. An additive
  `working-directory` input on the composite action is the seam.
- **The `local` row counts what is supported, not what is here.** Under a
  « this machine » header it listed `ollama · lmstudio · llamacpp ·
  localai · vllm` with nothing listening on any of them — the names are
  what the BINARY supports, the header promises what the MACHINE has. The
  row now says how many keyless engines exist and names the probe
  (`nika doctor --ping`). `nika catalog` still names them, where naming
  them is true.
- **`check --fix` keeps the filed #905 fixture YAML-parseable.** The
  round judge already rolled back a broken write; the under-indented
  `description: |` body (29 of 37 files in the original wave) is now a
  unit of that judge, and `nika check --fix` on the 7-line repro cannot
  announce a repair and leave PARSE-001. A repair that cannot re-parse
  still refuses; the file on disk stays YAML.
- **`permits.fs` `~/` and `$HOME/` grants expand at run.** A confined
  `exec` can name `~/.gitconfig` instead of one laptop's `/Users/…`
  path, so the grant that makes `git` (or `python3`, or any tool that
  reads its own installed state) work is one a shared workflow can
  commit. Expansion uses the operator `HOME`; `~user` and another
  tree stay out, and `permits.exec: ["git"]` still does not grant the
  homedir — the author names `~/.gitconfig`.
- **An unfilled scaffold refuses at `check`, before the spend.** `nika
  new chain` laid its `SLOT` markers as YAML **comments**, which the
  parser drops by construction — so `check` mentioned none of them, the
  run exited 0, and `output.md` was left holding the scaffold's own
  prompt echoed back by a mock: a file that outlives the terminal line
  explaining it. A comment cannot refuse, so the marker descends into
  the VALUE (`<SLOT: what should the model do with the gathered text?>`)
  where the parser sees it. Seven shipped skeletons now carry one, and
  `check` names each unfilled slot with its line and closes on one
  pasteable command. The refusal is worded as a step, not a fault —
  `not a workflow yet — 1 slot to fill, then it audits` — because
  someone who just typed `nika new` did nothing wrong. Fill it and the
  same file audits clean and runs; that second half is pinned too, so
  the refusal can never widen into a wall.
- **`check` names an `infer:`/`agent:` task no `model:` reaches.** The
  MODELS rung answered for a model it could not resolve and said nothing
  at all for a model that was never declared — an empty requirement list
  is the same shape as a workflow with no inference tasks. The rung now
  names the task, and the author reads it before the run instead of
  meeting the omission as a provider error.
- **`nika doctor` stops calling price rows models (#1179).** The pricing
  line formatted the vendored snapshot's rule count as « 633 models »,
  one command away from `nika catalog`'s « 69 models » — two inventories
  under one word, an order of magnitude apart, both on a first session.
  It now reads `633 price rules · 10 providers priced`. Same numbers,
  each naming the facet it counts: several patterns can price one model,
  and a pattern can price models this catalog never lists.
- **The catalog marks what this build can actually run (#1184).** `nika
  catalog` ships 38 vendors and this binary carries adapters for 16;
  until now the human list, the `catalog_version: 1` JSON and the MCP
  `nika_catalog` tool rendered a reachable and an unreachable vendor
  identically, so the fact only arrived after the choice, at the MODELS
  rung. Every provider row now carries `resolves`, derived from
  `nika_providers::CANONICAL_IDS` and never typed: the JSON emits the
  field (additive within v1 — no envelope bump), the human column reads
  `catalog only — does not resolve in this build`, and the MCP tool
  description tells an agent to pick only from rows where it is true.
  The word is the refusal rung's own — « wired » already names a
  different set (the run registry, `mock` excluded) one line above, and
  a synonym there would re-create the confusion `machine_truth.rs`
  exists to cure. `native` no longer invites `nika model pull` into a
  door that refuses at `check`. One traversal (`catalog_family.rs`, the
  `rust` CI job) holds all 38 rows to the same answer across both
  projections and the MODELS rung, and is the `proven_by` for their 38
  ledger rows.
- **`nika --json` answers the same next step as the terminal.** The
  screen's one next step is now computed once and rendered by every
  projection: the `Next:` block, the new top-level `next` field,
  `start` (a one-element array where it used to carry the pre-cascade
  triple `nika try 01-hello` · `nika init` · `nika new`), and every
  `inference_choice.rungs[].next`. Those rungs hardcoded `nika new
  hello`, so a harness reading them in a directory that already held
  the file was told to run a command that refuses on `--force`. The one
  derivation carries the audited laws too — a red sole file yields
  `nika check <file>`, a priced one yields the `--max-cost-usd` cap.
- **The first-contact screen promises one first command.** `nika` and
  `nika welcome` used to print the cascade's single `Next:` step and,
  eleven lines below it, the `start here` menu that step had replaced —
  two different doors for a stranger to choose between, and `nika init`
  offered twice. The menu is gone; the body keeps `this machine`, `this
  binary`, the sample block and the `learn:` line. The cascade's
  hardware row now reads `this hardware · N GB` and the local rung no
  longer repeats the RAM, so the words `this machine` name one thing on
  the screen instead of three. 43 lines down to 38.
- **A gate-blocked task names the upstream that closed the gate.** The
  row said `gate: an edge did not admit` — no edge, no upstream, no
  outcome — while the trace already carried `blocked_by`. It now reads
  `blocked · <task> settled <outcome> · no binding here admits that`, so
  the common case is legible: a `tasks.X.error` binding admits a failure
  or a skip, and a task that SUCCEEDED has no error to read.
- **In the v0.115 development line, the run's dataflow descends to the pure
  L0 `nika-dataflow` crate, so `nika-runtime` is
  not paying its 15k wall in doc comments.** `nika-runtime` sat at 98.6% of
  the production-LOC cap, and a written pull request could not land because
  branch and `main` were each under it while their *merge* crossed. That PR
  had already compressed three explanatory doc blocks to one-liners and
  still did not fit: a comment is the cheapest line to delete, so it is the
  first line deleted, and the budget gets satisfied by removing exactly the
  thing that makes a crate maintainable. `TaskRecord` and the `${{ }}` /
  `cel-subset/0.1` / jq evaluation over it are one concept and are now one
  crate — **14,787 → 14,053** production LOC under the corrected gate on
  current `main`. Every historical
  `nika_runtime::` path still resolves, and the four evaluation error
  classes keep their historical public constructors and match arms, plus
  their wire codes (`NIKA-VAR-001` · `-002` · `-004` · `-005` · `-006`),
  byte for byte.
  The L0 jq seam refuses ambient clock/timezone, host diagnostics, and
  process-control natives, including a typed-error fallback that prevents a
  jq halt exception from exiting the engine. Its newly public scope and
  record DTOs also follow FCI-002: authority fields are private behind safe
  constructors and the public dataflow types are non-exhaustive.
- **`nika catalog` groups what runs, instead of tagging what does not.**
  Marking each unreachable vendor was correct and unreadable: 22 of 38
  rows repeated the same suffix, so the fact a reader wanted had to be
  found by scanning for its ABSENCE. LOCAL and CLOUD now hold only the
  16 providers this build resolves, in the same doctrine order; the rest
  sit under one new head, `CATALOG ONLY (no adapter in this build · nika
  check refuses these)`. The group is the marker, said once. `native`
  leaves the « zero key · zero network » banner it could never honour.
  The `--json` and MCP projections are unchanged — a machine filters on
  `resolves`, it does not read headings.
- **The `✔ MODELS` green line no longer reads as « the run will reach
  the model ».** The rung judges resolution in this binary — never key
  presence on this machine — and the line now says so: « key presence on
  this machine not judged (advisory: check --json access_plan · the run
  gate refuses NIKA-INFER-001) ». The access truth existed but was
  advisory-only (`check --json`, `explain`); the sentence now names that
  deferral instead of letting a green claim cover it. What the gate
  covers is unchanged.
- **Release preparation has one transactional changelog owner and three lock families.** The wave sweep delegates a retry-safe engine fold to the fragment assembler, the uniformity gate covers the standalone ACP lock, and ecosystem coherence attributes editor drift from repo to release to each registry.

### Fixed

- **A workflow file typed bare is a run.** `nika notes.nika.yaml` used to
  answer `unrecognized subcommand` — a wall where a run was meant. A
  colleague sends a `.nika.yaml` and the person types its name the way one
  opens a file. The routing is narrow on purpose: the name must end in the
  workflow suffix AND be a file on disk, so a typo'd verb keeps clap's
  did-you-mean and a suffix naming nothing keeps clap's error.
- **One pre-push gate at a time per machine — a second push waits instead
  of racing.** Three concurrent `lefthook run pre-push` processes over one
  30G `target/` turned three unrelated ratchets red, none of which
  reproduces on an idle machine. Two were timeouts; the third,
  `credential-headers`, reported a credential leak **that does not exist**
  (the header it named is listed, and the gate reads that file directly —
  6/6 green idle). A security vector that cries wolf trains the next reader
  to wave it through. Measured the same evening: one gate takes 210-620s,
  three in parallel took 1958s and all three failed. The gate now takes an
  exclusive lease (`mkdir`, the one atomic primitive macOS and the Ubuntu
  runners agree on) whose holder records its pid so a dead owner's lease is
  reclaimed rather than wedging every later push. `NIKA_GATE_NO_LOCK=1` opts
  out, and says what that re-enables.
- **The pre-push lease now has a judge that runs.** #1064 shipped a lease
  that serialises the pre-push gate, with a self-test proving mutual
  exclusion, stale reclaim, and that a live owner is never robbed — and
  nothing ran it. Not CI, not even pre-push, because a hook helper has no
  runner. It was a green that had never been asked a question. The
  `issue-proof` gate, shipped in the same merge, reopened #1064 within
  minutes for exactly that: a close whose proof does not exist. The first
  thing it caught was its own author. `gate-lock` joins the ratchet matrix
  beside `credential-headers` and `changelog-fragments`, which are there for
  the same reason one degree less severe, and it fails closed when the
  self-test is missing rather than reading an absent file as a pass.
- **`nika lsp` watches the host it was told to watch.** `--clientProcessId`
  was accepted by clap and discarded at the call site, and the `initialize`
  request's own `processId` was never read either, so a client that died
  **without** closing the pipe left the language server running forever — the
  ordinary path hid it, because a clean shutdown closes stdin and the server
  exits on EOF. Both channels now feed one watchdog (argv wins, the payload
  covers hosts that send only that), and the server exits when its declared
  parent goes, per LSP `initialize` §processId.
- **One cwd lease for the whole CLI, so the budget tests stop failing one
  run in four.** `set_current_dir` is process-global and `cargo test --lib`
  runs a crate's tests as parallel threads in one process. `nika-cli` had
  three independent guards — one private to the budget tests, one private to
  `arm fire` — and a third chdir site, `run --example`, with no guard at
  all. Three private mutexes over one global resource do not compose: a test
  could hold its own lock for its whole body and still have the ground moved
  under it. Measured across four CI runs of effectively identical trees (two
  byte-identical), `access-harness tests` failed once, always on the same
  three `verbs::check::budget::tests` — the ones whose assertions derive
  from the current directory. Every site now takes `crate::cwd`, and the
  race is pinned by a test that runs a chdir storm against a lease holder.
  An intermittent red teaches everyone to press the button again, and that
  habit is how a real red gets waved through.
- **`issue-proof` judges every close, instead of only the ones the filer
  armed it for.** The gate exists to refuse the lying checkmark GitHub
  prints when a merge auto-closes an issue — but its trigger required the
  *filer* to have written `proven_by:` in the body, or someone to have
  remembered a label. So an issue filed before the gate existed could never
  opt in, and the merge that closed it is precisely the event the gate was
  built for. Measured one minute apart on one issue: `skipped`, then
  `success` once the string was added. The condition is not widened, it is
  deleted — a guard that cannot be false cannot drift. The honest
  non-capability close now opts *out* through the closer's own act (GitHub's
  `not_planned` / `duplicate`, or a `no-capability` / `question` / `invalid`
  label), which is fixture-pinned in `scripts/ci/test-issue-proof.sh`.
  `wontfix` deliberately does **not** waive: it is added at filing time, and
  honouring it would hand the opt-out straight back to the filer.
- **`issue-proof` can now read an issue that talks about `issue-proof`.** The
  body parser took the first line *containing* `proven_by:` anywhere, so #1200
  — the issue about this very gate — could never be closed: its body quotes
  the old guard, `contains(github.event.issue.body, 'proven_by:')`, inside a
  code fence, and the parser extracted `)` as the job name and reopened the
  issue. Measured, not reasoned: `JOB=[)]`. An issue that discusses the proof
  mechanism is exactly the issue most likely to report a defect in it, so the
  parser has to be able to read its own subject matter. A trailer is now a
  line that is *only* the trailer, and the last one wins — which steps past a
  fenced quote, an inline backticked mention, and a prose line that happens to
  wrap onto column 0.
- **`.agents/**` is classified as the vendored copy it is.** The estate called it the authored source « mirrored downstream into nika-plugins » — the exact inverse of the clients-resync lane, which re-vendors `.agents/` from the plugins SSOT with `--delete`. The misclassification is what let two merged pull requests live only here, until the lane proposed reverting them and rolling four manifests back from 0.114.0 to 0.111.0. The rule now names the lane, the SSOT, and the gate that judges the heal.
- **`check-doc-private-items` no longer files a broken toolchain as documentation drift.** The « cargo could not answer » branch tested the line prefix, but a tool abandoning prints `error: could not document …` — a prefix match — so the branch could never fire in exactly the situation it described (measured: a full disk under `target/doc-check` named crates nobody had touched, on a clean tree). The verdict now discriminates on the failure mode: incapacity verbs route to « the tool failed to run », and only when no genuine lint diagnostic stands beside them.
- **A skipped task's `error` now has a proven reader.** `EdgeKind::FailureObservation` admits `{failure, skipped}`, and `skipped` is in that set solely so a downstream `tasks.X.error` binding has a consumer — but only the record was pinned, never the admission. The new runtime test drives a real consumer across the seam and asserts all three legs: the consumer is admitted (success, never cancelled), the bound value is the typed record with its code intact in the exact command bytes, and the same consumer against a succeeded producer settles cancelled, so the pass-set cannot silently narrow OR widen again.
- **The release tooling test can no longer write into the repository that invokes it.** `git -C` scopes the directory, never the index: an inherited `GIT_INDEX_FILE` (or `GIT_DIR` / `GIT_WORK_TREE`) pointed its fixture commits at the caller's branch while the test printed PASS. The test now sanitizes the git environment at entry and proves on exit, from its trap, that the caller's HEAD and worktree are byte-identical to what they were.
- **`nika check` now refuses a `thinking:` block the run would reject or
  ignore.** The parser validated each field's type and stopped: a
  `budget_tokens` at or over `max_tokens` audited green, then the provider
  refused the call (the reasoning share lives inside the cap), and
  `thinking: { enabled: true }` on a seat the catalog knows cannot reason
  was a dead declaration the wire dropped or 400'd. Both are MODELS-rung
  findings now — the seat check fires only when the catalog positively
  knows the exact model (a provider row or an exact pricing pattern), so a
  newly shipped model the dated snapshot has not met keeps its benefit of
  the doubt, and a templated `model:` is judged through its declared
  default or left to the run.
- **`nika check` no longer greens a plain YAML number or boolean where the
  spec says string.** `prompt: 123` rode through the parser because a plain
  scalar's source text restringifies silently — the field audited clean on a
  value whose type the author never checked. Every string-typed verb field
  (infer/agent `prompt`·`system`·`model`, exec `shell`·`cwd`·`stdin`,
  `command` elements, `env` values, agent `tools`/`skills` entries, invoke
  `tool`/`workflow`) now refuses a plain scalar that resolves as an
  int/float/bool and teaches the quoted form (`"123"`). The YAML 1.1 aliases
  `yes`/`no` stay strings (only `true`/`false` are booleans in this
  dialect), and `${{ }}` templates are untouched. A sweep test walks the
  closed verb key sets against a checked-in field→type table, so a new verb
  field without a refusing fixture fails the suite.
- **A refused cleanup is no longer invisible.** An `after: { x: unwind }`
  cleanup that failed — a permit refusal, a non-zero exit, a timeout, even
  a closed `when:` gate — used to vanish without a frame: the trace read
  pixel-identical to a cleanup that never fired. The lane still never
  propagates (best-effort by spec), but its outcome is journaled now: one
  `permit_checked` frame on plane `on_finally` per skipped, failed, or
  timed-out cleanup, naming the error code (`NIKA-SEC-004` and friends) —
  spec 03's « its errors are logged » guarantee, kept.
- **One access census, one truth — the seat in the first screen, the doctor
  fix, and the refusal tail.** Three surfaces each read a different source of
  access truth. `welcome` and `doctor --json` classified a machine with a
  signed-in harness seat as `installed · no inference path` (the probe filled
  from provider rows only, the seat rows one call away and never joined in);
  the doctor per-seat fix taught `install: @zed-industries/claude-agent-acp@…`
  — the wrapper id `run --access` refuses as retired (NIKA-1802) — and the
  NIKA-1800/INFER-001 witnesses never named the seat escape hatch nor the
  credential's custody. The census (`nika_providers::census::AccessCensus`)
  joins provider rows and harness seats in ONE read; the adoption ladder gains
  the `seat_ready` rung between `key_present` and `real_ready`; the cascade
  names seats by their live pin token (`claude-code`, not the wrapper id);
  doctor's seat fixes name `--access <seat>` plus the gesture; the admission
  witness says `<VAR> unset in process env`; and the L4 refusal render plus
  `nika explain` append « or use a signed-in seat: `--access …` » — printed
  only when this machine actually has one.
- **The arm-room test reads the cwd under the lease that governs it.**
  `concurrent_run_rooms_are_serialized_and_restore_the_caller` observed
  the process-global cwd twice — the baseline and the restoration —
  without holding `cwd::hold()`, so it measured whichever sibling
  happened to own the process. It went red on three consecutive `main`
  commits with `left` = `cwd::tests`'s chdir-storm room, while this
  test's own restore had already put the process back. The production
  path was never at fault: `enter_room` takes the crate lease and rides
  `fchdir` exactly as `cwd.rs` documents. Both reads now ride the lease,
  which is what makes the claim well-defined. Reproduced 2/20 by running
  the test WITH the storm; 40/40 after (the full suite hides it — 12/12
  green either way, which is why the red only ever surfaced in CI).
- **The MODELS refusal points at a surface that actually names them.**
  It said *"16 runnable — `nika doctor` names them"*. Measured on a
  virgin machine: plain `nika doctor` names five — the local line — and
  folds the ten cloud rows into « 10 providers unconfigured »; `mock`
  gets no row at all. A stuck user was sent to a surface that named five
  of the sixteen, and only `--verbose` improved on it. Both refusals now
  point at `nika catalog`, which groups all sixteen under LOCAL and
  CLOUD, and the unknown-provider one adds where the id they typed sits
  (`CATALOG ONLY`). The claim is pinned per run:
  `the_named_surface_actually_names_them` counts the rows the listing
  renders before that head and refuses any drift from
  `CANONICAL_IDS.len()`.
- **The 15k crate-size counter was wrong for 69 of 71 crates, in both
  directions at once.** It guards a *maintainability* budget, so every line
  it mis-charges gets paid for in deleted doc comments — which is how #1203
  surfaced it. Three defects: braces inside **string literals** ended a
  `#[cfg(test)]` module early (412 lines of test body charged to production
  in one file), `#[cfg(test)] mod foo;` — an attribute on a declaration —
  swallowed whichever block came next and **hid** production lines, and a
  phantom trailing line was charged once per file. `nika-display` was
  over-charged 846 lines, `nika-cap` 733; `nika-cli` had 31 production lines
  hidden, `nika-runtime` 65. The awk filter in `_lib.sh` had already learned
  the string-literal rule in August; three python copies never did. The
  counter now lives in one proven file (`scripts/ci/prod-loc.py`) that
  refuses to render a verdict unless its own fixtures pass, and the gate
  fails closed if they are missing. Corrected, the crate nearest the wall is
  `nika-check` at 14,697.

### Security

- **A decided human gate stays decided.** `--resume` of a trace that
  already journaled a `nika:prompt` success now refuses `--answer` on
  that same task (environment class). A recorded NO cannot be flipped
  into a shipment. A paused gate (no `task_completed` yet) still
  accepts `--answer`. Measured against `nika 0.114.0 (80d62b8f8)` on
  `human-gated-ship`.
- **The default sandbox arm stays fail-closed (#822).** `NIKA_SANDBOX`
  unset (`auto`) plus a `permits:` workflow plus no OS jail is NIKA-1710,
  not a composed Noop run. The composition gate is tested with a Noop
  decision so deleting the refuse arm cannot hide behind a host that
  ships Seatbelt. Doctor display of the row stays S3.
- **A sanctioned secret into `agent:` is still a named flow (#1041).**
  JOURNEY takes the agent's `tools:` intersected with `permits.net.http`
  as the destination set. SECRETS stops saying « no declared secret
  reaches an effect » after the author applied the tool's own `egress:`
  advice. A sanction authorizes a flow; it does not deny the flow exists.
- **The first screen cannot promise a seat whose adapter is absent.** A
  signed-in Claude Code no longer reads as a runnable harness seat when
  `claude-agent-acp` — a different npm package, the binary a session
  spawns — is not on PATH. `ready` now needs three things, not two: the
  app is here, it is signed in, and its ACP adapter answers. The row
  stays visible and names the one command that closes the gap
  (`npm i -g @zed-industries/claude-agent-acp`); hiding an app the person
  has would trade one lie for another. `doctor --json` stops reporting
  `ready: true` and `chosen_access: claude-agent-acp` on a machine where
  no such binary exists — an agent reads that field and acts on it.
## [0.114.0](https://github.com/supernovae-st/nika/compare/v0.113.0..v0.114.0) - 2026-08-23

**Remote execution as a loopback door.** Default `nika serve` stays the
resident ARM firer. `--bind` + `--workflows` + `--token-file` opens
authenticated HTTP: jobs, SSE, OpenAPI. The worker runs the POST-time
snapshot, not live files. Cancel, artifacts and `/v1/run` stay 404.
The workflow envelope is unchanged since v0.113.0. The project file's
retired `nika: v1` tag now refuses. Pre-1.0 real semver puts this at a
minor bump.

### Added

- **`nika serve --bind` is authenticated loopback HTTP.** Pair it with
  `--workflows` and `--token-file` (credential bytes never enter argv).
  Default `nika serve` is still the resident ARM firer. The verb is on
  `nika --help`. Listen line prints the bound address, including port 0.
  Job cancel and artifacts stay 404 until those authorities exist.
- **Job events project over SSE** at `GET /v1/jobs/{id}/events`. Frames
  are `{sequence,kind,status}` only. `GET /v1/openapi.json` is the live
  route table; cancel, artifacts and `/v1/run` are omitted.
- **`nika doctor` names the HTTP door when a token file is present.**
  Owner-only mode is OK; group/world-readable is a fail with the umask
  077 fix. The row never claims TLS — that is the reverse proxy.
  Silent when the cwd has no `.nika/serve.token` (the door is opt-in).
  systemd and Caddy examples live in `docs/ops/`.

### Changed

- **`nika check` names the ancestor `nika.yaml` spend cap.** `nika run`
  already filled `--max-cost-usd` from that file; check printed « no
  total ceiling » and advised adding the flag, on a tree that already
  had one (issue 1050). The COST line still prices the workflow; a
  `BUDGET` footnote (and a presence-gated `run_budget` object on
  `--json`) now says the number and `nika.yaml:line`. `--max-cost-usd`
  still wins. `run --dry-run` and `--help` stay silent — this is the
  surface that contradicted the file.
- **A piped `nika try` / `nika run` no longer waits on the macOS keychain
  after a green card.** The card printed, then `SecKeychainFindGenericPassword`
  blocked the main thread: a pipe cannot complete an ACL prompt. The
  keychain is skipped when stderr is not a TTY (file/env custody stay);
  a disabled journal (`nika try` · `--no-trace-file`) does not consult it
  at all.
- **The README says the trace inherits what the run read.** A `nika:read`
  of a file puts those bytes into `.nika/traces/` in the clear — correct
  for a replayable journal, unnamed until an auditor derived it (issue
  1047). The receipt paragraph now says hash-chained is not confidential.
- **`nika spec --canon` says the error-code count is the floor.** An agent
  read `count: 103` plus two `NIKA-BUILTIN-*` rows as the builtin-code
  family. The spec now carries a `scope:` sibling (nika-spec 282); this pin
  vendors it. Per-builtin and per-provider codes still live in `nika explain`.
- **BREAKING — the project file names itself (`nika.yaml`).** `nika:` carried a
  frozen `v1` tag while a workflow's `nika:` names the file: one key, two
  grammars, and every surface reading both had to know a special rule. It now
  carries the project's kebab-case **name**, the same grammar the workflow
  envelope gives its own `nika:`. The reasoning is this repo's own, written
  when the workflow envelope was nuked — a field with one legal value is not a
  version, so nothing is traded away, and the project gains a name it never
  had. The retired tag refuses **here and nowhere else**: a pre-nuke workflow
  carried a `workflow:` block beside its `nika: v1` and still refuses on that
  key, so `v1` stays free to be an ordinary workflow name; a pre-nuke project
  file had no companion key, so without a refusal the same bytes would quietly
  stop meaning « schema v1 » and start meaning « a project named v1 ». Only a
  whole marker qualifies — `vault`, `v2ray` and `v1-migration` stay names.
  Migration is one line: `nika: v1` → `nika: <your-project-name>`.

### Fixed

- **HTTP cancel now reaches the blocking worker.** Timeout and SIGTERM
  no longer mark interrupted while effects continue. Queued jobs persist
  their workflow name and are re-enqueued on the next incarnation.
- **POST captures the execution world.** A symlink or rewrite after 202
  cannot run bytes the client never admitted. GET names `execution_id`
  and `trace_id` after readmit. The service sandbox is the workflow root.

### Added

- **`nika check` names the exact builtin when a utility is 1:1.** `sleep`,
  `date`, `uuidgen`, the digest family, `yq`, `grep`/`rg`/`ag` and `find`
  used to be silent — or, for `date`/`sha256sum`, a family catalogue.
  Rule `native-first/006` answers with one builtin and its argument shape
  (`nika:wait` · `duration:`) so the author types the next line, not a
  menu. It sits at the foot of the ladder and never steals a more specific
  family. `echo` stays silent on purpose: it is the universal placeholder,
  not a builtin.
- **Tool-result spill in the `agent:` loop (opt-in seam).** Past 16 KiB a
  tool result's full text leaves the conversation for the blob store —
  the content hash IS the locator — and the model keeps a 2 KiB preview
  plus the pointer, so the context window stops re-paying bytes it cannot
  use. Nothing is discarded, and a store refusal keeps the full text:
  the spill is an optimization of the model's reading, never a gate on
  the data. Seat it with `AgentVerb::with_spill`; without the seam the
  loop is byte-unchanged.
- **`nika check` judges a project file as a project.** It applied the nine-key
  WORKFLOW envelope to every document, so a project file came back
  `NIKA-PARSE-002 missing required envelope field: tasks` — on a file
  `nika init --project-file` had just written — and following that finding's
  own advice converted a correct project file into a broken workflow. The
  discriminant is the spec's, normative and covering every document
  (`01-envelope` §The type discriminant): a `tasks:` key means WORKFLOW, its
  absence means PROJECT. Deliberately not the filename, so it still holds for
  a registry blob, an HTTP body or a fence pasted into a chat. A project now
  audits in its own vocabulary — exit 0 clean, 2 on a finding — and says what
  it governs rather than a count it never stated.
- **`nika check` notes a file whose name and filename have drifted apart.**
  Copy `foo.nika.yaml` to `bar.nika.yaml`, forget the header, and every trace
  and journal event keeps saying `foo`. It is a NOTE and never a finding:
  divergence is usually deliberate (an ordering prefix such as `01-hello` is
  stripped before comparing), and the exit code is untouched. The filename is
  a location `git mv` may change; the name is an identity that rides traces.

### Fixed

- **`nika check`'s audited line names the declared blast radius.** The
  default card said `permits declared`; the grants themselves lived
  behind `--infer-permits` and `--json` (persona 4). Cost was already
  on the card. The cell now lists the exec / tools / fs / net / env
  grants (an explicit empty block is `{}`, absent is still `none`).
- **A recovered run is no longer a green tick at a glance.** `--quiet`
  and the shareable card titled `✔` / `✓` on a run that repaired a
  task (`task_recovered` then Ok). Exit 0 is still correct — recovered
  is a success cause. The headline and the card title now carry the
  warn mark; the storyboard already named `N recovered` (persona 14).
  `trace ls` still says `completed` (no new `TraceState` this cut).
- **`--infer-permits` no longer pastes a host-file grant.** A
  `nika:read` of `/etc/passwd` (or `~/.ssh/…`) under an absent
  `permits:` block printed `fs.read: ["/etc/passwd"]`; applying that
  block greened check and run (persona 7). G-09 already withheld the
  shovel on a *declared* boundary; the AUTH-006 companion and the
  inferred YAML still handed it. Escaping paths (absolute · home ·
  `..`-climb) stay a note. The printed repair is the tool conjunct
  only.
- **`nika check` no longer panics on a decorative verb glyph.** Copying
  `⛨permits:` / `◇infer:` from nika.sh into a file, then running the
  advertised `nika check`, dumped `annotate-snippets` (`byte index N is
  not a char boundary`) with no NIKA code and no `--fix` hint. The
  snippet painter widened a point span by one BYTE into a 3-byte glyph;
  it now snaps to a char boundary and widens by one CHAR. MCP already
  taught `did you mean permits?` — the CLI default path matches that
  calm.
- **`nika try 10-compose-pipeline` stages the child it invokes.** The
  rehearsal room used to hold only the parent; check then died
  `NIKA-COMP-001` on `./10-compose-child.nika.yaml` (e2e S2 17/18 on
  81c1138f). Fixture materialize already carried `examples/fixtures/`
  ingredients; a relative `workflow: "./….nika.yaml"` pack sibling is
  the same class.
- **`for_each` over a constant that is not an array is refused at check, not
  at dispatch.** `const: { items: "x" }` with `for_each: ${{ const.items }}`
  audited clean, then died at the run with `NIKA-VAR-006` — a linter's answer,
  not a verifier's, and exactly the gap ADR-092 exists to close. The static
  lane already caught a *typed* non-array var but exempted every untyped one,
  on the rationale that « a `--var` override could pass an array ». That rule
  is inputs-only: `--var` sets an `inputs:` value and refuses unknown keys, and
  spec 01 §const is normative — a constant is « immutable across the run and
  never caller-supplied ». An untyped constant's literal IS its run value, so
  a non-array can never become one. Untyped entries are legal in `const:`
  alone, arrays and typed declarations are untouched, and all 59 shipped
  templates and examples still audit clean.
- **`nika explain` answers the token `nika check` printed in `[brackets]`,
  including a hint.** A HINT row put `jq-as-map` (or `native-first/006`)
  in the same slot as `NIKA-PARSE-019`, so the next gesture was
  `nika explain jq-as-map` and the answer was `unknown code`. A finding
  carries `code`; a hint carries `kind` — real in the data, invisible
  in the render. Explain now resolves the printed identity (the kind,
  or the numbered native-first rule) and teaches the class; MCP
  `nika_explain` speaks the same text.
- **`nika check` names the line of a PARSE refusal.** A CONFORM finding
  already carried a rustc-grade frame (`path:line:col` + caret). A PARSE
  finding — `NIKA-PARSE-017` duplicate key, `NIKA-PARSE-005` unknown
  field, any span the parser held — printed the code and left the author
  to find the site. Duplicate keys are the worst of that class: the
  message says `"a" appears twice`, so grepping `a:` returns both, and
  neither is wrong on its own. The colliding key's span was in the
  loader's hand and discarded (`span: None`). It now rides the same
  frame CONFORM uses, under the same `PARSE ✗` first line.
- **`nika arm` no longer refuses a project that sets its retention or its
  provenance floor.** Two readers parse `nika.yaml` — the project reader
  (`ceiling` · `traces.keep` · `registry.floor` · `arm`) and the cadence
  grammar. The grammar refused `traces:` and `registry:` by name as
  « round 2 » keys with a remedy that was false (« retention stays with
  the env vars ») while the project reader had just accepted them and the
  retention ladder and the provenance gate consume them — the project
  starter's own `traces:` line made `nika arm` exit 2. Measured
  2026-08-18. The grammar now admits the project's other rungs OPAQUE and
  judges nothing about them (they are judged where they are owned); the
  cadence domain's own deferred keys (`signature:` · `budget:`) stay
  refused by name. A test derived from the project reader's closed key
  set pins the parity: every key it admits, `nika arm` reads green.

## [0.113.0](https://github.com/supernovae-st/nika/compare/v0.112.0..v0.113.0) - 2026-08-21

**The couture release.** The judge already knew; the agent can now see.
Error codes and `nika explain` ride MCP, CLI JSON and wasm as one well.
Pipelines are judged per segment. Four missing authoring forms have
skeletons. Zero breaking changes since v0.112.0, so pre-1.0 real semver
puts this at a minor bump.

### Added

- **`nika check` now judges every native shell segment, not only the head.**
  Pipelines, `env` wrappers, redirections, groups, `if`/`while` prefixes and
  newlines each surface their own `native-first` hint. Comments stay comments.
- **Four form-first skeletons join `nika new`.** `classify-and-route`,
  `corpus-qa`, `document-to-fields` and `evaluate-and-optimize` ship with their
  golden and their refusing neighbour, pinned to spec `d40fe6ac`.
- **The MCP oracle now carries `instructions` and a structured example index.**
  A dirty report keeps its `NIKA-*` code on the agent channel; `nika_examples`
  without a slug returns recoverable rows instead of a bare list.
- **A green MCP check carries the contract, not just the word clean.**
- **The tightest permits boundary is offered, and only when it is knowable.**
- **The arm ledger is the firing truth; the workspace admits the arm custody
  library.**

### Changed

- **The engine carries one compile-time identity for its version, build,
  language pin and remote API axis.** `nika-runtime` now owns the typed
  `EngineIdentity` consumed by trace prologues, `nika check --json` and the CLI
  version surface. The embedded language pack is re-vendored from that exact
  `SPEC_PIN`, records the same commit in `pack/SPEC_SHA`, and the build refuses
  split identity.

### Fixed

- **A `NIKA-PARSE-*` finding is a PARSE row, including when the analyzer
  emitted it.** Missing `nika:` / `tasks:` no longer wear the CONFORM
  ladder on `nika check`, `--json` `findings[]`, wasm, or MCP — the spec
  family is the gate the agent explains from.
- **Wasm parse-fatal rows stay PARSE regardless of code**, matching CLI
  `parse_fatal_json` (a `NIKA-DAG-005` unknown `after` predicate is PARSE
  on both assemblies).
- **`--fix` cannot rewrite a digest-pinned registry cache, a symlink into
  that cache, stdin, or a device/FIFO.** The footer teaches a copy into the
  workspace; a project path that merely looks like `.nika/registry` stays a
  normal file.
- **The pinned conformance clock includes Agent Skills and current trace
  witnesses.** The harness now exercises the spec's skill lane with exact
  `AGENT`, `AUTH` and `SEC` refusal codes, recognizes the entropy/jitter law,
  and replays every current runtime-trace verdict. The heal workflow advances
  the pin and pack together on an immutable PR branch; Diamond CI independently
  re-vendors every mapped byte.
- **Reference dry-run, AUTH advice, repair and mock seats tell the truth.**
- **The clone says when its own enforcement is not armed.**
- **The plan projection API is locked.**

## [0.112.0](https://github.com/supernovae-st/nika/compare/v0.111.0..v0.112.0) - 2026-08-20

**The instrument-honesty release.** Three features and sixteen fixes, several
of which began as a measurement disagreeing with what a surface said. A cargo
test binary can no longer open the OS keychain — an ACL is bound to the
requesting binary, and a test binary's hash changes on every compile, so the
prompt could never be answered once and for all. `nika check`'s JOURNEY rung
counts model endpoints instead of tasks, ending a card that contradicted
itself four lines apart: COST read `no infer/agent tasks` while JOURNEY read
`3 model endpoints`. A fan-out that recovered now says so in its record and
not only in its prose, which is what spec 13 requires of the pair. And the
`exec:` fit lane gained an fs arm, so a leg jailed away from its own script
is refused at check instead of exiting 126 under a green card.

### Added

- **`nika list` names every workflow below the current directory.** Output is
  stable and root-relative, nested workflows are included, project metadata
  and hidden/build directories stay out, and an incomplete walk refuses
  instead of presenting a partial inventory as exhaustive.
- **Bare `nika` on a terminal opens one continuous thread.** Model turns
  stream through the existing `agent:` runtime; `/workflow` posts a workflow
  into the thread, `/run` executes it there, and Ctrl-C interrupts the active
  turn without closing the outer conversation.

### Removed

- **BREAKING — `VirtualClock` loses its dead time-mover (`nika-clock`).**
  `VirtualClock::advance` and `VirtualClock::elapsed_total` are removed:
  `advance` documented itself as « the ONLY mover of virtual time » while
  having zero production callers — virtual time never moved, so under
  `run: { clock: virtual }` (or `entropy: none | seeded(N)`, which imply
  it) a task `timeout:` budget raced an instantly-ready timer and every
  deadline was already settled at dispatch. The clock is now honestly
  FROZEN by construction (`Copy` bases, no shared offset): an author who
  needs a real deadline honored against real work must not declare
  `clock: virtual`. Wiring the task `timeout:` budget to the exec
  runner's own deadline (`linger: false`) is a follow-up wave.
- **The exec runner's process-group kill is removed
  (`nika-exec-runner`).** `terminate_group` (SIGTERM→SIGKILL the whole
  process group) plus the `process_group(0)` spawn setup were correct
  and tested but unreachable in production — they fired only on
  `TimedOut`/`Cancelled`, and the engine never assigns
  `ShellCommand.timeout` nor invokes `cancel`. Cancellation stays
  `kill_on_drop` (INV-011 · future-drop, the ADR-016 primary); detached
  grandchildren are no longer group-killed on the embedder-facing
  timeout/cancel arms, and the `nix` dependency goes with them.

### Changed

- **BREAKING — the event error codes leave the Shield reservation
  (`nika-event`).** `NIKA_420/421/422` (serialize failed · buffer full ·
  lock poisoned) were minted inside the locked Shield band (380-429), so
  a full event buffer surfaced as « Shield security policy blocked the
  operation » — a refusal its reader would read as security. They are
  renumbered into their own Observability band (800-819) as
  `NIKA_801/802/803`, constants renamed with them.

### Fixed

- **A cargo test binary no longer opens the OS keychain.** A macOS keychain
  ACL is bound to the requesting BINARY, and a test binary is
  `target/<profile>/deps/<name>-<hash>` whose hash changes on every
  recompile — so "Always Allow" grants a binary that will never exist
  again and the prompt returns forever, on every worktree, with no
  operator-side gesture that stops it. `NIKA_KEYCHAIN=off` now skips the
  custody, and a test binary skips it by default whether or not anyone
  remembers the flag. An installed `nika` and `cargo run` land outside
  `deps/` and keep their custody unchanged. All eight keyring call sites
  sit behind the flag, held there by a ratchet that walks the crate's own
  source.

- **The JOURNEY rung counts model endpoints, not tasks.** The envelope
  `model:` is a fallback for a task that HAS a model · it was applied to
  every task, so a body of builtin invokes read `3 model endpoints` while
  the COST rung four lines above read `no infer/agent tasks` — one card
  contradicting itself. `model_endpoint_of` already typed the task and
  threw the answer away on the next line. Across the shipped corpus 45 of
  99 cards carried an inflated count; each is now exactly the number of
  `infer:`/`agent:` tasks the file declares, and no verdict changed.

- **`nika check` judges every secret sharing one effect independently.** A
  sink that referenced two secrets previously retained only the first IFC
  trace, so clearing that first edge could hide an uncleared second edge.
  Direct references and task-local `with:` / `for_each` item aliases now
  produce one consent verdict per distinct secret while the existing
  singular output-propagation trace stays unchanged and bounded. Literal
  `for_each.items` secret references also appear in the data journey.

- **`nika check` now judges the script an `exec:` interpreter must open.**
  The runtime jails every `exec:` child to the declared `permits.fs` set, so
  `exec: ["bash", "leg.sh"]` with no `fs.read` grant could never open its
  own script — measured on seatbelt, the leg exits **126** with empty
  stdout. The audit was ✔ on all fourteen lanes and the run rendered it
  `✔ leg` with rc 0: a leg that did nothing, reported as a success. The
  `exec:` fit lane gained an fs arm beside its net arm (which shipped
  2026-07-29 for the same sentence one boundary over), so the escape is a
  `NIKA-SEC-004` finding at check with the one-line repair. The claim is
  narrow on purpose — only a literal argv whose program is an interpreter,
  on its script positional, through a literal `cwd:`; everything else stays
  the runtime's verdict, and the verdict models the jail (which binds a
  grant's literal prefix and never globs) rather than the stricter lexical
  walk. `--infer-permits` learned the same fact in the same change, so the
  boundary it writes cannot self-refuse the workflow it came from. Swept
  over the shipped corpus: 63 of 63 unchanged.
- **The TRIFECTA tick is derived, so it cannot outlive the gate that
  bought it.** Measured on 0.111.0, one card printed `✔ TRIFECTA … without
  a human gate` four lines above two `NIKA-SEC-014` rows proving that same
  gate lets the effect fire on 'no'; a control run with the prompt deleted
  raised `NIKA-SEC-009`, so the trifecta was complete and the tick was
  bought entirely by a rubber stamp. The lane credited a *blocking prompt*
  (one task, one key lookup) while the consent lane ran the full
  refusal-substitution walk — and the clearance discarded WHICH gate it
  credited, so a trifecta cleared by a gate and one cleared by a missing
  leg were the same empty vec. The clearance now publishes its credit and
  the rung withholds the tick where another lane refutes it, pointing at
  the code that owns the repair. No second finding: the consent row
  already names the defect and teaches the fix.

- **The `nika-error` crate-spec band table matches the one-voice
  registry.** It still read `330-379 Binding/template · 380-429 Provider`
  while the registry moved Provider to 330-379 (2026-05-11) and reserves
  380-429 for Shield. The stale rows invited exactly the collision the
  reservation exists to prevent.

## [0.111.0](https://github.com/supernovae-st/nika/compare/v0.110.0..v0.111.0) - 2026-08-19

**The authoring-loop release.** `nika check --json` now reports
`paid_ready`, `compiled` and `next` — a green parse is legal, not
best. `nika:inspect` is live: the runtime seeds the DAG at run
start and a workflow can read its own cost, records, dag_info and
threads. `nika:compose` stays loop-only (grant after `nika:done`;
checking never executes). The arm lock outlives the shot.

### Added

- **`paid_ready` · `compiled` · `next` on `nika check --json`
  (#1013).** `paid_ready` is silent only when no paid-run hint
  remains. `compiled` means the law is proven (const-fixture
  assert). `next` is the first repair. `nika explain` prints a
  **before a paid model** panel. MCP `nika_check` hard-fails
  `infer-as-law` and `digit-string-enum` only.

- **`nika:inspect` is live (#1018).** `LiveInspect` is the same
  `Arc` the dispatcher and the runtime share. The DAG is seeded at
  run start — the first task sees `available: true`. Records and
  spend mirror after each wave. Hint `inspect-unwired` is retired.
  Teaching shape: `16-inspect-self`.

- **Lesson 15 `nika:compose` on an agent whitelist (#1016).**
  Grant after `nika:done`. The model drafts YAML, gets the full
  check JSON, iterates until `valid`. A standalone `invoke:` is
  `NIKA-BUILTIN-COMPOSE-001`. Checking never executes the draft.
  Parent→child composition stays lesson 10.

- **The arm lock outlives the shot (#1015).** A fire that is
  still running keeps the project lock so a second tick cannot
  overlap the first.

### Fixed

- **Authoring seams from a paid extract wave (#1012).**
  `nika:hash` serializes structured `content:`. `nika:validate`
  parses string schemas. Scalar `anyOf` flattens into coerce.
  `for_each` + `item.field` is resume-eligible (collection is the
  input identity). Hints: `digit-string-enum` · `glob-readme` ·
  `jq-as-map` · `assert-quarantine`.

## [0.110.0](https://github.com/supernovae-st/nika/compare/v0.109.2..v0.110.0) - 2026-08-19

**The arming release.** The project file `nika.yaml` learns to PROPOSE a
schedule, and the machine learns to keep it — « le fichier propose, la
machine dispose ». The `arm:` registry carries the team's armed beats
(thirteen keys, two of them required with no default — `plafond:` and
`manqué:` — because choosing for you would be choosing who pays), one
firer computes the due window and spends under the per-tick ceiling, the
OS bridge hands launchd/systemd the calendar, and `nika serve` keeps the
same firer resident behind the wall clock. One firer, four doors (D2):
`nika arm fire`, the emitted OS units, and `serve` all end at the SAME
fire — a beat the lock, the ceiling, or the miss policy governs is
governed identically no matter who pulled the trigger.

### Added

- **The project file carries the thirteen beat keys (`arm:` · W1 ·
  #993).** Each beat spells `workflow` (a repo-relative `*.nika.yaml`
  path) · `cadence` (a 5-field cron with the zone INSIDE the expression
  — `TZ=Europe/Paris 0 9 * * 1` — or `on-webhook`, resolved against the
  embedded tzdb, never the host's) · `où` · `plafond` · `manqué` ·
  `chevauchement` · `après_saut` · `actif` · `raison` · `jusqu_au` ·
  `tolérance` · `décalage` · `par`. The grammar is CLOSED
  (`deny_unknown_fields`): an unknown key fails at parse and the refusal
  names what is known. `plafond:` (the per-tick USD ceiling) and
  `manqué:` (what "missed" means: `rattraper` · `rattraper-une-fois` ·
  `sauter`) are OBLIGATORY with no default — a default `rattraper`
  spends what nobody asked for, a default `sauter` loses a deliverable
  in silence. A suspended beat must tell its story: `actif: false`
  without `raison:` is a suspension nobody narrates, without
  `jusqu_au:` an oblivion — both refuse by name. Bare `nika arm` READS
  the registry and reports what is armed, due, suspended, or refused —
  it fires nothing.

- **`nika arm fire <label>` — the one firer (W2 · #1001).** Computes
  the planner's silence over `(last, now]`, the on-time window, and the
  miss policy; takes the project lock; refuses BEFORE spending when the
  tick would cross the beat's `plafond:`; and writes the firing record
  to the ledger. Prints exactly one stdout line, always (D8) — a skip
  is an event, said as such (`skipped <label> · inactive — <raison>`),
  never a silence.

- **`nika arm --emit launchd|systemd` — the OS bridge (W3 · #1005).**
  Renders the unit files PURE from the registry (`--write` installs
  them); per-beat units are labelled `nika.arm.<radical>` (D4 — the
  labels the firer uses, computed once); the env file rides by PATH
  only (D7 — provider keys never enter a unit). launchd's
  `StartCalendarInterval` is the cartesian product of the restricted
  fields, counted before built — past 500 dicts the emit refuses (a
  plist of n dicts is a load, not a calendar); systemd writes the sets
  inline and the zone travels in `OnCalendar=`; `Persistent=` answers
  `manqué ≠ sauter`. Every refusal teaches: D10 `TzMismatch` (launchd
  fires in the machine's zone — the remedy names `TZ=` or systemd) ·
  `Webhook` (no calendar can fire an event) · `TooManyIntervals` · the
  D6 v0 set below.

- **`nika arm disarm <label>` — the N4 gesture (W3 · #1005).** Removing
  the line does NOT disarm — the file would simply stop proposing while
  the OS keeps firing. Disarming is `actif: false` + `raison:` +
  `jusqu_au:` in the registry; the verb teaches exactly that, and
  `--tear-down` takes the emitted OS unit down with it.

- **`nika serve` — the same firer, resident (W5 · #1008).** The SAME
  `fire` as `arm fire` and the OS units (D2), driven by the wall clock
  in place of launchd/systemd. The loop reads ONLY the registry —
  judged by vocab + cadence BEFORE any shot — and its own `.nika/arm/`
  sidecar; it reloads `nika.yaml` when its mtime moves (a broken edit
  is told, and the last-good registry keeps serving); it fires what
  `due` returns through the one firer (the per-tick ceiling always
  passed · every fire is a fresh run); and it sleeps to the earliest
  next slot (≤ 60 s) racing ctrl-c/SIGTERM — a signal breaks clean
  (exit 0 · the current fire, synchronous, finishes first · the lock is
  released). No network input, no environment read, no argument beyond
  the clap surface.

### What v0 refuses — and when each arrives (D6)

A policy the firer cannot honor REFUSES, never approximates — and the
refusal names the version the support arrives with:

| Written in the file | v0's answer | Arrives with |
|---|---|---|
| `chevauchement: remplacer` | refuses — today: `sauter` (the law-⑥ default) or `file` | serve v0.2 |
| `après_saut: à-complétion` | refuses — today: `prochain-créneau` (the default) | serve v0.2 |
| `manqué: rattraper` | refuses — today: `rattraper-une-fois` or `sauter` | serve v0.2 |
| `décalage:` | refuses — today the slot fires at the instant said | serve v0.2 |
| `où: cloud` | the local firer SKIPS the beat, journaled — « le cloud exécute, le calendrier demeure au registre » | the cloud rung |
| `signature:` · `budget:` | refused at validation, by name — round-2 keys: round 1 claims nothing it cannot prove (`traces:`/`registry:` likewise) | round 2 |

### Fixed

- **The ORDER and LIFT findings render in the human lane
  (`nika-display` · #1002).**
- **LOT 3 task-body rungs + the sweep's third lock (#999).**
- **Leftover fourteen-key teaching in `nika explain` and rustdoc
  (#1007).** `NIKA-PARSE-002` taught `nika: v1` + `workflow:` + a
  `tasks:` list; `NIKA-PARSE-005` parked custom metadata in
  `description:`. The `RawWorkflow` fence, the analyzer crate doc,
  `MissingEnvelopeField`, and the LSP outline still named `workflow:`
  as a required envelope key. They now speak the live nine-key
  envelope (identity on `nika: <kebab-id>` · `tasks:` is a map ·
  prose is a `#` comment above `nika:`).

### Documentation

- **In-repo teaching speaks the nine-key envelope of 0.109** — the
  hello-example comments name the nine-key identity (#995) · the README
  gifs are rebaked for the envelope (#996) · the docs sweep of 0.109
  lands in-repo (#992).

### Build & CI

- **The release funnel runs on every push (#985)** — the gate the tag
  trusts has already run on the commit it tags.
- **apt gets a deadline (#1000)** — a mirror stall is a five-minute
  red, not a six-hour hang.
- **The pack follows the spec (#987).**

## [0.109.2](https://github.com/supernovae-st/nika/compare/v0.109.1..v0.109.2) - 2026-08-19

**The second refusal, one layer down.** `v0.109.1` fixed the fossil envelope
in the release gates and died on both Linux builders one leg later:
`[consent-run] exit=3 want=4` — since #889 (0.109.0) a workflow that
declares `permits:` refuses to START on a host with no sandbox backend
(`NIKA-1710`), and a GitHub Linux runner has no bubblewrap. The macOS
builders, where seatbelt exists, passed both gates confined. No asset
shipped under `v0.109.1` either; the binaries were fine both times. This
patch is the same tree plus the second fix and is the version consumers
install.

### Fixed

- **The Linux release builders install bubblewrap before the gates run
  (release.yml).** The Diamond CI tests-leg recipe (apt bubblewrap · detach
  ubuntu-24.04's AppArmor bwrap profile · keep unprivileged userns open) now
  runs on the two Linux builders, so the funnel e2e and the trust battery
  run CONFINED there exactly as they do on macOS — never a waiver. A gate
  that spends an `exec` under `permits:` proves the jail as a side effect;
  a host that cannot jail says so (`NIKA-1710`) instead of being waved
  through.

## [0.109.1](https://github.com/supernovae-st/nika/compare/v0.109.0..v0.109.1) - 2026-08-19

**The release the release gate refused.** `v0.109.0` was tagged from
`f58a17396` and its own pre-upload gates killed all four builders: the
funnel e2e and the trust battery still authored their fixtures in the
fourteen-key envelope (`nika: v1` + `workflow:`) the nine-key engine
refuses at parse (`[guard-dirty] missing: NIKA-SEC-014` · `[consent-run]
exit=2 want=4`). No asset was published under that tag; the binaries were
fine and the gate was the fossil, exactly as v0.106.0 died on 2026-07-27
when the battery spent an exec without a `permits:` block. `v0.109.0`
stays a tag with no release; this patch ships the same tree plus the gate
fix and is the version consumers install.

### Fixed

- **The release gates speak the live envelope (funnel e2e · trust
  battery).** Four fixtures move from `nika: v1` + `workflow: {id}` to
  `nika: <id>`. Nothing else in the gates changes: the consent-dirty leg
  still expects `NIKA-SEC-014` at `guard` and `check`, the consent-pause
  leg still expects exit 4 with the resume line, the trust battery still
  runs its exec under `permits.exec`.
- **Hygiene vector 50 · `check-release-gate-envelope`.** The two gates run
  only at tag time, so a language change on main could leave them teaching
  the previous envelope for weeks with nothing red on any push. The vector
  greps both scripts for the dead envelope forms (`nika: v1` · `workflow:`
  · `on_finally:` · `depends_on:` · `${{ vars.` · `${{ env.`) on every
  push and is RED on any hit — proven by mutation (one restored fixture →
  red).

## [0.109.0](https://github.com/supernovae-st/nika/compare/v0.108.0..v0.109.0) - 2026-08-18

**The nine-key release.** The envelope shrinks from fourteen keys to nine and
a workflow written for 0.108.0 will not check on 0.109.0 · this is the flag-day
the 0.106.0 front page announced as possible, and it lands whole. The identity
moves onto `nika:` itself (`nika: <id>` · a kebab-case name · the `workflow:`
block, its `id:` and its `description:` are gone), the value authorities are
exactly three (`inputs` · `const` · `secrets` · `config:` died with the block),
`types:` · `policy:` · `assert:` leave the envelope, and the task body loses
its second grammars: cleanup is a real task on an `unwind` edge (`on_finally:`
is dead · `graph_format: 3` carries the `finally` node), `output:` is spelled
`extract:`, `declassify:` and `inert:` merge into one door (`lift:`),
`fail_workflow` is gone (`on_error` is `recover` or `skip`), the two fan-out
knobs live INSIDE `for_each:`, and `group:` arrives (fan-in · `NIKA-DAG-008`).
Two P0 close at the surface users install: an expression sees only its INPUT
(the ambient `env` leaves the jaq function set at the three seams, with a
pinned inventory of natives that reddens if a future jaq adds one), and a
third-party receipt can no longer write the operator's clipboard (every field
rides `escape_tty`). The refusal a 0.108.0 file meets first now TEACHES where
each retired key's role went, instead of `unknown field`.

### ⚠️ Migration

#### 1 · The envelope · fourteen keys become nine (LOT 2 · ADR-113 · #909 and the sweep of 2026-08-11/13)

The live envelope is `nika` · `model` · `inputs` · `const` · `secrets` ·
`permits` · `run` · `tasks` · `outputs`. Every other top-level key refuses,
and the refusal names the destination:

| Dead form | Write instead | The teaching |
|---|---|---|
| `nika: v1` + `workflow: { id, description }` | `nika: <id>` (kebab-case) · the description as a `#` comment above it | the identity IS the envelope key · prose is demoted, never dropped |
| top-level `description:` | a `#` comment above `nika:` | shipped twice (bare · inside `workflow:`) · both dead |
| `config:` | an `inputs:` entry with `required: false` and a `default:` | a deployment-supplied value is an input with a default · authorities are exactly three |
| `types:` (`NIKA-TYPE-002` retired) | the verb's `schema:` (structured output) · a task's `returns:` | a shape rides its consumer · the ten primitives stay lowercase (spec 09) |
| `policy:` | `permits:` (`fs` · `net` · `exec` · `tools`) · `secrets:` · the unconditional laws (spec 10 · `NIKA-SEC-015` net-before-exec) | a vocabulary is not a policy · what survived is the boundary |
| `assert:` | nothing in the file · `nika trace verify` (spec 15) | obligations are proven on the sealed trace |

#### 2 · The task body · one grammar per thing

| Dead form | Write instead |
|---|---|
| `on_finally:` mini-tasks | a task of its own · `after: { <parent>: unwind }` (a `finally` node · `graph_format: 3`) · every graph judge governs it because it walks `wf.tasks` |
| `output:` | `extract:` (same shape) |
| `declassify:` list · `inert:` string | `lift:` (the law is a parameter of one door · spec 10 §the authored doors) |
| `on_error: { fail_workflow: true }` | nothing · the default IS the failure · `on_error` is `recover` or `skip` |
| task-level `max_parallel:` · `fail_fast:` | inside the block · `for_each: { items: …, max_parallel: N, fail_fast: false }` |
| `depends_on:` | `with:` bindings (the binding IS the edge) · `after: { x: success }` for control (`NIKA-PARSE-024` · unchanged since W2) |
| `graph_format: 2` pins (`*.graph.json` goldens) | regenerate · `nika inspect --format json` · never edit a projection by hand |

#### 3 · What `nika check --fix` migrates · and what it does not

The rungs are idempotent and equivalence-or-stop · **r1-identity** (NEW ·
`nika: v1` + `workflow: {id, description}` · the block, the pre-W1 scalar
`workflow: <id>`, the one-line flow form, a bare top-level `description:` ·
become `nika: <id>` with the prose demoted to a `#` comment ABOVE it, never
dropped · it STOPS, never guesses, when `nika:` already names something else,
when the block carries a foreign key, when the id is not kebab-case, or when
there is no id at all) · **w1-map** (a `tasks:` sequence becomes the map ·
atomic or nothing) · **w2-flow** (`depends_on` + body `tasks.*` reads become
`with:` bindings and `after:` predicates) · **d1-split** (the pre-0.103 string
`command:`) · **esplit** (`vars:` → `inputs:` / `const:` · classify-not-rename)
· **predicates** (`succeeded` → `success`). One `--fix` runs them all in one
loop, so a 0.108.0 file whose only sins are the identity and the tasks list
heals to green in one command. Every round is a transaction: a repair whose
text no longer parses is rolled back and reported, and the file is written
once, from committed text only.

**Still hand migrations in this release** · the `on_finally:` restructuring
(cleanup becomes its own task on an unwind edge), `output:` → `extract:`,
`declassify:`/`inert:` → `lift:`, `config:` → `inputs:` (a classification),
and the `for_each` re-nesting · the refusal teaches each destination at the
point of refusal and `--fix` leaves the file untouched rather than write a
document its own checker would reject. Measured on the pack that ships inside
this binary: 0.108.0 passes 0/40 of these examples · 0.109.0 passes 40/40 ·
every existing file outside this repo sits on the 0.108.0 side of that line
until it is migrated.

#### 4 · Two P0, closed where users install

- **An expression sees only its input (#959).** A `nika:jq` expression could
  read the ambient environment (`env.PATH`) under an ABSENT permits block
  while `check` printed « the body is pure compute so nothing escapes ». The
  retained natives leave the jaq function set at the three seams from ONE
  list (`nika_cap`), and a pinned inventory of jaq natives reddens if a
  future jaq adds one. `check` now refuses the escape at the binary users
  install.
- **A third-party receipt wrote the operator's clipboard (#958).** Three
  fields of a proof receipt (`assert` · `level` · `task`) reached the
  terminal without `escape_tty` while the helper existed in the same file ·
  a foreign evidence pack could emit OSC52. Every receipt field rides the
  escape · proven by mutation before publication.

#### 5 · The two trains (RELEASING §0)

`stable` is the newest tag · what brew · the Registry · nika-action and the
starters install. `next` is `main`, at `<next>.0-dev` between tags · a real
semver prerelease · `nika --version` and every trace say which one they are.
Stable consumers move only when a tag they can install exists.

### Added

- **The project file `nika.yaml` (D-2026-08-11-N5).** An OPTIONAL file at
  the repo root, discovered upward from the CWD the way git finds `.git`,
  carrying the four keys that are decisions of a project rather than of an
  invocation: `ceiling` (the `--max-cost-usd` flag's DEFAULT — the flag
  always wins), `traces.keep` (the retention ladder's file rung, below the
  three `NIKA_TRACE_*` env vars), `registry.floor` (a GATE, max-composed
  with `~/.nika/registry/policy.toml` — a project raises the bar, never
  lowers the operator's), and `arm:` (the team arming registry — parsed
  and shape-validated here, executed by the cadence arc). An absent file
  is today's behavior bit for bit; a present-but-broken one refuses
  before any spend, with its line. The founding wizard offers a
  commented starter on an explicit yes (scripted twin: `nika init
  --project-file`) — never laid silently. No `seat`, no `profile`, no
  permits in it: the portability test (D-2026-08-10-N2) keeps the file
  to defaults and gates, never meaning.

- **The sandbox policy: declared `permits:` now require confinement, or
  the run refuses (#889 · #822's P0 fail-open).** A workflow asserting a
  `permits:` boundary used to run UNCONFINED with a loud note when the
  host had no OS sandbox (Linux without bwrap · any platform without the
  layer) — the contract silently degraded. The severity now derives from
  the declared contract, never the machine: `NIKA_SANDBOX=auto` (the
  default) refuses a permits-declaring workflow with `exec:` children
  the host cannot jail (any block counts — even tools-only jails the
  exec child to the empty axes; permits without exec keep running),
  `require` refuses any unconfined start, and `off` is the explicit
  waiver — parsed ONCE at the composition root
  (`SandboxPolicy::judge`'s truth table: policy × confined × permits ·
  no cell yields a silent unconfined-with-permits), and an unparsable
  value refuses to start (a typo'd security knob loudly defaulting would
  be the fail-open class). The refusal is the typed NIKA-1710 (the
  NIKA-1708/1709 launch-refusal precedent — before the prologue, zero
  events, zero spend), naming the exact per-OS fix. Every waiver is
  WITNESSED: the journal's opening frame attests `sandbox_policy` +
  `sandbox_waived`, so a sealed trace SHOWS the operator chose it (the
  `resume_unverified` trust-amendment precedent). ADR-080 Q4.B amended;
  platform-gated best-effort stays for permit-less runs.

- **The doctor's sandbox row (#891 · #822 P1).** `nika doctor` was
  blind to the OS sandbox: a Linux host without `/usr/bin/bwrap` read
  green while every `exec:` and external MCP spawn ran unconfined. The
  row rides the ONE selection's `SandboxDecision` (#888 — never a third
  selector): a confined backend is Ok and names its mechanism (`Linux
  sandbox (bubblewrap) · backend id: landlock`, the host-granular
  allowlist residual named as follow-on — never a full-strength claim),
  and a `noop` WARNS with the exact per-OS fix. `doctor --json` carries
  the row on the same findings lane.

- **The thinking-budget teaching at check (#651 · leg 3).** A
  reasoning-capable model (the vendored catalog knows) seated with
  `max_tokens` but no `thinking:` now draws the `thinking-budget` hint:
  the reasoning share lives INSIDE that budget, and a heavy think
  concludes with a paid blank answer — the typed NIKA-INFER-004 failure
  at run since leg 1. The hint teaches the declaration before a token
  is spent; a templated seat defers to the run's resolution, a declared
  `thinking:` or a no-think model stays silent.
- **The pause is heard — outbound pause delivery (ADR-111).** When the
  operator sets `NIKA_NOTIFY_URL`, a run that pauses on a human gate
  POSTs its pause payload once — a CloudEvents 1.0.2 structured envelope
  (`sh.nika.run.paused`, deterministic id from trace × task) with
  Standard Webhooks headers (`webhook-id`/`webhook-timestamp` always;
  `webhook-signature` `v1,`-HMAC-SHA256 when `NIKA_NOTIFY_SECRET` holds
  a `whsec_` secret) — then journals the outcome (`notify_delivered` /
  `notify_failed`, two additive event kinds) BEFORE the seal, so the
  chain covers the delivery claim. Default OFF: no URL, no socket. The
  same SSRF floor as every engine egress judges the target (the
  exact-loopback carve-out included, so a local ntfy relay works
  as-is), and delivery failure never changes the run's verdict — the
  run exits `paused` with the same code either way. Proven red-first at
  the binary plane: default-off · signed CloudEvents delivery ·
  metadata-range refusal · unreachable-target non-fatality.
- **Traces speak the current OTel GenAI semantic conventions
  (ADR-112, Part 1).** `nika trace export` now projects an infer/agent
  task's access facts to `gen_ai.provider.name` and
  `gen_ai.request.model` · the *current* semconv names (never the
  deprecated `gen_ai.system`) · so any OTel-native viewer or eval tool
  reads the model and provider off a nika trace with zero translation.
  Provider ids normalize to the semconv well-known values where one
  exists and differs (`mistral` → `mistral_ai` · `xai` → `x_ai` ·
  `gemini` → `gcp.gemini`); every other id passes through verbatim.
  `gen_ai.response.model` stays OUT: the semconv defines it as the
  provider-reported model that SERVED, the journal captures no
  provider-reported id, and emitting the requested name there would
  assert a fact never captured. The mapping lives in the one projection
  module (`nika_dap::otel`); a
  pre-stable-semconv rename is one edit, never a scatter. Additive: the
  existing `nika.*` attributes are unchanged. (The `--format dataset`
  SFT/eval export — ADR-112 Part 2 — is proposed and gated on an
  operator go: it needs the trace to capture input prompts, a content-
  policy change, not a mere projection.)

### Changed

- **Evidence packs redact by default — the auditor gets hashes, not
  payloads.** `nika trace evidence` now builds a REDACTED pack unless
  `--full` is passed: every payload field of the copied journal (task
  outputs, model answers, tool results, failure details, shown prompts)
  is replaced by `{"sha256", "unavailable"}` — the hash of the field's
  own bytes plus the reason it stays with the operator — while every
  structural field (event kinds, chain links, digests, durations,
  verdicts) rides verbatim. The manifest still attests the ORIGINAL
  journal (`journal_sha256`, chain, head, seal), gains
  `trace.projection_sha256` (the one offline check the projection
  supports) and a `redaction` object declaring the class, because a
  pack that cannot say which class it is would wear the old one's
  trust. VERIFY.md now teaches the two classes apart: a redacted pack
  proves the run's INTEGRITY, not its CONTENT — those are two
  different asks, and content disclosure is a separate, operator-side
  gesture. `--full` keeps the historical bytes and says so, in the
  summary and in the manifest. `evidence_format` stays 1 (additive
  fields · zero programmatic consumers). Measured on a real trace:
  the redacted copy leaks zero payload bytes, each placeholder
  verifies against the disclosed value with `shasum -a 256`, and a
  zero-payload journal projects byte-identical.

### Fixed

- **`nika check --fix` can no longer write a document it cannot read.**
  Two defects, one class, measured 2026-08-18. (1) `NIKA-PARSE-005`
  carried its human teaching (a retired key's migration · the modeline
  fix · a small set's own vocabulary) in the same field as its typed
  did-you-mean, and both repairers — `--fix` and the editor quickfix —
  spliced whichever they found: `--fix` on a file carrying `workflow:`
  renamed the key to the sentence "the fields here: nika · model · …",
  announced one repair applied, and left YAML that no longer parsed;
  the shipped 0.108.0 did the same on a de-commented
  `yaml-language-server:` line. `SchemaError::UnknownField` now carries
  `suggestion` (a bare key · what a splice applies) and `teaching`
  (prose · never machine-applied) separately, and every repairer reads
  renames through the one typed door, `rename_repair()`. (2) The repair
  loop is transactional: each round starts from a savepoint, and a round
  whose text no longer parses as YAML is rolled back — rows and notes
  included — and reported as a typed refusal (`✗ FIX refused — … · the
  file is unchanged`); the byte-surgery door refuses any target with the
  shape of prose. Nothing is written except committed text, atomically.
  W1 also keeps a CRLF file CRLF (its rewritten task lines were LF).

- **The argv exec floor is judged at check, with the run's own
  predicate (#605 · NIKA-SEC-001).** `nika check` audited green an
  argv-form `exec:` command the runtime's exec floor refuses at spawn
  (`["bash","-c",…]` — interpreter inline-eval): the static lane was an
  advisory hint over a hand-mirrored eval table, and a hint cannot fail
  a file the run refuses — an `on_error: {skip: true}` leg swallowed
  the refusal as a SKIP and fleets degraded silently. The predicate now
  lives in `nika-types::exec` (the L0 leaf both sides depend on — the
  `host_in_allowlist` precedent), the check emits the `NIKA-SEC-001`
  FINDING (exit 2) for any literal argv the run would refuse, and the
  advisory hint retires. Honest scope, pinned by tests: the shell form
  and any `${{ }}`-templated argv make no static claim — the runtime
  re-judges the resolved argv pre-spawn. `nika explain NIKA-SEC-001`
  teaches exactly that split, the human render gains the EXEC rung, and
  a cross-crate agreement test pins check ≡ run on the same argv.
- **A templated `model:` resolves at run, not just at check (#824).**
  `infer.model: "${{ config.model }}"` checked green — the MODELS rung
  judges the declared default through the one shared static resolver —
  then the run handed the RAW template bytes to the provider, dying
  NIKA-INFER-001 on a string that was never a model id. The dispatch
  now renders `model:` (infer AND agent — the same one-line seam each)
  through the `${{ }}` render path `prompt:`/`system:` already took, so
  the resolved binding is what reaches the wire and the
  spec-sanctioned parameterization idiom (03 §model-by-condition ·
  08 §H20 env targeting) holds end-to-end. A declared-but-valueless
  ref now fails the task loud (NIKA-1702) instead of leaking the raw
  island to the provider. Proven red-first at the seam: the issue's
  repro workflow lands the resolved default in the captured provider
  request body, and the agent loop's mock records `mock/echo`, never
  the template.
- **`check --fix` migrates the pre-0.103 string `command:` (#572 · the
  D1 codemod).** The refusal taught the migration in prose but answered
  « no machine-applicable repairs » on the exact finding whose repair IS
  mechanical. The parser's refusal is now the typed
  `SchemaError::D1StringCommand` (same wire code — NIKA-PARSE-019 — the
  variant exists so the ladder can match it), and the D1 codemod joins
  the ladder: a string command inside an `exec:` block becomes `shell:`
  VERBATIM (the same decoded string reaches /bin/sh -c — semantics
  byte-identical) or, for a bare string of provably-inert tokens
  (no character a shell could reinterpret), the argv flow form the
  grammar prefers. A `command:` outside an exec block (an `invoke:` arg
  named `command`) is never touched; a mapping/null value STOPS with an
  honest note, never a guess. The repair ladder itself descended to
  `nika-cli-host::fix_ladder` at the 15k wall (ADR-110 · one
  architectural unit, two members), and nika-migrate's D1 lives in its
  own `d1.rs` (the 1500-file wall, ADR-023).
- **An empty `infer` answer settles FAILED, never green (#651).** A
  thinking model under a tight `max_tokens` can spend the whole budget
  on its reasoning trace and conclude with a blank visible answer — the
  run used to finish green (exit 0) over `output: ""`, the only signal
  a non-fatal console warn every downstream `${{ tasks.X.output }}`
  silently ignored. The warn is promoted to the typed failure
  `NIKA-INFER-004` (`VerbInferError::EmptyAnswer` · NIKA-435), raised at
  the verb on the exact signal the warn keyed off (blank visible answer
  + token spend — a reported reasoning split OR one undifferentiated
  output count) and carrying the same max_tokens/no-think teaching.
  Non-transient: a declared `retry:` never re-asks at the same budget
  unless the author opts in via `on_codes: [NIKA-INFER-004]`, and the
  billed round-trip rides the failure's spend. The zero-spend carve-out
  is preserved (a blank answer with zero tokens is a plain empty
  completion, not the footgun), and the `schema:` lane is untouched —
  an empty reply already dies NIKA-INFER-002 at extraction, while a
  schema-validated empty container stays a legitimate answer.
- **The resume verifies the chain before trusting the trace (ADR-099
  trust amendment).** `nika run --resume` served a trace's recorded
  successes as cache hits WITHOUT consulting the tamper-evidence chain
  the same journal carries: a chain-broken journal resumed silently
  (exit 0), propagated a forged output into a live task, and emitted a
  fresh journal whose own chain verified clean — one resume laundering
  a journal that FAILS `nika trace verify` into one that PASSES it.
  The chain is now walked BEFORE the fold (the same walk the verify
  verb runs): a broken chain refuses (exit 2 · the FILE class, one
  voice with the verify verb) naming the finding and the opt-out, while
  a crash's honest signatures (killed mid-flight · torn tail) still
  resume — crash-resumption is the use case. The opt-out is NAMED, never
  a silent default: `--resume-unverified` proceeds loudly and the NEW
  run's boot manifest journals `resume_unverified: declared` +
  `resume_unverified_finding`, so a laundered trace can never claim a
  clean ancestry silently. A chainless journal (a `--json` stream
  capture · a pre-0.96 journal) still resumes under the compat — said
  on stderr AND attested on the boot manifest (`resume_unverified:
  unchained` + the reason), so the strip-the-chain forgery (tamper,
  then delete every `chain` field to turn the walker's `Broken` into
  `Unchained`) never converts the refusal into a SILENT proceed.
  Proven red-first at the binary plane: the forgery refused by default
  (and no new journal descending from it) · the opt-out attested on the
  child journal · the stripped forgery attested `unchained` · the
  intact control journaling no claim.
- **An exact `fs` grant is judged by its effective path identity on the
  builtin arm too (NEP-0009).** Between `nika check` and `nika run`, an
  exact grant literal swapped for a symlink (e.g. `read:
  ["./allowed.txt"]` → `./oob/secret.txt`) was served by the in-process
  builtins (`nika:read` · `nika:glob` · `nika:grep` · `nika:write` ·
  `nika:edit`): the boundary re-judged the path the task NAMED, and the
  resolved-vs-resolved comparison followed the planted symlink on both
  sides — the kernel sandbox never sees an in-process read, so the arm
  suspected least was the open one. The boundary now judges the grant's
  effective path identity (the longest existing ancestor canonicalized,
  the FINAL component held lexical — the dispatch re-gate's own
  judgment, restated on the builtin seam) and refuses the divergence as
  `fs.path_mismatch` (`NIKA-SEC-004`), naming the judged prefix and the
  resolved target — one verdict voice on both arms. A symlinked
  ANCESTOR stays tolerated (`/tmp`→`/private/tmp` · a nix-store link),
  a not-yet-existing write target stays legal (law 5), and a grant that
  legitimately traverses a symlink changes verdict: declare the
  effective path instead (the NEP's documented backwards-compat). Proven
  red-first at the unit and binary planes: the swapped exact grant
  refused with the secret never served · the inside-pointing symlink
  refused as divergence · the swapped glob root refused · the honest
  tree admitted before and after.
- **The `--json` stream carries the chain — the trusted-by-default class
  is retired (ADR-099 §5 follow-on).** A `nika run --json` capture was
  the last journal shape the resume trusted by default: the stream wrote
  no `chain` field, so a captured journal resumed under the
  attested-but-unverified `unchained` compat, and tampering the capture
  met no walk. The two lanes now drive one shared chain state — the
  journal file is the stdout stream BYTE FOR BYTE — so a fresh capture
  verifies under `nika trace verify`, resumes on the verified lane (no
  notice · no attestation), and its forgery is refused (exit 2) like any
  broken journal. The compat stays for pre-chain journals and stripped
  forgeries — said, attested, never silent. Proven red-first at the
  unit and binary planes: every streamed line carries the chain · the
  capture verifies and resumes verified with no claim journaled · the
  forged capture refused · both mutations (the insert dropped · the
  head never advancing) kill their tests.
- **The builtin fs boundary's decisions ride the permit witness
  (NEP-0007 law 2 · the declared v1 residual, closed).** Until now the
  in-process arm attested a refusal only as the task's coded failure
  (`NIKA-SEC-004` in `task_failed`), and its GRANTED reads and writes
  were witnessed nowhere — an auditor could not reconstruct what
  authority the builtin arm actually exercised. The boundary's
  enforcement point now records every verdict, allow and deny alike,
  into the attempt's collector (a tokio task-local scoped by the
  runtime per attempt — the one channel that reaches the enforcement
  point inside the shared dispatcher without breaking the kernel's
  `ToolExecute` seam, and the only one that follows the attempt across
  `.await`), and the settle spine emits one `permit_checked` frame per
  decision with `plane: "fs"` — the same payload shape as every other
  plane, so the frames bind to the task that took them through the hash
  chain, on the failure path too (the deny precedes `task_failed`).
  Outside a run the slot is a no-op: telemetry never panics. Proven
  red-first at the binary plane: the permitted read journals one allow
  between `task_started` and `task_completed` · the dynamically-refused
  read journals one deny before `task_failed` with zero secret bytes
  emitted · neutralizing the record kills both planes. The per-op NET
  decisions remain the declared residual.
- **The builtin fs reads open pinned — the enforce→open race closes on
  the in-process arm (NEP-0009 law 6 · the builtin-side follow-on).**
  The dispatch guard judged the path and THEN the op opened it: between
  the two, a parallel task of the same run could swap the judged file
  for a symlink, and a plain `open(2)` would follow it — the parallel
  sibling of the sequenced pivot the re-gate killed. Every builtin READ
  (`read` · `edit`'s read phase · `grep` · `glob` · `decide`'s bundle ·
  `fetch`'s multipart parts) now runs against the judged fs: the path is
  re-judged at open time (SILENT — the guard already witnessed the op's
  one fs frame), then opened `O_NOFOLLOW`, so the KERNEL refuses a
  swapped final component (`ELOOP`) inside the syscall itself,
  atomically — no check-then-act, no window. A pre-existing
  inside-pointing symlink is still served (resolved, re-judged on the
  TARGET, re-opened pinned · the no-regression rule), a dangling link
  keeps the file-not-found verdict, and a redirect storm refuses coded
  past a hard hop bound instead of hanging. Writes need no pin: the
  atomic temp+rename lane replaces a symlinked destination, never
  follows it. Declared gaps, honestly on the record: the pin compiles
  on the tier-1 unixes (macOS · Linux) and every other target
  degenerates to enforce + plain read; `O_NOFOLLOW` pins the FINAL
  component only, so a swapped ANCESTOR directory stays a residual of
  the exec arm's `--bind-fd` follow-on class; and `chart` keeps the raw
  fs because its save lane re-reads the write-permitted artifact for the
  idempotence law. Proven red-first at the unit plane: the nofollow open
  never serves a symlink target · the swapped exact grant refuses coded
  with zero secret bytes · the inside link serves byte-exact · the loop
  and the storm refuse coded and RETURN.

### Security

- **`nika mcp --transport http` refuses a non-loopback bind without a
  bearer token (#890 · #822 P0/P1).** `NIKA_MCP_TOKEN` was optional and
  the auth gate treated its absence as OK — right for the loopback
  default, a classic misconfiguration the moment `--bind 0.0.0.0` met a
  multi-user or VPS host. The refusal is code-enforced before serving
  (`HttpServer::guard_bind_auth` judges the RESOLVED address, so
  `localhost` reads as the loopback it bound, never the spelling) and
  names both fixes: set `NIKA_MCP_TOKEN` to require a bearer, or bind a
  loopback address. Loopback without a token stays convenient,
  unchanged.

## [0.108.0](https://github.com/supernovae-st/nika/compare/v0.107.2..v0.108.0) - 2026-08-05

**The access layer arrives; the check stops trusting what it cannot
read.** Three steps of the access ratification land (`access` picks the
path, `model:` picks the intelligence — resolver, pin, and the ACP
harness class with its mock instrument), and the zero-authority scan now
refuses every `exec` spelling — the shell form included. Proven
red-first, like everything on this train.

### Added

- **Execution access · step 3 — the ACP harness class** (D-2026-08-04-N1
  · P3). The `nika-acp` spec crate lands (ACP 2.0.0 = wire v1, verified
  against the published schema) with its **mock agent in a quarantined
  workspace** — the instrument that proves the wire without a vendor in
  the loop — and the kernel gains the **`AgentBackend` seam**
  (`nika-kernel-ai` · lane-agnostic): the harness access path plugs in
  where every other lane already does, behind a trait, never a special
  case.

- **Execution access · step 2 — the deterministic resolver, the pin,
  the narration** (D-2026-08-04-N1 · steps P2.1–P2.8). `model:` picks
  the intelligence; **access** picks the path. The admission-time
  resolver is a pure function with a strict sovereign order (`local <
  mock < harness < oauth < api`, codepoint tie-break) — enumeration
  order can never change the outcome (property-tested), and every drop
  carries its witness (dimension · layer · teaching line). `--access
  <path>` on `run` and `try` pins the path: judged at the launch gates
  before the prologue (zero events · zero spend); unsatisfied refuses
  with `NIKA-1800/1801/1802`, never substitutes. Without a pin the RUN
  path is byte-unchanged — the gate never fires; the audit surfaces do
  grow (additive, the `models_catalog_warnings` precedent):
  `check --json` gains the advisory `access_plan` rows, `explain`
  gains the « access (this machine) » section, the run header
  announces an explicit pin, and `AccessPlan` records the chosen
  path's id. Run-start liveness stays the only runtime act: a dead
  pinned path refuses, never falls back.

### Fixed

- **Every catalog-miss advisory printed twice.** A duplicated block in
  the models rung pushed each `models_catalog_warnings` row two times;
  one block remains, with a test that proved red against the doubled
  version first.
- **The taught surfaces stopped misdirecting.** The injected session map
  no longer teaches doors that refuse; `--recipe starter` says which
  half a pipe cannot deliver; the taught next step works on the machine
  that just ran it; `explain`'s two golden-lane refusals teach instead
  of misdirecting; the check strictness hint says close, not add.
- **The sandbox tightened twice more.** The scratch claims its path
  exclusively — never adopts one — and the shared host tmp stops being
  an ambient grant; exec-runner's scratch moved out of egress at the
  file wall.
- **A resumed run keeps its seat.** The model override rides the trace —
  a silent seat swap refuses.
- **The pure-internal security exemption asked about the tool, not the
  call.** It asks about the call now.
- **Every pack skeleton passes its own golden lane** — the armor reaches
  the tails.

### Changed

- **A blank answer that burned tokens is a typed failure, not a green
  task (#651 · NIKA-INFER-004).** A thinking model under a tight
  `max_tokens` can spend the whole budget on its reasoning trace and
  conclude with a BLANK visible answer — the task used to settle green
  over `""` (a warn nobody downstream acts on) while every
  `${{ tasks.X.output }}` silently resolved to nothing. The OBS-E warn
  is promoted to the typed `NIKA-INFER-004` failure (engine NIKA-435),
  fail-closed with the spend attached as ledger evidence. The signal is
  deliberately narrow: blank visible answer PAIRED with token spend
  (a reported reasoning split, or an undifferentiated
  `output_tokens > 0` — the ollama path strips the think block
  upstream). A blank answer with zero spend stays green (a plain empty
  completion is not the footgun), the `schema:` lane is untouched (an
  empty reply already dies NIKA-INFER-002 at extraction; a validated
  empty container is a legitimate answer), and `on_error:` remains the
  author's named opt-out. The summary's « 7/7 done » can no longer
  count an empty paid answer as done — the failure default makes the
  honesty leg moot.
- **The anthropic default moves to `claude-sonnet-4-6`.** The catalog sat
  two generations back (`claude-sonnet-4-20250514`) while the spec's
  examples and conformance fixtures standardized on the 4.6 id — the
  docs-spec coherence vector named the contradiction on the public site.
  Six sites across the anthropic · openrouter (`anthropic/…`) · bedrock
  (`anthropic.…-v1:0`) entries follow each gateway's naming form. Parser
  and bench test strings keep the historical id on purpose (they are
  inputs, not defaults).

### Security

- **A shell-string `exec:` with no `permits:` block passed `nika check`
  green.** The zero-authority scan (F-O8 · NEP-0003) refused the argv
  spelling it can read (`command: ["rm", …]` → `NIKA-AUTH-006`) and
  deferred the shell spelling it cannot (`shell: "rm -rf …"`) to the
  runtime — the exact inversion of a security gate: the verifiable door
  refused, the unverifiable one open. Law 1 puts the exec capability in
  `Required` the moment an exec task sits in the body, whatever the
  command form; law 3's runtime deferral owns dynamic VALUES, never the
  category question, and the runtime refused both spellings all along.
  The shell form and a computed argv head now refuse at check with
  `NIKA-AUTH-006` — check ≡ run restored. Repair:
  `nika check --infer-permits` writes the block (the shell form widens
  `exec` to `true` with a note; rewrite to the array form for a program
  allowlist).

## [0.107.2](https://github.com/supernovae-st/nika/compare/v0.107.1..v0.107.2) - 2026-08-02

**The adversarial pass.** 0.107.1 shipped six boundaries; an adversary
was then set on that work with one instruction, break it. Three of six
claims fell, and hunting what the first repairs still let through found
four more. Every fix below was proven on the binary before it was
touched, and each carries the mutation that makes it fail.

### Two doors that were open

- **A permit could name a system root by shouting it.** `/root/./x*`
  closed in the morning; `/ROOT/x*` did not. macOS ships a
  case-insensitive filesystem — `/ETC` and `/etc` are the same inode —
  so an exact-match root check let a permit name any system root on the
  very platform the seatbelt backend serves. The comparison folds case
  now, and refusing these on Linux can only ever refuse a path that does
  not exist.
- **A secret was redacted in the trace and printed on stdout.** The
  redacting sink wraps the event lane, and a run's `outputs:` map is not
  an event: it rides `RunOutcome` straight to `--output json`, where the
  CLI serialized it verbatim. The static check refuses a *declared*
  egress, but not the side channel this backstop exists for — an exec
  catting a file-sourced secret, a tool echoing its input. The map is
  scrubbed now, at any depth.

### Three guards that judged less than they claimed

- **The dangerous-environment floor is proven entry by entry.** Forty
  names, eleven asserted; deleting the one that makes macOS load
  arbitrary code into every dynamically linked child left the suite
  green. Both halves are pinned now — every listed name enforced, and a
  floor naming what may never leave.
- **A tainted `nika:notify` target is judged whatever channel carries
  it.** One `${{ }}` in `channel:` made the tool unclassifiable and the
  re-gate silent: the same payload passed with rc=0 templated and rc=2
  spelled out.
- **The run guard speaks only about runs.** An unreadable payload from a
  host we do not parse denied every command in the session — `ls` came
  back « nika run blocked ». It now degrades only for bytes that could
  have carried a run.

### One law, two implementations

- **The MCP spawn composes the child environment through the same
  function as the exec runner**, which its own module doc had promised
  all along. The copy was equivalent, and equivalence was exactly what
  nothing guaranteed.


## [0.107.1](https://github.com/supernovae-st/nika/compare/v0.107.0..v0.107.1) - 2026-08-02

**The composition wave.** The 0.107 train shipped the trust OBJECTS;
an outside checkpoint then measured what a stranger actually meets and
found the composition missing — the concierge still taught a verb the
0.107 rename had killed, doctor rendered a table-declared guard in the
green word a proven one earns, and every surface composed its own next
step. Three synthetic personas (novice FR · senior dev · privacy-first)
walked the binary end to end; the fixes below each carry the transcript
line that found them.

### The doors tell the truth

- **One door catalog, one ratchet.** `DoorId{Discover,Create,Project}`
  is the single source behind every taught first-contact command; the
  five workspace states, the chat-only JSON mirror and the kit's
  `allowed-tools` all derive from it, and a new test replays EVERY
  command welcome can teach against the live clap tree. The dead
  `nika examples` the concierge kept teaching (the parser refuses it)
  is gone from text, JSON, kit and docs — and hygiene vector 45 sweeps
  the whole rendered output of three surfaces so the class cannot
  return.
- **`nika try` opens on three jobs, not thirty-nine.** The storefront
  names one contrasted trade each (support · meetings · release), every
  row a taught `try <slug>` with its pitch, closed by four doors and the
  verb legend the glyphs never had. A pipe still gets the full parsable
  shelf byte-for-byte (the editor's wire contract), and `--all` forces
  it on a terminal.

### The verdicts narrow to what they cover

- **`guard-declared` is not `guarded`.** The host receipt gains
  `guard_evidence` (declared · loaded · proven): a hook the static kit
  table declares now reads « guard-declared (kit ships hooks · unproven
  in session) », and the bare word waits for a live allow+deny canary.
  `welcome --json` carries the same companions the doctor receipt does.
- **`--plain` means ASCII in doctor too** — the verb rides the same
  sobriety seam the concierge rides; the machine lane stays byte-exact.
- **The journey names its cloud endpoints in words** — locus, retention
  and training were machine-only facts while the human line read
  identically for a mock and a cloud model.
- **`risk unbounded` carries its next move**, the red pre-run
  diagnostic ends its own line, and a sensitive voyage discloses that
  its trace keeps full task outputs in plaintext, with the removal
  handle beside it.

### The experience contracts land

- **`ExperienceStateV1` → `route()` → `NextActionV1`** — one pure
  decision table (drift ≻ unselected multi-root ≻ chat-only ≻ paused ≻
  failed ≻ findings ≻ unknown inventory ≻ clean ≻ several ≻ create ≻
  discover), one primary CTA with at most two safe exits, and gates
  asserted structurally per action across the swept state space: no
  door hides a run. `welcome --json` is its first consumer;
  `WorkflowPreviewV1` renders the same content in strict ASCII and
  Mermaid, beside the context, privacy and authority receipts.

### The boundaries hold where they claimed to

A sweep for checks that report a verdict they cannot justify found six
places where a boundary was green and open. Every one was proven on the
binary before it was touched, and every repair carries the mutation that
makes it fail.

- **A cross-origin redirect no longer carries the API key.** The header
  list that strips credentials on a redirect had been copied from a
  general-purpose HTTP client and did not know `x-api-key` — which the
  Anthropic wire sends, and which `nika:fetch` documents to workflow
  authors as the place auth rides. A 302 handed the live key to whatever
  host the redirect named. One list now serves both the redirect strip
  and the Debug redaction, and `check-credential-headers.sh` fails the
  build when a source sends an auth header the list does not name.
- **A permit can no longer name a system root through `.`.** Both
  sandbox backends refused `/root/*` and granted `/root/./x*` — they
  compared text where the kernel folds, so the grant resolved back to a
  read-write bind of the host's root inside the jail. The fold lives in
  the kernel now, shared, and the guard test walks every root in the
  const across six spellings instead of the three its doc comment named.
- **A tainted `nika:notify` target is re-gated like a `fetch` url.**
  Notify sat in the taint re-gate's tool list and did nothing: the list
  read `url` from every member, and notify's argument is `target`. The
  re-gate asks the capability table now. Measured against the reference
  oracle: parity unchanged at 216/220, all 39 examples clean.
- **The run guard stops approving what it never judged.** On the generic
  hook wire, "no opinion" and "judged clean" shared an arm, so the kit
  answered `permission: allow` to every shell command in the session.
  A command with no `nika run` in it now gets `{}` — the bytes that mean
  *behave as if this hook were not installed*. And with the binary off
  PATH the shim used to deny everything, telling the user `ls` was
  "nika run blocked"; it degrades only for commands that could have been
  ours.
- **The editor offers what the binary accepts.** Completion taught
  `description:` at top level (the parser refuses it with its own code)
  and `google/` as a provider (this binary does not resolve it — the
  runnable id is `gemini`), while never offering four keys the parser
  takes. The vocabulary derives from the parser and the catalog now.
- **The privacy gate guards the layout that exists.** Six of its seven
  patterns matched no directory that still exists, leaving the private
  content it was written for entirely unguarded, and a `git mv` skipped
  it altogether.

### The owned copy works where it landed

- **The taught command inside YOUR file runs in YOUR workspace** — all
  39 pack examples self-reference their pack path, and the copied
  `# Run ·` comment exited 3 when pasted; `nika new` re-points it to the
  destination.
- **A dropped cadence is named** — « chaque lundi … » routed on the work
  and ate the schedule half in silence; the file owns the WORK, a
  scheduler owns WHEN, and the note says so.
- **The guard judges both spellings of its own binary** (`nika` ·
  `nika-cli`): a dev-build invocation rode past the uncapped-priced-run
  refusal as no-opinion.
- The wizard's run hint follows the chosen seat instead of teaching a
  literal `$0.00` on an Ollama pick.

## [0.107.0](https://github.com/supernovae-st/nika/compare/v0.106.1..v0.107.0) - 2026-08-01

**The trust release.** An outside audit measured the experience instead of
the feature list — five waves, seventy-two receipts, twenty-two P0s — and
the arc closed every one: welcome gates its run CTA on the exact file's
verdict, a non-affirmative consent fires zero effects (NIKA-SEC-014, minted
spec-first with its conformance fixtures), the hooks' judge moved into the
binary (`nika guard`, fail-visible, bypass matrix in test), autonomy is
graded before it is colored (the risk rung never renders green past
Supervised),
the data journey names sources, destinations and secrets before the run,
and redaction works by provenance — a one-byte secret dies the same death
as a long one. Around the core the doors multiplied honestly: one client
matrix asserts the coverage of thirty-one hosts, `nika wire` previews and
never rewrites unasked, and every probed host gets a capability receipt
that separates oracle-only from integrated. The discipline held on the
inside too: the host plane descended to `nika-cli-host` at the 15k wall
(ADR-110 — one unit, two members, zero call-site churn), and the wall
itself grew a descent window, the crate-size vector warning at eighty
percent instead of ambushing the push.

**The night train (Jul 31 → Aug 1).** The teaching grammar collapsed to
three doors and the whole surface followed: `nika try` is the showroom
(bare lists · a slug runs the mock rehearsal offline by default — no
`--model mock/echo` incantation left to teach · `--model self` keeps
the example's own seat), `nika new` takes ONE positional gesture
(an example slug lands verbatim WITH its ingredients · plain words
BM25-route across the whole catalog · a lone `<name>.nika.yaml` names
a destination and gets the wizard), `nika init` founds. The `examples`
verb tree died; `evidence` and `receipt` moved under the run's dossier
as `nika trace evidence` / `nika trace receipt explain`. The same
night, four replayable persona waves judged the result end-to-end and
the last taught-line breaks fell before morning.

### The three doors (V5)

- **`nika try [slug]` — see it work, own nothing** (#796). Offline by
  default: the rehearsal seat law lives in one place and is pinned;
  the shelf, the take and the founding read as one grammar. Every
  teaching surface (welcome START block · lazy door · rescue tips ·
  recipes · briefs/AGENTS scaffold · kit skills · README · funnel e2e)
  speaks the new forms in the same release.
- **`nika new` routes the WHOLE catalog** (#778): the 26 human-worded
  jobs are visible to the one surface that takes human words — a routed
  example lands verbatim with its fixtures beside it (one shared
  materializer for every taking door), a routed skeleton instantiates,
  and below the confidence bar the clarify names facets + each entry's
  own description line.
- **The MCP oracle walks the same door** (#797 · RAMS-11): a
  plain-words miss on `nika_examples`/`nika_template` routes through
  the CLI's router — the interpretation is SAID in a leading
  `# routed:` comment, single tokens keep the unknown-key contract,
  and the adversarial-keys pin holds verbatim.
- **Every taught line survives the paste-back** (#798): the clarify
  hint is facet-aware (a skeleton carries its `<dest>.nika.yaml`, an
  example lands bare) and a spaced intent is re-echoed shell-quoted —
  the gauntlet's teach-a-command-that-breaks class, closed the night
  it was measured.

### The honest machine (the tier-B wave)

- **A dead local server stops the run in seconds, named** (#786): the
  B-5 liveness gate dials the local endpoint BEFORE any wire call —
  silent (nothing listens) and mute (accepts, never speaks) refuse
  fast with the exact repair (`ollama serve`, or rehearse with
  `mock/echo`); a keyed cloud seat, mock, or a failed probe never
  block.
- **The models rung consults the catalog before saying `resolves`**
  (#784) · **the local route stops teaching what this binary cannot
  do** (#788) · **a healthy machine reads calm** — doctor's advisory
  noise folds (#789).
- **One machine-truth** (#781): every provider count names its facet
  (`38 catalog entries · 15 wired in this build · 10 take a key`) from
  a single projection, pinned end-to-end on the rendered surfaces.
- **mock is a proven zero** (#785): the check's floor and the run card
  say the same $0.00, and the exec-floor hint drops its phantom route.
- **The fan says its tally** (#793 · V7-1): a `for_each` with
  recovered items renders `N/M ok · K recovered` — the silent fan
  class dies at ITEM level.
- **The closer never promises more than the judge checked** (#795):
  `explain`'s canon-row closer is per-class — SEC-004 teaches the
  literal/computed split (a green PERMITS is not the RUN's promise) —
  and the C-9 lessons (#787) speak one voice across CLI and MCP.
- **A closed pipe dies clean** (#783): `nika run | head` ends with the
  screen silent and the honest 141, never a Rust panic dump.
- **A UTF-8 BOM parses** (#791) · **`examples run`/`copy` history**:
  the pack resyncs landed the fanout-trap fix, the write carve-out and
  the measured-truth corpus (#782 · #790).
### Added

- **`nika init` writes the two project MCP doors.** The root `.mcp.json`
  (the standard `mcpServers` stanza FOUR agent surfaces read natively:
  Claude Code project scope · Grok Build via its Claude compat · GitHub
  Copilot CLI · Warp) and `.agents/mcp_config.json` (Antigravity CLI's
  workspace file, beside the authoring skill under the cross-vendor
  `.agents/` convention). One shared body, seventeen scaffold targets —
  a repo equipped by `nika init` now hands the read-only oracle to six
  clients with zero machine wiring.
- **`nika wire copilot` + `nika wire amp` — the wave-3 doors, shapes taken
  from the clients' own writers.** Copilot CLI gets `~/.copilot/
  mcp-config.json` with the exact `{tools: ["*"], type: "local"}` entry its
  own `copilot mcp add` writes (a copilot-added entry reads `· current`,
  never churns); Amp gets the literal dotted key `"amp.mcpServers"` in
  `~/.config/amp/settings.json` — JSONC settings get the snippet,
  byte-identical (the Zed contract). `wire all` covers twenty-one targets.
- **`nika wire` grows four client doors: grok · antigravity · kimi · kiro.**
  Grok Build gets the Codex-shaped `[mcp_servers.nika]` table in
  `~/.grok/config.toml` (comments preserved · idempotent — its Claude
  compat already merges the project `.mcp.json`, the native table survives
  a `[compat.claude]` toggle); Antigravity CLI (`agy`, the gemini-cli
  successor) gets the standalone `mcpServers` entry in
  `~/.gemini/config/mcp_config.json` per Google's migration contract;
  Kimi Code CLI gets `~/.kimi-code/mcp.json` per its two-level contract;
  Kiro CLI (the Amazon Q rebrand) gets `~/.kiro/settings/mcp.json`.
  `wire all` covers all four.

- **`nika doctor` speaks the kit↔binary handshake.** Installed plugin kits
  get one row each, probed at the rung their sessions actually load
  (Cursor local drop · Claude Code install of record · Codex per-version
  cache — marketplace clones as fallback): green on the binary's release
  train, ⚠ with the
  exact per-client refresh command when a kit lags (Claude Code names BOTH
  rungs — the half-climbed ladder is the proven trap), ⚠ with `brew upgrade
  nika` when a kit rides ahead. Patch drift is not a finding (kits are cut
  per train). The session-context hook grows the same two probes client-side:
  a missing binary teaches the install line, a train divergence names the
  direction-aware align command. `nika welcome`'s machine mirror names
  train drift in one line and routes to doctor — aligned or absent kits
  stay silent (carry information, never a lecture).
- **A green run names its fruit and stops lying.** The run card says
  what the run actually produced, and a run whose green hid an untruth
  says so out loud — the run-comprehension surface's honesty pass
  (A-2 of the first-run-truth arc · the 19-persona gauntlet).

### Fixed

- **The permits stop punishing honesty.** The trifecta explains its
  dominance rule (the dominating gate named · the bypassing data edge
  named · the taught fix provably flips the verdict green), a
  workspace-escaping path earns no machine fix but the taught narrow
  way, and an exec grant reads "exec outside the fs bounds" — never a
  default-deny misread (A-1 · Nina's BLOCKER).
- **`nika examples copy` brings the recipe's ingredients.** Every
  `examples/fixtures/…` file the copied body reads now lands beside it at
  the exact relative path the yaml names (existing files are kept, never
  clobbered) — the copied recipe's own taught offline run used to die
  `NIKA-BUILTIN-READ-001` on the missing fixture (the one rage-quit of the
  19-persona gauntlet, 2026-07-31).
- **Bare `nika` greets in a pipe too, exit 0.** The pipe used to get clap
  usage at exit 2 — an agent's first contact read as breakage, and spec §4
  reserves 2 for file findings. Both worlds now get the welcome mirror;
  `--help` stays the reference card.
- **The agent's request order is the author's `tools:` order.** The tool
  list used to ride catalog order with loop-owned intrinsics appended last,
  so `nika:done` could never come first — and the offline rehearsal
  (mock M1 invokes the first granted tool) died at turn 1 on any fs-scoped
  loop, refused by the boundary it could not satisfy. Listing `nika:done`
  first now closes the loop cleanly offline; real models are unaffected (a
  whitelist has no ranking semantics).
- **`nika explain NIKA-BUILTIN-READ-001` teaches the contract** — paths
  resolve from the RUN's working directory, with the three exits (look ·
  cd-and-run · `examples copy` lands the ingredients) — instead of the
  namespace boilerplate.
- **The taught mock rehearsal says its limit on writing workflows.** The
  mock swaps the model, not the effects: a mock re-run after a real one
  overwrites the real artifacts (a gauntlet persona lost a real
  CHANGELOG.md that way). The `explain <file>` rehearsal line on a
  writing workflow now says `file writes STILL land — rehearse before the
  real run, not after`.
- **`nika model` teaches an ungated starter id.** The suggested
  `Qwen/…-GGUF` repo answers 401 without a token; the taught id is now the
  public `unsloth/Qwen3-4B-Instruct-2507-GGUF` mirror (verified 200).
- **NIKA-SEC-014 names the real defect.** The finding said the route
  « never consumes the answer » — a route that binds the answer but never
  gates on it read that as false; it now says « never gates on the
  answer ».

- **A human gate can no longer kill a first run.** A `nika:prompt` with no
  `default:` used to die `NIKA-BUILTIN-PROMPT-001` in milliseconds on every
  text-mode run — a pipe, CI, an agent, even a human at a terminal (the
  ADR-099 durable pause was armed on the `--json` output flag, and the
  promised TTY prompter had never shipped). The rider is now armed on every
  lane: unattended runs **pause durably** (exit 4 · `workflow_paused`
  journaled · never a failure frame), and at a terminal **the gate asks you
  directly** (confirm `[y/N]` · choice by value or index · input verbatim),
  binding the answer through the same attested resume path as a manual
  `--resume --answer`. Walking away (Ctrl-D) leaves the paused trace and
  its taught resume line.
- **The paused run teaches its exact next move.** Every lane prints a
  paste-able `resume: nika run <file> … --resume <trace> --answer
  <task>=<value>` line that now **carries the run's own `--var`/`--model`**
  (a required-input workflow refused the taught line without them). The
  frame renders the pause honestly: the gate row turns `◇` amber and the
  paused card names the awaiting task.
- **Fallout counts beside the root cause.** One failed gate cancelling 22
  downstream tasks used to read `23/23 done · 1 failed` — the meter now
  says `1 failed · 22 blocked`.
- **`nika explain NIKA-BUILTIN-PROMPT-001` teaches the contract**, not the
  namespace boilerplate: the cause and all four exits (`--answer` at
  launch · resume · `default:` · the terminal ask). The `nika check`
  headless-prompt hint teaches the same working recipes.

### ✨ Features
- **catalog** — Pricing carries upstream truth with provenance ([95af0984a](https://github.com/supernovae-st/nika/commit/95af0984ac88577f5dc949e2bf57e39b29832fbe))
- **catalog** — The schema learns energy · data policy · effect hints ([814df726c](https://github.com/supernovae-st/nika/commit/814df726c4fa3e5f70ce060cf4e05d34b96c2ca8))
- **catalog** — The sourced facts enter and the refresh learns to keep them ([b4f5df37f](https://github.com/supernovae-st/nika/commit/b4f5df37f6846109c17931ab2ed532dc42c322bb))
- **catalog** — Two price catalogs face each other and nobody wins ([88f98fc39](https://github.com/supernovae-st/nika/commit/88f98fc396e57e229df3948546c25a86ba347f04))
- **catalog** — The one door opens ([03ab16f5b](https://github.com/supernovae-st/nika/commit/03ab16f5b437309dfc060af693069054039755e3))
- **catalog** — Sixteen measured energy rows from the public leaderboard ([2e2813368](https://github.com/supernovae-st/nika/commit/2e2813368e741d86c07fdbc1941d248b467f0dff))
- **check** — The energy reading joins the report (NEP-0018 · the 15k descent) ([136e3ed93](https://github.com/supernovae-st/nika/commit/136e3ed93257d9138c3807a2fdf53fe28965ce96))
- **check** — The judge-night lane lands — judged defaults, energy aggregate, adversarial greens ([b176a344d](https://github.com/supernovae-st/nika/commit/b176a344da7c3d4d322d53f6deba3cbcf4e195d6)) ([#768](https://github.com/supernovae-st/nika/pull/768))
- **check** — One verdict everywhere · a risk grade names the unbounded ([631940a45](https://github.com/supernovae-st/nika/commit/631940a45c088b4fddd652fe1dea9319eb8c87a7))
- **check** — The consent lane grades the gate, never the position ([6d1f68243](https://github.com/supernovae-st/nika/commit/6d1f68243ce3d1f67598b2fcd7e31c6f3a61b672))
- **check** — The exec floor is predicted · the gate must be affirmative ([1511b2be2](https://github.com/supernovae-st/nika/commit/1511b2be2b5eaacd8dc29cb1dbd1b3c3f3cb8649))
- **check** — False fires exactly zero effects — NIKA-SEC-014 ([1c0f708c5](https://github.com/supernovae-st/nika/commit/1c0f708c5b782757659fadeb34a0f9971b38fba3))
- **check** — The data journey names every flow before the run ([5cc366dd8](https://github.com/supernovae-st/nika/commit/5cc366dd829ae63db15fbf529757e64490e2975a))
- **cli** — Welcome gates the run cta on the exact file's verdict ([1a7053554](https://github.com/supernovae-st/nika/commit/1a70535548b9402dc93107f86280f98291d0f675))
- **cli** — Nika guard — the hook's judge lives in the binary ([50ce7a452](https://github.com/supernovae-st/nika/commit/50ce7a45256269379db7607ddeceabf80b5dff0a))
- **cli** — The context envelope resolves the workspace once ([fd143d214](https://github.com/supernovae-st/nika/commit/fd143d2146a690b92433f9dc6e3afb49cb438fb3))
- **cli** — The adoption ladder greets each rung with its own line ([72e892e42](https://github.com/supernovae-st/nika/commit/72e892e42e3adfbd3611354048796abe5226986d))
- **cli** — A failed latest run opens on the repair, never the re-run ([44847b275](https://github.com/supernovae-st/nika/commit/44847b275d5ee87cbdb6d375a22f7f11785bf8e7))
- **cli** — Doctor names each host's honest capability level ([c21ef94c8](https://github.com/supernovae-st/nika/commit/c21ef94c893fc0499721768cd78a034bff95cbb1))
- **cli** — Welcome resolves its context through the envelope ([202395c66](https://github.com/supernovae-st/nika/commit/202395c66531da5e56cab210c3aa13c60b4a8b37))
- **cli** — Doctor hands every host a capability receipt ([8c66e48a5](https://github.com/supernovae-st/nika/commit/8c66e48a539167c1cfc83ec0ced74c32f3cfb35a))
- **cli** — Wire previews, detects, and never rewrites unasked ([7ffe07e68](https://github.com/supernovae-st/nika/commit/7ffe07e68bb39c3399504f859767e95db7a5ebeb))
- **cli** — The binary reads the one client matrix ([a59df6a32](https://github.com/supernovae-st/nika/commit/a59df6a321391e7f05b108de87112953405d3b00))
- **cli** — Ascii means ascii · metrics stay local and content-free ([b81060688](https://github.com/supernovae-st/nika/commit/b81060688776e41dd9deee795dfa4446083175b5))
- **cli** — The host plane descends to its own member · nika-cli rejoins the 15k wall ([bb231b8bc](https://github.com/supernovae-st/nika/commit/bb231b8bc6c5b21f5f819b778a424155578abb48))
- **display** — The consent refusal prints its rung ([779d3d7f1](https://github.com/supernovae-st/nika/commit/779d3d7f19fafe135ddd9d102635d414d914e129))
- **estate** — The mirror stops being a convention and becomes a gate ([fc3f7aa8e](https://github.com/supernovae-st/nika/commit/fc3f7aa8e564168bd99a4cb0f277b704d21bb4bf))
- **hooks** — The session seed probes the binary and names version drift ([dd377a268](https://github.com/supernovae-st/nika/commit/dd377a268c5aac545e646ca0451a09f932ec41ae))
- **hygiene** — The crate-size wall gains its descent window ([83ca64a44](https://github.com/supernovae-st/nika/commit/83ca64a449774baaea34f2ae64e0e667e5bd0295))
- **init** — The project grows two MCP doors · one stanza, six clients ([e8b1930c4](https://github.com/supernovae-st/nika/commit/e8b1930c42317acaaa0d4e87b599083013440315))
- **kit** — The doctor command makes coherence a one-slash gesture ([23c22463a](https://github.com/supernovae-st/nika/commit/23c22463ad7e35847780afb28b2de9796e28ab96))
- **kit** — The codex page opens with three doors, not three verbs ([24e9335f6](https://github.com/supernovae-st/nika/commit/24e9335f6d217da47a999e53a135b4027bf62456))
- **lot-3** — The thin laws (F-P13..F-P23 · NEP-0014) ([#753](https://github.com/supernovae-st/nika/issues/753)) ([472c704b4](https://github.com/supernovae-st/nika/commit/472c704b4d4935d352c8fd91c325808ae7c19c18)) ([#753](https://github.com/supernovae-st/nika/pull/753))
- **media** — The hero gains the window chrome · the dead slug class dies ([bd915b85f](https://github.com/supernovae-st/nika/commit/bd915b85fa5eb25ec03053e4c855d34d9dce6e11))
- **nika-cli** — Doctor probes the installed kits and names their drift ([b20e9b338](https://github.com/supernovae-st/nika/commit/b20e9b3388eff6e1f8731bceb145d7ff39f7867d))
- **nika-cli** — Welcome names kit train drift and routes to doctor ([c38ce446a](https://github.com/supernovae-st/nika/commit/c38ce446ae22db72544f67b0c980df9bb7d11999))
- **nika-cli** — The energy rung — cost honesty in watt-hours (NEP-0018) ([e92570786](https://github.com/supernovae-st/nika/commit/e9257078654c781dd6741d32f53235c426e0a956))
- **nika-store** — The signed-memory substrate (F-P8 · lot 2) ([#755](https://github.com/supernovae-st/nika/issues/755)) ([62728587b](https://github.com/supernovae-st/nika/commit/62728587b2f80f921c9f1804cd81cab70b5fb452)) ([#755](https://github.com/supernovae-st/nika/pull/755))
- **onboard** — The intent shapes the workflow before the template ([1ea784404](https://github.com/supernovae-st/nika/commit/1ea7844045afb469ec9dd162aab23e59c8cbb7da))
- **providers** — Readiness is a ladder · local is a place ([96da9aeb9](https://github.com/supernovae-st/nika/commit/96da9aeb955bfc9a8e90603d385a9fd9237a5fe2))
- **registry** — The provenance ladder + the operator admission floor (F-P27 · NEP-0016) ([#751](https://github.com/supernovae-st/nika/issues/751)) ([51f170bb5](https://github.com/supernovae-st/nika/commit/51f170bb5907053da3a2c347e6fc5fe5374827f1)) ([#751](https://github.com/supernovae-st/nika/pull/751))
- **runtime** — Preview-commit · the judged request is the fired request (F-P6) ([#749](https://github.com/supernovae-st/nika/issues/749)) ([d5b411b36](https://github.com/supernovae-st/nika/commit/d5b411b36fa0cdf7d69218cea3ef8397394940f4)) ([#749](https://github.com/supernovae-st/nika/pull/749))
- **runtime** — Nika test runs on a simulated effects plane ([871460cbd](https://github.com/supernovae-st/nika/commit/871460cbd726eca6ab017b23531aa2ef800d6d4b))
- **runtime,check** — Human approval is a bounded, attested ticket (F-P4 · NEP-0013) ([#744](https://github.com/supernovae-st/nika/issues/744)) ([bee82f9b1](https://github.com/supernovae-st/nika/commit/bee82f9b166ed4a15e54172393b83f8ab52ae467)) ([#744](https://github.com/supernovae-st/nika/pull/744))
- **runtime,check** — The thin-laws lot 3a (F-P13 · F-P15 · F-P16 · F-P21 · NEP-0014) ([#752](https://github.com/supernovae-st/nika/issues/752)) ([5ed027cb1](https://github.com/supernovae-st/nika/commit/5ed027cb106b2ec21b6ac3505105f9ee361bc73e)) ([#752](https://github.com/supernovae-st/nika/pull/752))
- **wire** — Grok and antigravity become wire targets · the toml family is born ([34bb14833](https://github.com/supernovae-st/nika/commit/34bb14833fda59b1f6ce8833a059b0157666b87a))
- **wire** — Kimi and kiro join the doors · the estate learns the index lesson ([155bd53b6](https://github.com/supernovae-st/nika/commit/155bd53b6ea36b152ec237b12c62c5f77caa351c))
- **wire** — Copilot and amp complete the wave · shapes from the clients' own writers ([837671c86](https://github.com/supernovae-st/nika/commit/837671c86150550748afc6811b8164837f9c6292))
- **workspace** — The corpus is indexed by what it teaches, not by an invented tier ([6988af52f](https://github.com/supernovae-st/nika/commit/6988af52f71217c63900e4657a9172a8892638c0))

### 🐛 Bug Fixes
- **agent,infer** — Fail closed when a priced backend omits token usage (R3-F1) ([aa669fd2e](https://github.com/supernovae-st/nika/commit/aa669fd2e351fe5deeca57d7d3fa85ac78737d74))
- **audit** — Wave A — the general adversarial audit's law+security findings ([#764](https://github.com/supernovae-st/nika/issues/764)) ([a12deff69](https://github.com/supernovae-st/nika/commit/a12deff696f0d51185174f0d3906490692737151)) ([#764](https://github.com/supernovae-st/nika/pull/764))
- **builtin** — Shadow jaq's scan to the jq-global semantics ([7fa3e535c](https://github.com/supernovae-st/nika/commit/7fa3e535c92970b02989731f9b50f74626962227))
- **check** — Two verdict lines stop claiming more than they cover ([7fc837571](https://github.com/supernovae-st/nika/commit/7fc83757169f6c63d47ee5af847a09cf176d2a77))
- **check** — --infer-permits stops contradicting the check that reads it ([e624bc452](https://github.com/supernovae-st/nika/commit/e624bc452f665306d1ed799839f279d544e3f4d1))
- **check** — Recover the decidable conjunct the dynamic argument was taking with it ([d8ae2d933](https://github.com/supernovae-st/nika/commit/d8ae2d933f7a55dce2e298e60f64aca95eabb418))
- **check** — The hint and the cost line narrow to what they cover ([c3fc10256](https://github.com/supernovae-st/nika/commit/c3fc10256ecaf31429548bf67e3d7d4d844ac00a))
- **check** — Price composed children into the cost ceiling with call multipliers ([b8eba5125](https://github.com/supernovae-st/nika/commit/b8eba5125ccd1d80950af75f90de7d03d2cfb3a5))
- **check** — The secrets fix ladder names the layer that failed (R4-F1) ([4b8e815a2](https://github.com/supernovae-st/nika/commit/4b8e815a24905532d85400c5bf7ee44605864111))
- **check** — The exec net-fit judges literal argv URLs like an invoke (D1) ([f318566d5](https://github.com/supernovae-st/nika/commit/f318566d5b75a937a52db197556c6cc8af0a6b92))
- **check** — The types verdict names its unshaped-output blind spot, aliases included (F3) ([f8f2326e5](https://github.com/supernovae-st/nika/commit/f8f2326e5c170064e425b74c79545d34c874df36))
- **check** — The coded VAR-003 walk adopts the locked strict-binding law ([bde2ae3cc](https://github.com/supernovae-st/nika/commit/bde2ae3cc0ab9e4cea5b1f4c82a4a097bd6e98be))
- **check** — Retried non-idempotent builtins earn the retry-effects hint ([4861589ad](https://github.com/supernovae-st/nika/commit/4861589adcba3f44f20f431033aa3edac90dca96))
- **ci** — The two lanes meet · the gate fixture obeys the law it crossed ([549719e18](https://github.com/supernovae-st/nika/commit/549719e18eaa966ccb64b396273c7002e208746d))
- **cli** — Claim neither bound in unbounded cost renders ([de4c459ca](https://github.com/supernovae-st/nika/commit/de4c459ca4bf1e3849148a7bad46d1d7f068487c))
- **dap** — Refuse a required anchor on an unsealed journal ([73e3af6d3](https://github.com/supernovae-st/nika/commit/73e3af6d303eebd7b7fb1d718aad240cde9dc564))
- **dap** — A seal with lines after it is tampering, and an absent key is not forgery ([9a16ecd70](https://github.com/supernovae-st/nika/commit/9a16ecd70796a46dc9acefafe67fa86da0061018))
- **dap** — A truncated inventory never renders as zero ([a5592f07c](https://github.com/supernovae-st/nika/commit/a5592f07c177625e81cd234801a5a6bd3dde95dd))
- **dap,cli** — The lot-1 review's fixpack (terminal hygiene · fuzz ci · journal bound · otel class) ([#740](https://github.com/supernovae-st/nika/issues/740)) ([9118b1f99](https://github.com/supernovae-st/nika/commit/9118b1f9987151dd7205b6c0bc6fb689e28e3670)) ([#740](https://github.com/supernovae-st/nika/pull/740))
- **dco** — Exempt bot-authored commits by author name too ([770b8d412](https://github.com/supernovae-st/nika/commit/770b8d41206e29a282db1498de0a4d7fa098527c))
- **docs,tests** — The spell gate passes (plural-of-child repaired · ATTACH-ed) ([#759](https://github.com/supernovae-st/nika/issues/759)) ([f19e9c928](https://github.com/supernovae-st/nika/commit/f19e9c9286117f02f32ff26726f3361c38ca533e)) ([#759](https://github.com/supernovae-st/nika/pull/759))
- **drift** — Model glob walk roots and multipart parts as reads; exec poisons fs sets ([34f248180](https://github.com/supernovae-st/nika/commit/34f24818010d734463ccc22f7c9fdd30808c7d55))
- **drift** — The drift pass counts exec argv urls like the net-fit (D1 coherence) ([3f56c5f19](https://github.com/supernovae-st/nika/commit/3f56c5f19ea9d30b6990437ce311418037bbdee9))
- **estate** — The mirror gate watches pushes, not only pull requests ([2f1f2e277](https://github.com/supernovae-st/nika/commit/2f1f2e277f4db1a75b749fe8f2edc250510a7eaa))
- **estate** — The mirror carries the mode, and the rules stop tripping the linter ([c7fdcd71c](https://github.com/supernovae-st/nika/commit/c7fdcd71c7094403faa96446e2c96f587e46d194))
- **estate** — The noqa actually ships ([93b503b73](https://github.com/supernovae-st/nika/commit/93b503b738013ef80c47c64f16dea3138f8f83ff))
- **exec** — The eval floor parses per interpreter, never per prefix ([b54e95a17](https://github.com/supernovae-st/nika/commit/b54e95a176572a8f5d364b295f3c1b310a37ebd0))
- **hooks** — The edit hook names the oracle that answered ([778664fea](https://github.com/supernovae-st/nika/commit/778664feaa12ab430fb96620fb0c1d8ddc9102e7))
- **hooks** — The path is the oracle identity, the version is only a tag ([ce6ab031a](https://github.com/supernovae-st/nika/commit/ce6ab031a4146f02cb6c65c7ed8adb35956a0834))
- **hooks** — Derive commit scopes from the crate list, and stop citing a file that does not exist ([b3f50713b](https://github.com/supernovae-st/nika/commit/b3f50713b7a0c8f383d39c91caa04175c739e42c))
- **hooks** — Check-on-edit judges with the tree build by default, not the PATH (F14) ([50bd19f5d](https://github.com/supernovae-st/nika/commit/50bd19f5d333fda070370030e120ff1f31af3cfc))
- **hooks** — Derive the script surfaces too, since the gate named its own gap ([48a90712d](https://github.com/supernovae-st/nika/commit/48a90712d76d4cc72a86a60a53a38af3503c9ff6))
- **hygiene** — Vector 9 tracks the living city, not a frozen snapshot of it ([23113342b](https://github.com/supernovae-st/nika/commit/23113342b06366b23233188b8119e236b39ff131))
- **hygiene** — The lan seam declares its bypass · rustdoc links qualify ([5e6d26e45](https://github.com/supernovae-st/nika/commit/5e6d26e4555f22bd31f93d003fce1dc2f742799a))
- **kit** — Session-context never inherits the process cwd ([4405ba678](https://github.com/supernovae-st/nika/commit/4405ba67829797d6765f2c0a72c0517ec4e373e7))
- **media** — The fanout capture pointed at a path the pack flattened away ([b406174e1](https://github.com/supernovae-st/nika/commit/b406174e1d5f447b255af6fbc5bb704d64925897))
- **nika-cli** — The energy rung stops inventing an iteration, and scopes get subtotals ([419488b4d](https://github.com/supernovae-st/nika/commit/419488b4dac76a751650710269d438222a64cd42))
- **nika-cli** — The MODELS rung stops reading a template as a model id ([69c402333](https://github.com/supernovae-st/nika/commit/69c40233318d5ad35c62de2b8f8213845e62adc7))
- **nika-cli** — A human gate can no longer kill a first run ([#771](https://github.com/supernovae-st/nika/issues/771)) ([c6a2ac0cc](https://github.com/supernovae-st/nika/commit/c6a2ac0cc4b91d2451d63b0927b0a29c78510652)) ([#771](https://github.com/supernovae-st/nika/pull/771))
- **nika-runtime** — The floor fixture gains its NEP-0002 gate — the e2e twin moved, the copy did not ([2a2efcc0b](https://github.com/supernovae-st/nika/commit/2a2efcc0b2d5a3a87cc09659c7d39b1ccd316cb7))
- **onboard** — An invalid answer is said and re-asked, never defaulted ([4542a616f](https://github.com/supernovae-st/nika/commit/4542a616f145146da9fe133f6978934ea3942096))
- **pack** — The fold doubled two permits blocks in the mirror ([d8b8ef18f](https://github.com/supernovae-st/nika/commit/d8b8ef18f48a8c3e9724048d865160e5aff3b42e))
- **pack** — The canon counts and the manifest hashes tell the truth ([#758](https://github.com/supernovae-st/nika/issues/758)) ([5176f03ce](https://github.com/supernovae-st/nika/commit/5176f03ce1f5620f38058fe8b7621740982ebfc5)) ([#758](https://github.com/supernovae-st/nika/pull/758))
- **permits** — A declared fs boundary stops granting more than it declares ([0e73adc28](https://github.com/supernovae-st/nika/commit/0e73adc28206c8f2e167e8fb3afa0bbe054f427f))
- **release** — The immutable-sha checkout learns its one tag ([79bcf6e66](https://github.com/supernovae-st/nika/commit/79bcf6e66a5273c704a90a756fbd2a4253f5c5e2)) ([#738](https://github.com/supernovae-st/nika/pull/738))
- **run** — --answer pre-seeds the gates of a fresh run, no --resume needed (F4) ([ed873e3b2](https://github.com/supernovae-st/nika/commit/ed873e3b27f0d67da73bd7ab79a12589b587d055))
- **runtime** — Refuse a floor-above-budget launch at admission (NIKA-1709) ([c6c52ae0f](https://github.com/supernovae-st/nika/commit/c6c52ae0ff8f7df51f30f59c2432e6f74c96d0c2))
- **runtime** — An edited child no longer cache-hits its caller ([f86fbde07](https://github.com/supernovae-st/nika/commit/f86fbde07b38a929d9d5713b244ac8751e5065e0))
- **runtime** — The scrub redacts secrets of any length by provenance ([37f6c1716](https://github.com/supernovae-st/nika/commit/37f6c17163d62ac562fac50a3b6c9e6268e02cb3))
- **sandbox** — Admit sqlite journal sidecars and cwd/parent listings on exact-file grants ([3c767ca20](https://github.com/supernovae-st/nika/commit/3c767ca2005c6285fdb3d548a15734581770168b))
- **store,dap,event** — The memory substrate carries its own bounds (audit wave B) ([#765](https://github.com/supernovae-st/nika/issues/765)) ([4d0a9bee1](https://github.com/supernovae-st/nika/commit/4d0a9bee1405b3e966182d1348ba5e51e6e170a0)) ([#765](https://github.com/supernovae-st/nika/pull/765))
- **trifecta** — The exec verb is born-ingress, and notify's default channel is net (F2) ([b9901cad5](https://github.com/supernovae-st/nika/commit/b9901cad50c3ee4d1052e271cc1eebaa6658dfc0))
- **trifecta** — The file channel arms on arrived taint, never on born output ([fc0b69c15](https://github.com/supernovae-st/nika/commit/fc0b69c15cc1c17014105ab578dc94ad75c1782b))
- **ux** — The gauntlet's six wounds close · the taught chain runs green end to end ([ab9b5978c](https://github.com/supernovae-st/nika/commit/ab9b5978c0830322f2d8d73c14fbbac4770a21c9))

### 🔨 Refactors
- **catalog** — The entry validator splits at its facts seam ([34b17a825](https://github.com/supernovae-st/nika/commit/34b17a825e723309eccd26e7bb3509246d44b735))
- **check** — The permit-fit batteries move beside their module ([7ae63c0a5](https://github.com/supernovae-st/nika/commit/7ae63c0a552a1dc4e1939f76e42d4992b35923b4))
- **check** — The two over-limit judges split at their seams ([b02b8c3f2](https://github.com/supernovae-st/nika/commit/b02b8c3f2ba16a61392bad016a21528c6bca349f))
- **check** — The one-voice filter gets a name and its own function ([6209d6ca9](https://github.com/supernovae-st/nika/commit/6209d6ca96f4c70640cc8c311ed0178f7d84ec33))
- **cli** — The run verb's tests move to their own file ([0ce6cbdfa](https://github.com/supernovae-st/nika/commit/0ce6cbdfaacd7fc9023e8fab0e5aa0272c7a6bd2))
- **cli** — The resume surface descends to its own module, the loc cap holds ([1057859fd](https://github.com/supernovae-st/nika/commit/1057859fd93523d37b2fdf4a4920dece594100e6))
- **display** — Descend the check render and the dag art to nika-display ([e11558493](https://github.com/supernovae-st/nika/commit/e11558493c5a279d1985fd18234b96232864fdc3))
- **display** — The rung claims descend to their own module, the loc cap holds ([85a0adad5](https://github.com/supernovae-st/nika/commit/85a0adad5e0c5e69d46c51a7b4a0af95bfcc916a))
- **runtime** — Bring run and the verify tier under the 100-line cap ([7208a21f3](https://github.com/supernovae-st/nika/commit/7208a21f31802ac91d61dadf32e39b0fffd90a50))
- **runtime,dap** — Split two fns at the 100-line law (fn-length ratchet) ([fcddd872e](https://github.com/supernovae-st/nika/commit/fcddd872e3fe14227a67a4064630e4cf4eb24ef9))

### 📚 Documentation
- **adr** — Adr-109 — the composition receipt, condition by condition ([1c4064156](https://github.com/supernovae-st/nika/commit/1c4064156bca57dcdee2a235cf195fbe29d2f1be))
- **adr** — Re-issue the composition receipt — 9 rows, two at a named lower tier ([66be812c9](https://github.com/supernovae-st/nika/commit/66be812c98d158add8da6cab9f7e093d91da77ba))
- **audit** — Run 5's four regressions fixed after the operator's decisions ([616a4d77a](https://github.com/supernovae-st/nika/commit/616a4d77a425c08523c8b0a9b99ce92fc16eb70d))
- **audit** — The next session's checkpoint — run 5 domain, traps, and the queue ([d6f8b863a](https://github.com/supernovae-st/nika/commit/d6f8b863a08c81cd08fac318bf9ef234ea892fd1))
- **catalog** — The deepseek three-way resolves at the rendered page ([0a8fbf746](https://github.com/supernovae-st/nika/commit/0a8fbf746869bc7a702b014f2928022b0f535179))
- **check** — The two laws move to where a check is written and reviewed ([d9e4d43e6](https://github.com/supernovae-st/nika/commit/d9e4d43e666a3a029435961883c0a30cc7830d35))
- **honesty** — The surfaces catch up with the proven behavior ([f671f1cf7](https://github.com/supernovae-st/nika/commit/f671f1cf7efd49e443fdf26f1754b0e459543843))
- **host** — Three links to private items become plain code text ([8cd4bc729](https://github.com/supernovae-st/nika/commit/8cd4bc72942aba955a6d3f258e8363e588c7431c))
- **kit** — The delegation rule routes health to the doctor ([3d05ce215](https://github.com/supernovae-st/nika/commit/3d05ce215ed0c8e954667990aa23dbd90b07289d))
- **media** — Every drawn frame speaks the released grammar ([2a273cc32](https://github.com/supernovae-st/nika/commit/2a273cc325e2673872b52e59b86c176731aaf1fd))
- **media** — The last two stale paintings catch up with their scenes ([bdc7d3117](https://github.com/supernovae-st/nika/commit/bdc7d31175ab15eb4e8c2d84b4d5095af064ac50))
- **media** — The readme's taught slugs face the same executioner ([c16d4e891](https://github.com/supernovae-st/nika/commit/c16d4e891eee1f9dcbd484714034ff4c7de880c5))
- **media** — The renderer refuses to paint outside the frame ([8be8cc8db](https://github.com/supernovae-st/nika/commit/8be8cc8dbfaae12314d80bc5c2828b11ee25c184))
- **nika-cli** — The fixture doc catches up with its gated shape ([763439161](https://github.com/supernovae-st/nika/commit/763439161c6a3943e2860c7541ba2c8e6d19e638))
- **plans** — The cost ceiling covers half the bill, and four forks get their reasons ([27f3f4ec8](https://github.com/supernovae-st/nika/commit/27f3f4ec83e564dc7bf33318f00441ba4d60786f))
- **plans** — The contradictory-advice pair closed with the matcher ([1513d2f48](https://github.com/supernovae-st/nika/commit/1513d2f48583a0faaa9d2b62db574de7ccef7d96))
- **plans** — Sec-009 keeps its semantics, its message stops hiding the approximation ([ace795ae9](https://github.com/supernovae-st/nika/commit/ace795ae9aa25aa9da8319912c56efb96da33b8f))
- **plans** — The resume wedge does not reproduce, and that is worth recording ([c3c293852](https://github.com/supernovae-st/nika/commit/c3c2938526bfdab7cb7a22193c2f3725bd8e81c6))
- **plans** — The arc record separates shipped from written ([0e1b9bee0](https://github.com/supernovae-st/nika/commit/0e1b9bee0cb47da9375fe32aee3d0ace112c20ea))
- **plans** — The adversarial audit run 2 and the handoff closure ([eb2342054](https://github.com/supernovae-st/nika/commit/eb2342054fd6b3a220c3599b3fa309638445a422))
- **plans** — The adversarial audit run 3 — agent-loop budget + MCP pricing ([00e81c55b](https://github.com/supernovae-st/nika/commit/00e81c55b9e2eb298edf208e542984836cb17e6e))
- **readme** — The repo names its place in the city ([5fb78af4c](https://github.com/supernovae-st/nika/commit/5fb78af4c2cde55aecb1c381b570022d6fd7668f))
- **readme** — The island links every building ([56032f47d](https://github.com/supernovae-st/nika/commit/56032f47dd8fb7c6a72a783d2575dbb372836ea3))
- **readme** — The city island names which root this building carries ([45fe0d31a](https://github.com/supernovae-st/nika/commit/45fe0d31afdcb1a9c1320ee6598ccd7e3596ff34))
- **readme** — The city gains its ci district and loses its witness ([f53df4c42](https://github.com/supernovae-st/nika/commit/f53df4c425ddcd96abb20bdf79c83210aba9e850))
- **roadmap** — The skill row points at the living repo, not a dead link ([e5382e231](https://github.com/supernovae-st/nika/commit/e5382e2318ebeb405d536780f6f541bbf9e60947))
- **trace** — The verify help promised a taxonomy the verb had outgrown ([5488d2f3c](https://github.com/supernovae-st/nika/commit/5488d2f3c18ea180dbc4c41630aa7d403cc62b14))

### 🧪 Tests
- **check** — The integration twin follows the lock, and typos stops reading French ([be8ccad00](https://github.com/supernovae-st/nika/commit/be8ccad008aadcf13027f1a0c907ccd50c39b43d))
- **cli** — The check-run oracle rides the corpus ([fa08fce9b](https://github.com/supernovae-st/nika/commit/fa08fce9b84fd048b6d4aab3d1c25ca534be64e9))
- **cli** — The corpus coverage ratchet holds both axes ([92c9fef2e](https://github.com/supernovae-st/nika/commit/92c9fef2e868410f0b78d2d132ffdb523c76e593))
- **cli** — The two builtin roots meet their consumer-side gate ([97b6e435e](https://github.com/supernovae-st/nika/commit/97b6e435efe6eee460edf471dd6b7a202fde2384))
- **cli** — The ratchets absorb the reviewer's mutations ([8d3d1179d](https://github.com/supernovae-st/nika/commit/8d3d1179d5d6140af5cc94e2150bd01120132a12))
- **dap** — The rust-python differential renders one verdict (nep-0012 law 4) ([#741](https://github.com/supernovae-st/nika/issues/741)) ([40be14609](https://github.com/supernovae-st/nika/commit/40be1460946a70fbfd8f51dbaa203d6a2afa9af0)) ([#741](https://github.com/supernovae-st/nika/pull/741))
- **nika-cli** — The child's floor bounds the parent budget — adr-109 condition 4 closes ([01e45f580](https://github.com/supernovae-st/nika/commit/01e45f58095a66491838835a79807590e06e1c80))
- **pack** — The vendored canon's 17 must resolve in the shipped catalog ([3e32fd4e0](https://github.com/supernovae-st/nika/commit/3e32fd4e0efaa7807b8bc6cdbf3e8bd6577e536b))

## [0.106.1](https://github.com/supernovae-st/nika/compare/v0.106.0..v0.106.1) - 2026-07-28

**The browser release.** The checker takes the seat the spec reserved for it
(07-conformance Level 2 · « custom engines for specialized environments »):
the parse + conformance half of `nika check` compiled to WebAssembly, admitted
through the full 12-gate ceremony (ADR-107) — including a three-leg adversarial
review that found a real engine bug before any browser saw it (a jq nesting
bomb that killed the checking instance for good; the guard now refuses at
depth 128 on every surface). The artifact debuts on npm as
`@supernovae-st/nika-check-wasm`, packed by this release train itself:
manifest projected from cargo metadata, host paths remapped out of the bytes,
the tarball attached to this release + attested whether or not the registry
credential exists. In-band honesty rides every verdict — `wasm: true` and a
closed `legs:` list, so the browser half can never be mistaken for the full
binary. Around it the ladder keeps tightening: `when:`/`for_each:` stop
admitting the loop locals (the runtime pin collected its own documented
sunset), and the audited card stops calling a ceiling a floor.

### ✨ Features
- **catalog** — The pricing provenance is produced by the engine it feeds ([a30080600](https://github.com/supernovae-st/nika/commit/a300806002c5aea4bfe1990105275ba3cc16025f))
- **check** — A prompt with no default names its headless cost ([acdb032ab](https://github.com/supernovae-st/nika/commit/acdb032abc352f8fb561660a2600e5a4c48409a4))
- **check** — A structured capture nobody branches on names what it swallows ([5ea8cf2dd](https://github.com/supernovae-st/nika/commit/5ea8cf2dd02f90cb176dc68e214b623d9fc70d62))
- **check-wasm** — Admit the browser half of nika check (ADR-107 · 12 gates) ([3a8e2e843](https://github.com/supernovae-st/nika/commit/3a8e2e84369e3028d9b6221d77090dc628c81d7f))
- **cli** — Nika lsp accepts the host convention flags as no-ops ([a3c4950e2](https://github.com/supernovae-st/nika/commit/a3c4950e251d5047987592a312d32617d6751f28))
- **mcp** — The five slash commands reach every client, not three ([e7f1f5284](https://github.com/supernovae-st/nika/commit/e7f1f5284f8ef3a18d22d4079937a47dde87513b))
- **mcp** — The agent-facing oracle stops handing back a green the run gate refuses ([62ba2406e](https://github.com/supernovae-st/nika/commit/62ba2406eca3c87b332ee1e6615180198dc1af80))
- **plugin** — The codex manifest carries its public listing card ([56d6dc3e5](https://github.com/supernovae-st/nika/commit/56d6dc3e57175bbb7a9cb367781125d3b1d53766))

### 🐛 Bug Fixes
- **check** — `when:` and `for_each:` stop admitting the loop locals ([f7b680366](https://github.com/supernovae-st/nika/commit/f7b680366eea1025c9f0fd0b18405b775d14cbf9))
- **check** — Every surface that judges for the author judges like the run gate ([74d230254](https://github.com/supernovae-st/nika/commit/74d230254f2641957456c8d582ff3e13c2d5f2d4))
- **check** — The audited card stops calling a ceiling a floor ([a77078707](https://github.com/supernovae-st/nika/commit/a770787070a186033c023bf7431fc6568bae41b4))
- **kit** — The plugin taught a syntax the engine refuses ([0b362db42](https://github.com/supernovae-st/nika/commit/0b362db42fd42cd9d41865f3ff514223a0399c22))
- **mcp** — The read-only oracle says so on the wire ([a6bdf3e54](https://github.com/supernovae-st/nika/commit/a6bdf3e54b88c4322690f88740c9f6c7f07d336b))

### 🔨 Refactors
- **check** — Scan_task stops building its contexts by hand ([16bb12b97](https://github.com/supernovae-st/nika/commit/16bb12b97a191e4a32dc4db28d4266cc95b4652c))
- **check** — The traversal half of the hint lane earns its own file ([12add44a3](https://github.com/supernovae-st/nika/commit/12add44a31474f0f94f0badb7599834877a92dc9))

### 📚 Documentation
- **kit** — The kit teaches the whole language, not a third of it ([a94360f2c](https://github.com/supernovae-st/nika/commit/a94360f2c644171e544d540a4d5e4ad3ca53d1f9))
- **kit** — Composition was a whole chapter the kit never mentioned ([9cc9d6002](https://github.com/supernovae-st/nika/commit/9cc9d60025091b5133c331b01f442b473df7c42f))
- **kit** — The native-first law gains the recipe it was missing ([0b5040ca1](https://github.com/supernovae-st/nika/commit/0b5040ca196260088f9a0bcf1ef3f2e4da0c525f))
- **plans** — The false-green class, six findings and their law ([2aaa80881](https://github.com/supernovae-st/nika/commit/2aaa8088102750163945a1855889efc529ffe4dc))
- **plans** — The resource algebra — what a workflow costs and what check can prove ([71c67da3f](https://github.com/supernovae-st/nika/commit/71c67da3fdbda0e238737a49888a04a340f5a511))
- **plans** — The cost ceiling is unsound on agent loops, and the reason is a theorem ([1ca813fbb](https://github.com/supernovae-st/nika/commit/1ca813fbb1625201fa11a72cbfd59295673c74f3))
- **plans** — The resource-vector research corrects four of my own rows ([a7cd93b28](https://github.com/supernovae-st/nika/commit/a7cd93b2863ea6b820067fb320c5f2261e73eaad))
- **plans** — The DAG width is measured, and it closes the hypothesis T1 rests on ([9b172979e](https://github.com/supernovae-st/nika/commit/9b172979e0fe5de9601f970ad6aa95bef92542d8))
- **plans** — An adversarial pass killed 17 of 33 claims — the corrections lead the document ([b40839d16](https://github.com/supernovae-st/nika/commit/b40839d16ea91f38b81da451ffb7cd76d3ed5aba))

### 🧪 Tests
- **check** — The ledger fixture goes on one line, and says why ([14a14b1d5](https://github.com/supernovae-st/nika/commit/14a14b1d52d43c045aa2d46c9dc25147f135ebf3))

## [0.106.0](https://github.com/supernovae-st/nika/compare/v0.105.0..v0.106.0) - 2026-07-27

**The authority release.** Two flag-days land in the same window, and both
change what an existing file MEANS. The envelope's value forms split into the
four authorities — `vars:` and `env:` are dead, `inputs:` · `config:` ·
`const:` · `secrets:` are the whole family — and a `permits:` block stops
being optional: absent is now the EMPTY boundary, not the unconfined floor.
Around them the attestation lane arrives whole: a run declares its entropy and
its clock, boots from a manifest, seals what it covered, signs, anchors to a
public transparency log, and exports a pack an auditor reads without trusting
us. This is the first release where a workflow written yesterday can refuse to
check today. The migration is the front page, not a footnote — `nika check
--fix` applies the mechanical half and STOPS untouched rather than guess at
the rest.

### ⚠️ Migration

#### 1 · The value authorities — `vars:` and `env:` are dead (R3a « the E-split » · #669)

The law is **classify-not-rename**: every old entry moves to the authority its
ROLE commands, never to one bulk destination.

| Dead form | Classify it as | Refusal |
|---|---|---|
| `vars:` entry · a typed parameter a caller supplies | `inputs:` (typed · `required:` · `default:`) | `NIKA-VALUES-001` |
| `vars:` entry · a fixed value baked into the file | `const:` (bare literal, or `{ type, value }`) | `NIKA-VALUES-001` |
| `env:` entry · non-sensitive runtime configuration | `config:` (typed · deployment-supplied) | `NIKA-VALUES-002` |
| `env:` entry · a credential | `secrets:` (a store reference · never a literal) | `NIKA-VALUES-002` |
| `env:` entry · a name a child process must see | `permits: { env: [NAME] }` (exact names) | `NIKA-VALUES-002` |
| `${{ vars.X }}` · `${{ env.X }}` | the authority the role commands | `-001` · `-002` |
| `${{ anything_else.X }}` | the family is closed: inputs · config · const · secrets | `NIKA-VALUES-003` |

`nika check --fix` migrates the `vars:` half mechanically — comment-preserving,
idempotent, and class-aware (the name→class map comes from the file's own
block, never a blind rename). It leaves the file UNTOUCHED and names the reason
on a credential-shaped name, a typed-only declaration, a flow-style
`vars: {…}` header, a `required: true` entry without `type:`, or an empty
block: atomic-or-nothing, the codemod never guesses. **`env:` has no
mechanical repair** — re-shaping a flat string map into typed `config:`
declarations is a human classification, and the teaching says so at the point
of refusal.

Two consequences worth reading twice · `config:` resolves ONLY against the
declared block, so the engine never silently falls back to the OS environment
(every value a workflow depends on is visible in the file); and `--var` now
names `inputs:` — the flag keeps its spelling, its target moved.

#### 2 · The boundary — absent `permits:` is zero authority (F-O8 · NEP-0003 · #691)

A missing `permits:` block used to be the unconfined floor. It is now the
EMPTY boundary: a body carrying any effect with no block refuses
`NIKA-AUTH-006` at check — before a token is spent — and the runtime gates
refuse before any spawn. Only a pure-compute body stays clean, and it gets a
hint teaching `permits: {}`, the legal zero. The 39 embedded workflows that
shipped with this repo — examples, showcase tiers, templates, battery files —
each had to declare its inferred block: that is the blast radius, measured
rather than guessed. The repair is one command —
`nika check --infer-permits` prints the tightest block, and the round-trip law
holds (the inferred block re-checks clean).

Four more refusals ride the same window. Each was previously admitted:

| Refusal | What it now refuses |
|---|---|
| `NIKA-AUTH-007` | an interpolation reaching a permit BOUND (host · glob · program · env name) — a bound MUST be a literal, or the boundary is self-serve |
| `NIKA-AUTH-008` | an untrusted value whose canonical resolved form escapes the step's permit (the static twin of the runtime re-gate) |
| `NIKA-AUTH-009` | a `permits: env:` entry naming a dangerous-floor variable — the engine strips it unconditionally, so the grant is an inert dead grant |
| `NIKA-AUTH-010` | `*.example.com` in `permits.net.http` — the `*.` subdomain wildcard delegates the boundary to the zone operator (every host under the suffix, present and future). Name exact hosts, or the bare `*` when allow-all is genuinely intended |
| `NIKA-SEC-008` | a `nika:fetch` whose resolved URL path names a code-bearing class with no `inert:` door declared — the read hides an execution sink (NEP-0006) |

And one law that carries no code but changes what a child process SEES · **a
spawned child no longer inherits the engine environment**. Its environment is
COMPOSED from a cleared slate — the runner floor ∪ the names declared in
`permits: env:` ∪ the task's own `env:` map, the dangerous names stripped last
(F-O4 · NEP-0005). A workflow that relied on an ambient variable reaching an
`exec:` child must now name it.

#### 3 · The embedder cut — `nika-schema` → `nika-check` (#683 · no re-export shims)

| Before | After |
|---|---|
| `nika_schema::{analyze, AnalyzedWorkflow}` | `nika_check::{analyze, AnalyzedWorkflow}` |
| `nika_schema::{check, check_composed, infer_permits}` | `nika_check::{…}` |
| `nika_vocab::VarType` (the flat 6-enum) | the full `TypeExpr` of spec 09 |
| `NIKA-PARSE-019` (entropy × clock) | `NIKA-PARSE-026` · `-027` · `-028` |
| `NIKA-PARSE-015` (malformed typed `vars:`) | **retired · never reused** — what it refused is admitted by `TypeExpr`; what stays outside the grammar refuses `NIKA-TYPE-001` |

`nika-schema` keeps its blueprint shape (THE PARSER: AST + raw + error +
keysets). Every consumer inside this repo — cli · lsp · runtime · dap · mcp ·
verb-agent · lints · graph · display · onboard · the fuzz harness — already
points at `nika_check`; what migrates is the embedding code outside this repo.
The cut is clean by choice: a shim would have kept two names for one judgment.

The retired and re-minted codes count as breaking for anyone FILTERING on
them — a tool watching `NIKA-PARSE-019` for the entropy × clock contradiction
will never see it pass again.

#### 4 · The predicates and the type grammar (R5 · #677 · R3b · #673)

| Dead form | The respelling | Refusal |
|---|---|---|
| `after: { t: succeeded }` | `after: { t: success }` | `NIKA-DAG-005` |
| `after: { t: failed }` | `after: { t: failure }` | `NIKA-DAG-005` |
| `type: boolean` | `type: bool` — the one boolean spelling, no alias | `NIKA-TYPE-001` |
| bare `type: array` · `type: object` | `{ array: T }` · `{ object: { … } }` | `NIKA-TYPE-001` |
| a `default:` that does not fit its own `type:` | fix the value, or the type | `NIKA-DEFAULT-001` |

`skipped` and `terminal` are unchanged. `nika check --fix` applies the
predicate respelling 1:1 — flow and block `after:` forms, quoted values,
comments preserved, idempotent; a `when:` status comparison is the
`NIKA-DAG-007` class and is never touched. `NIKA-DEFAULT-001` closes a real
soundness hole: a declared default that could never satisfy its own type used
to sail through.

### Added

- **`nika-check`** — the static judgment crate (new L0 member · split from
  `nika-schema` at the 15k crate-size wall; the nika-graph/nika-dap
  precedents): the workflow analyzer (`analyze` · `AnalyzedWorkflow` · the ONE
  derived-DAG-edge computation every surface projects) plus the whole `nika
  check` ladder (`check` · `check_composed` · cost ceiling · secret-leak IFC ·
  capability-escape fit · trifecta · policy · gate reachability · the
  `RunCertificate` · `infer_permits`). Static judgment without the CLI, for
  the embedder/SDK surface (§Migration 3 for the import map).

- **`run:` — the run declares its entropy and its clock** (F-P3 · NEP-0010 ·
  #711) — a new envelope block with two keys: `entropy:` (`ambient` · `none` ·
  `{ seeded: <n> }`) and `clock:` (`system` · `virtual`). A declared pair that
  contradicts itself refuses at parse (`NIKA-PARSE-026` ambient × virtual ·
  `NIKA-PARSE-027` none|seeded × system), and an `entropy: none` that
  nevertheless consumes a structural randomness source refuses at check
  (`NIKA-PARSE-028`). `ambient` is the default when `run:` is absent — the
  honest status quo, so nothing that ran before changes. Determinism becomes a
  declaration the engine holds you to, not a hope.

- **The run's lifecycle is attested** (F-P2 · NEP-0011 draft · #718) — the
  `workflow_started` prologue becomes a boot manifest (`spec_pin` ·
  `stamper_kind` · the resolved `clock` · `seed` under a determinism demand);
  the run seal's `covers` extends additively with the folded `receipt_digest`,
  the consumed budgets and the exercised effects (the classic four-field seal
  stays byte-identical); a journal that never reached a lifecycle-terminal
  frame verifies **INCOMPLETE** — the verifier's finding, never the dying
  run's silence; and a check report stamped with a different semantic hash
  than the booting workflow refuses before the first event (the
  judged-vs-booted binding · exit 2 · semantic grain).

- **The receipt fortress — bounds are code** (F-P1 · NEP-0012 draft · #721) —
  the verifier is the one component guaranteed to parse attacker-supplied
  bytes, so its bounds became named constants on every profile: 1 MiB per
  document, a string-aware pre-parse depth scan at 32, proof-bearing arrays at
  64, identifier strings at 256. The chain walk refuses an over-long line
  BEFORE the parse (the new `LineOverLong` verdict, rendered as a FILE refusal
  by `trace verify` and an honest refusal by the evidence pack), and the
  anchor sidecar loads through the same door.

- **`nika sign` · `nika key` · `run --require-signature`** (S3 · #660 · #655) —
  workflow author-binding. `nika sign <file>` mints `<file>.minisig`
  (`--check` verifies); `nika key` is the run-signing key lifecycle (mint ·
  TOFU fingerprint · rotate — old public halves stay verifiable); `nika run
  --require-signature` refuses an unsigned or invalidly-signed workflow at
  exit 2. Runs emit a signed `run_sealed` event under run-key custody.

- **`nika trace anchor`** (#665) — notarize the journal head OUTSIDE the
  journal: the post-seal head, signed with the run key, submitted to the
  public Sigstore Rekor v2 transparency log plus an RFC 3161 timestamp,
  writing a detached `<trace>.anchor.json` sidecar. An explicit NETWORK act —
  this verb IS the opt-in. `nika trace verify` now climbs a four-tier ladder
  and reports the highest honestly-attained tier: chain OK · **SEALED** (the
  `run_sealed` signature verifies against a custody key) · **ANCHORED** (the
  sidecar verifies fully offline) · **REPLAYED** (`--replay` compares a fresh
  run; verify never re-executes).

- **`nika evidence`** (#662) — export the evidence pack for one run: journal +
  manifest + receipt + a `VERIFY.md` that tells an auditor what to run.

- **The permit-decision witness** (F-O6 · NEP-0007 · #701) — every permit
  decision is recorded in the journal, granted and refused alike, so
  `trace verify` can judge the boundary a run actually rode; and the
  check ⇔ run equivalence oracle proves the two agree. `trace_format` stays 2
  (the witness rides existing frames · no wire bump).

- **MCP tool pinning — TOFU + fail-closed drift** (#657) — a configured MCP
  server that changes its tool definitions after you approved them is the rug
  pull. Per-tool pins (blake3 over a domain-separated canonical pre-image)
  land in `.nika/mcp_pins.json` (`mcp_pins_format: 1`) beside a reviewable
  snapshot; first contact enrolls loudly, a match proceeds silently, ANY drift
  fails closed with a diff naming the CHANGED field and returns no tools. A
  hand-edited lockfile is `NIKA-MCP-004`, never a silent re-TOFU.
  **`nika mcp approve <server>`** re-pins after human review.

- **The exec sandbox is wired** (ADR-095 L6 · #642) — `permits:` jails the
  child (seatbelt on macOS · landlock/bubblewrap on Linux), the
  `SandboxSpec` network arm becomes a tri-state (#658), MCP stdio servers are
  spawned inside the same confinement (#667), and the **loopback egress
  proxy** makes the sandbox's network arm the exact projection of
  `permits.net.http` (#663 · #706 · F-P5 · NEP-0008).

- **Two new task fields** — `inert:` (the declared door for a `nika:fetch`
  whose payload is data, never code · the `NIKA-SEC-008` sanction) and
  `declassify:` (`from` · `to` · `because` · the audited secret-flow
  sanction).

- **Registry client v0.2 signatures** (#648) — minisign + TOFU on registry
  pulls (`NIKA-REG-006` · `NIKA-REG-007`).

- **`NIKA-DRIFT-001` — declared-but-unused hints in `check`** (#661) — a
  declared name or a `permits:` entry nothing in the body references. Advisory:
  it never fails the audit (the reverse direction, used-but-undeclared, is the
  hard refusal surface).

- **Two new journal event kinds** — `declassify` and `run_sealed`. Additive:
  `trace_format` stays 2, but a consumer matching the kind vocabulary
  exhaustively must learn them.

- **Spec 17 · trace** — the journal dialect becomes normative in the embedded
  pack (the NDJSON frame grammar chained by sha256, the prologue manifest, the
  closed kind vocabulary), and the pack ships the `law` + `registries` JSON
  schemas.

### Changed

- **`run:` declared-pair refusals ride their dedicated mints** — the
  parse-level entropy × clock contradictions stamp `NIKA-PARSE-026` (ambient ×
  virtual) and `NIKA-PARSE-027` (none | seeded × system), and the check-side
  `entropy: none` × structural-source judgment stamps `NIKA-PARSE-028` — was
  the registered generic `NIKA-PARSE-019`; the NEP-0010 mints landed with the
  87f764a spec pack resync.

- **The lethal-trifecta judge asks a better question** (trifecta v2.0 ·
  NEP-0002 · #643) — v1.1 asked « could this workflow complete the trifecta? »
  over the declared capability set. v2.0 asks « does untrusted content
  actually REACH an egress? », the integrity half of the flow lattice. The
  inversion that matters: an `infer:`/`agent:` output carries the taint when
  its prompt saw it — a summary of an attacker's page carries the payload.
  v2.0 findings ⊆ v1.1, so nothing that passed before starts failing.

- **`permits.tools` is enforced at run** (#639) — the last check-only axis
  closes. A tool call outside the boundary now refuses at dispatch, not only
  at check.

- **`NIKA-SEC-005` is core-visible — law 5 at every tier** (#708) — the
  net-egress floor was already emitted by `check`; only the core-tier
  conformance filter hid it. The core verdict now matches the reference
  oracle.

- **`nika trace verify` exit 0 means « the highest attained tier holds »** —
  the verdict is tiered, not binary (exit 2 broken or forged · exit 3
  unchained or a missing input).

- **The embedded spec pack catches up to the spec branch** — NEP-0004 through
  NEP-0012 land in the pack `nika spec` serves, along with the 6-namespace
  substitution family, the 25 error namespaces / 96 error codes, and the
  17-provider catalog count.

### Fixed

- **A planted symlink can no longer pivot an `fs:` grant** (H2 · NEP-0009 ·
  #710 · the CVE-2024-42472 class) — the mount-projection arm followed a
  symlinked bind SOURCE where the kernel path-walk arm refuses at open, so an
  upstream task that replaced `/ws/data` with a link to `$HOME/.ssh` made a
  later task's `fs.read: [/ws/data]` bind the wrong tree. Every grant's
  literal prefix is now re-judged as its EFFECTIVE path identity at dispatch,
  before the jail is built: a legitimately-symlinked ANCESTOR is absorbed, the
  final component stays lexical, and an identity that redirects outside the
  judged path is refused before spawn (`NIKA-SEC-004`) — never mounted under
  the judged name, never rewritten to the resolved form. The receipt does not
  lie.

- **A forged `CheckReport` cannot buy authority** (#656 · `NIKA-1707`) — the
  runtime re-derives the boundary subset at run start; a clean report over
  different bytes is not clean.

- **Resolved secrets are redacted from the journal, and journals are 0600**
  (#640).

- **Pulled model weights are sha256-verified against the Hub's declaration**
  (#641).

- **Security-boundary refusals never feed back to the model** (#638 ·
  `NIKA-468`) — a mid-loop refusal is the boundary's word, not another turn's
  context.

- **A `required: true` input with neither a `default:` nor a `--var` refuses
  at admission** (#674 · `NIKA-1708`) — before the DAG spends a task, not
  mid-run.

- **Key trust reads the public half only** (#668) — no decrypt on the print
  path.

- **The red team's residuals close** (#702 · #703 · #704) — four permit edge
  cases, three exec-runner residuals, decode-then-trim, and the `finally`
  attestation.

- **The taught flow bindings quote their islands** (#717) — an unquoted
  `${{ }}` in a YAML flow mapping is `NIKA-PARSE-001`; the shipped teaching
  surfaces no longer hand it to you.

## [0.105.0](https://github.com/supernovae-st/nika/compare/v0.104.0..v0.105.0) - 2026-07-20

### ✨ Features
- **authority** — W4 the authority — policy law, coded secret flows, certified effects ([#593](https://github.com/supernovae-st/nika/issues/593)) ([de5c359f2](https://github.com/supernovae-st/nika/commit/de5c359f2899b0b03ebb25d190e0660da8c87ff3)) ([#593](https://github.com/supernovae-st/nika/pull/593))
- **bench** — The w0 refonte baseline harness — slopes judged, three caught ([#578](https://github.com/supernovae-st/nika/issues/578)) ([21e72a80c](https://github.com/supernovae-st/nika/commit/21e72a80c8b69af130c86524d4e3c7086de1d75f)) ([#578](https://github.com/supernovae-st/nika/pull/578))
- **composition** — W-comp the composition — invoke: workflow:, specified + partial ([#596](https://github.com/supernovae-st/nika/issues/596)) ([0b85d5ce7](https://github.com/supernovae-st/nika/commit/0b85d5ce70c33ee85895685fa28d925dccb9e2a2)) ([#596](https://github.com/supernovae-st/nika/pull/596))
- **decision** — W-dec the decision — nika:decide, the deterministic kernel ([#594](https://github.com/supernovae-st/nika/issues/594)) ([c51a92698](https://github.com/supernovae-st/nika/commit/c51a926986bd62ba9bcce97f6826c50f5f5502af)) ([#594](https://github.com/supernovae-st/nika/pull/594))
- **lsp** — Every block teaches its own keys — the parser's keysets door ([#569](https://github.com/supernovae-st/nika/issues/569)) ([0d4221ae1](https://github.com/supernovae-st/nika/commit/0d4221ae150066eb9fe90cdf07c3840237049ba7)) ([#569](https://github.com/supernovae-st/nika/pull/569))
- **lsp** — Server-side rename — the map key renames everywhere at once ([#582](https://github.com/supernovae-st/nika/issues/582)) ([a3bbfc520](https://github.com/supernovae-st/nika/commit/a3bbfc52078231118c27288e76e493d553ef570f)) ([#582](https://github.com/supernovae-st/nika/pull/582))
- **lsp** — Semantic_document_format:1 — the oracle surface names its own version (W7) ([#598](https://github.com/supernovae-st/nika/issues/598)) ([57e997646](https://github.com/supernovae-st/nika/commit/57e9976462cef73a2019206d5ac19876ed556054)) ([#598](https://github.com/supernovae-st/nika/pull/598))
- **nika-cap** — The lethal trifecta judge — NIKA-SEC-009 (NEP-0002) ([#637](https://github.com/supernovae-st/nika/issues/637)) ([15dcc88f7](https://github.com/supernovae-st/nika/commit/15dcc88f7e6bfb5db416cc74070e5ece5d8f05e8)) ([#637](https://github.com/supernovae-st/nika/pull/637))
- **nika-lsp** — Loop-scoped roots by the law — item gated, index joins ([#576](https://github.com/supernovae-st/nika/issues/576)) ([f5db09288](https://github.com/supernovae-st/nika/commit/f5db092880973f4f95d2bbd256021c509126c86f)) ([#576](https://github.com/supernovae-st/nika/pull/576))
- **outcomes** — W5 the bounds — the Outcome IR, one table, cause on the record ([#595](https://github.com/supernovae-st/nika/issues/595)) ([aa8675e45](https://github.com/supernovae-st/nika/commit/aa8675e45e44060e21f3adb5f94703369eb1c0b2)) ([#595](https://github.com/supernovae-st/nika/pull/595))
- **proof** — W6 « la preuve » — semantic hash · nika.lock · assert: v1 · receipt_format:1 (the LAST pre-1.0 wave) ([#597](https://github.com/supernovae-st/nika/issues/597)) ([f5bb3f819](https://github.com/supernovae-st/nika/commit/f5bb3f81960d4edbacbbe6bec9a1ee0177f45dfc)) ([#597](https://github.com/supernovae-st/nika/pull/597))
- **schema** — W1 the map — workflow object + task map keyed by id ([#581](https://github.com/supernovae-st/nika/issues/581)) ([35f8604ac](https://github.com/supernovae-st/nika/commit/35f8604acf9d1e06ebcf7463d6d8c2fdb1ad21b3)) ([#581](https://github.com/supernovae-st/nika/pull/581))
- **schema** — W2 the flow — two doors, one graph, the gate names its refusal ([#588](https://github.com/supernovae-st/nika/issues/588)) ([21e515684](https://github.com/supernovae-st/nika/commit/21e51568457fcbcdf07f6601fc8ffd05924c1104)) ([#588](https://github.com/supernovae-st/nika/pull/588))
- **types** — W3 the contract — one type core, three relations, typed doors ([#592](https://github.com/supernovae-st/nika/issues/592)) ([249c996c8](https://github.com/supernovae-st/nika/commit/249c996c8d0f5c870270bc66940302b874e46ae1)) ([#592](https://github.com/supernovae-st/nika/pull/592))
- Nika-sandbox-landlock, the Linux command-sandbox twin ([#630](https://github.com/supernovae-st/nika/issues/630)) ([413133719](https://github.com/supernovae-st/nika/commit/413133719159a9d6b5e07dfc6c59e75171e1965d)) ([#630](https://github.com/supernovae-st/nika/pull/630))

### 🐛 Bug Fixes
- **ci** — The trust battery fixture speaks the map surface ([66f1d39b0](https://github.com/supernovae-st/nika/commit/66f1d39b067178568306a802ef49b3a0d84a67a3))
- **hooks** — Deletion-only pushes skip the pre-push gate ([#590](https://github.com/supernovae-st/nika/issues/590)) ([2906ffabc](https://github.com/supernovae-st/nika/commit/2906ffabcc65690af6e77a19ccd5b18e1ae5a7e5)) ([#590](https://github.com/supernovae-st/nika/pull/590))
- **kit** — The new command frontmatter parses — invalid yaml dies at the source ([#583](https://github.com/supernovae-st/nika/issues/583)) ([ff0cba5b8](https://github.com/supernovae-st/nika/commit/ff0cba5b85b73d551ba1fec2dad4928f823f20de)) ([#583](https://github.com/supernovae-st/nika/pull/583))
- **tests** — The oracle fixtures speak argv — the 565×570 merge race paid ([#573](https://github.com/supernovae-st/nika/issues/573)) ([d1458743e](https://github.com/supernovae-st/nika/commit/d1458743ee06301995d0e2dd59b86dde6f41f6ef)) ([#573](https://github.com/supernovae-st/nika/pull/573))

### ⚡ Performance
- **lsp** — The downstream walk goes one-pass — hover sheds its x20 slope ([#580](https://github.com/supernovae-st/nika/issues/580)) ([0b0be55a0](https://github.com/supernovae-st/nika/commit/0b0be55a01263a08c8f4e2b784e51280468c91be)) ([#580](https://github.com/supernovae-st/nika/pull/580))

### 📚 Documentation
- **adr** — Related reciprocity — the 4 one-way arrows answer back ([#587](https://github.com/supernovae-st/nika/issues/587)) ([da81e4f7e](https://github.com/supernovae-st/nika/commit/da81e4f7e649f9f7ee0df657a51091fa37dde4e7)) ([#587](https://github.com/supernovae-st/nika/pull/587))
- **agents** — Mcp oracle is 9 tools · fold dead verbs · exit-4 paused ([#622](https://github.com/supernovae-st/nika/issues/622)) ([22f18ab09](https://github.com/supernovae-st/nika/commit/22f18ab090f53f3068b3b6fe5ad3e99b6cbae497)) ([#622](https://github.com/supernovae-st/nika/pull/622))
- **changelog** — The union-rebase double Added folds to one ([d8feac8db](https://github.com/supernovae-st/nika/commit/d8feac8db0d3bd4010295fd7695b2afea2b06449))
- **changelog** — Append v0.104.0 — auto-generated ([#604](https://github.com/supernovae-st/nika/issues/604)) ([5ed6c4a27](https://github.com/supernovae-st/nika/commit/5ed6c4a279ae14d2c738deb82ab0f91a4db8fa0b)) ([#604](https://github.com/supernovae-st/nika/pull/604))
- **cite** — The citation cross-references the spec — additive only ([#636](https://github.com/supernovae-st/nika/issues/636)) ([7b22ee5ce](https://github.com/supernovae-st/nika/commit/7b22ee5ce4822125c8b9efdab4871010708b06c3)) ([#636](https://github.com/supernovae-st/nika/pull/636))
- **crate-spec** — The gate-3 verb tree drops the phantom pack ([#629](https://github.com/supernovae-st/nika/issues/629)) ([58ce0d5f9](https://github.com/supernovae-st/nika/commit/58ce0d5f914beef245aa8956a78d549d1914d149)) ([#629](https://github.com/supernovae-st/nika/pull/629))
- **crate-specs** — The teaching surfaces say graph_format 2 ([#589](https://github.com/supernovae-st/nika/issues/589)) ([86d1f2d20](https://github.com/supernovae-st/nika/commit/86d1f2d2080b4c2d9d98d99d608d6d6643ef89da)) ([#589](https://github.com/supernovae-st/nika/pull/589))
- **crate-specs** — Nika-cli exit-4 paused · fold graph/schema residues ([#625](https://github.com/supernovae-st/nika/issues/625)) ([d62a5ec71](https://github.com/supernovae-st/nika/commit/d62a5ec713069b58a68661b99034dc0abd2867b5)) ([#625](https://github.com/supernovae-st/nika/pull/625))
- **kit** — The plugin readme counts nine — nika_inspect joins at the source ([#584](https://github.com/supernovae-st/nika/issues/584)) ([ccc38b425](https://github.com/supernovae-st/nika/commit/ccc38b4254c494b7d73fdb83191f1d97a7e7371e)) ([#584](https://github.com/supernovae-st/nika/pull/584))
- **rules** — Skills check invocation is /spn-powers:system:yo ([b6c9dff6d](https://github.com/supernovae-st/nika/commit/b6c9dff6dbcaf3ccab70fd680b03085359ff7d5d))

### 🧪 Tests
- **nika-schema** — E-diff static battery pins boundary and inference ([#635](https://github.com/supernovae-st/nika/issues/635)) ([d959ce2e5](https://github.com/supernovae-st/nika/commit/d959ce2e527b90150ac345af59c4dc72c3f93e87)) ([#635](https://github.com/supernovae-st/nika/pull/635))
- **runtime** — Boundary differential — check and runtime agree on exec permits ([#620](https://github.com/supernovae-st/nika/issues/620)) ([783b346da](https://github.com/supernovae-st/nika/commit/783b346dae2353af547e0352050d40b11c61a6b7)) ([#620](https://github.com/supernovae-st/nika/pull/620))
- **schema** — Fuzz the permit checker and the infer-permits surface ([#624](https://github.com/supernovae-st/nika/issues/624)) ([cf9d3f105](https://github.com/supernovae-st/nika/commit/cf9d3f1057651e67df16503f6f4b2492890dd8f5)) ([#624](https://github.com/supernovae-st/nika/pull/624))
- Fs boundary differential — check and runtime agree on canonical globs ([#627](https://github.com/supernovae-st/nika/issues/627)) ([7bb0395cb](https://github.com/supernovae-st/nika/commit/7bb0395cb03bd195b4b34a4b4deefc0fcbc3140c)) ([#627](https://github.com/supernovae-st/nika/pull/627))

### 📦 Build
- Install bubblewrap so the landlock jail proof runs ([#632](https://github.com/supernovae-st/nika/issues/632)) ([5c95a59b6](https://github.com/supernovae-st/nika/commit/5c95a59b6ca8b05a31bdedf352a8e345451165b6)) ([#632](https://github.com/supernovae-st/nika/pull/632))
- Msrv gate + CODEOWNERS + Scorecard badge ([#634](https://github.com/supernovae-st/nika/issues/634)) ([1be89dc9e](https://github.com/supernovae-st/nika/commit/1be89dc9effb1f7969b76a8a5e62a8fad6e8b90c)) ([#634](https://github.com/supernovae-st/nika/pull/634))

### 🧹 Chore
- **ci** — The spec pin becomes a file — one mechanism across the estate ([#577](https://github.com/supernovae-st/nika/issues/577)) ([c6d743353](https://github.com/supernovae-st/nika/commit/c6d74335398956d4dd4669c0b0ed925636019cd4)) ([#577](https://github.com/supernovae-st/nika/pull/577))
- **ci** — Nika-lints joins the public-api floor — the 50th lock ([#591](https://github.com/supernovae-st/nika/issues/591)) ([1ab3e53f5](https://github.com/supernovae-st/nika/commit/1ab3e53f5e995b20179e309b4078f5d2b0984660)) ([#591](https://github.com/supernovae-st/nika/pull/591))
- **ci** — The refonte splits join the public-api floor — 53/53 ratchet closed ([#600](https://github.com/supernovae-st/nika/issues/600)) ([c39b85f8c](https://github.com/supernovae-st/nika/commit/c39b85f8c55afd59b5d74eb6f47c09afce624174)) ([#600](https://github.com/supernovae-st/nika/pull/600))
- **pack** — The pack follows the spec — 1eddca9 (pack-resync) ([#601](https://github.com/supernovae-st/nika/issues/601)) ([b9839ed33](https://github.com/supernovae-st/nika/commit/b9839ed33dcb4b8127e46c84a430511762b0b84b)) ([#601](https://github.com/supernovae-st/nika/pull/601))
- **spec-pin** — The tests leg follows the spec — 1eddca9 ([#602](https://github.com/supernovae-st/nika/issues/602)) ([1bab0d554](https://github.com/supernovae-st/nika/commit/1bab0d55428a3ce7ccd796757a2dbd9be404976b)) ([#602](https://github.com/supernovae-st/nika/pull/602))

## [0.104.0](https://github.com/supernovae-st/nika/compare/v0.103.0..v0.104.0) - 2026-07-17

### ✨ Features
- **providers** — Moonshot joins the canonical catalog (17) — kimi priced ([16c9ae9bd](https://github.com/supernovae-st/nika/commit/16c9ae9bd0da58718fabfc5efc451af552d8c5cc))

### 🐛 Bug Fixes
- **lsp,graph** — Fixtures speak argv — five tests shipped red at the tag ([faac6a5b8](https://github.com/supernovae-st/nika/commit/faac6a5b8bb6c3ccd762ea18ae9bf33d2eeb3867))
- **mcp** — Inspect fixtures speak argv — the third red crate at the tag ([8638dd1e5](https://github.com/supernovae-st/nika/commit/8638dd1e5927064e766bccd8a434c5d985a68c14))
- **mcp** — The second string-form fixture · green verified before commit ([31f4a522a](https://github.com/supernovae-st/nika/commit/31f4a522a357eebbe201d3196998dad66edc123a))
- **providers** — The profiles pin follows the role, not the number ([3b420dbd6](https://github.com/supernovae-st/nika/commit/3b420dbd6957804093d80dc6eafadd801d286a2d))

### 🧹 Chore
- **workspace** — The tag was not fmt-clean under the current rustfmt ([793f11431](https://github.com/supernovae-st/nika/commit/793f11431eec5508e25af8c3cbc300f47dce556b))

## [0.103.0](https://github.com/supernovae-st/nika/compare/v0.102.0..v0.103.0) - 2026-07-13

### Changed — BREAKING (the #75 window: the language tightens)

- **exec semantics never fork on a YAML type again** (#570 · spec#78) —
  `command:` is argv-only (execve · per-element substitution: an
  interpolated value can never break out); the NEW `shell:` field is
  the explicit dangerous door (`/bin/sh -c` · pipes/redirects · the
  blocklist attaches HERE). Exactly one of the two; a string
  `command:` rejects with the migration teaching.
- **bare `${{ tasks.X }}` is a validation error** (`NIKA-VAR-020`) —
  the task result is a record, the projection set (.output/.status/
  .error/.duration_ms) is CLOSED; the envelope is not a value.
- **the gate algebra becomes normative** (spec#78) — the when-status
  pattern is a propagation CHOICE (default gate: failure cancels the
  cascade · when-form: skip-once-then-continue), stated as a table.
- **the analyzer learns the argv world** — lints 006/007 (timeout
  wrapper · shard signature) read argv heads/tokens.

### Added

- **`nika/semanticDocument`** — the LSP's vendor-prefixed custom
  request (capability-gated via `experimental.nika`): the canonical
  `graph_format: 1` projection VERBATIM plus a span wrapper (task id →
  declaring token range). One projector, every surface — the graph
  moves to its own L0 member **`nika-graph`** (split from nika-schema
  at the 15k cap; the CLI keeps the renderers and re-exports), so
  `inspect --format json`, the LSP and future canvases read one truth.

## [0.102.0](https://github.com/supernovae-st/nika/compare/v0.101.0..v0.102.0) - 2026-07-13

### Added

- **The editor speaks the language — the LSP completes it end to end**
  (#549 · #553 · #556 · #558). The pause after a colon answers itself
  (space joins the triggers); the file teaches itself — `args:` keys
  from the tool's own schema (required first), `mode:` enums scoped to
  the enclosing tool, `${{ vars./secrets./env. }}` completions from the
  FILE's declarations, self-reference filtered (an offered cycle is a
  bug); hover cards on `tool:`/`model:`/`- id:` (the declaration reads
  its own graph — wave k/N, transitive reach, a 3-tier model
  fallback); references resolve like the graph reads — closure-aware
  jumps, `${{ }}` goto-definition to the exact declaration span.
- **`wave-sweep.sh`** — the whole release-wave version sweep, one
  pattern-anchored command (matches each carrier by ROLE, uniformity
  guard; born from the 0.101 concurrent-session misses).
- **The coherence bot watches the three drifts caught by hand**
  (action@v1 served default · starter template default · registry
  certifier pin) — with the grace ladder on the served default and a
  9/9 offline harness.

### Fixed

- **The changelog workflow heals its own stale PRs** (#555) — the
  auto-prepend guard closes superseded cliff PRs instead of stacking
  them.

## [0.101.0](https://github.com/supernovae-st/nika/compare/v0.100.0..v0.101.0) - 2026-07-13

### Added

- **The sovereign lane ships whole** (#518 · the release ruling,
  executed) — every release binary now carries `local-infer`: `nika
  model pull` → `nika model serve` → workflow `infer` against your own
  machine, no cloud, no external daemon, no build-from-source wall.
  Measured +2.4 MB. CPU on every target on purpose (darwin included):
  candle 0.10's quantized rms-norm Metal kernel is broken — a metal
  lane would die at first token. The funnel now pins the teaching:
  a feature-carrying binary must never utter « built without local
  inference ».

## [0.100.0](https://github.com/supernovae-st/nika/compare/v0.99.0..v0.100.0) - 2026-07-12

### Added
- `nika init` equips Cursor FULLY, project-side — the binary carries what
  the local plugin loader drops (it consumes MCP + skills only): the three
  kit subagents land in `.cursor/agents/`, the delegation rule in
  `.cursor/rules/`, and the three seatbelt hooks in `.cursor/hooks.json` +
  `.cursor/hooks-nika/` (exec bit set on unix). All bodies `include_str!`
  from the kit — one source, byte parity by construction; parity tests walk
  every hooks.json command back to the scaffold table (#509).

### Changed

- **One glyph table, zero-alloc live channel** (rust-pro pass) — the
  verb glyph vocabulary lives ONCE (`Theme::verb_glyph_bare` joins
  `verb_glyph`; the render-side copy dies), and the wire map's live
  channel becomes a borrowed probe (`LiveProbe = &dyn Fn(&str) -> bool`
  — a 10 Hz repaint asks the rows, it never materializes a set).

- **Less, but better: 24 verbs become 20, in six families** (operator
  Rams pass) — `graph` folds into `inspect --format json|mermaid|dot`
  (one projector, one door; `check`/`run` already draw the map),
  `schema` folds into `nika spec --schema`, `context` folds into
  `nika welcome --deep` (one mirror, two depths — the `--json` agent
  contract rides along unchanged), and `tools` folds into
  `nika catalog --tools` (one catalogue, two shelves). The COLOUR
  CHAIN is one road now: `--ascii` joins the global flags and the 23
  per-verb `--no-color`/`--ascii` twins die (`--color never` and
  `--plain` were always the umbrella — one chain, no per-verb echo).
  The help reads as the family map (make · prove · run · learn · wire
  · machine) instead of a flat 24-row wall, and every teaching surface
  (agent briefs · README · hints) speaks the new doors. Pre-1.0 · no
  aliases kept (no-legacy).

### Changed

- **The embedded pack re-syncs the taught corpus (spec #66)** — the
  binary now ships the renumbered 01-07 path (contiguous, `git mv`'d in
  spec), the six corpus bug-fixes (fetch-chain's literal recover ·
  ceo-brief's date slice · the null-safe fan-ins · the untyped
  quarantine output · config-drift's `{}` default), the offline-green
  gate lessons, the `# Needs ·` header contract, and the agent
  done-contract prompts — `nika examples` and `nika new` teach the same
  corpus the spec publishes, no drift. Engine-side foundation refs
  follow (examples/README table · run-tip fixtures).

### Added

- **The motion SSOT is parity-gated, and `test` joins the lazy door**
  — a new integration gate proves the terminal spinner constants
  mirror the vendored `design/motion.yaml` (spec #65) family by family
  (`infer·sampling` · `exec·scanline` · `invoke·roundtrip` ·
  `agent·orbit`): hand-edited drift between the CLI's motion and the
  site's tiles now dies in CI, not in a screenshot. And bare
  `nika test` resolves the workspace's only workflow exactly like
  `run`/`check` (zero→trio · several→copy-paste list) — the last
  family inconsistency at the lazy door.

- **The DAG is visible where you look** (operator: « voir la dag ! ») —
  `nika check` on a TTY now ends with the SAME themed wire art `graph
  --format ascii` speaks (the audit reads as the graph it judged;
  conformance failures skip it — no valid order exists to draw), and
  the Live run storyboard gains the LIVING MAP: one wave-column line
  under the header where every node wears its state (dim pending · the
  verb's own motion frame while running · green/red settled · `⊘`
  skipped), repainted every tick so the running node's spinner turns
  INSIDE the map. Wide runs drop ids and keep chips — the map never
  wraps. And on shapes the wire law can draw, the Live run leads every
  repaint with the FULL wire map itself (`◆ gather ───▶ ⠂ think ───▶
  · persist` — the same art as check, each node painted by its live
  state, the running node turning its verb's motion in place; the
  wave-column line stands down to it) — and the INCOMING edge pulses:
  the rail segment feeding a running node cycles density (`──╍▶` ·
  Accent) so the map shows where the run's energy flows; a still map
  is byte-stable under ticks (no idle flicker · law-tested), and the
  flow gantt's lanes wear their verb chips (`◆ discover ▕██▏` — the
  timeline speaks the same 4-verb vocabulary as the rows). The wire
  drawing itself DESCENDS to `nika-display::wires` (decoupled
  `WireGraph` — any surface with waves + deps can draw; the CLI keeps a
  thin projection bridge), freeing `nika-cli` back under the 15k wall.
  Interactive surfaces only; every sober register byte-intact.

- **One source of truth for the corpus — the loose engine copies die**
  — `engine/examples/` carried two pre-pack workflows (`pr-risk-review`
  · `image-og-pipeline`) that duplicated pack showcases from every
  angle's worst position: unversioned, unlisted, un-CI'd. Nuked; the
  folder keeps a thin pointer README (the spec pack, vendored into the
  binary, IS the gallery — `nika examples`), and the root README's
  table row runs the pack twin instead.

- **UNIFY: one street, one gesture** — the whole onboarding surface now
  reads as a single funnel. The concierge card keys its `start here`
  block on the WORKSPACE STATE (empty → the offline proof + the wizard;
  workflows without briefs → `init` adds-only; one founded workflow →
  bare `run`; several → `context` — one strong key per state, gh/bun
  law). `nika new --from` resolves EXAMPLES too (slug · filename ·
  showcase path — verbatim lessons beside the template skeletons; one
  resolution ladder, `examples copy` is the same gesture's showroom
  handle). And the founding wizard gains the sixth lane: **start from
  one example** (slug beat · Enter = `01-hello` · no model question — a
  lesson carries its own), with `nika init --example <slug>` as the
  scriptable twin. Proven end-to-end: a PTY walk of the lane and a
  first-hour smoke (copy → bare run → new-from-example → init
  --example, all green offline).

- **Bare `nika` is the concierge, and the showroom hands over the keys**
  — on a terminal, plain `nika` now answers with the welcome card (what
  this machine has · where you are · the next gesture) instead of the
  22-command wall; pipes and scripts keep the exact usage screen and
  exit 2. The missing adoption gesture ships as `nika examples copy
  <slug> [dest]` (the embedded example lands as YOUR file · next steps
  said · refuses silent overwrites · points `nika init` when no agent
  briefs sit beside it), and a green TTY `examples run` ends with the
  one-line handoff `make it yours · nika examples copy <slug>` — the
  full loop is now see → like → own → bare `nika run` finds it.

- **`nika examples run` takes `--var` and `--quiet`** — several
  examples declare required vars in their header (`04-schema-retry`
  says `--var text=…`) and the old surface had no way to pass them
  (gauntlet friction F7). `--quiet` gives the verdict-line register;
  the TTY pre-display keeps its Live-only gate.

### Added

- **`nika init` becomes the founding wizard** — bare on a terminal it
  converses (the clack-school rail): pick a project **recipe**
  (`agentic` — the 4-pattern curriculum chain → fan-out → gate → agent
  loop · `starter` · `ship` · `content` · `minimal`), the model
  (catalog-derived · local first · Enter = the offline mock), the VS
  Code DAG **canvas theme** (`nika.dag.theme` stamped into the created
  `.vscode/settings.json`), and which agent clients to **wire** to the
  MCP oracle — then scaffolds, audits every scaffolded workflow on the
  spot (audit-before-run inside the first minute), and hands over a
  ready panel. Every recipe workflow is an embedded template VERBATIM
  through the same stamp `nika new` uses, so the own-corpus law (a
  fresh scaffold checks clean) is inherited, never re-proven. The
  scriptable twins: `--recipe <name>` · `--theme <nika|editor|
  phosphor|auto>` · `--wire <client,…>`; plain `--yes` keeps the
  historical report byte-for-byte, and every question is asked BEFORE
  the first write (cancel = « nothing written », honestly).

- **The verb identity column reaches the terminal** — the four verbs
  paint their tokens-SSOT glyphs (`◇` infer · `▷` exec · `◆` invoke ·
  `✦` agent · ASCII twins `i $ @ *`) in a bright-band ANSI slot
  (identity vocabulary · never colliding with a verdict hue — the
  user's terminal theme still owns every color): `nika inspect` wave
  boxes and single rows, the `nika graph --format ascii` wire art, and
  `run --dry-run` (which now renders the same themed anatomy). The
  graph ascii art finally inherits the binary's ONE color chain instead
  of a forced monochrome — pipes stay escape-free by resolution, TTYs
  see the art they were owed.

- **`nika run` breathes while it thinks** — the Live storyboard gains
  real spinner ticks: a timer rider advances the braille phase (~10/s)
  while a task is running, so a long `infer`/`agent` await animates
  instead of freezing between settles. Live + motion only (the
  reduced-motion env, `--no-progress`, pipes, CI and `--json` never
  tick — every sober register keeps byte-identical output), and the
  frame still repaints inside one DEC-2026 synchronized frame.

- **`nika examples` becomes the organized corpus** — the flat slug dump
  grows into the taxonomy: « the path » (the 7 foundation steps · FULL
  `.nika.yaml` filenames · each file's own header title · verb chips ·
  what you see is what you type) then the showcase grouped T1→T4
  (starters · daily ops · parallel intelligence · autonomous). Every
  fact derives from the example file itself at call time (header +
  line scan — no engine catalog to rot). `show` frames the anatomy
  (file · title · verbs · task count) over the VERBATIM body and hands
  the run command; `run` PRE-DISPLAYS the source on a TTY before the
  first token (the lesson before the spend — pipes byte-unchanged).

- **`nika init` recipes ship their index** — every workflow set writes
  a generated `workflows/README.md` (the curriculum in order: file ·
  what it teaches from the template's own header · per-file check/run
  commands); the proof ladder audits workflows only. `nika tools`
  speaks the rail (categories as heads · names strong · teaching cuts
  dim).

- **`nika-onboard` — the onboarding surface becomes its own member**
  (the 15k prod-LOC wall broke at 16,027: base main sat 12 under, the
  founding wizard crossed it — per D-2026-07-09-N1 the unit descends,
  the `nika-display`/`nika-dap`/`nika-tmpl` precedents). `nika new`'s
  guided flow + `nika init`'s founding body (briefs · recipes · wizard)
  now live in `crates/nika-onboard`; the composition root keeps thin
  adapters that inject the two REAL effects (the check ladder · the MCP
  wiring) — the member converses and scaffolds, the root owns what
  proving and wiring mean. Zero observable change on every surface.

- **`nika-display` grows the structural chrome vocabulary**
  (`chrome.rs`): the wizard rail (`◆ │ └` · ASCII twins), the rounded
  panel with frame-true width math, the segment progress bar with its
  half-cell frontier, the 3-line identity banner (no figlet walls), and
  the dither pulse that only exists where motion does — every shape
  colour-through-Role only, 2-cell law, zero escapes when colour is
  off.
- **LSP code actions — the `--fix` engine in every editor**: the language
  server now answers `textDocument/codeAction` with quickfix renames
  built from the checker's typed `offending`/`suggestion` pairs (unknown
  fields · tools · args · rename-shaped conformance findings). Same
  discipline as `nika check --fix`: did-you-mean only, unique-token
  only — an ambiguous or suggestion-less finding offers nothing. One
  fix engine, projected; VS Code, Cursor, zed, helix and neovim get the
  one-click repair the terminal already had.

### Fixed

- **`on_error.recover` awaits a no-edge referent's terminal state**
  (spec 05 §recover · #291 #402) — a same-wave `recover: ${{ tasks.X.output }}`
  used to race dispatch and fail `NIKA-VAR-001` whenever the referent had
  not settled yet. Recoveries now park on the settle spine and retry as
  referents turn terminal; a workflow-end pass resolves mutual-recovery
  cycles against each side's pre-recovery failed record (history never
  rewrites). Deterministic by construction: the park table only moves on
  the sequential settle spine — the event stream stays byte-identical
  across parallelism caps.
- **A settled sibling's frames reach the trace at ITS settle, not the
  wave join** (#412) — a `kill -9` mid-wave used to lose the resume
  credit of every sibling that had already finished on the console (the
  journal held `task_scheduled` only), so `--resume` re-ran — and
  re-billed — finished work. Settles now stream through the ordered
  spine; total event order is unchanged, only the timing moves earlier.
- **Swapping the envelope `model:` re-runs a model-less infer on resume**
  (#409) — the effective default model (`--model` override, else the
  envelope line) joins those tasks' resume identity, so a model swap can
  no longer cache-hit the OLD model's output. Tasks pinning their own
  `model:` and exec tasks never re-key; older traces simply re-run once.
- **A token-burning empty answer warns on the console** (#410) — a
  thinking model that spends its whole budget inside the think block and
  settles green with "" now speaks: the OBS-E oracle covers the
  unreported-split shape (the ollama path strips thinking upstream), and
  the display renders `⚠ <task> · <warning>` above the meter on the
  final frame and the streamed close — a green run no longer silently
  feeds the empty string downstream.
- **The example rescue tip keys on the failure kind** (#145) — an exec
  `program not found` used to earn the mock-model nudge (a swap that
  cannot conjure a missing binary). Infer/provider failures keep the
  offline-preview tip; a missing program names the real dependency.
- **`nika:convert` joins the native-first/005 inventory** (#475) — the
  check hint's helper-script inventory named every native lane except
  the one that parses; "my input is YAML/CSV/TOML" was the single most
  common reason a sidecar survived it. One clause (spec row paired in
  nika-spec#64); the test pins the lane.

- **Every trace reader resolves the names `trace ls` prints** — `show` ·
  `replay` · `outputs` · `verify` · `export` · `peek` · `flow` accept the
  bare store name exactly like `rm` always did (an explicit path still
  wins · unknown handles keep their teaching error). Copy-pasting a name
  from `ls` into `show` no longer answers "No such file or directory".
- **The MCP `nika_explain` teaches the runtime namespaces** — per-builtin
  (`NIKA-BUILTIN-<NAME>-<NNN>`) and per-provider (`NIKA-PROVIDER-<NNN>`)
  codes answer over the agent lane with the same text the CLI gives (the
  teaching moved down to `nika-error::codes::namespace_help` — one text,
  one home), instead of "unknown code" on exactly the codes a failed run
  hands an agent.

- **`nika:glob` walks its pattern's literal directory prefix** — a scoped
  pattern (`hiring/inbox/*.md`) now anchors its walk (and the
  `permits.fs.read` gate that fences it) at `./hiring/inbox` instead of
  the whole cwd, so a least-privilege boundary like
  `read: ["./hiring/inbox/**"]` accepts the glob that stays inside it
  (previously: `NIKA-SEC-004` on the `.` walk root — the
  `t3-resume-screener` showcase could never run). Returned paths keep
  the exact historical `./…` byte shape (run traces and registry
  oracles hash them); a missing prefix directory yields `[]` uniformly
  (absolute patterns errored before); the SEC-004 refusal now names the
  real walk root.

### Changed

- **The openai showcase seats leave 2024** — the catalog's two openai
  showcase models are now `gpt-5.2` (default) and `gpt-5-mini` (cheap),
  matching the live API's current family and the spec's teaching
  surface (both already priced + capability-mapped; `gpt-4o` and every
  other live id keeps working verbatim through provider pass-through —
  proven with a live `openai/gpt-5.2` run, 780ms · $0.000098).

### Added

- **`nika model pull/list/rm` — first-class Hugging Face acquisition for
  the native path** ([#146](https://github.com/supernovae-st/nika/issues/146)):
  one command from the Hub to a sovereign in-process run. `pull
  owner/repo[:QUANT]` resolves the repo's file tree first (sizes BEFORE
  any byte moves; 2 GiB and over confirms, `--yes` for CI), streams the
  GGUF over the house `nika-http` seam (rustls · SSRF floor · per-hop
  redirect vetting — no `hf-hub`/`ureq` second HTTP stack), resumes an
  interrupted transfer from its `.part` via `Range:`, and brings
  `tokenizer.json` along — the exact sibling layout the serve loader
  wants. ONE canonical models dir (`~/.nika/models/<owner>/<repo>/`):
  the downloader and the resolver share it by construction (the
  brouillon-era pull/load two-dir mismatch cannot re-happen), so `nika
  model serve --model owner/repo[:QUANT]` now resolves pulled ids (and
  bare file stems) — a real path still passes straight through.
  `list` prints the dir once with id · size · file rows; `rm` reclaims
  a whole repo or one quant (sweeping a gguf-empty dir) and refuses a
  no-match WITH the installed list as the teaching surface. `HF_TOKEN`
  authenticates gated repos (the Hub answers 401 for missing repos too
  — the refusal names both lanes). `nika doctor` grows the models row:
  dir + count + bytes once anything is pulled (any build), and a
  teach-pull advisory on a sidecar build with nothing to serve. The
  fetch is CLI-level, like `registry:` pulls — a workflow's `permits:`
  never govern it. Acquisition only: the candle runtime owns
  loading/generation (ADR-091/093). The whole unit ships as the
  `nika-models` member (store · pull · serve glue) per D-2026-07-09-N1
  — `nika-cli` sat at 14,958 of the 15,000 prod-LOC cap and keeps thin
  exit-contract adapters at the unchanged public paths (the
  `nika-onboard`/`nika-display`/`nika-dap` descents' wall, the same
  house way).

- **The one earned ask: welcome + init grow the community line** (#498 —
  the traction baseline showed installs running 2.5x ahead of stars
  because the product never asks). `nika welcome`'s footer gains a third
  door on its `learn:` line (`⭐ github.com/supernovae-st/nika`, OSC-8
  linked) and `nika init`'s NEXT_BLOCK closes with the one-line ask.
  Once per surface, additive to the #158 script-stable lines, JSON
  outputs untouched — working commands (check · run) stay marketing-free
  by doctrine.

- **`nika examples run` carries the run trio** — `--var KEY=VALUE`
  (repeatable · the `nika run` contract), `--no-progress` and
  `--max-cost-usd <n>`, threaded through the same funnel `run` uses.
  Examples with `required:` vars (`19-schema-retry`) were unrunnable by
  this surface — and clap's `-- --var` tip pointed at a trailing lane
  that never existed.

- **Pre-generated shell completions ride the release tarballs** (#487)
  — each platform tarball now carries `completions/` (bash `nika.bash` ·
  zsh `_nika` · fish `nika.fish`), generated by the exact binary being
  packaged and gated non-empty before tar. Distro packages (AUR
  `nika-bin` · future nixpkgs/apk) can `install -Dm644` them without
  executing the target-arch binary in `package()` — the aarch64-on-x86
  packaging law. Packaging only, zero engine change.

- **Cursor first-class: the plugin kit gains its native format + `init`
  wires the MCP** — the agents kit (`.agents/plugins/nika/`) now ships a
  `.cursor-plugin/plugin.json` (Cursor's marketplace manifest: logo ·
  rules · skills · agents · commands · hooks · mcpServers), the
  `nika-author` subagent (the route → instantiate → fill-SLOTs → check →
  repair protocol as an agent definition), a `check-on-edit` hook
  (afterFileEdit on `*.nika.yaml` runs `nika check` — capability-honest:
  missing binary skips, never blocks), the language rule as a bundled
  file (extracted byte-identical from the `init` template), and the
  brand logo. Both existing plugin manifests bump to 0.3.0 together
  (the marketplace mirror gate pins the agreement) and the engine-root
  Claude marketplace catches up from its stale 0.1.0 two-tool
  description. `nika init` now also writes a project-scoped
  `.cursor/mcp.json` (the read-only 8-tool oracle reaches Cursor's
  agent with zero manual setup — same skip-if-exists discipline as
  every scaffold file).

- **`nika wire` wave-3b: `cline` + `continue`** (#449 — closes the
  ranked list). Cline: Cursor-style `mcpServers` record; the resolver
  picks a host IDE's EXISTING `saoudrizwan.claude-dev` globalStorage
  file (VS Code · Cursor · Windsurf · VSCodium · Insiders — the live,
  chokidar-hot-reloaded one), else the stable
  `~/.cline/data/settings/cline_mcp_settings.json` (the CLI's home
  today and the extension's after its in-flight migration). Continue:
  an OWN-FILE write at `~/.continue/mcpServers/nika.json` (the
  Claude-Desktop JSON shape its drop-dir scans) — the user's
  comment-bearing `config.yaml` is never touched, and the verdict line
  carries the reload hint (external drop-dir writes are not
  hot-reloaded). Both ride `wire all` (15 targets).

- **`registry:owner/name[@version]` refs on `check` and `run`** — the
  registry's 22 certified artifacts become consumable from the CLI:
  `nika check registry:supernovae-st/competitor-radar` audits a
  stranger's workflow before it ever touches your workspace, and `run`
  rides the same seam. The resolution is the registry-v0.1 trust chain,
  native: index → advisory MUST-refuse (`NIKA-REG-002`) → entry TOML
  re-verification (never the index alone; disagreement refuses,
  `NIKA-REG-005`) → raw https fetch capped at 1 MiB → sha256 must equal
  the pinned digest or nothing is written (`NIKA-REG-003`). Verified
  bytes cache under `~/.nika/registry/<owner>/<name>/` beside their
  digest record — a cache hit re-verifies and runs offline; a bare ref
  pins its version at first resolve and never floats. Nothing executes
  at pull time: the fetched file feeds the SAME audit-before-run
  pipeline as any local path, and a workflow's `permits:` govern its
  run, never this CLI-level fetch (the help text says so). `--fix`
  refuses registry refs (a digest-pinned artifact stays read-only —
  copy it to edit). The `nika add` install verb, org indexes
  (`--index`) and `nika.lock` stay on the ADR-106 lane (#452).

- **`graph --format mermaid` paints verb identity** — nodes carry their
  verb class and the diagram ends with the SAME classDef map every
  projected docs page uses (the shared visual vocabulary: spec
  `design/tokens.yaml`, vendored into the pack as `design-tokens.yaml`
  and exposed via `nika_pack::design_tokens()`). Byte-parity with the
  spec's showcase projector (`fill = color + 22` alpha · only drawn
  verbs get a classDef); a parity test pins the renderer's consts to
  the vendored tokens, so a spec-side hue change stays red engine-side
  until the table follows. Terminal output untouched — chrome remains
  ANSI-16 semantic (#464).

- **`nika wire` wave-3a: `claude-desktop` + `qwen`** (#449). Claude
  Desktop was the double gap — a different app with a different config
  file than Claude Code's `~/.claude.json`: the writer targets
  `claude_desktop_config.json` under the platform app-config dir
  (macOS `~/Library/Application Support/Claude/` · Windows
  `%APPDATA%\Claude\` · Linux `~/.config/Claude/`), `mcpServers` root,
  idempotent, unrelated servers preserved. Qwen Code (gemini-cli fork)
  reads the same `mcpServers` key from `~/.qwen/settings.json`. Both
  ride `wire all`. Cline/Continue remain on #449 (wave-3b — variant
  paths and YAML-list shapes verified first).

- **`nika model serve` — the sovereign sidecar's launch surface** (the
  ADR-091/093 rung `nika model pull` (#146) sequences after). A build
  with `--features local-infer` serves a Qwen3-family GGUF as a
  loopback OpenAI-compatible server, in the foreground (Ctrl-C stops
  it · one generation at a time): `nika model serve --model
  <path.gguf> [--tokenizer <path>] [--port 8712] [--model-id <id>]` —
  the tokenizer defaults to `tokenizer.json` beside the weights, the
  id to the file stem. Zero new dispatch seam: a workflow reaches it
  through the existing local base-URL lane (`export
  NIKA_LLAMACPP_BASE_URL=http://127.0.0.1:8712` · `model:
  llamacpp/<id>`). The DEFAULT binary keeps the subcommand and refuses
  with the build recipe (exit 3 · zero inference deps linked), and
  `nika doctor` gains a `sidecar` row exactly when the feature is
  built in.

- **An exact loopback literal in `permits.net.http` clears the SSRF
  floor for that host** (#395 · the ADR-092 secrets-`egress:`
  precedent: the owner's explicit act, co-located with the boundary).
  Qualifying literals: `localhost` · a `127.x.y.z` v4 literal · `::1`
  (bracketed `[::1]` accepted) — NEVER a glob, never the `*.localhost`
  family, never RFC1918/link-local/CGN/metadata (those stay
  floor-blocked even when named). The clearing is exact-host and
  host-level (ports don't participate in permits): a permitted
  `localhost` reaches its own resolved `127.0.0.1`/`::1`, while a
  rebind of that name to any other blocked range, a redirect hop to an
  un-permitted floor host, and a public DNS name resolving to loopback
  (`mylocal.dev` → `127.0.0.1`) all still refuse — the declassification
  is the literal in the file, never the resolution. check≡run same-PR:
  the floor-parity pass stops flagging the permitted literal
  (NIKA-SEC-005) and the dead-grant flag skips it; the clearing is
  stated instead — an informational line in the PERMITS panel and a
  `permits.notes` entry in the JSON report. `--infer-permits` still
  NEVER writes a loopback grant (the explicit act stays the author's);
  its honesty note now teaches the opt-in.

- **`nika check --fix` — the in-binary repair loop.** The ladder's typed
  did-you-mean suggestions become one keystroke (the `clippy --fix` /
  `eslint --fix` shape): typo'd fields (`promt:`), tools (`nika:raed`),
  args (`inpit` · the `expr`→`expression` prefix rung), `depends_on`
  targets and `${{ }}` references (fully qualified — a splice never
  strips the namespace) are renamed in place and the file re-audited
  until the loop converges. Safety over reach: typed suggestions only
  (never scraped from prose), a token must be unique in the file as a
  whole word (ambiguity is skipped with a note — a skip stays retryable
  across rounds, so the two-site case heals: the qualified reference
  first, the bare token once it stands alone), zero applied repairs =
  zero write, and the publish is temp-sibling + rename (POSIX-atomic ·
  a crash or full disk never truncates the workflow). Do-no-harm proved
  over the whole 147-workflow battery corpus: 0 files rewritten, 0
  phantom repairs. The scaffolded teaching surfaces (`nika init`'s
  AGENTS.md · copilot · CLAUDE.md · cursor rule · agent skill) all name
  the flag, pinned by a parity loop so a future capability cannot miss
  the scaffold train (#434 · #444 · #446 · #450).
- **Software Heritage badge.** The repository is archived at Software
  Heritage (save request accepted 2026-07-11 · the archive re-crawls on
  its own cadence); the README badge links the archived origin — the
  permanent, vendor-independent copy of the source.

- **Official Docker image on GHCR** — the release workflow builds and
  pushes `ghcr.io/supernovae-st/nika` (multi-arch linux/amd64 + linux/arm64 ·
  tags `latest` + semver). The image is fed from the SAME linux tarball
  artifacts the release ships — never a rebuild — so its binary is
  bit-identical to the tarballs the funnel e2e + trust battery already
  gated. The entrypoint is the whole CLI: `docker run --rm
  ghcr.io/supernovae-st/nika --version`, and `docker run -i --rm
  ghcr.io/supernovae-st/nika mcp` serves the read-only MCP oracle.
  (#442 — two rival rails from the same-day trains #463/#465 collided as
  a duplicate `jobs.docker` key that would have killed the next release
  at parse time; the artifact-fed rail survives, the rebuild rail and
  its `docker/Dockerfile` are gone.)

### Fixed

- **The same provider failure now speaks ONE error language on both
  verbs** (#468): the agent loop's mid-loop provider failure surfaced
  as a bare-numeric `NIKA-463` — outside the spec's namespace grammar,
  so `nika check` rejected it in `on_codes:` and no retry/recover
  filter could ever match the agent path — while `infer` surfaced the
  same 408 as `NIKA-INFER-001`. The agent's chained failures now carry
  the spec's shared classes on the wire: provider call → `NIKA-INFER-001`,
  final-message `schema:` gate → `NIKA-INFER-002` (the namespace follows
  the failure class, not the hosting verb — the spec's own `NIKA-SEC-002`
  precedent). `retry.on_codes: [NIKA-INFER-001]` now catches provider
  failures on BOTH verbs; the internal registry identities (463/464 ·
  `nika explain`) are unchanged.
  verb · 2026-07-11): a standalone `nika:compose` passed `check` but
  the runtime refused it (COMPOSE-001) — the loop-only rule joins the
  one shape table both surfaces read, beside its sibling `nika:done`;
  the `when:` shape teaching (`NIKA-VAR-005`) routes by declared shape
  — the bool route leads (`x == true` · `!x`), since the old
  comparison examples applied to a declared boolean traded VAR-005 for
  the no-coercion type error; and the PERMITS panel leads each row
  with the wire code (`[NIKA-SEC-004 · tools]` · floor rows
  `[NIKA-SEC-005 · net]`), so every panel is `nika explain`-able.
  Re-verdict vs the fixed binary: 36/36 (#458).
- **`nika:chart` and `nika:tts_generate` were invisible to the effect
  classification** — a chart/tts write outside the boundary passed the
  static scan and failed only at runtime, and `--infer-permits` wrote a
  boundary the run then REFUSED (the self-refusing class the analyzer
  forbids everywhere else). Both media graduates now classify: chart's
  permit-gated `out` write (plus its `compile_to` vega `.vl.json`
  sibling — one shared derivation, matching the runtime byte for byte)
  and tts's recursive `output_dir` write (the image_generate shape).
  Escape scanning, boundary inference and the per-task graph `permits`
  attribution all speak them now.

- **`graph --format json` fills the per-task `permits` attribution** —
  the field the projection declared as its contract (empty since #367)
  now carries each task's pinnable capability effects: `exec: <prog>`
  (or `exec: true` when dynamic) · `fs.read:`/`fs.write: <path>` ·
  `net.http: <host>` · `tool: <ref>` — deterministic order, the same
  effect walk `--infer-permits` aggregates into the workflow boundary,
  un-aggregated (`nika_schema::check::task_permits`). Effects too
  dynamic to pin project nothing (the check's escape lane owns that
  story — a projection never guesses). Graph clients that already read
  the field (the nika-vscode `▦ N` card chip) light up with no client
  change.

- **`graph --format json` projects the declared POLICY** — nodes gain
  `retry_max_attempts` · `timeout_ms` · `on_error`
  (`recover`/`skip`/`fail_workflow`) · `outputs` (declared binding
  names, source order). Additive, absent when undeclared
  (skip-serializing — no fake defaults), `graph_format` stays 1 per the
  tolerance contract. One voice: canvas/graph clients read the DECLARED
  policy from the projection instead of re-parsing the YAML for it (the
  nika-vscode dense cards were regex-reading these four facts
  client-side — that read becomes the pre-0.99 fallback).

- **`llms-install.md` gains the bare-metal lane · `context7.json` steers
  the retrieval surface.** The install runbook now covers the box with no
  package manager: release tarball + `SHA256SUMS` verify, with version
  discovery via the releases web redirect instead of the GitHub API
  (anonymous `api.github.com` rate-limits to 403 in shared/CI
  environments — hit live while proving this lane; the whole flow was
  then proven curl-only end to end). `context7.json` is the owner config
  Context7 reads when the repo is indexed: it points parsing at the
  teaching surfaces (docs · examples · spec pointers, engine internals
  excluded) and rides four authoring rules along every retrieval — the
  check-first loop, provider/model form, unpriced-never-free, and
  never-invent-builtins.

- **`llms.txt` lists `llms-install.md`.** The agent on-ramp's « Start
  here » now includes the install runbook — an agent landing on the raw
  repo finds the install lane before the authoring contract.

- **Agent-facing repo metadata: `llms-install.md` · `CITATION.cff` ·
  `ADOPTERS.md`.** `llms-install.md` is the install runbook written FOR
  an AI agent (the file Cline-class installers read): package-manager
  paths only in the agent lane — brew · `cargo binstall --git` · nix —
  each checksum-verified by its own flow, the shell script stays the
  human lane (the same line the skill-guard hardening drew). Verify ·
  prove offline (`nika examples run 01-hello --model mock/echo`) · wire
  MCP · uninstall clean. `CITATION.cff` makes GitHub's « Cite this
  repository » box work and is the metadata Zenodo reads at archive
  time — version/date deliberately not hand-written (releases stamp
  them); CITATIONS.md keeps crediting the research Nika builds on — the
  two files answer different questions. `ADOPTERS.md` seeds the public
  adopters table (one-line-PR invitation · « runs with nika » badge).

- **`nika check` audits several files in one call.** `nika check a.nika.yaml
  b.nika.yaml …` runs the full per-file ladder on each (every report keeps
  its own header), no stop-at-first — a broken file mid-list exits with the
  worst spec-§4 code while the files after it still audit. The single-file
  invocation is byte-identical to before, and the machine modes stay
  one-file-per-call: `--json` (`report_version: 1` is a per-file contract)
  and `--infer-permits` with several files refuse with a teach line
  (exit 3 — the invocation is wrong, no file was judged). This is the
  pre-commit/CI shape: the framework passes every staged match in one
  argv, and the hook manifest now points straight at the binary — the
  fan-out wrapper the manifest shipped with (#407) is gone before it
  ever reached a tag.
- **`.pre-commit-hooks.yaml` — `nika check` as a pre-commit hook.** The
  standard manifest the [pre-commit](https://pre-commit.com) framework
  reads from a hooked repo (actionlint · shellcheck-py · ruff all ship
  one): every hooked repo audits its staged `*.nika.yaml` at commit
  time. `language: script` with a fan-out wrapper because `nika check`
  audits ONE file per call (its report is a per-file contract) while
  pre-commit passes every staged match in one argv — each failing file
  reports in the same run and the worst spec-§4 exit survives (proven
  against the released binary: a broken file mid-list exits 2, the
  files after it still audit). The `nika` binary is assumed on PATH,
  the same trade actionlint's system hook takes. Unblocks the
  pre-commit.com listing once tagged (#407).
- **`nika wire gemini|lmstudio|junie` — wave-2 wire targets.** Three more
  hosts join the explicit, idempotent MCP wiring (#384, sibling of #330):
  Gemini CLI (`~/.gemini/settings.json` — the shared settings file, every
  unrelated key preserved), LM Studio (dedicated `mcp.json`, with the real
  macOS location honoured when the app keeps it under `~/.cache/lm-studio/`
  — upstream docs and reality disagree, lmstudio-bug-tracker#1371), and
  JetBrains Junie (project-scope `.junie/mcp/mcp.json`). Same laws as
  wave 1: create-or-repair, stale-argv migration, other servers untouched,
  `wire all` covers them. Cline stays marketplace-side by design.
- **`nix run github:supernovae-st/nika` — the flake install path.** A
  root `flake.nix` builds the exact release binary (`--bin nika-cli`,
  locked, renamed to its public name) on the four release platforms —
  zero gatekeeper, no queue, the 2026 Rust-CLI canon (helix · atuin ·
  jujutsu all ship one). The derivation needs zero native build inputs
  (the operator crate's dep tree is pure Rust + rustls) and skips tests
  by design — diamond-ci gates every merge; a dedicated `nix.yml` job
  proves the build on every PR touching the flake or the lockfile
  (#388). Pairs with the binstall metadata (#383): together they cover
  the two big « install without brew » crowds.
- **`cargo binstall nika-cli` resolves the prebuilt release binaries.** The
  binary crate ships `[package.metadata.binstall]` mapping every release
  asset (macos/linux × arm64/x64 · the binary at tarball root under its
  public name) onto binstall's resolver — the Rust-native fast path now
  fetches the published tarball instead of silently falling back to a
  source build; verification rides the per-release `SHA256SUMS` (#383).
  Proven live against the v0.99.0 assets on two targets.
- **`nika mcp --transport http` — the Streamable HTTP transport.** The
  managed-MCP hosts stdio closed on get their wire: POST-only,
  conformant-minimal per MCP rev 2025-11-25 (single
  `application/json` response · `202` notifications · `405` on the
  push-stream GET and session DELETE — a read-only, stateless audit
  server), origin-gated on every request (anti DNS-rebinding),
  loopback bind by default, optional constant-time bearer via
  `NIKA_MCP_TOKEN`, the stdio pump's own 8 MiB ceiling — zero new
  dependencies (hand-rolled HTTP/1.1, deliberately sequential). The
  protocol dispatch was always a pure function; this is just the
  second pump.
- **The machine-consumer rung, completed** — three surfaces one release
  promised each other: `nika run --dry-run --json` emits ONE versioned
  plan object (`plan_version: 1` — waves resolved to task ids · per-task
  verbs · the cost ceiling · the permits contract · caller requirements)
  instead of refusing with "no machine dry-run form yet" (#332);
  `check --json` states the AFFIRMATIVE permits
  contract (`permits`: source `declared`/`floor` · the authored block
  spec-shaped · the tightest boundary the body statically needs — the
  same derivation `--infer-permits` prints · honesty notes) (#346); and
  every finding class rides ONE `findings[]` list — `{kind, gate,
  severity, message}` on every row, `code`/`docs_url` only where a
  canonical spec code exists, with `is_clean() ⇔ findings.is_empty()`
  pinned per-class so an eleventh class can never go silently missing
  (#331). Additive: `report_version` stays 1.
- **Bare `trace show`/`verify`/`outputs`/`flow` read the workspace
  latest** — the first thing typed after a run no longer demands the
  path the run card just printed; one stderr line names the pick, zero
  traces keeps the teaching exit-3, explicit paths are unchanged (#345).
- **`--help` speaks user** — the ADR/L3/clap vocabulary leaves the first
  screen; `check` findings print the same `fix: nika explain <CODE>`
  affordance run failures always had; `explain` grows concrete
  fix-forms for the high-traffic conformance codes (DAG-001/002/003 ·
  PARSE-002) and its footer teaches instead of reading inward (#145).

### Fixed

- **A declared write permit creates its tree — `nika:write` and
  `nika:chart` agree** (#433 · use-case battery 2026-07-11). The two
  artifact writers disagreed on a missing parent directory: chart
  auto-created it, write refused (`create_dirs: true` required). When
  `permits.fs.write` declares the tree (e.g. `state/**`), that permit is
  the author's standing declaration that the tree is theirs to make — so
  the guarded seam now creates the parent after a passing write-boundary
  check, and BOTH writers inherit it. Purely additive: a write to a new
  sub-directory inside a declared write permit succeeds without
  `create_dirs`; the un-declared engine-floor corner is unchanged (write
  keeps its safety gate, chart its seam). Option C of the #433 fork
  (operator brainstorm).
- **The secrets surface teaches its own fixes** (use-case battery
  2026-07-11). Three diagnostics that made the reader consult spec 01
  §egress now carry the answer: (1) an information-flow leak names the
  EXACT sanction — `leak into invoke (task shape) … · fix: sanction it —
  egress: [{ to: "nika:jq" }] on secrets.api_key` — the tool id computed
  per sink, in both the human report and the `--json` findings[]; (2) a
  dead egress sanction is refused at parse — `to:` outside the sink
  vocabulary (a destination HOST is the classic slip) can never match, so
  it no longer passes silently reading as declassified; the refusal lists
  the set (tool id · `exec` · `infer` · `agent` · `outputs`); (3) an
  unknown secret field with no near-miss, and the non-mapping egress
  refusal, now name the whole accepted set instead of hiding it behind an
  ellipsis. Additive `SecretLeak.sink_id` (non-exhaustive struct).
- **`nika run --task` honours the whole-file audit it promises.** The
  help says « the full workflow still audits (findings stay whole-file
  faithful) » — empirically the scoped re-check REPLACED the full report
  before the clean gate looked, so a PERMITS violation or a conformance
  error in a branch outside the target's ancestor cone neither printed
  nor blocked: the scoped run exited 0 over a file `nika check` refuses.
  The whole-file gate now fires BEFORE scoping (same findings rendering,
  same exit 2 as the unscoped run — a file must be sound even to
  regenerate one block), and the scoped re-check still gates after the
  cut (#411).
- **Teaching diagnostics from the 147-workflow new-user gauntlet** —
  arithmetic in a `${{ }}` guard teaches the route instead of the raw
  tokenizer error: `+ - * / %` → « `${{ }}` is a boolean guard, not a
  calculator (v0.1 CEL subset): compute the value in a `nika:jq` task »
  — one voice in the checker lexer (nika-tmpl) AND the runtime lexer
  (nika-cel), so an uncheck'd run learns the same lesson (#394). An
  unknown extract mode teaches the canonical route on the measured
  misses (`json` → `mode: jq` with `jq: "."` · `html` → `raw`/
  `selector` · `xml`/`rss`/`atom` → `feed`/`raw` — evidence-based rows
  only, never speculation), the same hint table behind the runtime
  Display and the check voice (#397).
- **gemini 2.5 dynamic thinking no longer burns structured budgets** —
  on a `schema:` call with authored `max_tokens` and no authored
  thinking budget, the wire bounds thinking (flash 0 · pro at the API's
  own 128 floor) so the author's tokens buy OUTPUT; an authored budget
  always wins, uncapped calls keep dynamic thinking, non-2.5 models
  never gain a surprise key. Landed twice honestly: the first fix gated
  on the provider id and never fired — caught by a local capture-server
  probe and the live battery, re-proven at the wire (#300).
- **Parse-fatal `check --json` answers JSON** — the most common CI case
  emitted plain text on stdout; now ONE object (`parse_fatal: true` ·
  a `findings[]` row carrying the NIKA-PARSE code) (#331).

### Changed

- **The SSRF floor speaks at `check` — down to the wire code** (battery
  finding F3 · #395): a literal `nika:fetch`/webhook-notify URL — or a
  `permits.net.http` entry — naming a target the always-on floor
  refuses (the `localhost` family per RFC 6761 · private ranges · cloud
  metadata) is now a check escape carrying `NIKA-SEC-005`, the exact
  code the run would emit, with or without a `permits:` block.
  Previously check blessed a workflow that could never run. One static
  host oracle (`nika_types::net::host_is_blocked`) now feeds
  `nika-http`, the browser navigate gate (which gains the
  metadata-NAME block that was open there), the escape scanner, and
  `--infer-permits` (which stops synthesizing floor-blocked grants —
  honesty note instead). Dynamic URLs and DNS names resolving privately
  stay the runtime `GuardedResolver`'s half (#403).
- **The `${{ }}` expression grammar lives in `nika-tmpl`** — descended
  from `nika-schema` at the 15k crate-size wall (the trace→dap
  precedent): the scanner and the language it scans are one home,
  `nika_schema::expression` re-exports verbatim, `ExprError` renders
  byte-identically through a hand-written Display, and the AST enums
  are deliberately exhaustive (a silent wildcard arm in a secrets
  walker would be an IFC hole).
- `nika-chart` joins the public-api coverage floor (44/44 admitted lib
  crates surface-locked).

## [0.99.0](https://github.com/supernovae-st/nika/compare/v0.98.0..v0.99.0) - 2026-07-10

### Added

- **`nika:image_fx` — deterministic artistic effects, the 26th builtin
  (stdlib §Media graduate #3).** The `image editing` deferred row comes
  home zero-dep: 15 op families (dither · palette · duotone · pixelate ·
  halftone · grain · vignette · chromatic aberration · scanlines ·
  glitch · ascii …) over a hand-rolled PNG codec (full RFC 1951 dynamic
  Huffman inflate · 5-filter decode · CRC), seeded and byte-identical —
  the recipe rides the PNG `tEXt` chunk (`image_fx/v1`), the artifact
  sha256 rides the trace chain, and a re-run with the same inputs
  idempotently skips.
- **`nika:chart` — deterministic chart artifacts, the 27th builtin
  (stdlib §Media graduate #4).** Rows + a semantic spec compile to
  byte-identical SVG (sha256 → trace chain): five closed types (bar ·
  line · area_band · scatter · heatmap), typed semantics (usd ·
  duration_ms · timestamp · category …), `out:` must end in `.svg` (the
  attestation surface) and `compile_to: vega_lite` writes the `.vl.json`
  sibling. Zero dependencies; parity proven byte-exact across
  architectures (wasm32-wasip1 ≡ aarch64).
- **`nika check --model <provider/model>`** — the static preview of the
  run override: the envelope is re-priced AS IF the flag replaced the
  file's default (per-task `model:` still wins), so what check shows IS
  what run will refuse or allow.
- **Egress to `outputs` — the workflow boundary earns its valve.** The
  capture-taint law is deliberate (the provider saw the key — its
  response is not provably clean), but a workflow that calls an
  authenticated API and RETURNS the result had no sanctioned path: the
  embedded `api-upload-and-create` template failed its own audit (the
  night battery's catch), documented as the one known gap. The gap
  closes the way its own note asked: `egress: [{ to: "outputs" }]` on
  the secret declassifies the workflow boundary itself — sink-only,
  secret-specific, never authorizes a send, default-deny when absent
  (spec 01-envelope §egress). KNOWN_GAP is empty: every embedded
  template now passes its own audit, with zero exceptions.
- **The MODELS rung — every `model:` must resolve in THIS binary.** The
  ladder validated tools but never models: a vendor-cataloged provider
  the resolver cannot drive (`azure/…`) and a bare model id
  (`gpt-5-turbo`) both audited green — the bare one even wore a
  conjured price. Both are findings now (exit 2) with the fix taught
  in-line; pricing refuses to price what cannot resolve (unpriced beats
  conjured); the `--json` payload carries `models_resolve` +
  `model_findings[]`; and the SAME law guards the MCP `nika_check` lane
  (`nika_providers::resolve_refusal` — the two machine lanes cannot
  disagree).
- **`nika wire` learns `opencode` and `hermes`** — the two ecosystems
  that natively read what `nika init` writes get first-class MCP wiring
  (`wire all` now covers 8 targets). OpenCode: project-local
  `opencode.json`, its own `mcp.nika` shape, idempotent merge. Hermes:
  `~/.hermes/config.yaml` under the Zed contract — create when missing,
  recognize current, otherwise hand back the exact snippet and leave a
  foreign YAML byte-identical.
- **OpenRouter calls carry the app-attribution pair** (`HTTP-Referer:
  https://nika.sh` + `X-Title: Nika`) — runs surface as Nika on the
  public rankings instead of an anonymous key. Openrouter-profile only;
  peers may 400 on surprise headers (proven both directions).
- **The plugin ships three slash commands** (`/nika:check` ·
  `/nika:explain` · `/nika:new`) — born under `.agents/plugins/nika/`
  per the marketplace mirror law; the commands read the `--json`
  payload, not the prose.
- **`nika explain --forecast` — learned truth before a run.** Duration,
  cost and risk priors computed from YOUR local traces (`.nika/traces/`)
  — deterministic stats, never a model call, never the network. The
  honesty ladder is a type: never-run says so · one run is « last run » ·
  2-4 runs earn a min–max range · p50/p90 bands are earned at n ≥ 5
  (Hyndman & Fan type-7, the numpy/R default). Costs compose the `≥`
  floor whenever unpriced spend participates — absence stays a dash,
  never `$0`. Retried-then-passed counts as flaky, never failed; cache
  hits and other-model runs are excluded from bands and named. The
  section auto-appears in `nika explain <file>` once 3 runs exist; the
  flag forces it, and `--json` gains a versioned `forecast` key
  (internally-tagged rungs — consumers tolerate unknown kinds).
- **The missing-input trap is taught at check time** — `nika check`
  prints an `[inputs]` HINT when a `nika:read` path that resolves
  statically (a literal, or one `${{ vars.X }}` with a literal default)
  does not exist here; never an error — the file may appear at run
  time, and anything dynamic is never guessed
  (`nika_schema::check::static_read_paths`, the pure half).
- **The release tarball is funnel-gated** — `scripts/ci/funnel-e2e.sh`
  plays the stranger's first path against the EXACT tarball about to
  ship (clean HOME · offline · content asserts); a broken first-run
  never uploads.

### Fixed

- **The run card advertises the full 64-hex chain head** — `trace
  verify` printed the whole sha256 while the run card truncated to 32,
  so the taught receipts loop could only prefix-match. Byte-exact `==`
  now closes it (CI-assertable).
- **The broken editor modeline names itself — cause, not symptom.** A
  weak copier de-comments the `# yaml-language-server:` line; YAML then
  fails at the first mapping (« line 14, `nika: v1` ») while the fault
  is line 1 — repair loops chased the symptom forever (0/13 measured on
  a 14B grid). Both forms now teach the fix on the offending line, and
  the class is mirrored spec-side as conformance fixtures 014/015 —
  writing them un-crashed the oracle's scan-failure path.
- **The cost floor prices the EFFECTIVE model.** The delegation idiom
  agents are taught (`--model <p/m> --max-cost-usd <usd>`) never met
  the pre-start refusal — the floor was computed from the file's model
  while the run used the override. The budget preflight now re-prices
  the effective envelope; the mock-override preview idiom still passes.
- **The PNG heatmap speaks the SVG's quantized bins** — the design pass
  quantized the SVG cells onto the legend's 8 shared bins while the PNG
  projection of the same recipe kept the continuous ramp; one shared
  fill law now feeds both surfaces (every legend swatch IS a color a
  cell can wear).
- **Fold verdicts are terminal kinds only** — a journal truncated after
  its opening line no longer surfaces `workflow_started` as if the
  crashed run had reached a state; `nika context` reads it as
  honestly-unknown.

### Changed

- **The chart design pass — per-mode palettes, computable, never
  eyeballed.** The six-check validator refuted « Okabe-Ito is CVD-safe
  on both modes » (4 slots outside the dark lightness band · the yellow
  at 1.29:1 on white): dark becomes a SELECTED palette (same seven
  hues, its own steps, all checks green against `#0f1318`; light
  re-steps one slot, yellow → gold), series and diverging bins ride CSS
  classes through the `prefers-color-scheme` seam (ONE byte-stable
  document renders both themes), heatmap cells quantize onto the
  legend's 8 shared bins with a 2px surface gap, bars cap at 24px with
  a rounded data-end and square baseline, and the diverging midpoint
  goes near-surface graphite in dark — « no change » must recede, never
  glow. A BOTH-lists-style test guards the style block against palette
  drift.
- **`nika-dap::stats::conformal_upper` — the forecast's first THEOREM.**
  A distribution-free, finite-sample upper prediction bound (split
  conformal, order-statistic form): for exchangeable runs the NEXT one
  falls at or below the k-th order statistic with probability ≥ k/(n+1),
  exactly k/(n+1) for continuous data (arXiv:2411.11824 Theorem 3.2). The
  level arrives as a rational (the f64 route mis-computes the exact
  feasibility frontier — 0.9·10 ceils to 10); nine runs earn a
  guaranteed 90% bound, nineteen earn 95%. Proven by a deterministic
  leave-one-out property test that COUNTS the theorem, never samples
  it. Renderer wiring lands with forecast-R3.
- **`nika-dap` is its own crate — the trace-forensics plane has one
  home.** The DAP replay server moves out of `nika-cli` (the crate sat
  at 98.9% of its size cap before the forecast landed), and the seams
  every forensic reader shares descend with it: the tolerant NDJSON
  reader (`recover_events`), the tamper-evidence chain walk
  (`chain::walk` + ONE `CHAIN_GENESIS` the sink now imports — three
  private sha256 copies unified), and the source-identity hashes.
  `nika-cli` re-exports every seam at its old path — zero behavior
  change, `nika dap` answers exactly as before.

## [0.98.0](https://github.com/supernovae-st/nika/compare/v0.97.0..v0.98.0) - 2026-07-08

**Structured output goes native, the checker closes its gaps — and the
engine gets its one lexer.** Four arcs land together: the answer now
rides each provider's own grammar; `nika check` catches what used to
fail at run; costs stopped lying last cycle and now the budget can't be
dodged; and the `${{ }}` scanner becomes a crate both the checker and
the runtime share — parity by construction.

### The native-answer arc

- **Anthropic native structured output** — `output_config.format`
  replaces the instruction fallback on claude models that support it.
- **Gemini rides `responseJsonSchema`** — the lossy OpenAPI converter
  dies; the author's JSON Schema reaches the wire as written.
- **OpenAI strict-mode honesty** — schemas carrying `not`/`allOf` are
  stripped and flattened at the wire instead of 400ing; gpt-5/o-series
  get `max_completion_tokens` (legacy models and every compatible peer
  keep `max_tokens` — and the two spellings are ONE logical key, a raw
  extras `max_tokens` can no longer ride alongside the routed one).
- **Capability is a PROVIDER fact** — deepseek has no `json_schema`;
  the profile says so instead of failing live. `nika doctor` names the
  clouds that fall back to instruction mode.
- **The coercion ladder** — SAP-lite repair (case-fold enums · string
  numbers · singleton arrays) before any PAID retry; retry-loop
  economics send a numbered repair list and fast-fail on truncation.

### The audit-before-run arc

- **The compact block-sequence bomb is dead (CRITICAL)** — `- `×4000 on
  one line used to stack-overflow-ABORT every `nika check`/`run` and
  the LSP with them; the dash-run cap catches it as NIKA-PARSE-001. The
  LSP additionally proves it SERVES the bomb as a document and keeps
  answering (e2e), and floors mid-char offsets instead of panicking.
- **`max_turns` out of 1-1000** and **`for_each` over a typed
  non-array var** are check-time findings now, not run-time surprises.
- **`env:` binds at run** — a green check referencing `${{ env.X }}`
  used to fail with NIKA-VAR-001 because the runtime never bound the
  namespace it was checked against. The exact parity class
  audit-before-run exists to prevent; threaded end-to-end (gates ·
  pause payloads · resume identity — an env change re-keys, never
  wrong-skips).
- **New hints**: `exec-json-capture` (a `capture: structured` task
  whose bindings parse `.stdout | fromjson` and read nothing else of
  the record — use `capture: stdout` so a failing helper errors as
  NIKA-EXEC-001 instead of becoming data) · `native-first` (the check
  names the builtin/MCP path an exec shells out to) ·
  `schema-portability` (the grammar-blind keywords named).
- **A dirty MCP check is `isError:true`** — the agent repair loop
  (template → fill → check → repair) triggers again.

### nika-tmpl — the 41st crate

The `${{ … }}` island lexer, extracted from its two hand-duplicated
copies (the drift already shipped one check-passed/run-broke bug) into
a zero-dependency L0 leaf both consumers now share. Quote-aware close,
`\${{` escape, byte-spans, AST-free. Mutation 46/51 (90.2%) with the 5
survivors certified unkillable in-spec; parity pre-proven byte-identical
across ~337k exhaustive inputs.

### And

- The wizard escapes user strings into YAML (a backslash in the intent
  no longer scaffolds a file that fails its own check), survives spaced
  filenames, and never promises what the file doesn't carry — with PTY
  e2e coverage driving the real conversation.
- fetch vNext: form posts · multipart · bounded traverse, then the
  hardening pass (multipart cap unbypassable · cross-origin redirects
  re-pin · userinfo redacted · robots.txt bounded).
- The LSP honors `$/cancelRequest` — a request the editor discarded
  (superseded completion · rapid typing) dies before its analysis runs.
- `NIKA_<ID>_BASE_URL` reaches the CLOUDS — the locked long-tail hatch
  (D-2026-06-10-N2) gets its operator surface: point any cloud profile
  at an OpenAI-compatible endpoint (an EU host · a corporate gateway)
  with zero catalog change, paired with the scoped `NIKA_<ID>_API_KEY`.
- exec feeds stdin concurrently (a large input can no longer deadlock)
  · the runtime honors the documented key ladder (`NIKA_` prefix wins)
  · `nika init`'s AGENTS.md teaches the live clap tree · `nika welcome`
  + `nika explain <file>` — the 30-seconds narrative layer.

**Nika never lies about costs** (the cost arc, continued from 0.97):
the pricing catalog identifies itself, the math prices what providers
actually billed, agents stop hiding their LLM spend, `unknown` always
says WHY, and the operator gets a real budget lever.

### The detail (every PR)

### 🆕 Crates admitted
- **nika-pck-manifest** — Admit to workspace — all 12 gates passed ([#306](https://github.com/supernovae-st/nika/issues/306)) ([2b93da863](https://github.com/supernovae-st/nika/commit/2b93da863d94185506c74149a4f97f6826f66d1c)) ([#306](https://github.com/supernovae-st/nika/pull/306))
- **nika-tmpl** — Admit to workspace — the ONE ${{ }} island lexer, all 12 gates passed ([#302](https://github.com/supernovae-st/nika/issues/302)) ([9d80f6e22](https://github.com/supernovae-st/nika/commit/9d80f6e2225a558c0ae1a06c03d25f6cbadc2fe7)) ([#302](https://github.com/supernovae-st/nika/pull/302))

### ✨ Features
- **check** — Native-first — the check names the native path ([#258](https://github.com/supernovae-st/nika/issues/258)) ([ab361ba0d](https://github.com/supernovae-st/nika/commit/ab361ba0d259021dc4f7db9d2582e8e7ec1529ba)) ([#258](https://github.com/supernovae-st/nika/pull/258))
- **check** — Schema-portability hint — the grammar-blind keywords named ([#262](https://github.com/supernovae-st/nika/issues/262)) ([56af8f124](https://github.com/supernovae-st/nika/commit/56af8f124d172c31d3ac0adb9979764a30dbadee)) ([#262](https://github.com/supernovae-st/nika/pull/262))
- **cost** — Cost intelligence — provenance, cache-aware math, agent split, budget guard ([#271](https://github.com/supernovae-st/nika/issues/271)) ([0b571b485](https://github.com/supernovae-st/nika/commit/0b571b48524f3b1dcc2fb3355b54141bd6983c5d)) ([#271](https://github.com/supernovae-st/nika/pull/271))
- **cost** — Billed-then-failed spend reaches the frame, the totals, and the budget gate ([#288](https://github.com/supernovae-st/nika/issues/288)) ([226ada754](https://github.com/supernovae-st/nika/commit/226ada754164c9d3da47654d70445b1b5e7ccaec)) ([#288](https://github.com/supernovae-st/nika/pull/288))
- **doctor** — The health surface names the instruction-fallback clouds ([#287](https://github.com/supernovae-st/nika/issues/287)) ([5ab624c7b](https://github.com/supernovae-st/nika/commit/5ab624c7b3ceb5f1dfa01f987de542923567168c)) ([#287](https://github.com/supernovae-st/nika/pull/287))
- **lsp** — $/cancelRequest — stale requests die before they compute ([#303](https://github.com/supernovae-st/nika/issues/303)) ([2ca467e3b](https://github.com/supernovae-st/nika/commit/2ca467e3b93f23fba7ded93f5833ec575dea4e2a)) ([#303](https://github.com/supernovae-st/nika/pull/303))
- **nika-builtin** — Fetch vNext — form · multipart · bounded traverse ([#257](https://github.com/supernovae-st/nika/issues/257)) ([534c0999a](https://github.com/supernovae-st/nika/commit/534c0999a5d80339a5a3940ac98892deba6bdde4)) ([#257](https://github.com/supernovae-st/nika/pull/257))
- **nika-cli** — Wizard wow — the conversation speaks the display seam ([#261](https://github.com/supernovae-st/nika/issues/261)) ([24fcf43c4](https://github.com/supernovae-st/nika/commit/24fcf43c422913665768fb606481d3c6d5b2170a)) ([#261](https://github.com/supernovae-st/nika/pull/261))
- **nika-cli** — The scaffolded agents.md teaches the live clap tree ([#281](https://github.com/supernovae-st/nika/issues/281)) ([d47f3959c](https://github.com/supernovae-st/nika/commit/d47f3959cdec0902df271dab37fa9f7c91a9596d)) ([#281](https://github.com/supernovae-st/nika/pull/281))
- **nika-cli** — Nika welcome + nika explain <file> — the 30-seconds narrative layer ([#298](https://github.com/supernovae-st/nika/issues/298)) ([5316bf7e3](https://github.com/supernovae-st/nika/commit/5316bf7e3c69f362c6f6270263ed531941e44ae6)) ([#298](https://github.com/supernovae-st/nika/pull/298))
- **nika-cli** — The long-tail hatch gets its surface — NIKA_<ID>_BASE_URL for clouds ([#304](https://github.com/supernovae-st/nika/issues/304)) ([25db7137d](https://github.com/supernovae-st/nika/commit/25db7137dddbe6fdb7782663d1a07096cafb3bad)) ([#304](https://github.com/supernovae-st/nika/pull/304))
- **nika-cli** — The mirror speaks the colour seam — and shows the language ([#305](https://github.com/supernovae-st/nika/issues/305)) ([46511025d](https://github.com/supernovae-st/nika/commit/46511025da09fc9e585e083d01f40260731e4655)) ([#305](https://github.com/supernovae-st/nika/pull/305))
- **nika-lsp** — Hostile-input hardening — the #282 bomb served, mid-char offsets floored ([#296](https://github.com/supernovae-st/nika/issues/296)) ([f03eacc56](https://github.com/supernovae-st/nika/commit/f03eacc562f098c01e76777dc21dc5736c4482f3)) ([#296](https://github.com/supernovae-st/nika/pull/296))
- **nika-schema** — Exec-json-capture hint — capture stdout when bindings parse it ([#295](https://github.com/supernovae-st/nika/issues/295)) ([75d1602e6](https://github.com/supernovae-st/nika/commit/75d1602e6fd33286a285df11102393ecd0c70f59)) ([#295](https://github.com/supernovae-st/nika/pull/295))
- **providers** — Gemini rides responseJsonSchema — the OpenAPI converter dies ([#269](https://github.com/supernovae-st/nika/issues/269)) ([98a363b49](https://github.com/supernovae-st/nika/commit/98a363b499324eb1630c47c8ad9c859a2b351df7)) ([#269](https://github.com/supernovae-st/nika/pull/269))
- **providers** — Anthropic native structured output — output_config.format ([#264](https://github.com/supernovae-st/nika/issues/264)) ([c66c20231](https://github.com/supernovae-st/nika/commit/c66c20231aee47cdb8090e91a660268fada5c9cf)) ([#264](https://github.com/supernovae-st/nika/pull/264))
- **verb-infer** — Retry-loop economics — numbered repair list + truncation fast-fail ([#268](https://github.com/supernovae-st/nika/issues/268)) ([a92d383d2](https://github.com/supernovae-st/nika/commit/a92d383d2ce430990cb1e86f27a5e5b4d7e7ae85)) ([#268](https://github.com/supernovae-st/nika/pull/268))
- **verb-infer** — The coercion ladder — SAP-lite repair before a paid retry ([#280](https://github.com/supernovae-st/nika/issues/280)) ([a79da7963](https://github.com/supernovae-st/nika/commit/a79da79638f8c913a7d1daf710e9894e2d2decec)) ([#280](https://github.com/supernovae-st/nika/pull/280))

### 🐛 Bug Fixes
- **ci** — The coherence bot's openvsx probe points at the real extension ([#260](https://github.com/supernovae-st/nika/issues/260)) ([bfbe083ed](https://github.com/supernovae-st/nika/commit/bfbe083ed4b6d7dc8ff9b76fecd1668a9c1d88c2)) ([#260](https://github.com/supernovae-st/nika/pull/260))
- **exec-runner** — Feed stdin concurrently so a large input cannot deadlock ([#256](https://github.com/supernovae-st/nika/issues/256)) ([407252d4d](https://github.com/supernovae-st/nika/commit/407252d4d20a985d71229f01bf098162668458b8)) ([#256](https://github.com/supernovae-st/nika/pull/256))
- **nika-builtin** — Fetch vNext hardening — the crawl stops leaking, over-reading, truncating ([#272](https://github.com/supernovae-st/nika/issues/272)) ([31475f574](https://github.com/supernovae-st/nika/commit/31475f57404499f3b5d4964e0e950f8add18129f)) ([#272](https://github.com/supernovae-st/nika/pull/272))
- **nika-catalog** — Declare fetch traverse — the merged binary refused every crawl ([#263](https://github.com/supernovae-st/nika/issues/263)) ([56a6a9172](https://github.com/supernovae-st/nika/commit/56a6a9172117977442e95284bc95a1f44b69d030)) ([#263](https://github.com/supernovae-st/nika/pull/263))
- **nika-cli** — Wizard coherence — never promise what the file doesn't carry ([#266](https://github.com/supernovae-st/nika/issues/266)) ([ec245c32e](https://github.com/supernovae-st/nika/commit/ec245c32e815d8050a9bf12ce40fc71acd8dcd06)) ([#266](https://github.com/supernovae-st/nika/pull/266))
- **nika-cli** — The night batch — the why reaches the operator ([#265](https://github.com/supernovae-st/nika/issues/265)) ([758023c72](https://github.com/supernovae-st/nika/commit/758023c72d7fcc6c8f5c6ec7f25fe292d7b8b728)) ([#265](https://github.com/supernovae-st/nika/pull/265))
- **nika-cli** — The budget's unbounded warning names each reason, not the fixed disjunction ([#273](https://github.com/supernovae-st/nika/issues/273)) ([9282edbe2](https://github.com/supernovae-st/nika/commit/9282edbe2f985a801b4e3934d94276654c29aeb3)) ([#273](https://github.com/supernovae-st/nika/pull/273))
- **nika-cli** — The wizard's hand-off commands survive a spaced filename ([#275](https://github.com/supernovae-st/nika/issues/275)) ([7921bf268](https://github.com/supernovae-st/nika/commit/7921bf268def332789325d5cdb853b3f72a38765)) ([#275](https://github.com/supernovae-st/nika/pull/275))
- **nika-cli** — The wizard escapes user strings into YAML ([#276](https://github.com/supernovae-st/nika/issues/276)) ([c7cbbb588](https://github.com/supernovae-st/nika/commit/c7cbbb588a1aff4b761dd710b859a36f3dab74fd)) ([#276](https://github.com/supernovae-st/nika/pull/276))
- **nika-cli** — The runtime honors the documented key ladder — NIKA_ prefix wins ([#286](https://github.com/supernovae-st/nika/issues/286)) ([4395ea9ca](https://github.com/supernovae-st/nika/commit/4395ea9ca0710a2c417cbdd7842e86f4207ee710)) ([#286](https://github.com/supernovae-st/nika/pull/286))
- **nika-mcp** — A dirty check is isError:true — the repair loop must trigger ([#270](https://github.com/supernovae-st/nika/issues/270)) ([49a3fff8f](https://github.com/supernovae-st/nika/commit/49a3fff8fa417a3f0053e42fa17ac2041cd42391)) ([#270](https://github.com/supernovae-st/nika/pull/270))
- **nika-providers** — Gpt-5/o-series budget key — max_completion_tokens on the openai wire ([#294](https://github.com/supernovae-st/nika/issues/294)) ([90a5615c1](https://github.com/supernovae-st/nika/commit/90a5615c12fdbc76f0aae26c86597198200e51ae)) ([#294](https://github.com/supernovae-st/nika/pull/294))
- **nika-runtime** — Bind the envelope env namespace — a green check must run ([#293](https://github.com/supernovae-st/nika/issues/293)) ([9ff72e3f8](https://github.com/supernovae-st/nika/commit/9ff72e3f8b4114b3417bd1f30ce2e3e4e6e74b06)) ([#293](https://github.com/supernovae-st/nika/pull/293))
- **nika-schema** — Native-first rule 004 gets the bare-head guard its siblings have ([#278](https://github.com/supernovae-st/nika/issues/278)) ([6fc4ed65e](https://github.com/supernovae-st/nika/commit/6fc4ed65e19908b2a97dcfb6820a8cad8b103050)) ([#278](https://github.com/supernovae-st/nika/pull/278))
- **nika-schema** — Check catches an out-of-range max_turns — audit before run ([#279](https://github.com/supernovae-st/nika/issues/279)) ([89624f3a5](https://github.com/supernovae-st/nika/commit/89624f3a5984075e2b90e0ce052084aa404263e0)) ([#279](https://github.com/supernovae-st/nika/pull/279))
- **nika-schema** — A compact block-sequence bomb no longer aborts the process (CRITICAL) ([#282](https://github.com/supernovae-st/nika/issues/282)) ([e3c9a7cc8](https://github.com/supernovae-st/nika/commit/e3c9a7cc846690d9eecf04dd6821ad8bfbcda200)) ([#282](https://github.com/supernovae-st/nika/pull/282))
- **nika-schema** — Check catches for_each over a typed non-array var — audit before run ([#284](https://github.com/supernovae-st/nika/issues/284)) ([b18e7842e](https://github.com/supernovae-st/nika/commit/b18e7842e7c1f084eaf9ada697d8bb8929ae918a)) ([#284](https://github.com/supernovae-st/nika/pull/284))
- **nika-types** — Cost.rs imports String from alloc — the no_std powerset holds ([#297](https://github.com/supernovae-st/nika/issues/297)) ([48c175ac4](https://github.com/supernovae-st/nika/commit/48c175ac444cad8642e76364f49a619826f853aa)) ([#297](https://github.com/supernovae-st/nika/pull/297))
- **providers** — Openai strict rejects not/allOf — strip and flatten at the wire ([#267](https://github.com/supernovae-st/nika/issues/267)) ([9ec2c0bb2](https://github.com/supernovae-st/nika/commit/9ec2c0bb24c8057ffcb8d79ad654d32ff121d114)) ([#267](https://github.com/supernovae-st/nika/pull/267))
- **providers** — Capability is a PROVIDER fact — deepseek has no json_schema ([#283](https://github.com/supernovae-st/nika/issues/283)) ([39a2a46d2](https://github.com/supernovae-st/nika/commit/39a2a46d22a8ad27b4632e7de514f12958300b84)) ([#283](https://github.com/supernovae-st/nika/pull/283))

### 📚 Documentation
- **adr** — Ratify adr-094 — fci-004 reserved-core catches the d4 taxonomy ([#292](https://github.com/supernovae-st/nika/issues/292)) ([18a95c9aa](https://github.com/supernovae-st/nika/commit/18a95c9aa06c21e72deb927c32d64ac50ecd6874)) ([#292](https://github.com/supernovae-st/nika/pull/292))
- **nika-cli** — --max-cost-usd help names its three real limits at the point of use ([#274](https://github.com/supernovae-st/nika/issues/274)) ([011667feb](https://github.com/supernovae-st/nika/commit/011667feb2d84f735ddd748c141cfb0feaaa886e)) ([#274](https://github.com/supernovae-st/nika/pull/274))
- **pack** — Surgical vendor — provider count catches canon (16) ([#259](https://github.com/supernovae-st/nika/issues/259)) ([242377674](https://github.com/supernovae-st/nika/commit/242377674d47613e4ef52ecd5a97e20027da72e3)) ([#259](https://github.com/supernovae-st/nika/pull/259))

### 🧪 Tests
- **nika-cli** — The own-corpus law is a ratchet — every template audits clean ([#277](https://github.com/supernovae-st/nika/issues/277)) ([fabf3acb7](https://github.com/supernovae-st/nika/commit/fabf3acb7dae7b021c507709429d042ccc234d9e)) ([#277](https://github.com/supernovae-st/nika/pull/277))
- **nika-cli** — Pty e2e — the wizard conversation gets executable coverage ([#285](https://github.com/supernovae-st/nika/issues/285)) ([67ee9f2e3](https://github.com/supernovae-st/nika/commit/67ee9f2e38f60d866be51588a5369cef5ce1fdbb)) ([#285](https://github.com/supernovae-st/nika/pull/285))
- **nika-cli** — Pty hardening — raii dirs, transcript tee, the third door ([#289](https://github.com/supernovae-st/nika/issues/289)) ([d097adb05](https://github.com/supernovae-st/nika/commit/d097adb0503d64244254404740e024d6e09f9812)) ([#289](https://github.com/supernovae-st/nika/pull/289))
- **scripts** — Rail C — the live structured-output battery (P0) ([#299](https://github.com/supernovae-st/nika/issues/299)) ([9649d8421](https://github.com/supernovae-st/nika/commit/9649d8421a83c2176b5c839186f675e1c5857d72)) ([#299](https://github.com/supernovae-st/nika/pull/299))

### 🧹 Chore
- **ci** — Public-api baseline — Profile::supports_response_format joins ([#290](https://github.com/supernovae-st/nika/issues/290)) ([e1e934eea](https://github.com/supernovae-st/nika/commit/e1e934eea6ca872549e619af1620644fcad289c1)) ([#290](https://github.com/supernovae-st/nika/pull/290))
- **ci** — Public-api baseline — the Profile fn rendering from the ubuntu artifact ([c6f4f0b54](https://github.com/supernovae-st/nika/commit/c6f4f0b54f084022389c7b8f04f7d644ed0cd77d))

## [0.97.0](https://github.com/supernovae-st/nika/compare/v0.96.0..v0.97.0) - 2026-07-07

**The run becomes evidence.** 0.96 made the run a place you can visit;
0.97 makes it a record you can trust — and prices it before you pay.

### ✨ Features

- **The journal is tamper-evident** — every line carries a hash chain;
  `nika trace verify` walks it and names the first broken link ([PR 237](https://github.com/supernovae-st/nika/pull/237)).
  Export and replay check the chain BEFORE trusting the data ([PR 238](https://github.com/supernovae-st/nika/pull/238)).
- **`nika trace reproduce`** — is this run reproducible, and WHY not:
  the verdict names every non-deterministic ingredient ([PR 241](https://github.com/supernovae-st/nika/pull/241)).
- **The journal attests its engine** — `engine_version` + platform ride
  `workflow_started`: a failure report says WHICH binary WHERE ([PR 235](https://github.com/supernovae-st/nika/pull/235)).
- **Models are priced before the first run** — the vendored catalog
  refreshed from models.dev (62 rules → 602 · [PR 233](https://github.com/supernovae-st/nika/pull/233)) and `check --json`
  carries per-model rates ([PR 236](https://github.com/supernovae-st/nika/pull/236)): the editor preflight (nika-vscode
  0.97.3) shows `$in/$out per 1M` with zero spend — it lights up on this tag.
- **`check` IS the dry-run** — the plan names WHAT dispatches WHEN:
  waves, gates, blast radius, before anything runs ([PR 245](https://github.com/supernovae-st/nika/pull/245)).
- **`doctor --json`** — the diagnosis speaks machine ([PR 244](https://github.com/supernovae-st/nika/pull/244)).
- **Guided onboarding** — bare `nika init`/`nika new` converse on a
  terminal instead of demanding flags ([PR 253](https://github.com/supernovae-st/nika/pull/253)).
- **Envelope-model did-you-mean resolves like any surface** — deep/019 ([PR 239](https://github.com/supernovae-st/nika/pull/239)).

### 🐛 Bug Fixes

- **The trust surface stops lying at its edges** — the rust-pro batch
  hardens verify/export/replay edge cases ([PR 248](https://github.com/supernovae-st/nika/pull/248)),
  and the chain writer earns its anchor — the writer-side review
  batch ([PR 252](https://github.com/supernovae-st/nika/pull/252)).
- **infer bills every round-trip, not just the last** — multi-cycle
  runs report their true cost ([PR 250](https://github.com/supernovae-st/nika/pull/250)).
- **The drift warn tells a re-encode from an edit** — CRLF/BOM sources
  record `workflow_sha256_lf` (the LF normal form); dap replay compares
  content, not bytes — an editor re-encode no longer cries
  « workflow changed » ([PR 247](https://github.com/supernovae-st/nika/pull/247)).
- **dap launch gets the file-side bounds** — 64 MiB cap, regular files
  only (a device/FIFO hung the adapter), and a torn-tail journal says
  « valid prefix only » instead of replaying silently ([PR 242](https://github.com/supernovae-st/nika/pull/242)).
- **infer repairs near-miss JSON** and reaches longer stall cycles ([PR 243](https://github.com/supernovae-st/nika/pull/243)).
- **Strict `json_schema` claims travel only where earned** ([PR 246](https://github.com/supernovae-st/nika/pull/246)).

### 📦 Pack

- Vendored spec pack synced to nika-spec main — `nika:edit count:` is a
  strict non-negative integer: the string `"2"` is a loud arg error,
  never a silent replace-all (spec [PR 26](https://github.com/supernovae-st/nika-spec/pull/26)).

## [0.96.0](https://github.com/supernovae-st/nika/compare/v0.95.0..v0.96.0) - 2026-07-06

### ✨ Highlights

- **`nika dap` — time-travel replay debugging** ([PR 225](https://github.com/supernovae-st/nika/pull/225) ·
  drift warn [PR 227](https://github.com/supernovae-st/nika/pull/227)) — a Debug
  Adapter over the run journal: breakpoints in your `.nika.yaml`, step
  forward AND backward through task settles, recorded outputs in the
  Variables pane. Replay never re-executes. The editor extension's F5
  integration (shipped dark in nika-vscode 0.97) lights up on this tag.
- **`nika trace export` — every OTel tool becomes a nika viewer**
  ([PR 221](https://github.com/supernovae-st/nika/pull/221) · true durations
  [PR 223](https://github.com/supernovae-st/nika/pull/223)) — project any
  journal to OTLP/JSON lines: drag into Jaeger, POST to Grafana/Langfuse
  (cost rides `gen_ai.usage.cost`). Local file, zero collector.
- **The caller contract** ([PR 213](https://github.com/supernovae-st/nika/pull/213)) —
  `check --json` gains a `requirements` section (models · keys · secrets ·
  env the run will need) so editors and CI state blockers BEFORE any token.
- **Unknown fields teach** ([PR 228](https://github.com/supernovae-st/nika/pull/228)) —
  a typo'd verb key gets the did-you-mean: `` unknown field `infr` … — did
  you mean `infer`? `` on every surface (check · JSON · LSP · MCP).
- **The run knows its story** — `workflow_sha256` on workflow_started
  ([PR 210](https://github.com/supernovae-st/nika/pull/210)) powers drift-aware
  replay; skips and cancels say WHY (`when` + `blocked_by` ·
  [PR 211](https://github.com/supernovae-st/nika/pull/211)).

### 🐛 Fixes & hardening

- `doctor --ping` v2: true 300ms cap, sovereign order, parallel sweep
  ([PR 229](https://github.com/supernovae-st/nika/pull/229)).
- Strict boolean args close the `overwrite:` data-loss footgun
  ([PR 220](https://github.com/supernovae-st/nika/pull/220));
  `nika:convert` gains the opt-in CSV formula-injection guard
  ([PR 217](https://github.com/supernovae-st/nika/pull/217)).
- Trace export renders TRUE durations — the settle-burst law
  ([PR 223](https://github.com/supernovae-st/nika/pull/223)).

### 🏗️ Internals

- The ecosystem coherence bot: cross-repo pins checked nightly, registry
  watched, self-testing ([PR 216](https://github.com/supernovae-st/nika/pull/216)/[PR 222](https://github.com/supernovae-st/nika/pull/222)/[PR 230](https://github.com/supernovae-st/nika/pull/230)).
- CI gets the full integration battery ([PR 218](https://github.com/supernovae-st/nika/pull/218));
  the agent surface round-trips in bin_smoke — tools/call + the LSP framed
  wire ([PR 219](https://github.com/supernovae-st/nika/pull/219)).
- The pack re-vendors nika-spec main (formula_guard prose · the embedded
  jaq's honest @csv note · nika-spec#22).

### ✨ Features
- **nika-builtin** — Nika:convert formula_guard — opt-in CSV injection guard ([#217](https://github.com/supernovae-st/nika/issues/217)) ([3edb94454](https://github.com/supernovae-st/nika/commit/3edb94454ccd2d361bbf737cb6441bedbbb790eb)) ([#217](https://github.com/supernovae-st/nika/pull/217))
- **nika-cli** — Trace export — every OTel tool becomes a nika viewer ([#221](https://github.com/supernovae-st/nika/issues/221)) ([d6e6f9ee5](https://github.com/supernovae-st/nika/commit/d6e6f9ee5540e63492a5add3aceb66cdc275415f)) ([#221](https://github.com/supernovae-st/nika/pull/221))
- **nika-cli** — Nika dap — time-travel replay debugging over the run journal ([#225](https://github.com/supernovae-st/nika/issues/225)) ([b844c316c](https://github.com/supernovae-st/nika/commit/b844c316cd45a7ef025f4755fd6fe497f0e24b0a)) ([#225](https://github.com/supernovae-st/nika/pull/225))
- **nika-cli** — Dap launch warns when the workflow drifted since the run ([#227](https://github.com/supernovae-st/nika/issues/227)) ([05cdaab1e](https://github.com/supernovae-st/nika/commit/05cdaab1ec68217f3a7fb03841dbe5f7720767d4)) ([#227](https://github.com/supernovae-st/nika/pull/227))
- **nika-runtime** — The run knows its source — workflow_sha256 on workflow_started ([#210](https://github.com/supernovae-st/nika/issues/210)) ([74f53d443](https://github.com/supernovae-st/nika/commit/74f53d443f9c768a8708843ce9055ffa9af895d0)) ([#210](https://github.com/supernovae-st/nika/pull/210))
- **nika-runtime** — The skip and the cancel say WHY — when + blocked_by ([#211](https://github.com/supernovae-st/nika/issues/211)) ([dc7b31b4c](https://github.com/supernovae-st/nika/commit/dc7b31b4c6db578408630a898f28c6b256a38867)) ([#211](https://github.com/supernovae-st/nika/pull/211))
- **nika-schema** — The caller contract — a requirements section on check ([#213](https://github.com/supernovae-st/nika/issues/213)) ([e3a9bcb4a](https://github.com/supernovae-st/nika/commit/e3a9bcb4ab06421c6812fa57950482bb60f3cf68)) ([#213](https://github.com/supernovae-st/nika/pull/213))
- **nika-schema** — Unknown fields carry the did-you-mean — PARSE-005 teaches ([#228](https://github.com/supernovae-st/nika/issues/228)) ([be92b54dc](https://github.com/supernovae-st/nika/commit/be92b54dc0ade1e0d7995595733ab5d5a21c3e46)) ([#228](https://github.com/supernovae-st/nika/pull/228))

### 🐛 Bug Fixes
- **ci** — The integration suites finally run somewhere — CI gets the full battery ([#218](https://github.com/supernovae-st/nika/issues/218)) ([5160a8216](https://github.com/supernovae-st/nika/commit/5160a8216aa804fb9f7ef6238a51569fb14823cc)) ([#218](https://github.com/supernovae-st/nika/pull/218))
- **nika-builtin** — Strict boolean args — close the overwrite data-loss footgun ([#220](https://github.com/supernovae-st/nika/issues/220)) ([2fdb057dc](https://github.com/supernovae-st/nika/commit/2fdb057dcff5cdf98fafa949e5fc30bae13a9861)) ([#220](https://github.com/supernovae-st/nika/pull/220))
- **nika-builtin** — Strict count arg — close the edit over-edit footgun ([#231](https://github.com/supernovae-st/nika/issues/231)) ([59ff98a05](https://github.com/supernovae-st/nika/commit/59ff98a05bed02ee071151812bf565967a8a3238)) ([#231](https://github.com/supernovae-st/nika/pull/231))
- **nika-cli** — Trace export renders TRUE durations — the settle-burst law ([#223](https://github.com/supernovae-st/nika/issues/223)) ([412e32c27](https://github.com/supernovae-st/nika/commit/412e32c276352e0b89c6ed98032fd4904c4c9a6a)) ([#223](https://github.com/supernovae-st/nika/pull/223))
- **nika-cli** — Doctor --ping — true cap, sovereign order, parallel sweep ([#229](https://github.com/supernovae-st/nika/issues/229)) ([aa7366f17](https://github.com/supernovae-st/nika/commit/aa7366f17a7dc5ad8518768522a4cae732acdae9)) ([#229](https://github.com/supernovae-st/nika/pull/229))

### 📚 Documentation
- **adr** — Adr-106 — nika add, the registry client verb (proposed) ([#226](https://github.com/supernovae-st/nika/issues/226)) ([018b4673a](https://github.com/supernovae-st/nika/commit/018b4673a938b9e7c7c143f181152debdf283a5b)) ([#226](https://github.com/supernovae-st/nika/pull/226))
- **readme** — Shared workflows have a home — the registry pointer ([#224](https://github.com/supernovae-st/nika/issues/224)) ([047b8b838](https://github.com/supernovae-st/nika/commit/047b8b838959a22b327759a0c366c8a5ecc26001)) ([#224](https://github.com/supernovae-st/nika/pull/224))

### 🧪 Tests
- **bin_smoke** — The agent surface round-trips — tools/call + the LSP wire ([#219](https://github.com/supernovae-st/nika/issues/219)) ([6ef0d67f9](https://github.com/supernovae-st/nika/commit/6ef0d67f9c5d137e61ea7acd2ef6e88cca107483)) ([#219](https://github.com/supernovae-st/nika/pull/219))

### 📦 Build
- **coherence** — The registry is a watched first-class citizen ([#222](https://github.com/supernovae-st/nika/issues/222)) ([0110da503](https://github.com/supernovae-st/nika/commit/0110da50311ed16287d24e0705920a28fc001c61)) ([#222](https://github.com/supernovae-st/nika/pull/222))
- **coherence** — The bot self-tests before every run — and survives pre-releases ([#230](https://github.com/supernovae-st/nika/issues/230)) ([bba71ebf6](https://github.com/supernovae-st/nika/commit/bba71ebf6caa19aefc14b7e33ee9e9e30e9a1c70)) ([#230](https://github.com/supernovae-st/nika/pull/230))
- The ecosystem coherence bot — cross-repo pins, checked nightly ([#216](https://github.com/supernovae-st/nika/issues/216)) ([325ed0a8b](https://github.com/supernovae-st/nika/commit/325ed0a8b598cdbdca1265b0ea39e312448bda4b)) ([#216](https://github.com/supernovae-st/nika/pull/216))

## [0.95.0](https://github.com/supernovae-st/nika/compare/v0.94.0..v0.95.0) - 2026-07-06

### ✨ Highlights

- **The 5 local servers get their catalog face** ([PR 208](https://github.com/supernovae-st/nika/pull/208)) —
  ollama · lmstudio · llamacpp · localai · vllm join `nika catalog` (and
  `catalog --json`, so editor model pickers see them) with descriptions,
  `local`/`open-source` tags and seed models. Keyless by construction:
  a catalog edit can never invent a key gate. Sovereign models stay
  « unpriced », never « free ». 38 catalog providers total.
- **The lost-user footer** ([PR 203](https://github.com/supernovae-st/nika/pull/203)) — a bare `nika`
  suggests the next command instead of a wall of clap.
- **Hygiene: the seam-discipline vector** ([PR 207](https://github.com/supernovae-st/nika/pull/207)) +
  the chromiumoxide surface pin.

### 🐛 Fixes

- `nika:write` honors `create_dirs: false` — a missing parent is refused
  loudly instead of silently materializing a tree ([PR 196](https://github.com/supernovae-st/nika/pull/196)).
- `nika:date` resolves named timezones from the bundled tz db, not the
  OS ([PR 199](https://github.com/supernovae-st/nika/pull/199)).
- `nika:log` neutralizes terminal control sequences ([PR 204](https://github.com/supernovae-st/nika/pull/204)).
- The MCP stdio transport bounds its line reads — no unbounded buffer
  on a hostile client ([PR 209](https://github.com/supernovae-st/nika/pull/209)).

### 📚 Docs & internals

- Doc-comments go count-free (« 22-builtin » / « 5/23 » swept — the
  catalog is the count · [PR 206](https://github.com/supernovae-st/nika/pull/206)); README daily
  commands catch the 0.94 loop ([PR 205](https://github.com/supernovae-st/nika/pull/205)).
- The embedded pack re-vendors nika-spec main: count-free schema
  description (nika-spec#21) and `create_dirs` enforcement prose
  (nika-spec#20).
- `nika:validate` SSRF floor + deep-YAML totality pinned ([PR 197](https://github.com/supernovae-st/nika/pull/197));
  public-api baselines synced ([PR 198](https://github.com/supernovae-st/nika/pull/198)/[PR 200](https://github.com/supernovae-st/nika/pull/200)).

### ✨ Features
- **hygiene** — Seam-discipline vector + chromiumoxide surface pin ([#207](https://github.com/supernovae-st/nika/issues/207)) ([b8cd039aa](https://github.com/supernovae-st/nika/commit/b8cd039aa888642074b7907ff27522a710074749)) ([#207](https://github.com/supernovae-st/nika/pull/207))
- **nika-catalog** — The 5 local servers get their catalog face ([#208](https://github.com/supernovae-st/nika/issues/208)) ([7223c41b0](https://github.com/supernovae-st/nika/commit/7223c41b07c81768db59a8a866d08afc61991016)) ([#208](https://github.com/supernovae-st/nika/pull/208))
- **nika-cli** — The lost-user footer — bare nika suggests the next command ([#203](https://github.com/supernovae-st/nika/issues/203)) ([16e279935](https://github.com/supernovae-st/nika/commit/16e279935949dfc7d722cd370921987a2ccf3b4e)) ([#203](https://github.com/supernovae-st/nika/pull/203))

### 🐛 Bug Fixes
- **nika-builtin** — Write honors create_dirs:false — no silent tree ([#196](https://github.com/supernovae-st/nika/issues/196)) ([7fc3c9fc1](https://github.com/supernovae-st/nika/commit/7fc3c9fc18d44836de48ca1ab8cecbda44bb1fd6)) ([#196](https://github.com/supernovae-st/nika/pull/196))
- **nika-builtin** — Date resolves named tz from the bundled db, not the OS ([#199](https://github.com/supernovae-st/nika/issues/199)) ([228032695](https://github.com/supernovae-st/nika/commit/228032695567ae51d10939037248768771c634c7)) ([#199](https://github.com/supernovae-st/nika/pull/199))
- **nika-cli** — Log message neutralizes terminal control sequences ([#204](https://github.com/supernovae-st/nika/issues/204)) ([09c059646](https://github.com/supernovae-st/nika/commit/09c05964655359f5780113d94a10b75fbfc269ff)) ([#204](https://github.com/supernovae-st/nika/pull/204))
- **nika-mcp** — Bound the stdio transport — no unbounded line read ([#209](https://github.com/supernovae-st/nika/issues/209)) ([dd829f451](https://github.com/supernovae-st/nika/commit/dd829f45138e6e6d2ec83393eb441356841265a9)) ([#209](https://github.com/supernovae-st/nika/pull/209))

### 📚 Documentation
- **readme** — Daily commands catch the 0.94 loop ([#205](https://github.com/supernovae-st/nika/issues/205)) ([da5740747](https://github.com/supernovae-st/nika/commit/da574074799cabc01431bc83b178b1af6b15e2c0)) ([#205](https://github.com/supernovae-st/nika/pull/205))
- **src** — Stdlib counts leave the doc-comments — the catalog is the count ([#206](https://github.com/supernovae-st/nika/issues/206)) ([69929aaab](https://github.com/supernovae-st/nika/commit/69929aaabe5d3752f49986b156fd610c6c18424b)) ([#206](https://github.com/supernovae-st/nika/pull/206))

### 🧪 Tests
- **nika-builtin** — Pin validate's SSRF floor + deep-YAML totality ([#197](https://github.com/supernovae-st/nika/issues/197)) ([f96317699](https://github.com/supernovae-st/nika/commit/f963176999380946021f87e81f244f3b0ae9b938)) ([#197](https://github.com/supernovae-st/nika/pull/197))

### 🧹 Chore
- **nika-cli** — Sync public-api baseline — run::run gained no_trace_file+task_filter ([#200](https://github.com/supernovae-st/nika/issues/200)) ([68ce435cb](https://github.com/supernovae-st/nika/commit/68ce435cb084787d007c6c00201a3d905b82a76b)) ([#200](https://github.com/supernovae-st/nika/pull/200))

## [0.94.0](https://github.com/supernovae-st/nika/compare/v0.93.1..v0.94.0) - 2026-07-06

### ✨ Highlights

- **The media suite** — two new builtins take the stdlib to 25.
  `nika:image_generate` ([PR 173](https://github.com/supernovae-st/nika/pull/173) · providers v1.1 local-first + xai
  [PR 174](https://github.com/supernovae-st/nika/pull/174) · `mode: edit` M-A/M-A.2
  [PR 188](https://github.com/supernovae-st/nika/pull/188)/[PR 189](https://github.com/supernovae-st/nika/pull/189)) and
  `nika:tts_generate` ([PR 176](https://github.com/supernovae-st/nika/pull/176) · one sovereign
  `/v1/audio/speech` wire = LocalAI/Kokoro/Speaches · openai · elevenlabs · a real
  deterministic WAV under mock). Assets land on disk with provenance manifests —
  content credentials detected and preserved ([PR 177](https://github.com/supernovae-st/nika/pull/177)) ·
  the elevenlabs watermark declared ([PR 183](https://github.com/supernovae-st/nika/pull/183)).
- **Every run leaves a journal** — `.nika/traces/<ts>-<id>.ndjson` by default
  ([PR 170](https://github.com/supernovae-st/nika/pull/170) · opt out `--no-trace-file` /
  `NIKA_NO_TRACE_FILE`), and `nika run --task <id>` scopes execution to one task
  and its upstream cone. CEL expression completion lands in the LSP.
- **The catalog rides the wire** — `nika catalog --json` · `nika tools --json`
  ([PR 172](https://github.com/supernovae-st/nika/pull/172)) + their MCP twins:
  the oracle now serves 8 read-only tools, and the server speaks MCP
  2026-07-28 natively ([PR 171](https://github.com/supernovae-st/nika/pull/171)) while
  accepting 2025-11-25 clients ([PR 185](https://github.com/supernovae-st/nika/pull/185)).
  *Corrected in 0.123: the server never spoke 2026-07-28. It speaks the
  handshake revisions 2024-11-05 to 2025-11-25; the final 2026-07-28 revision
  has no handshake, and none of its MUSTs were implemented.*
- **Honest money** — real per-task spend: `cost_usd` rides `task_completed`
  ([PR 168](https://github.com/supernovae-st/nika/pull/168) · absent for mock/local,
  never a fake zero) and agent loops meter tool-reported cost
  ([PR 178](https://github.com/supernovae-st/nika/pull/178)).
- **Providers 16** — huggingface + nvidia join the canonical catalog
  ([PR 167](https://github.com/supernovae-st/nika/pull/167) · ADR-104).
- **`nika doctor --ping`** — the local ports, actually probed
  ([PR 195](https://github.com/supernovae-st/nika/pull/195) · TCP connect-only ·
  300ms cap · loopback/configured URLs only · the default run stays offline).
  `nika check` findings carry severity + a docs URL
  ([PR 184](https://github.com/supernovae-st/nika/pull/184)).

### 🧹 Chore

- **pack** — re-vendored from spec main: the 16-provider/25-builtin markers ·
  the tts error-category ladder · the new `mcp:` canon section ride the binary.
- **ci** — the test gate runs under nextest ([PR 192](https://github.com/supernovae-st/nika/pull/192)) ·
  public-api baselines canonicalized from the ubuntu artifact ·
  `iter_over_hash_type` denied ([PR 181](https://github.com/supernovae-st/nika/pull/181)).
- **cli** — round-8 visual polish ([PR 169](https://github.com/supernovae-st/nika/pull/169)) ·
  the comprehension pass ([PR 166](https://github.com/supernovae-st/nika/pull/166)) ·
  the init hand-off drops its phantom indentation ([PR 194](https://github.com/supernovae-st/nika/pull/194)).

## [0.93.1](https://github.com/supernovae-st/nika/compare/v0.93.0..v0.93.1) - 2026-07-05

### ✨ Highlights

- **The embedded pack teaches 2026 models** — `nika examples` /
  `nika new` / `nika spec` now carry the qwen3.5 cascade
  ([PR 161](https://github.com/supernovae-st/nika/pull/161)): the very
  first `nika examples run 01-hello` of a fresh install works against
  the models people actually pull in July 2026 (the v0.93.0 binary
  still embedded the pre-cascade pack — this patch closes the reach).
- README daily-commands block ([PR 162](https://github.com/supernovae-st/nika/pull/162)).

### 📚 Documentation
- **readme** — Daily commands — the full 0.93 user loop in one block ([#162](https://github.com/supernovae-st/nika/issues/162)) ([8356df6f7](https://github.com/supernovae-st/nika/commit/8356df6f7e481c089bb86f6efd907a1b1f3240a0))

### 🧹 Chore
- **pack** — Vendor the qwen3.5 teach-cascade from spec main ([#161](https://github.com/supernovae-st/nika/issues/161)) ([e8f500f73](https://github.com/supernovae-st/nika/commit/e8f500f7362b02cb44a649f861d1228fde16d0cc))

## [0.93.0](https://github.com/supernovae-st/nika/compare/v0.92.0..v0.93.0) - 2026-07-05

### ✨ Highlights

- **Local thinking-era models unbricked** — the provider-plane HTTP timeout
  rises to 180s ([PR 148](https://github.com/supernovae-st/nika/pull/148)): 2026 open-weight models (qwen3.5 · gemma4) spend
  40-90s thinking before a structured answer on consumer hardware; every
  local structured `infer:` died at the old 30s cloud-calibrated ceiling.
  Field-fix train [PR 149](https://github.com/supernovae-st/nika/pull/149) pairs it with per-task transport-deadline semantics.
- **`nika run --resume`** — durable-lite resume: the trace IS the checkpoint
  (ADR-099 · [PR 154](https://github.com/supernovae-st/nika/pull/154)): completed tasks replay from the flight recorder as
  visible cache hits · a paused/failed run continues where it stopped.
- **`nika test`** — the workflow test harness + ADR-098 provider json-mode +
  the CLI wow pass (waves · lanes · verdict card) landed in the Rounds 2+3
  train ([PR 153](https://github.com/supernovae-st/nika/pull/153)).
- **Onboarding golden path** — brew caveats walk the first 60 seconds ·
  `nika init` hands over to the next command ([PR 158](https://github.com/supernovae-st/nika/pull/158)) · the embedded pack
  carries the current spec (60s README · why-not table · llms.txt).

### 🆕 Crates admitted
- **nika-cap** — Admit to workspace — all 12 gates passed ([ea5b2090d](https://github.com/supernovae-st/nika/commit/ea5b2090de164f849369316236f587acbf69bb1d))

### ✨ Features
- **init** — Hand over to the next command · the beginner golden path ([#158](https://github.com/supernovae-st/nika/issues/158)) ([cd291a3b5](https://github.com/supernovae-st/nika/commit/cd291a3b54ff15c834d97c4af0de0ea52fa84626)) ([#158](https://github.com/supernovae-st/nika/pull/158))

### 🐛 Bug Fixes
- **cli** — Raise provider-plane http timeout to 180s for local models ([#148](https://github.com/supernovae-st/nika/issues/148)) ([f99828cbf](https://github.com/supernovae-st/nika/commit/f99828cbf728ce9f0c4ce07a1fd48271f7791573)) ([#148](https://github.com/supernovae-st/nika/pull/148))
- **nika-schema** — Char-boundary panic in go-duration unknown-unit error path ([c1f73af89](https://github.com/supernovae-st/nika/commit/c1f73af89aaf61fd65a696b6bd1894045ca2f537))
- **scripts** — Adr index generator tolerates missing optional fields ([#152](https://github.com/supernovae-st/nika/issues/152)) ([5d5982f41](https://github.com/supernovae-st/nika/commit/5d5982f418b444e415dc840e1db3ecfa94db028c)) ([#152](https://github.com/supernovae-st/nika/pull/152))

### 📚 Documentation
- **changelog** — Append v0.92.0 — auto-generated ([#147](https://github.com/supernovae-st/nika/issues/147)) ([2a42f0712](https://github.com/supernovae-st/nika/commit/2a42f0712783235630c940712e00632530b8dc52)) ([#147](https://github.com/supernovae-st/nika/pull/147))
- **workspace** — Canonical pck crate names + fix publish adr citation ([58d9514bf](https://github.com/supernovae-st/nika/commit/58d9514bf1db97809c41ca95e8a751faf1d831e7))

### 🧪 Tests
- **nika-mcp** — Regression guard for the embedded-lookup injection-safety ([4f306d5f9](https://github.com/supernovae-st/nika/commit/4f306d5f99c2055695b103a63f0b008f9a9f8d65))
- **schema** — Forward-compat anchors for the v0.2 seed clauses ([#156](https://github.com/supernovae-st/nika/issues/156)) ([5a84a4702](https://github.com/supernovae-st/nika/commit/5a84a4702586893a2bd077ee5c0f65ddd7942d07)) ([#156](https://github.com/supernovae-st/nika/pull/156))

### 🧹 Chore
- **ci** — Api-lock the last 3 uncovered lib crates ([539a039eb](https://github.com/supernovae-st/nika/commit/539a039ebb6441fe8863a0b383f407c92c8a89e2))
- **ci** — Canonicalize 16 public-api baselines from the ci artifact ([1a44b139c](https://github.com/supernovae-st/nika/commit/1a44b139c26b596aacd73d379a8e3a872d4d0566))
- **ci** — Nika-cli baseline from the ubuntu artifact ([688a851ea](https://github.com/supernovae-st/nika/commit/688a851ea2b317fe5ef894eb72f9a6829e40f6c0))
- **nika-catalog** — Regenerate public-api baseline — additive builtin arg-shape surface ([a681d6044](https://github.com/supernovae-st/nika/commit/a681d6044855842fda455be8e0c4b5b5f237f8af))
- **nika-pack** — Re-vendor the pack from the merged spec ([#157](https://github.com/supernovae-st/nika/issues/157)) ([0d5b6dd8c](https://github.com/supernovae-st/nika/commit/0d5b6dd8c46dc316a6f73c876accbc19b409c5f8)) ([#157](https://github.com/supernovae-st/nika/pull/157))
- **version** — Main → 0.93.0-dev after the v0.92.0 release ([4ad3cbd20](https://github.com/supernovae-st/nika/commit/4ad3cbd203778b0f97d0af1c055fe2bc8c77aacf))

### 💼 Other
- Field fixes: local-model timeouts, mock-from-schema, --var, sitemap examples ([#149](https://github.com/supernovae-st/nika/issues/149))

* fix(workspace): task timeout governs the provider http deadline

The provider HTTP client aborted every round-trip at a hardcoded 30s
total deadline, killing any local-model task regardless of its declared
timeout: budget (408 at 30s on timeout: "7m" · F1 field report
2026-07-04). The task budget now rides the whole chain — task.timeout →
dispatch → InferInput → InferRequest → HttpRequest — and when no budget
is declared the default is per provider CLASS: the 5 local servers get
300s (a 14B model cannot answer a real prompt in 30s), cloud keeps the
historical 30s. Streaming carries only an explicit budget (the idle-read
guard reaps stalls). The provider client's config timeout is raised to a
600s transport ceiling because reqwest arms the client-level read guard
even while awaiting response headers — it would otherwise undercut any
longer per-request deadline.

Tests: wire-level parity across all 13 wired profiles (class default ·
task budget wins · streaming explicit-only) + profile classification +
verb plumb + the real parse→check→run chain against a capturing http
seam. Baselines: nika-kernel-ai + nika-verb-infer public-api
regenerated (additive timeout field on two #[non_exhaustive] DTOs).

* feat(nika-providers): mock synthesizes schema-conformant output

mock/echo echoed the prompt regardless of an attached schema, so EVERY
structured workflow on the mock burned its 3-attempt retry budget and
died NIKA-INFER-002 — no offline CI story for exactly the workflows
that need one (F3 field report 2026-07-04). A request carrying
response_format: JsonSchema now returns a SYNTHESIZED minimal instance
of the schema as pure JSON: string → "mock" (enum → first entry ·
const/default honored) · integer → minimum ?? 0 · number → 0.0 · bool →
false · array → one item (minItems honored · allocation-capped) ·
object → the required keys recursively. Total + deterministic
(byte-stable) · unsupported keywords (pattern · $ref) degrade to an
instance that honestly fails the verb's validation. The plain echo
contract is untouched.

Tests: generator matrix validated with the SAME jsonschema crate the
verb floor uses (atlas-style enum severity + bounded integers green) ·
verb-level offline dry-run + retry-exhaustion re-pinned on a pattern
schema · mock wire pure-JSON determinism · e2e pipeline updated to the
synthesized instance.

* feat(nika-cli): repeatable --var key=value supplies workflow vars

A workflow with a required: true var and no default was UNRUNNABLE
from the CLI — nika run had no input surface, so the first
${{ vars.x }} reference died NIKA-VAR-001 with no fix available (F4
field report 2026-07-04). nika run gains a repeatable --var KEY=VALUE:
values override a declared default:, satisfy required vars, parse as
JSON when they parse (numbers · booleans · arrays) else ride as
strings, and unknown keys are refused loudly with the declared set
(exit 3 — a typo silently doing nothing would be the worst outcome).
The runtime gains the with_var_overrides builder (merged over the
envelope defaults at run start). NIKA-VAR-001 now teaches the fix on
BOTH surfaces: the runtime message appends the --var hint for vars.*
references, and nika explain NIKA-VAR-001 carries an engine-side fix
line.

Tests: required-var run green with --var / failed without · unknown
key + malformed pair refused · JSON-else-string typing · override
beats default through the real parse→check→run chain · both hint
surfaces pinned. Baselines: nika-runtime regenerated (additive
builder) · nika-cli run() signature line patched in place (the
committed file is the ubuntu-canonical artifact — a full local regen
would carry macOS render skew on unrelated lines).

* fix(nika-pack): sitemap examples bind the root array not .urls

nika:fetch mode: sitemap returns the ROOT ARRAY
[{loc, changefreq, priority}, …] — the shape nika-extract pins in its
own tests — but the embedded showcase examples bound a phantom .urls
wrapper (t2-seo-content-brief .urls[:5] · t3-competitor-radar
.urls[:8]) and the embedded spec 03-dag fan-out snippet taught
pages: ".urls[]" (doubly wrong: phantom wrapper AND a stream binding
where a binding is single-valued). Every user copying the examples hit
NIKA-VAR-004 at the first sitemap task (F5 field report 2026-07-04).
The engine is RIGHT — the teaching surface is fixed: .[:5] | map(.loc)
/ .[:8] | map(.loc) / map(.loc), plus the t2 header now documents the
sitemap shape and the mock-from-schema offline story F3 made true.

manifest.yaml sha256_16 recomputed for both files (lean-hash algorithm
cross-verified against all 27 committed rows · 27/27 match). Both fixed
examples pass nika check clean with the built binary.

FOLLOW-UP (out of this repo's scope): the pack is vendored from the
nika-spec repo via scripts/sync-pack.sh — the SSOT needs the mirror
fix (examples + 03-dag.md + manifest) before the next re-vendor, or it
reverts this.

* refactor(nika-cli): extract output-mode + dry-run helpers from run()

The F4 --var block pushed run() to 114 lines and the F1 budget plumb
pushed attempt_loop to 101 — both past the 100-line ratchet. Extract
the --output validation (output_mode) and the dry-run plan render
(render_dry_run) into named helpers; compress the attempt_loop budget
comment. Behavior identical — the extracted code is verbatim, tests
unchanged and green (110 + 78 lib).

---------
 ([90b19d589](https://github.com/supernovae-st/nika/commit/90b19d58960104d84e87235337da15cc82e3aa97)) ([#149](https://github.com/supernovae-st/nika/pull/149))
- Rounds 2+3: nika test, DX, ADR-098 json-mode, CLI wow (rebased train) ([#153](https://github.com/supernovae-st/nika/issues/153))

* fix(workspace): task timeout governs the provider http deadline

The provider HTTP client aborted every round-trip at a hardcoded 30s
total deadline, killing any local-model task regardless of its declared
timeout: budget (408 at 30s on timeout: "7m" · F1 field report
2026-07-04). The task budget now rides the whole chain — task.timeout →
dispatch → InferInput → InferRequest → HttpRequest — and when no budget
is declared the default is per provider CLASS: the 5 local servers get
300s (a 14B model cannot answer a real prompt in 30s), cloud keeps the
historical 30s. Streaming carries only an explicit budget (the idle-read
guard reaps stalls). The provider client's config timeout is raised to a
600s transport ceiling because reqwest arms the client-level read guard
even while awaiting response headers — it would otherwise undercut any
longer per-request deadline.

Tests: wire-level parity across all 13 wired profiles (class default ·
task budget wins · streaming explicit-only) + profile classification +
verb plumb + the real parse→check→run chain against a capturing http
seam. Baselines: nika-kernel-ai + nika-verb-infer public-api
regenerated (additive timeout field on two #[non_exhaustive] DTOs).

* feat(nika-providers): mock synthesizes schema-conformant output

mock/echo echoed the prompt regardless of an attached schema, so EVERY
structured workflow on the mock burned its 3-attempt retry budget and
died NIKA-INFER-002 — no offline CI story for exactly the workflows
that need one (F3 field report 2026-07-04). A request carrying
response_format: JsonSchema now returns a SYNTHESIZED minimal instance
of the schema as pure JSON: string → "mock" (enum → first entry ·
const/default honored) · integer → minimum ?? 0 · number → 0.0 · bool →
false · array → one item (minItems honored · allocation-capped) ·
object → the required keys recursively. Total + deterministic
(byte-stable) · unsupported keywords (pattern · $ref) degrade to an
instance that honestly fails the verb's validation. The plain echo
contract is untouched.

Tests: generator matrix validated with the SAME jsonschema crate the
verb floor uses (atlas-style enum severity + bounded integers green) ·
verb-level offline dry-run + retry-exhaustion re-pinned on a pattern
schema · mock wire pure-JSON determinism · e2e pipeline updated to the
synthesized instance.

* feat(nika-cli): repeatable --var key=value supplies workflow vars

A workflow with a required: true var and no default was UNRUNNABLE
from the CLI — nika run had no input surface, so the first
${{ vars.x }} reference died NIKA-VAR-001 with no fix available (F4
field report 2026-07-04). nika run gains a repeatable --var KEY=VALUE:
values override a declared default:, satisfy required vars, parse as
JSON when they parse (numbers · booleans · arrays) else ride as
strings, and unknown keys are refused loudly with the declared set
(exit 3 — a typo silently doing nothing would be the worst outcome).
The runtime gains the with_var_overrides builder (merged over the
envelope defaults at run start). NIKA-VAR-001 now teaches the fix on
BOTH surfaces: the runtime message appends the --var hint for vars.*
references, and nika explain NIKA-VAR-001 carries an engine-side fix
line.

Tests: required-var run green with --var / failed without · unknown
key + malformed pair refused · JSON-else-string typing · override
beats default through the real parse→check→run chain · both hint
surfaces pinned. Baselines: nika-runtime regenerated (additive
builder) · nika-cli run() signature line patched in place (the
committed file is the ubuntu-canonical artifact — a full local regen
would carry macOS render skew on unrelated lines).

* fix(nika-pack): sitemap examples bind the root array not .urls

nika:fetch mode: sitemap returns the ROOT ARRAY
[{loc, changefreq, priority}, …] — the shape nika-extract pins in its
own tests — but the embedded showcase examples bound a phantom .urls
wrapper (t2-seo-content-brief .urls[:5] · t3-competitor-radar
.urls[:8]) and the embedded spec 03-dag fan-out snippet taught
pages: ".urls[]" (doubly wrong: phantom wrapper AND a stream binding
where a binding is single-valued). Every user copying the examples hit
NIKA-VAR-004 at the first sitemap task (F5 field report 2026-07-04).
The engine is RIGHT — the teaching surface is fixed: .[:5] | map(.loc)
/ .[:8] | map(.loc) / map(.loc), plus the t2 header now documents the
sitemap shape and the mock-from-schema offline story F3 made true.

manifest.yaml sha256_16 recomputed for both files (lean-hash algorithm
cross-verified against all 27 committed rows · 27/27 match). Both fixed
examples pass nika check clean with the built binary.

FOLLOW-UP (out of this repo's scope): the pack is vendored from the
nika-spec repo via scripts/sync-pack.sh — the SSOT needs the mirror
fix (examples + 03-dag.md + manifest) before the next re-vendor, or it
reverts this.

* refactor(nika-cli): extract output-mode + dry-run helpers from run()

The F4 --var block pushed run() to 114 lines and the F1 budget plumb
pushed attempt_loop to 101 — both past the 100-line ratchet. Extract
the --output validation (output_mode) and the dry-run plan render
(render_dry_run) into named helpers; compress the attempt_loop budget
comment. Behavior identical — the extracted code is verbatim, tests
unchanged and green (110 + 78 lib).

* feat(nika-cli): add nika test — golden outputs under mock (F7)

The v1 workflow-testing surface the field report asked for: users had to
hand-roll e2e harnesses (atlas ships one) because the verb tree had no
test/eval/lint. nika test <file> checks (ADR-092 ladder · same gate as
run), executes under the MOCK provider (deterministic + schema-conformant
since F3 — the base that unblocked this), captures the typed outputs: as
ONE canonical JSON (pretty · key-sorted · newline-terminated) and compares
against the sibling <file>.golden.json. --update (re)writes the pin; no
golden + no --update teaches how to create one (exit 3). Mismatch renders
a readable per-path diff (golden → run · capped at 20 rows) and exits 1.

Gates affected: Gate 3 (impl) + Gate 4 (clippy 0). Test delta: +8
(update-then-match · drift mismatch · missing-golden hint · dirty-file
findings · diff paths/missing/extra/cap · elision · golden-path mapping ·
canonical bytes). 118 nika-cli lib tests green.

* fix(workspace): quoted timeout fix-form + json failure envelope (F6)

(a) nika-schema · the NIKA-PARSE-010 bare-number rejection now shows the
author's OWN value quoted with a unit ("420s" for seconds · "7m" for
minutes) — the correction becomes a copy-paste, not a spec hunt (the
field report hit `timeout: 420` and had to guess the form).

(b) nika-cli · `--output json` failures now emit ONE machine envelope
{"error":{"code":"NIKA-…"|null,"message":"…"}} on stdout — it used to
stay empty (pre-run findings) or print bare `{}` (run failures), so a
machine consumer had to scrape stderr. Covers every failure class:
parse/check findings · --var refusals · composition/executor ENV
errors · executed-and-failed runs (the folded view's failed-row detail
carries the wire code). Codes are extracted, never invented.

(c) verified, no change: the NIKA-VAR-001 explain/fix hint already
names `--var` (shipped with F4 · explain.rs cli_fix_hint plus its
pinned test).

Gates affected: Gate 3+4. Test delta: +5 (envelope shape/one-line ·
code extraction incl. per-builtin and no-false-positive · findings-line
condensing · failed-view envelope + empty-view fallback · parse-010
quoted fix-form). nika-cli 122 + nika-schema 758 lib tests green.

* feat(workspace): underspecified schemas ride json mode locally (F2)

The field-report F2 wall: the translate-payload class ({type: object} ·
or head/sections declared shapeless) 400s on OpenAI strict mode, and
fully specifying a free-form payload recursively is impossible — the
only workaround was schema-free promptware (zero guarantees).

Conservative fix, zero YAML surface (ADR-098): when the task schema is
UNDERSPECIFIED (any object without properties · any array without items
in the tree) on a strict wire, do NOT forward it — request the
provider's native JSON mode (ResponseFormat::Json), steer the shape
through the prompt instruction, validate LOCALLY against the user
schema (the existing floor + bounded retry). Fully-specified schemas
keep today's strict path verbatim; anthropic keeps the instruction
fallback; the MOCK keeps receiving the schema (its strict mode
synthesizes from anything — F3/offline goldens depend on it).

Seams: nika-verb-infer SchemaWire enum (None/Strict/JsonMode/
Instruction) + is_underspecified iterative walker · nika-providers
WireFormat::strict_rejects_underspecified (openai-compat + gemini
true · mock + anthropic false) + the ResolvedProvider delegate.

Gates affected: Gate 3+4+6-adjacent. Test delta: +9 (detection cases ·
decision table · request mapping · {type:object} green on the REAL
openai adapter with the http seam mocked + json_object on the wire ·
fully-specified stays json_schema · mock synthesis non-regression).
nika-verb-infer 42 + nika-providers 145 lib tests green.

ADR: docs/adr/adr-098-underspecified-schema-json-mode-fallback.md
(proposed + implemented · alternatives: json:true sugar · full
recursive spec · schema tightening — all rejected with reasons).
Note: docs/adr/index.json is stale at HEAD (generator exits 1 on
ADR-096 · pre-existing) — index.toml regenerated with ADR-098.

* refactor(nika-cli): keep main() and run() under the fn-length cap

Behavior-identical extraction after the F6/F7 additions tripped the
100-line ratchet (main 102 · run 104): the run clap surface moves into
a dedicated RunArgs struct (the TraceArgs idiom) unpacked by run_verb();
the runtime composition block moves into composed_runtime() with its
full composition story preserved in the doc comment.

cargo test -p nika-cli --lib: 122 passed, 0 failed. clippy -D clean.
check-fn-length.sh: OK all fns <= 100 lines.

* docs(nika-verb-infer): drop the private intra-doc link to SchemaWire

The crate-level doc linked [`SchemaWire`] — a private enum — which
fails `cargo doc --document-private-items -D warnings` (hygiene vector
28 · Gate 8 extended per ADR-015). Plain backticks carry the same
story without the broken link.

* CLI wow: wave-group inspect, live lanes + ms, waterfall, verdict card ([#151](https://github.com/supernovae-st/nika/issues/151))

* feat(nika-cli): inspect renders waves as bordered parallel groups

The flat first-parent tree hid the scheduler's proof — waves were
counted in the header but invisible in the body. inspect now renders
each parallel wave as a bordered group ("N in parallel"), single-task
waves as bare rows, and flow arrows between waves, so the DAG's real
concurrency reads at a glance (CLI wow design 2026-07-05 §2a).

- one projector law kept: the render slices the SAME GraphDoc node
 order by report.waves sizes — nothing re-derived
- --ascii parity first-class on every new glyph (box → +-|, diamond
 → #, arrow → v) + a leak test pinning zero unicode under --ascii
- boxes cap at 74 inner cells (graceful under 80 cols · overlong rows
 truncate with a mark)
- the spec §6 DAG-check footer + engineering analysis are unchanged;
 --dry-run inherits the new plan render through the same verb

* feat(nika-cli): per-task time, spend and parallel lane markers

Time and money were footer-only — no per-task duration, no per-task
cost, parallelism invisible. The storyboard now carries them first-
class (CLI wow design 2026-07-05 §2b):

- settled rows show their REAL wall time (the runtime-measured
 duration_ms field wins · stamp-span fallback) right-aligned after
 the note column; per-task spend follows when the stream reported it
- the running/retrying row shows a LIVE elapsed against the latest
 stamp the fold has seen (still a pure fold — no wall clock leaks)
- new display/flow module reconstructs each task's interval as
 [end − duration, end] (frames stamp at settle time · the measured
 duration is the wall truth) and derives the ∥ lane markers from
 honest overlap; the run verb injects the check report's wave plan
 so markers speak the scheduler's truth (siblings only), replayed
 traces fall back to pure overlap
- retries counted + per-row start/end/cost stamped in the fold
- --ascii parity (∥ → ||) with a leak test; machine lanes untouched
 (--json NDJSON verbatim · --output json stdout unchanged)

* feat(nika-cli): post-run waterfall closes the TTY final frame

Where the seconds burned was invisible after a run — the answer lived
in the trace but nothing drew it. The Live (TTY) final frame now ends
with a wall-time waterfall + an outputs pointer (design §2c):

- one scaled bar per task that RAN, offset by its reconstructed
 interval ([end − measured duration, end] — the same reconstruction
 the ∥ markers use), so real overlap reads as overlapping bars
- failed bars paint red · running/retrying cyan · per-task spend rides
 the row · a dotted time axis closes the chart
- "outputs → key (type)" names what left the run (types only — a
 pointer, never a data dump into the scrollback)
- pure fold of the run's own event stream — zero new instrumentation,
 and a solo-task run stays chart-free (a single bar is noise)
- sober registers untouched: piped / --no-progress / --quiet / machine
 modes never grow chart art (pinned in the piped bin test) · --ascii
 parity for every glyph (bars → [#] · axis dots → .)

* feat(nika-cli): shareable verdict card + trace replay renders the flow

The final frame becomes the thing you paste in a README (design §2d):
a bordered verdict card closing every Live run and every trace read —
the mini DAG-shape glyph (wave sizes as diamond runs joined by flow
arrows · "###" " => " "#" in ASCII · plan-true when the run injected
the schedule, interval-reconstructed for a bare trace), the totals
(tasks · waves · retries · wall · spend · the models the stream
named), and an "outputs → key (type)" note for runs. No verdict → no
card (a mid-run card would lie). Wide waves cap at five diamonds,
long chains at six waves; the box never breaks (fit + one inner
width, pinned).

mini-ADR · replay surface naming
Question: where does "render the waterfall from a past trace" live —
extend "nika inspect --trace <file>", or a new subcommand?
Decision: NEITHER — it rides the EXISTING "nika trace show|replay".
Why: (1) house taste = fewest verbs: trace is already the flight-
recorder reader (replay = re-render, never re-execute), and the
waterfall IS a trace read, so it belongs there; (2) inspect is locked
as the STATIC anatomy — its own module doc says "run overlays belong
to the trace surface", and an --trace flag would fork one verb into
two registers; (3) zero new verbs, zero new flags: "nika trace show
run.ndjson" now closes on the waterfall + verdict card, and "trace
replay" ends its animation on the same final frame a live TTY run
paints. The machine lanes stay byte-frozen (--json / --output json).

---------

---------
 ([da874faf6](https://github.com/supernovae-st/nika/commit/da874faf6fb4c02c1c6ebadb6a16a994be5ac02f)) ([#153](https://github.com/supernovae-st/nika/pull/153))
- Durable-lite resume — --resume, visible cache hits, durable pause ([#154](https://github.com/supernovae-st/nika/issues/154)) ([91d7cf9bf](https://github.com/supernovae-st/nika/commit/91d7cf9bfb9848e2950ede531215662612105a7d)) ([#154](https://github.com/supernovae-st/nika/pull/154))
# Changelog

All notable changes to Nika are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
Nika follows real semver toward a **1.0.0** public launch (amended
D-2026-06-20-N1) — quality over speed. v0.90.0 is the first public release.

Nika Diamond is a ground-up rewrite on an orphan branch (`main` ·
renamed 2026-05-06 from `nika-diamond`). Legacy v0.79.3 lives on
`brouillon` (renamed 2026-05-06 from `main`). Diamond starts at v0.80.0.

**Version history.** The pre-Diamond engine (the v0.1 → v0.79.3 legacy
era) is preserved in the private `nikab-legacy` reference repo — its tags
and releases were removed from this public repository in the 2026-06-21
cleanup. This public repo carries the Diamond arc only: `v0.80.0-alpha.*`
(the rewrite history) and `v0.90.0` (the first public release). This
changelog tracks the Diamond rebuild from **v0.80.0-alpha** onward.

---

## [0.92.0](https://github.com/supernovae-st/nika/compare/v0.91.0..v0.92.0) - 2026-07-03

### ✨ Features
- **media** — Permits-audit + on-error-recover motion scenes ([5ea0658bb](https://github.com/supernovae-st/nika/commit/5ea0658bbb18f9376324dd441b945ca02fdda21e))
- **nika-browser** — Guard navigate against private/loopback SSRF ([e81720031](https://github.com/supernovae-st/nika/commit/e81720031543554aa02050640e4ebbb9084fd517))
- **nika-cli** — Wire codex — mcp wiring for the codex cli ([b8246605c](https://github.com/supernovae-st/nika/commit/b8246605cfb31b92ab32972e616e7980eeb8d523))
- **nika-cli** — Codex plugin + repo-level agent skill ([4db87a89a](https://github.com/supernovae-st/nika/commit/4db87a89a7e4590b3509a8b70af4b3918634b0e3))
- **nika-cli** — Nika init scaffolds the AGENTS.md hard rules + learning surface ([45668958f](https://github.com/supernovae-st/nika/commit/45668958fea7e4313054c99ddf6728ddce2589a2))
- **nika-mcp** — Add the learning tools — schema · examples · template · canon ([0b38d3b28](https://github.com/supernovae-st/nika/commit/0b38d3b28514e3dc96190e59edefbdb5ff67e8c7))
- **nika-verb-exec** — Scrub the engine's provider API keys from exec children ([fa7a503dd](https://github.com/supernovae-st/nika/commit/fa7a503dd4b7ce4afacb2b1c78acd6e39ab17282))
- **workspace** — Claude code marketplace — one plugin dir, two ecosystems ([7e4a0b800](https://github.com/supernovae-st/nika/commit/7e4a0b80025f3a304c3bf8d84bb77dddf8351db2))

### 🐛 Bug Fixes
- **nika-cel** — Compare int64 exactly, not through f64 ([406af0072](https://github.com/supernovae-st/nika/commit/406af0072500c4f48c6c9e003274544be099e333))
- **nika-cli** — Cold-first-run truth — readme dual-line + tip guard ([484ca318b](https://github.com/supernovae-st/nika/commit/484ca318b91268233b90069e225deb15d162303b))
- **nika-pack** — Vendor the egress-sanctioned templates from nika-spec ([ede60533c](https://github.com/supernovae-st/nika/commit/ede60533c62a9e49c181b654963c811a0752856e))
- **nika-schema** — Flag the shell-string + permits.exec allowlist pairing at check ([d096698b8](https://github.com/supernovae-st/nika/commit/d096698b8d63bdfa339924d1abc470683cd8e44f))
- **nika-verb-exec** — Restrict exec env keys to POSIX names ([e33384543](https://github.com/supernovae-st/nika/commit/e33384543793c5b65ec653774d1253f6c08a55de))
- **security** — Quick-xml advisory pair · xcap bump + documented ignores ([1c7faed69](https://github.com/supernovae-st/nika/commit/1c7faed695c9204ace1c819e9066d284caa2d89f))
- **workspace** — The hero one-liner is verified-real now ([1855ada6b](https://github.com/supernovae-st/nika/commit/1855ada6bcb39c6e0486f779fae531234f9ab756))
- **workspace** — The plugin's .mcp.json was gitignored out of the publish ([4af2f2d68](https://github.com/supernovae-st/nika/commit/4af2f2d68a045f0a9823d004aa44bd5ac70fd71a))

### 🔨 Refactors
- **kernel** — Remove the deprecated cost_usd field ([2b3c33edc](https://github.com/supernovae-st/nika/commit/2b3c33edc2c40c36e0c94b9627d3ef0ae994ab9b))
- **nika-builtin** — Split date/uuid out of data.rs before the LOC cap ([a0753e716](https://github.com/supernovae-st/nika/commit/a0753e716116c0deb26d316a3d97cd6415545dec))
- **nika-schema** — Drop the now-dead shell-form program lookup ([d664944dd](https://github.com/supernovae-st/nika/commit/d664944ddd9f5f442a77818730f9d4cc18aeb95d))

### 📚 Documentation
- **adr** — Resolve ADR-093/094 id collisions — agent ADRs to 096/097 ([#144](https://github.com/supernovae-st/nika/issues/144)) ([fb01a4966](https://github.com/supernovae-st/nika/commit/fb01a4966736335a40f8e5cb5e53009afbb36995)) ([#144](https://github.com/supernovae-st/nika/pull/144))
- **changelog** — Append v0.91.0 ([#139](https://github.com/supernovae-st/nika/issues/139)) ([12a60b3b1](https://github.com/supernovae-st/nika/commit/12a60b3b162f04e631f5593863382da369bf5c08)) ([#139](https://github.com/supernovae-st/nika/pull/139))
- **clarity** — Kill stale maturity claims across visitor-reachable files ([eaa966a16](https://github.com/supernovae-st/nika/commit/eaa966a16054019453ce6f893f421bf09f2b9585))
- **crate-specs** — Drop hardcoded workspace version (anti-drift) ([4133ac0ce](https://github.com/supernovae-st/nika/commit/4133ac0cea6fc9359e4779fed98414f1af6a2882))
- **crate-specs** — Nika-cap gate-1 spec — the capability boundary as L0 ([20740b3fc](https://github.com/supernovae-st/nika/commit/20740b3fc41d723f8852574f38df5bb45e64266b))
- **dx** — De-drift the .claude commands + crate-admit skill ([6c203d6d0](https://github.com/supernovae-st/nika/commit/6c203d6d040ac9de5743a3fe2dd06c463766c7d2))
- **examples** — Real mermaid plan from nika graph + checks-clean line ([0f166dba9](https://github.com/supernovae-st/nika/commit/0f166dba924ca11d577f937676e0d24cd7e6dfb6))
- **media** — Motion media pipeline + 3 real-capture brand assets ([1a257ba98](https://github.com/supernovae-st/nika/commit/1a257ba98846097293f622e6a1f3107b5874ed39))
- **media** — V2 polish — narrative beats, data-flow pulses, 16fps gifs ([c319ae1d6](https://github.com/supernovae-st/nika/commit/c319ae1d6b07e6b909ddb5786e4c678b2f044954))
- **media** — Og + github social-preview cards from the motion pipeline ([c622dd39a](https://github.com/supernovae-st/nika/commit/c622dd39a132684fdc7f979928ac4828a764a7ba))
- **media** — Editor-diagnostics asset — the audit as you type ([3f1cb9e09](https://github.com/supernovae-st/nika/commit/3f1cb9e09d058bf454788c6435373e6fa2be3fe7))
- **media** — Workflow-gallery asset — start from a workflow ([ec089cbf8](https://github.com/supernovae-st/nika/commit/ec089cbf81b6e48b9a3e7028641dfd62171ba3a0))
- **media** — Social poster pair — the wedge + the audit ([6630f8a78](https://github.com/supernovae-st/nika/commit/6630f8a78dee134fe382efd641f78c4820bda1b7))
- **nika-builtin** — Correct the nika:jq internal-cost comment ([7f00faf3e](https://github.com/supernovae-st/nika/commit/7f00faf3e653e3ca55c3a2de395d14cd12ea6a41))
- **nika-pack** — Vendor the em-dash-swept quickstart from nika-spec ([ecc69c37a](https://github.com/supernovae-st/nika/commit/ecc69c37a316240048edff9bb27bc6f42f1a02f5))
- **readme** — Wedge-first rewrite — run-today proof + example gallery surfaced ([e4ee6f08a](https://github.com/supernovae-st/nika/commit/e4ee6f08a0c3f7ff5ff0cd1d9f2ea96c37b76962))
- **readme** — Real terminal gif — check audits, run executes (96KB) ([2ed5520ce](https://github.com/supernovae-st/nika/commit/2ed5520ce30034904f3803f958e6a70c4c756a72))
- **readme** — Embed the permits-audit + on-error-recover captures ([9e047ae85](https://github.com/supernovae-st/nika/commit/9e047ae85799268988511cca21e69a9859de3e65))
- **readme** — Plugin install block in work-with-your-agents ([e3b6f3155](https://github.com/supernovae-st/nika/commit/e3b6f31559a30fc1e55c5d7a29fd8c6565aa5acc))
- **readme** — Plugin marketplace → the lean nika-agents repo ([76a1cf8ef](https://github.com/supernovae-st/nika/commit/76a1cf8ef7375664c836241c8ff5c063cdd40160))
- **roadmap** — Fix self-contradicting release scars ([5e4c13990](https://github.com/supernovae-st/nika/commit/5e4c13990ad3c5a6e9c07cfd67b42c72f289e4ce))
- **roadmap** — The 0.92→0.95 ladder — three admissions to 42/42 ([71aa58db4](https://github.com/supernovae-st/nika/commit/71aa58db4b63ce8d4a79b80a1048141356e63f11))
- **workspace** — Prose em-dash sweep in the readme ([3f20694e8](https://github.com/supernovae-st/nika/commit/3f20694e87a2d0f6697c591106c010efd015e1d6))
- **workspace** — Join the readme to the new site pages ([587ad053e](https://github.com/supernovae-st/nika/commit/587ad053ec5ef1291a4b5d4584240df169a52c56))
- **workspace** — The hero run is real — local model register everywhere ([b5e7fecec](https://github.com/supernovae-st/nika/commit/b5e7fececa1f184e0f0494816e926a6fd7f17f1b))
- Refresh version pointers to v0.91.0 / main 0.92.0-dev ([95962d5cd](https://github.com/supernovae-st/nika/commit/95962d5cdca68b0a7992acc0f5bab6f4fce20af0))
- Fix stale version + builtin-count drift across engine docs ([4092a87de](https://github.com/supernovae-st/nika/commit/4092a87ded4e14aad92acac72b7fbec37f7b343f))

### 📦 Build
- **hygiene** — Stop nightly drift-issue spam + resync status block ([#143](https://github.com/supernovae-st/nika/issues/143)) ([c64082276](https://github.com/supernovae-st/nika/commit/c640822766a89dc8d79a5a5509fb2a552392ce52)) ([#143](https://github.com/supernovae-st/nika/pull/143))

### 🧹 Chore
- **catalog** — Refresh nika-types public-api baseline ([4a59e2551](https://github.com/supernovae-st/nika/commit/4a59e2551860b20d4a5fde14f6121c2424c0baef))
- **ci** — Lock 8 more public-api surfaces — vector 38 ratchet 27/38 → 35/38 ([1f398ef9f](https://github.com/supernovae-st/nika/commit/1f398ef9fef4ec27593c1c5baceca3e6d39d33c9))

## [0.91.0](https://github.com/supernovae-st/nika/compare/v0.90.0..v0.91.0) - 2026-06-25

### ✨ Features
- **cli** — Add explicit nika onboarding wiring ([fce281a1a](https://github.com/supernovae-st/nika/commit/fce281a1a031a711441804aaa0c381cf69e66dc6))
- **nika-cli** — Examples run --model override + offline mock hint ([ede69ccfd](https://github.com/supernovae-st/nika/commit/ede69ccfd2b025af4575293742772d5c09adf3af))
- **nika-screen** — Optional xcap backend (default-off) for headless builds ([9f2281f05](https://github.com/supernovae-st/nika/commit/9f2281f0588b124a59fa9f9a9cb4eb08c29900c4))

### 🐛 Bug Fixes
- **ci** — Clippy excludes macOS-only metal feature on the Linux runner ([93b7990a9](https://github.com/supernovae-st/nika/commit/93b7990a94d3ac71bb87c66b2b97f0c5d6d4f4dc))
- **doctor** — Recognize workspace cursor mcp config ([723fcd9e2](https://github.com/supernovae-st/nika/commit/723fcd9e2220f42c787dfe523966768c929c8f56))
- **nika-a11y** — Atspi 0.29 API — Role::Button + direct zbus dep ([53c19ef88](https://github.com/supernovae-st/nika/commit/53c19ef88552cb637fcbeb7fbbdee814efc28edf))
- **nika-a11y** — Make the atspi walk future Send ([ed055d94d](https://github.com/supernovae-st/nika/commit/ed055d94dd52bc5d56e5c3133c72202170fdc256))
- **nika-a11y** — Cfg-gate macOS-only AX helpers (Linux dead-code) ([bd9645483](https://github.com/supernovae-st/nika/commit/bd9645483fe186db1532a43c646bfa3a3977af99))
- **nika-a11y** — Backtick PascalCase in the atspi doc comment ([6e8960f51](https://github.com/supernovae-st/nika/commit/6e8960f51180ebcc20bf5cc486873a69ba14ec07))
- **nika-catalog** — Gate pricing/capabilities-conditional imports ([6648a389f](https://github.com/supernovae-st/nika/commit/6648a389f03b2f6dde75211ac5d885b18e01317e))
- **nika-types** — Gate serde so the no-default-features build compiles ([05e0de2d9](https://github.com/supernovae-st/nika/commit/05e0de2d92df29c211bcf3d1cd52029045c9604f))
- **release** — Separate dev version from brew assets ([16b9ac480](https://github.com/supernovae-st/nika/commit/16b9ac480d44f6ee110c4537eea87d07bf29a8c1))
- **typos** — Exclude generated/fuzz + allowlist domain vocab ([33411ce7c](https://github.com/supernovae-st/nika/commit/33411ce7c78fca318d6e63c5a03e0769ff062210))

### 📚 Documentation
- **changelog** — Append v0.90.0 — auto-generated ([#133](https://github.com/supernovae-st/nika/issues/133)) ([a424d559b](https://github.com/supernovae-st/nika/commit/a424d559b05cb078fa46d6d42a68dfa095db1164)) ([#133](https://github.com/supernovae-st/nika/pull/133))
- **coherence** — Fix stale facts post-ship + tag-cleanup ([de6fcbf49](https://github.com/supernovae-st/nika/commit/de6fcbf4942569e11db9a3258aae43ab36b48c36))
- **kernel** — Retire forever-v0.x doc refs (real-semver cascade) ([5b60fa0aa](https://github.com/supernovae-st/nika/commit/5b60fa0aa4023c78b93e3f8c019f2ede39ad8e44))
- **readme** — Real brew install + zero-setup quickstart; fix version residual ([b2ba50821](https://github.com/supernovae-st/nika/commit/b2ba5082140b444b40b4b8b060d7350591d1be71))
- **readme** — Document curl install + add editor-support section ([55551e4ce](https://github.com/supernovae-st/nika/commit/55551e4ce3c984adea60040d66a2b04fde38840e))
- **readme** — Correct the install-script PATH note ([895ce3a11](https://github.com/supernovae-st/nika/commit/895ce3a1182b3788b0e9ffcf5ecf0ed356b2f497))
- **release** — Clarify main versus tagged binaries ([47ff5f5d5](https://github.com/supernovae-st/nika/commit/47ff5f5d581bfe77af587df96da02bd7bb3aec9d))
- **roadmap** — Current-state reflects v0.90.0 SHIPPED (first public release) ([38218ab7c](https://github.com/supernovae-st/nika/commit/38218ab7c7dcf60f11886f05bc861941245bb68b))
- **status** — Sync dev version projections ([60c5a7828](https://github.com/supernovae-st/nika/commit/60c5a78285711a3642a1f8ec64ba56dddb107ede))

### 📦 Build
- **diamond** — Pipewire dep + ignore unmaintained paste advisory ([450477646](https://github.com/supernovae-st/nika/commit/4504776466af1e7095828629748f0c2b59bd042e))
- **diamond** — Egl/gl deps + miri toolchain pin + typos allowlist ([26d1cd098](https://github.com/supernovae-st/nika/commit/26d1cd098a56520e99aad0f91eab9cc02550bdb3))
- **diamond** — Exclude xcap from clippy features (system-lib, like metal) ([bf5d91ddc](https://github.com/supernovae-st/nika/commit/bf5d91ddc128e1024874c26dbb25ffed7fa5cd70))

### 🧹 Chore
- **hooks** — Accept nika-<crate> + diamond/coherence commit scopes ([744d1202d](https://github.com/supernovae-st/nika/commit/744d1202d2d2a1ca11200823aa80bca6cd8f9d58))
- **hooks** — Add typos to the commit-scope allowlist ([c0f7c070b](https://github.com/supernovae-st/nika/commit/c0f7c070b9e42587b12733ce1e99f95c6ee680f9))

### 🦋 New Contributors
- @github-actions[bot] made their first contribution in [#133](https://github.com/supernovae-st/nika/pull/133)

## [0.90.0](https://github.com/supernovae-st/nika/compare/v0.80.0-alpha.4..v0.90.0) - 2026-06-21

### 🆕 Crates admitted
- **nika-a11y** — Admit to workspace — all 12 gates passed ([047e180d1](https://github.com/supernovae-st/nika/commit/047e180d196c984eab516fe17a9a6d5e3bbb00d6))
- **nika-blob** — Admit to workspace — all 12 gates passed ([e91adcef2](https://github.com/supernovae-st/nika/commit/e91adcef273eeb88f24ed8c91f8828581830cc4d))
- **nika-bm25** — Admit to workspace — all 12 gates passed ([36ca8c3ee](https://github.com/supernovae-st/nika/commit/36ca8c3eed8ab2154fd9a0db59bd1a6a6de39f26))
- **nika-browser** — Admit to workspace — all 12 gates passed ([e1bce0283](https://github.com/supernovae-st/nika/commit/e1bce0283165c33e4689f1eceab89c9ff8a9cf95))
- **nika-builtin** — Admit to workspace — 12 gates (Gate 5 via GATE5-EXEMPT budget) ([16142cf60](https://github.com/supernovae-st/nika/commit/16142cf605957539a6f4b3a03aec80b9ce5d029f))
- **nika-catalog-codegen** — Admit to workspace — 12 gates passed (10/12 + 2 deferred) ([23ab2fef8](https://github.com/supernovae-st/nika/commit/23ab2fef8e080e391374d359478adafb8a2543f6))
- **nika-cli** — Admit to workspace — all 12 gates passed ([a904c2db7](https://github.com/supernovae-st/nika/commit/a904c2db7196e77d1b21a72c6756aedc07ded9a1))
- **nika-clock** — Admit to workspace — all 12 gates passed ([74a8ff483](https://github.com/supernovae-st/nika/commit/74a8ff48373c80047dfd8c85142288e3d3a7a00f))
- **nika-event** — Admit to workspace — all 12 gates passed ([d009b1dd8](https://github.com/supernovae-st/nika/commit/d009b1dd8f46cd3cfaffaaff5dccef637b1dd913))
- **nika-exec-runner** — Admit to workspace — all 12 gates passed ([7ba7b51d8](https://github.com/supernovae-st/nika/commit/7ba7b51d8915638e3366717dbb010e7e7f332ab6))
- **nika-extract** — Admit to workspace — all 12 gates passed ([28ba11760](https://github.com/supernovae-st/nika/commit/28ba1176038e0d3200c47220bf6aa7328d7c20c5))
- **nika-fs** — Admit to workspace — all 12 gates passed ([47825df4a](https://github.com/supernovae-st/nika/commit/47825df4a460d01791bb7c5ad86eda1b7faab95b))
- **nika-http** — Admit to workspace — all 12 gates passed ([221c5d5a9](https://github.com/supernovae-st/nika/commit/221c5d5a98eed2e0720e7d55f91eb93c6c717858))
- **nika-input** — Admit to workspace — all 12 gates passed ([e4686eccb](https://github.com/supernovae-st/nika/commit/e4686eccbaf354e188eaecadf8a883b10b325ecf))
- **nika-kernel-ai** — Admit to workspace — kernel split step 3 (ai sibling) ([9eb6e225c](https://github.com/supernovae-st/nika/commit/9eb6e225c1c965f0fd60111428f8e585f43cf7b8))
- **nika-kernel-core** — Admit to workspace — kernel split step 2 (base sibling) ([7180576b0](https://github.com/supernovae-st/nika/commit/7180576b0377f79e0b3273cd5e6b82509390ad3b))
- **nika-kernel-plugin** — Admit to workspace — kernel split step 5 (plugin sibling) ([27bf36d78](https://github.com/supernovae-st/nika/commit/27bf36d788ab0b77fff52af579b565363a124ca9))
- **nika-kernel-runtime** — Admit to workspace — kernel split step 4 (runtime sibling) ([393ddef86](https://github.com/supernovae-st/nika/commit/393ddef86acbc64967b4acf6b72ef90ea01245ea))
- **nika-lsp** — Admit to workspace — all 12 gates passed ([85ba7f513](https://github.com/supernovae-st/nika/commit/85ba7f513fcebb3e6dbf6273dd91362ba874a552))
- **nika-mcp** — Admit to workspace — all 12 gates passed ([850f1219f](https://github.com/supernovae-st/nika/commit/850f1219ff6d42edda92b76af23c21c68689339b))
- **nika-ocr** — Admit to workspace — all 12 gates passed ([2541a9181](https://github.com/supernovae-st/nika/commit/2541a91818f4b2e0d3a6f7ebb84e24047cd6b7f2))
- **nika-pack** — Admit to workspace — all 12 gates passed ([5f37637c3](https://github.com/supernovae-st/nika/commit/5f37637c3cd8336a26d70d32071585d8ee7ee5dc)) ([#112](https://github.com/supernovae-st/nika/pull/112))
- **nika-providers** — Admit to workspace — all 12 gates passed ([9537dcf82](https://github.com/supernovae-st/nika/commit/9537dcf82c47ba1b5be3b40e9e80f2b8dfa798c1))
- **nika-runtime** — Admit to workspace — all 12 gates passed ([2e0386d3a](https://github.com/supernovae-st/nika/commit/2e0386d3a0603957d113b8522de9c4494d73b32a))
- **nika-schema** — Admit to workspace — all 12 gates passed ([99c4dfb00](https://github.com/supernovae-st/nika/commit/99c4dfb003b7b129021875f17c4ea9d0da56b7ae))
- **nika-screen** — Admit to workspace — all 12 gates passed ([181da3148](https://github.com/supernovae-st/nika/commit/181da3148868d5a41f22711489c1e3b8a1a18157))
- **nika-verb-agent** — Admit to workspace — all 12 gates passed ([0e2900d92](https://github.com/supernovae-st/nika/commit/0e2900d92e5ffb549f3ebe2e4b4e815f75a70089))
- **nika-verb-exec** — Admit to workspace — all 12 gates passed ([9b3284979](https://github.com/supernovae-st/nika/commit/9b3284979aaff149dd5ed1ef8e6c0fe82cba0e32))
- **nika-verb-infer** — Admit to workspace — all 12 gates passed ([c5a0b3e74](https://github.com/supernovae-st/nika/commit/c5a0b3e74d1be60a65e00eac9360848e7f347dd5))
- **nika-verb-invoke** — Admit to workspace — all 12 gates passed ([11c42947a](https://github.com/supernovae-st/nika/commit/11c42947a2a0cc9cc834a7db4e9cb6494962b16d))

### ✨ Features
- **adr** — Supersedes-DAG cycle detection + self-contained contract ([8c7559cd4](https://github.com/supernovae-st/nika/commit/8c7559cd49c602e2e0601b8674695bbd28922c5b))
- **arch** — Decide + gate the kernel I/O error convention (Pattern A universal) ([e72a3e12a](https://github.com/supernovae-st/nika/commit/e72a3e12ad9b682df7e22044baa729cf92c1da28))
- **ci** — Add check-crate-gates.sh emitting olympus CrateGates JSON ([01f18a381](https://github.com/supernovae-st/nika/commit/01f18a381bb50573ac4bde632f3b1952f8a84404))
- **ci** — Real executable Gate 5 — cargo-mutants kill-floor enforcement ([97c8ad476](https://github.com/supernovae-st/nika/commit/97c8ad47627cacf243bc0e810505ddd979fdc148))
- **ci** — Mutation cross-platform calibration + public-API coverage ratchet ([6dce16899](https://github.com/supernovae-st/nika/commit/6dce1689980b742eba9bce5ed649d64056983b9d))
- **ci** — Lift public-API coverage 5→15 + project the floor into CI ([9688a2916](https://github.com/supernovae-st/nika/commit/9688a29162400211e1f28a9da0eac6c6b3eec94e))
- **ci** — Floor public-API for nika-fs/http/blob (post-merge coherence) ([5097478c2](https://github.com/supernovae-st/nika/commit/5097478c2cd1ce19ef4a6afd9a0cc316485fb42d))
- **dx** — Wire HQ dashboard hooks + /dashboard command ([3a6c11e32](https://github.com/supernovae-st/nika/commit/3a6c11e32500955ea333f3694fa15527bb577157))
- **dx** — Live roadmap projection + fix layer-count digit regex ([c00e1d16b](https://github.com/supernovae-st/nika/commit/c00e1d16bcb10b2d24c259fb5936c96aabd8f706))
- **error** — Wire NIKA-601..604 memory subsystem codes · diamond w2.1 ([8a02d152f](https://github.com/supernovae-st/nika/commit/8a02d152f429f7c21cdbf35e4804c8629a9bb7af))
- **fuzz** — Cargo-fuzz harness · 2 targets · corpus · nightly ci ([1b91aebb8](https://github.com/supernovae-st/nika/commit/1b91aebb8e06e9f3bf1677f6cf7fe5821ed24ff1))
- **hooks** — Post-commit auto-fires olympus xtask in background (wave 3a) ([220e8d9cb](https://github.com/supernovae-st/nika/commit/220e8d9cb0488e93a5f4e737c1ca4a3cfecd9c5e))
- **hygiene** — Autonomous ecosystem hygiene stack — WAVE 1+2 ([a8c01194d](https://github.com/supernovae-st/nika/commit/a8c01194da213a4c3e4b4cb36cef1327f5ab4d3c))
- **hygiene** — Vector 23 — status-claims-sync (Phase B.2) ([17602d073](https://github.com/supernovae-st/nika/commit/17602d0733876e546cde1f6dd55fbb18e6209341))
- **hygiene** — Vector 12 three-tier file-LOC + clippy too_many_lines (B.3, ADR-023) ([2225ac52f](https://github.com/supernovae-st/nika/commit/2225ac52fa080c2e88c9fb53d7d971f3a2c2444b))
- **hygiene** — Vector 25 — L0 sibling-dep fanout cap (B.4, ADR-027) ([8d35a946d](https://github.com/supernovae-st/nika/commit/8d35a946df4f6dd2bc0acabeb310b1761b0a77a0))
- **hygiene** — +vector 30 cancel-safety docs on kernel async fn (batch i.b) ([65700834a](https://github.com/supernovae-st/nika/commit/65700834a076601a424dcec3b8de5df5b6c16a21))
- **hygiene** — +vector 33 layer-deps bans (batch i.b) ([4bb4082d8](https://github.com/supernovae-st/nika/commit/4bb4082d867b81c1867931064970e576afcd48bb))
- **hygiene** — 3 new gates — ADR-081 guard enforcement + supply-chain policy ([b9e0bd75d](https://github.com/supernovae-st/nika/commit/b9e0bd75db4f825ddc3982debfa57cc0295eeaa7))
- **hygiene** — Vector 37 — error one-voice doctrine enforcement ([9c05e88d6](https://github.com/supernovae-st/nika/commit/9c05e88d6f8b4e34846be9d796fa170bbdfb2fcb))
- **hygiene** — Crate-spec LOC anchors deterministic — projector + freshness gate ([dfb3f6266](https://github.com/supernovae-st/nika/commit/dfb3f62667c97831e273f6a29fe35bb71c1b7fd7))
- **kernel** — Type the Fs traits with FsError, not std::io::Result ([5c19de82f](https://github.com/supernovae-st/nika/commit/5c19de82ff4d62f75927bbf0ef5b113d194abf8f))
- **kernel** — Type input + browser traits — Pattern A 100% uniform ([88371e56d](https://github.com/supernovae-st/nika/commit/88371e56d5cf300049b1d39e424f724b7807a3f5))
- **kernel** — Command-sandbox seam — OS confinement for the exec child ([a9abd4c3e](https://github.com/supernovae-st/nika/commit/a9abd4c3e83434014d6b8e3cfaf54e705a4e9b52))
- **kernel-a11y** — M1.3 add l0.5 io::a11y sealed traits + dtos ([e969e351f](https://github.com/supernovae-st/nika/commit/e969e351fc40fba99031e4477094779a88f82af7))
- **kernel-browser** — M1.5 add l0.5 io::browser sealed traits + dtos ([92aaf9b3c](https://github.com/supernovae-st/nika/commit/92aaf9b3cad5b2fdfe84ff4a6996a07c2d289d32))
- **kernel-input** — M1.4 add l0.5 io::input type-state trait + dtos ([0b0406167](https://github.com/supernovae-st/nika/commit/0b0406167749737e6fdd2ce13754cebdb51c11f5))
- **kernel-mock** — Enqueue_ok_with_headers — header-carrying canned responses ([cd9c98f77](https://github.com/supernovae-st/nika/commit/cd9c98f771b1ce1f28b767675a80009e1e8995d2))
- **kernel-ocr** — M1.2 add l0.5 io::ocr sealed traits + dtos ([e0bfa5b26](https://github.com/supernovae-st/nika/commit/e0bfa5b26583cbbab59ebf0fde6d9e00f105c9fb))
- **kernel-screen** — M1.1 add l0.5 io::screen sealed traits + dtos ([344b853ba](https://github.com/supernovae-st/nika/commit/344b853ba08f68aac8cc08da0b78f7974f8f9036))
- **kernel-screen** — M2.1.b1 capture_stream additive trait method ([da0a83358](https://github.com/supernovae-st/nika/commit/da0a83358d99f66ffa4aa96a3feeb357b2d1e66e))
- **kernel-vision** — M1.6 add l0.5 ai::vision sealed traits + dtos · m1 sealed ([1d3ff38e6](https://github.com/supernovae-st/nika/commit/1d3ff38e69e83f21ae5e826d1dd73247c53d0369))
- **mintlify** — Rebuild introduction with live snapshot + journey table ([58e0ab47d](https://github.com/supernovae-st/nika/commit/58e0ab47d0cb95c60606312aa0b239d7c3e7f564))
- **mintlify** — Architecture tab — layers + FCI + L0 decisions + admission ([74f18e211](https://github.com/supernovae-st/nika/commit/74f18e2115a33b4edd49af41072b4b4bdf6eab8e))
- **mintlify** — Reference — providers catalog (32 providers, 7 dialects) ([245243a38](https://github.com/supernovae-st/nika/commit/245243a38851ddb6395b1b107972050e36bac595))
- **mintlify** — Reference — capability rules (49 rules, 4 match kinds) ([2594b3b8e](https://github.com/supernovae-st/nika/commit/2594b3b8e7c160f5456af769bd6ba55d543ed495))
- **mintlify** — Concepts — architecture + providers rebuilt from current state ([ad55454e5](https://github.com/supernovae-st/nika/commit/ad55454e5bd4e495882938d0e311bb36cd4b439e))
- **mintlify** — Getting-started — honest v0.80 pre-release framing ([5e18782db](https://github.com/supernovae-st/nika/commit/5e18782db288657929c55ceab5383adace6cae99))
- **mintlify** — Architecture — ADR index (35 records, 11 thematic groups) ([1a1f2fc03](https://github.com/supernovae-st/nika/commit/1a1f2fc03ee106d2c2124542fabd941e588d2b4e))
- **mintlify** — Changelog tab — releases + roadmap + forever-v0.x ([edc91bbf9](https://github.com/supernovae-st/nika/commit/edc91bbf92c8e9d98e06da344d088ab0d6c7f641))
- **nika-a11y** — M2.3.b1 spec + b2 skeleton + guard 3 redaction ([54716278b](https://github.com/supernovae-st/nika/commit/54716278bead055726a74b364cddbedb6b09c5f9))
- **nika-a11y** — M2.3.b3 wire macos axuielement walk + ref cache ([a3ec54ee8](https://github.com/supernovae-st/nika/commit/a3ec54ee8b6538586511bf12c9394647e3cd8eb6))
- **nika-a11y** — Cross-platform linux atspi backend + guard 3 fix ([6cbd8108a](https://github.com/supernovae-st/nika/commit/6cbd8108af29993bfbe241cc1e61c5001e20581d))
- **nika-a11y** — Error one-voice — A11yError speaks NikaErrorCode ([662daf30c](https://github.com/supernovae-st/nika/commit/662daf30cff6af2207788fd7b2cb72fb5827b4be))
- **nika-bm25** — W3 admission prep · gate 1 spec + gate 3 scaffold ([3444e4131](https://github.com/supernovae-st/nika/commit/3444e41310ba8601d33b23bd8ec262092254e430))
- **nika-bm25** — Gate 3 green · pure-algo bm25 kernel shipped ([92e5d39fb](https://github.com/supernovae-st/nika/commit/92e5d39fbfb4fa848c785beb1673b14b78c9b698))
- **nika-bm25** — Gate 6 proptest + gate 7 criterion bench ([2da7c1e24](https://github.com/supernovae-st/nika/commit/2da7c1e2494fbf3751b715a42ed46190babb55a8))
- **nika-bm25** — EagerIndex — the BM25S eager sparse scoring architecture ([1fe44af34](https://github.com/supernovae-st/nika/commit/1fe44af345cae9166bd9d4b7f4c1c7abc3c2d844))
- **nika-bm25** — Activate BM25+ — the reserved delta wired through both paths ([27fa7ed1f](https://github.com/supernovae-st/nika/commit/27fa7ed1f733ce7a3814b0897e3ed068165213c1))
- **nika-bm25** — Canonical bm25+ preset — the lv-zhai delta default ([2402ed4f5](https://github.com/supernovae-st/nika/commit/2402ed4f50e1b9de1f5ad2881377935eaa2702f2))
- **nika-bm25** — MaxScore dynamic pruning + the research-conformance suite ([b7e5634a0](https://github.com/supernovae-st/nika/commit/b7e5634a0131dc778f34a96ea0dd5e1507f4e400))
- **nika-bm25,adr-039** — Sota 2026 q2 expert convergence · 10 locks ([82741170f](https://github.com/supernovae-st/nika/commit/82741170fbe893c58989723154402b863367c071))
- **nika-browser** — Scaffold security core — guard 5 pure verify ([eb6f07e0d](https://github.com/supernovae-st/nika/commit/eb6f07e0d25a82ee392f421487a8b956be81b592))
- **nika-browser** — Wire chromiumoxide backend — B.3, smoke-verified ([3e348cc43](https://github.com/supernovae-st/nika/commit/3e348cc431f8661442eda6cb13596cf8cdd60bcc))
- **nika-browser** — Guard 5 occlusion hit-test — SOTA actionability ([24e401e93](https://github.com/supernovae-st/nika/commit/24e401e930e8964a48e87703fe89bdc8c47cc70e))
- **nika-builtin** — Seed the 22-builtin dispatcher — the real tool layer (s16 · WIP) ([4ab88adeb](https://github.com/supernovae-st/nika/commit/4ab88adeb221dd55b0a1a9490ea0c38051d91604))
- **nika-builtin** — Fold the 3-lens review — transient · wait until · date six · jq bounds ([1d3025a56](https://github.com/supernovae-st/nika/commit/1d3025a5671b271c713a272609877e9e0c3d3c4f))
- **nika-builtin** — Wire the nika:fetch extract modes (step 13) ([3923767a9](https://github.com/supernovae-st/nika/commit/3923767a91dda46c50da4b8758c01e5a5a3d717f))
- **nika-builtin** — Fetch truth pass — runtime pairing mirrors · Cow decode · feed bytes · battery ([bbd8a3c19](https://github.com/supernovae-st/nika/commit/bbd8a3c195fb52ad4458846ca0a0842944197223))
- **nika-builtin** — Charset-aware decode for fetch extract modes ([c1487cc8f](https://github.com/supernovae-st/nika/commit/c1487cc8f6799a1e09ea397b998bae7969e86708))
- **nika-builtin** — Conformance pair + tz honesty — binary write · status details ([eda483459](https://github.com/supernovae-st/nika/commit/eda483459228d94696b73f28519bff8728c2626d))
- **nika-builtin** — Three Rams quick-wins — notify data · validate structured · log level clamp ([2f4b47470](https://github.com/supernovae-st/nika/commit/2f4b474702ee04c1b306fafb1be37bb5697d2331))
- **nika-builtin** — Nika:write serializes structured content to JSON ([53a721fae](https://github.com/supernovae-st/nika/commit/53a721fae5c10173742e5658d0aa82c2e0bce76e))
- **nika-catalog** — Tag enum + ParseTagError + FromStr ([cc3a1482f](https://github.com/supernovae-st/nika/commit/cc3a1482fd999c7b48796d80f3fd22bd456cf277))
- **nika-catalog** — Add tags + extra_tags fields to Provider, McpServer, Embedding ([bc21e5c23](https://github.com/supernovae-st/nika/commit/bc21e5c23a116bbf09df0c800807446869e6620b))
- **nika-catalog** — Populate tags across 3 catalogs + sort/dedup assertions ([a848b1916](https://github.com/supernovae-st/nika/commit/a848b1916bf98ff9588e20d627a7adc639e109c8))
- **nika-catalog** — Cargo features for subset compilation ([ceccfc39b](https://github.com/supernovae-st/nika/commit/ceccfc39b51fdbad965f2edf5fe3b2d5fa45931f))
- **nika-catalog** — MCP safety-tag XOR enforcement + runtime tag invariants ([83a9afaf4](https://github.com/supernovae-st/nika/commit/83a9afaf4b3d9e15a6c51b321550a5d9b44c69c2))
- **nika-catalog** — Session 2b foundation — modality + tokenizer + param_flag ([4f43db883](https://github.com/supernovae-st/nika/commit/4f43db88373a354c4ef633077e781d444e64c93a))
- **nika-catalog** — Session 2b — grow ModelCapabilities + CapPatch + codegen (no new rules) ([b2b8ce190](https://github.com/supernovae-st/nika/commit/b2b8ce1905387d42ef10fc09e5da401a1b30af62))
- **nika-catalog** — Session 2b rules — 28 capability rules + per-rule provenance ([1e0fd93bf](https://github.com/supernovae-st/nika/commit/1e0fd93bfb94df71460770e60c41f97a95e81fa7))
- **nika-catalog** — Session 3 — add 4 providers + 14 capability rules ([4d085afb0](https://github.com/supernovae-st/nika/commit/4d085afb05e2e2556568b6018db09b4ad3338502))
- **nika-catalog** — Add TokenizerFamily::Qwen variant ([4dbbe5db9](https://github.com/supernovae-st/nika/commit/4dbbe5db953890f7a1d744f0fa7653c95157c87f))
- **nika-catalog** — Pricing — add cached_input / image / reasoning axes ([1b3ea2e26](https://github.com/supernovae-st/nika/commit/1b3ea2e26f75f09aa3e160204de573884812a927))
- **nika-catalog** — Add NIKA-230..235 catalog error codes ([41198ec08](https://github.com/supernovae-st/nika/commit/41198ec08434024506ddb5cd9667824d70790d41))
- **nika-catalog** — Add context_window_tokens + max_output_tokens fields ([0fcabf6ef](https://github.com/supernovae-st/nika/commit/0fcabf6ef4c028b6a31a71817381e8b5478ffd59))
- **nika-catalog** — Add JsonMode enum, delete StructuredOutputNative ([6b74109aa](https://github.com/supernovae-st/nika/commit/6b74109aaf6dd429d22f9b07c1deb2e3dfed0a06))
- **nika-catalog** — Add ModelCapabilitiesView trait (Cortex v0.95) ([a142575f7](https://github.com/supernovae-st/nika/commit/a142575f70428aa7a196a5572b16fa802c3ed0a1))
- **nika-catalog** — Add Matcher::ContainsAny with word-boundary anchoring ([f8bcca19c](https://github.com/supernovae-st/nika/commit/f8bcca19c8aeea83a769ed5a99dea67622758dfa))
- **nika-catalog** — Promote CapRule/CapPatch/Matcher to pub #[non_exhaustive] ([69f10f5a9](https://github.com/supernovae-st/nika/commit/69f10f5a9062ff4afb23ff8485730fbdad1030b5))
- **nika-catalog** — Add Region enum and CapRule region scope dimension ([bb0a8c6e9](https://github.com/supernovae-st/nika/commit/bb0a8c6e90f7944366fcb63c5d90f0a6abce8755))
- **nika-catalog** — Toml-driven pricing, split cache_write/cache_read ([9453971db](https://github.com/supernovae-st/nika/commit/9453971db2fe62d7fcc96883e03345e4fe46d023))
- **nika-catalog** — Add CatalogDataSource trait + OverlayOrigin enum ([e88c3a78c](https://github.com/supernovae-st/nika/commit/e88c3a78ce36aa11e597ac24aa6c2140fabba058))
- **nika-catalog** — Add criterion benchmarks for catalog hot paths ([5998c39fc](https://github.com/supernovae-st/nika/commit/5998c39fc62ada5a463a5003933f372d8d7b080a))
- **nika-catalog** — Add 6 new ParamFlags (OpenRouter vocab align) ([e9e77a258](https://github.com/supernovae-st/nika/commit/e9e77a258eea3176344623790a4563c62cde4ee7))
- **nika-catalog** — Add 3 new Modalities (Embedding, Speech, ImageGen) ([892d5aff5](https://github.com/supernovae-st/nika/commit/892d5aff540c8f09bbf43b2ad44bee2c25004491))
- **nika-catalog** — Add 4 new TokenizerFamilies (LlamaV4/Granite/Glm/Grok) ([5dc3f2735](https://github.com/supernovae-st/nika/commit/5dc3f27358f612451f2bd31ea65d8ffd4f57b481))
- **nika-catalog** — Add 7 new providers + capability rules ([0415880c7](https://github.com/supernovae-st/nika/commit/0415880c79c7d5ede9dac7963e891025e9002aff))
- **nika-cel** — Admit the cel-subset/0.1 expression engine (L0) ([af4c2f8b8](https://github.com/supernovae-st/nika/commit/af4c2f8b885318f12be5886f0e006b73d403e369))
- **nika-cli** — Seed the L4 operator surface — display fold + trace reader + e2e pipeline rehearsal ([9fe99a5f8](https://github.com/supernovae-st/nika/commit/9fe99a5f80543b336da5bc4afdc3dceb216d9573))
- **nika-cli** — The static verb suite — audit a workflow before a single token ([b64c1074f](https://github.com/supernovae-st/nika/commit/b64c1074fd7623d1a4100a2c8ff617521337f245))
- **nika-cli** — Explain teaches spec codes + PLAN says the true width ([7b837d3a1](https://github.com/supernovae-st/nika/commit/7b837d3a14acbbb43cdba5781d754d481ab03733))
- **nika-cli** — The §3.1 state machine completes — retrying + cancelled ([d718f426e](https://github.com/supernovae-st/nika/commit/d718f426e8de83a14ef51d6c0679585fc2094645))
- **nika-cli** — Inspect carries the engineering read ([f523a16ea](https://github.com/supernovae-st/nika/commit/f523a16ea73164cd6645c0ad68703f4aa349b9a8))
- **nika-cli** — New routes free-form intent to the best template ([dc17c22f8](https://github.com/supernovae-st/nika/commit/dc17c22f827e53d9ee3b97f1757860a1142517f0))
- **nika-cli** — The nika run composer foundation — production seams + the two bridges ([68ed4a44c](https://github.com/supernovae-st/nika/commit/68ed4a44c5cdcb42a9776dfa3d7ebc80d6d47ff5))
- **nika-cli** — Nika run — the verb executes a checked workflow for real ([10f4ccdd6](https://github.com/supernovae-st/nika/commit/10f4ccdd64079a208aaab4d0aacb2debb0a5aec3))
- **nika-cli** — Examples run flips from refusal to execution ([6c1c93f16](https://github.com/supernovae-st/nika/commit/6c1c93f16005d002f68ee962ea07bd6e7d8255c2))
- **nika-cli** — Wire the nika lsp subcommand ([d290d809e](https://github.com/supernovae-st/nika/commit/d290d809ebd2c7d3c78ad594f7a663300663b74c))
- **nika-cli** — Explain teaches per-builtin NIKA-BUILTIN-<NAME> codes ([8d7a81754](https://github.com/supernovae-st/nika/commit/8d7a81754f95280313e3b1b1b63301176834e856))
- **nika-cli** — Nika run --output json emits the outputs: contract on stdout ([6b8dab5ce](https://github.com/supernovae-st/nika/commit/6b8dab5ce9d71b35659831a18735910e36e2b751))
- **nika-cli** — Nika doctor — environment diagnosis (spec §8 floor) ([c4b6472f0](https://github.com/supernovae-st/nika/commit/c4b6472f0ed91d1861487c63838bb99101db5f03))
- **nika-cli** — Nika init — scaffold a repo (spec §2 floor) ([65d7e24fc](https://github.com/supernovae-st/nika/commit/65d7e24fc1aff2658fd6df5466e322fbe78bc9d6))
- **nika-cli** — Check warns about required inputs before run ([2d7753e43](https://github.com/supernovae-st/nika/commit/2d7753e436f602db66d372b802f1a888fc8525e6))
- **nika-cli** — Explain teaches the NIKA-PROVIDER namespace ([88b3e0e3e](https://github.com/supernovae-st/nika/commit/88b3e0e3ef4da15034c1f3dd7c44c86e7a195e01))
- **nika-cli** — Add --no-progress/--quiet/--dry-run run flags ([eb8c8d7f7](https://github.com/supernovae-st/nika/commit/eb8c8d7f790c0665544ac251b28a0fa44e7678c2))
- **nika-compose** — The agent's self-check is nika:compose, the 23rd builtin ([44b701ac8](https://github.com/supernovae-st/nika/commit/44b701ac8fb9435811cbbf5c66e8056454a7d1e6))
- **nika-error** — Add 23 L0 foundational types + evolve kernel DTOs (ADR-033) ([d7b55b1e5](https://github.com/supernovae-st/nika/commit/d7b55b1e5f7dd9c0ce01bce563374c1a22b97404))
- **nika-error** — Cost stdlib arithmetic + checked_add/sub + remove TrustLevel::Default ([83294e026](https://github.com/supernovae-st/nika/commit/83294e026b3c06d01c20054ad933b7cc0990649b))
- **nika-error** — Register M2 computer-use code ranges — NIKA-1000..1206 ([951b3af39](https://github.com/supernovae-st/nika/commit/951b3af396e15686a0f1cee3bc26e3c972351da7))
- **nika-error** — Register verb codes NIKA-430..433 in the registry ([7a2fa2317](https://github.com/supernovae-st/nika/commit/7a2fa2317e671acd85be85b538b109453d62ead0))
- **nika-error** — Register NIKA-467 agent-stalled ([fcd5b1002](https://github.com/supernovae-st/nika/commit/fcd5b10029f5796d9f39d2ad9cf9e24dbd022edc))
- **nika-event** — Close the vocabulary over the display contract — 6 kinds + EventClass ([3820b9039](https://github.com/supernovae-st/nika/commit/3820b9039ff2f82531c2c6e8232e0b535ca2bee8))
- **nika-event** — The agent-loop telemetry vocabulary — 5 kinds + EventClass::Agent ([ea4ee3188](https://github.com/supernovae-st/nika/commit/ea4ee3188e09a3bbbb888f4141a0baec7911837b))
- **nika-exec-runner** — Argv program-floor, shell-line tripwire ([2efc48492](https://github.com/supernovae-st/nika/commit/2efc48492f14c2422aead9595f285663f759a1c0))
- **nika-exec-runner** — Strip dangerous-env injection vectors ([d5e63886a](https://github.com/supernovae-st/nika/commit/d5e63886af77fe894c75adc718c13aeb67f9e0d5))
- **nika-exec-runner** — Process-group kill — reap grandchildren ([6c5b10743](https://github.com/supernovae-st/nika/commit/6c5b10743e3308f0265b3e89ce05bf6975e4ddc7))
- **nika-exec-runner** — Wire the OS sandbox into the spawn path ([05a624f7d](https://github.com/supernovae-st/nika/commit/05a624f7de977c3b13ded9f044b36f089b6f3ffc))
- **nika-extract** — Seed the fetch extraction pipeline — 8 modes, pure (s17) ([241b2ab32](https://github.com/supernovae-st/nika/commit/241b2ab32c42bd9aee489a13b87de317700ce924))
- **nika-extract** — Science-grounded extraction wave — boilerpipe cascade + sitemap truth + RFC 8288 ([6c838f514](https://github.com/supernovae-st/nika/commit/6c838f5149f9fe892bb62bbb9425fd0b560e66e9))
- **nika-extract** — Round-2 hardening — DoS depth guard + adversarial battery + JSON-LD ([e24c875ae](https://github.com/supernovae-st/nika/commit/e24c875ae925ad0a2d569361d2bf612716e3b4d7))
- **nika-extract** — Feed mode surfaces full content + author ([35277fdd9](https://github.com/supernovae-st/nika/commit/35277fdd9e2df981c1c9d8a50f5b8a11ec9e5f99))
- **nika-extract** — Metadata mode extracts schema.org microdata ([0297334d6](https://github.com/supernovae-st/nika/commit/0297334d6e2a99f9330c3c3217adaf136ea724ad))
- **nika-extract** — Article mode → Trafilatura-grade 3-stage cascade ([2f1e1d6d5](https://github.com/supernovae-st/nika/commit/2f1e1d6d5842119c4b6d4e9a62b2dc8ec5003f48))
- **nika-extract** — Resolve lazy-loaded images to the real URL ([d0eaf328b](https://github.com/supernovae-st/nika/commit/d0eaf328b80460a40c3b979368b1327febafb45e))
- **nika-extract** — Honor <base href> in links + metadata resolution ([2d952eda2](https://github.com/supernovae-st/nika/commit/2d952eda27fb320e25cb45cf5a45f204f87bc8b3))
- **nika-extract** — Metadata title/description fall back to og/twitter ([b161a941d](https://github.com/supernovae-st/nika/commit/b161a941d9e582346fd95841e14f8b063607b182))
- **nika-extract** — Absolutize og:image/og:url/twitter:image URLs ([9dab7d9d8](https://github.com/supernovae-st/nika/commit/9dab7d9d846fd858a3bb370927f3bc109a505fbe))
- **nika-extract** — Feed items surface attached media (enclosure + MediaRSS) ([ddaee5318](https://github.com/supernovae-st/nika/commit/ddaee5318a26614c4b34acbf09f9a7867832c973))
- **nika-http** — Resolver-enforced SSRF closes the TOCTOU window ([7fdf3ac9e](https://github.com/supernovae-st/nika/commit/7fdf3ac9eb3bff777beb1bef83b1c0f913af0244))
- **nika-http** — Compression + h2 + streaming-true timeouts — the transport wave ([00c262111](https://github.com/supernovae-st/nika/commit/00c2621112b75960a739d4b399fd89da285266a3))
- **nika-infer-local** — Native SOTA decode-time algorithms — min-p, repeat-penalty, token-mask ([27f070f22](https://github.com/supernovae-st/nika/commit/27f070f221467ce24cb4646d5ac2c98cf65f4c46))
- **nika-infer-local** — The candle backend — sovereign inference runs (ADR-091) ([320b94d39](https://github.com/supernovae-st/nika/commit/320b94d39e192851b53dd8fa1d869eef4289ce95))
- **nika-infer-local** — Top-nσ sampling — native, temperature-invariant (arXiv:2411.07641) ([c4a2f0e2d](https://github.com/supernovae-st/nika/commit/c4a2f0e2d7a404cb179ca39f48aa0231dbc157ba))
- **nika-infer-local** — V1 sidecar http server — tiny_http per adr-093 ([34bb2441e](https://github.com/supernovae-st/nika/commit/34bb2441e8dc22b23dc511f3794d6e0236b9fc56))
- **nika-infer-local** — 12-gate admission as the local inference sidecar ([c5052cd4a](https://github.com/supernovae-st/nika/commit/c5052cd4a8f59d9ea5bcf1c49edd7ec470377cea))
- **nika-input** — Scaffold security core — type-state + guards 1+2 ([95fcf4002](https://github.com/supernovae-st/nika/commit/95fcf40021bc4460e75b076b6d8f13ded3aeffe2))
- **nika-input** — Wire enigo backend — B.3 + 3-lens review fixes ([c27bd850e](https://github.com/supernovae-st/nika/commit/c27bd850efb6e595d6243c8e663c643954c69443))
- **nika-kernel** — Add forward-compat seams for v0.95 Cortex + v0.100 WASM (Batch B) ([b68e58d4b](https://github.com/supernovae-st/nika/commit/b68e58d4b298561be7ea28d13fe76d37425f62e8))
- **nika-kernel** — Add 6 L0.5 traits + sealing pattern + mocks (ADR-034) ([32088a76d](https://github.com/supernovae-st/nika/commit/32088a76de26124d2ca6f3b1f4aaaebadfc264b5))
- **nika-kernel** — Inferresponse.cost: option<cost> + structured DenialKind ([0e2c3938e](https://github.com/supernovae-st/nika/commit/0e2c3938e8284b92bc2590f56271f8ea67460a4a))
- **nika-kernel** — Migrate MemoryId to UUIDv7 + deprecate cost_usd ([64afe77e3](https://github.com/supernovae-st/nika/commit/64afe77e3f916d381a5073c0dcb01013702cd466))
- **nika-kernel** — Add HttpStreamResponse::new() + #[non_exhaustive] on 20 mocks ([0aa41e8fe](https://github.com/supernovae-st/nika/commit/0aa41e8fec6c18df6c47c1a42a6e44efdd8ebbc6))
- **nika-kernel** — Add 7 forward-compat seams for v0.95/v0.100 ([a536b03ec](https://github.com/supernovae-st/nika/commit/a536b03ec4bf3b8b678352adc8027cc991388003))
- **nika-kernel** — Add prelude re-export hub (Q7) ([d967f4a7a](https://github.com/supernovae-st/nika/commit/d967f4a7a099a04647147d00aa863280aee80540))
- **nika-kernel** — Add AuditSink trait (Q12 Phase B — compliance channel) ([4be9a00a5](https://github.com/supernovae-st/nika/commit/4be9a00a51eeb020810ad4b99b9ac233e850aab3))
- **nika-kernel** — Genai_attrs OTel semconv bridge (Q13 executed) ([1ff35b759](https://github.com/supernovae-st/nika/commit/1ff35b7597264be4674582bbe71cdee34ecbe3ce))
- **nika-kernel** — Reserve WasmPluginError OutOfFuel + Trap + PluginCallContext (wave 4a r4) ([368820e42](https://github.com/supernovae-st/nika/commit/368820e42a129f33c3b10bf5dd7d8e89f047bb8c))
- **nika-kernel** — Reserve MemoryLifecycle trait with consolidate+prune (wave 4a r5) ([ac46b9ca5](https://github.com/supernovae-st/nika/commit/ac46b9ca5c7fcebda3239e3e746bd916fbaf1ca7))
- **nika-kernel** — Reserve parent_span_id + span links on SpanGuard (wave 4b #1) ([861f09bc9](https://github.com/supernovae-st/nika/commit/861f09bc9bef5dc51fc910f1d3765af26b1517c2))
- **nika-kernel** — Seal MemoryRecall/Remember/Forget per ADR-078 step 1 ([d642ee19e](https://github.com/supernovae-st/nika/commit/d642ee19e0b88329ea87342e0549f7607f7fc43e))
- **nika-kernel-ai** — Reserve ai::audio seam — stt + tts + vad traits (R6) ([1f34f3cc0](https://github.com/supernovae-st/nika/commit/1f34f3cc0a602719040a16b9979bf08652b81d39))
- **nika-kernel-ai** — Type vision + audio errors — Pattern A complete ([6af181177](https://github.com/supernovae-st/nika/commit/6af18117716e2959a96d3e301a6a4cd7904debc6))
- **nika-kernel-ai** — The tool-definition seam — ToolDefinitionProvider ([bb412572f](https://github.com/supernovae-st/nika/commit/bb412572f8b7f3b115d8b13c50aadb4a71294209))
- **nika-kernel-core** — Redact credential headers in http Debug ([8fcf9193d](https://github.com/supernovae-st/nika/commit/8fcf9193dafb7bb6cc38f4c05f55ebd1ce54d48e))
- **nika-lsp** — Editor UX — hover on task refs + bracket completion trigger ([2a3ac4a66](https://github.com/supernovae-st/nika/commit/2a3ac4a660977de14ff2fc6730010e3a43aa7f50))
- **nika-mcp** — In-binary MCP server closes the v0.81 cli floor ([7070b4636](https://github.com/supernovae-st/nika/commit/7070b46367c6bf2c9705564b3ccba843dabfeb61))
- **nika-ocr** — M2.2.b1 spec + b2 skeleton — ocrs backend, NIKA-1100..1109 ([a8013d62d](https://github.com/supernovae-st/nika/commit/a8013d62da4ee81504582ecebcf37be9bd367d2e))
- **nika-ocr** — M2.2.b3 wire real ocrs inference, close skeleton ([0a95cb157](https://github.com/supernovae-st/nika/commit/0a95cb1572cf4c3173c4933a575e2700c7fca30d))
- **nika-ocr** — Error one-voice — OcrError speaks NikaErrorCode ([a9d8ccbf4](https://github.com/supernovae-st/nika/commit/a9d8ccbf4b52984a8e632069d93fc6e835a2b48a))
- **nika-pack** — The 49-code registry + the emitted-within-registered ratchet ([990259c10](https://github.com/supernovae-st/nika/commit/990259c109ede3b497550700915b985b5083d8ce))
- **nika-providers** — Wire the gemini adapter — 14/14 providers ([5c50ffaa0](https://github.com/supernovae-st/nika/commit/5c50ffaa009847c014835baea7b04ac3cab558b6))
- **nika-runtime** — V2 spec-parity engine — concurrency + the full task pipeline ([dbb65c2c4](https://github.com/supernovae-st/nika/commit/dbb65c2c4765de87d46d6ba3d9f0bf5849b4abc5))
- **nika-runtime** — Property battery + jitter-herd fix — round 2 of the socratic pass ([2580838b6](https://github.com/supernovae-st/nika/commit/2580838b697e14455963a1e7c09f46d9e071fc82))
- **nika-runtime** — Agent telemetry wired — decisions on the canonical stream ([e269670e9](https://github.com/supernovae-st/nika/commit/e269670e914408ef23d4089f0b48772f3a9d9433))
- **nika-runtime** — Enforce permits.exec at the exec sink (NIKA-SEC-004) ([7c6cd9ceb](https://github.com/supernovae-st/nika/commit/7c6cd9ceb9350355e899bc454b08ec34c0319290))
- **nika-runtime** — Evaluate full cel-subset/0.1 via nika-cel ([0ae3c4f41](https://github.com/supernovae-st/nika/commit/0ae3c4f41ee6caf60825970fb511d7d1772a3569))
- **nika-runtime** — Output named-bindings + exec structured capture ([46e3f18fe](https://github.com/supernovae-st/nika/commit/46e3f18feac48a1f860d12387bd019e1d76ceb94))
- **nika-runtime** — Resolve workflow secrets from env/file at runtime ([b3264e4d7](https://github.com/supernovae-st/nika/commit/b3264e4d7c32a97aaef928e958309a6e5c31a8f9))
- **nika-runtime** — Warn on a reasoning model's blank answer (OBS-E) ([f18fef511](https://github.com/supernovae-st/nika/commit/f18fef51159734a02efe09510516068fc3cf81c4))
- **nika-sandbox-seatbelt** — MacOS command sandbox — adversarially verified ([c0941f145](https://github.com/supernovae-st/nika/commit/c0941f1450ac0808b22fb71ba9063bd33bb5c201))
- **nika-schema** — Scaffold crate — source tracking + error types (Round 1a) ([668a3b8bc](https://github.com/supernovae-st/nika/commit/668a3b8bc069f7ab41efb73ee3c92192fd9dc9cf))
- **nika-schema** — Add types module — 19 workflow config types (Round 2a) ([1cda7c5d0](https://github.com/supernovae-st/nika/commit/1cda7c5d05ec7bbaf0c3fdfd53ffc20a542822a3))
- **nika-schema** — Add trust, guardrails, and raw AST modules (Round 2b) ([9604d784e](https://github.com/supernovae-st/nika/commit/9604d784e25fca9e9bdde6c03f324f66e43058ee))
- **nika-schema** — Parser skeleton — top-level scalars (Round 2c) ([b85b612ca](https://github.com/supernovae-st/nika/commit/b85b612ca14bdeaee09553b6637b740c3a0677dd))
- **nika-schema** — Task-list parsing with action discriminator (Round 2d) ([2480822df](https://github.com/supernovae-st/nika/commit/2480822df8d40c3c1ce13f77a572294630bf910f))
- **nika-schema** — Task depends_on, condition, for_each (Round 2e-part-1) ([eac346c71](https://github.com/supernovae-st/nika/commit/eac346c71049282b6714c7e1e0fb243dbd9199d0))
- **nika-schema** — Codegen · invoke.tool no-drift gate + ADR-085 ([51ee7195a](https://github.com/supernovae-st/nika/commit/51ee7195a2948e39ecf46e6ee5923b4e197a3a47))
- **nika-schema** — Canonical v1 types — secrets, vars, retry, on_error, duration ([333ab9e9c](https://github.com/supernovae-st/nika/commit/333ab9e9c24401b7838e848bc931a1ff2cc1fcb5))
- **nika-schema** — Canonical raw ast + error taxonomy — envelope, task, verbs ([e5435fa2f](https://github.com/supernovae-st/nika/commit/e5435fa2fe009ed663185755e5d14d3d3d9abcba))
- **nika-schema** — Parser rewrite — canonical keys, strict/lenient, 4 verbs ([cf45bc7cf](https://github.com/supernovae-st/nika/commit/cf45bc7cf42727e05c6a30bf0d47cd34d88739a0))
- **nika-schema** — Expression module — CEL v0.1 subset, hand-rolled L0 ([abb2de0d6](https://github.com/supernovae-st/nika/commit/abb2de0d6e9633be025cb2341f9b739667aa7958))
- **nika-schema** — Analyzer — DAG topology, namespace resolution, when shape ([1e0a0ab68](https://github.com/supernovae-st/nika/commit/1e0a0ab68e9f4c804511a9894d197e76aaa6da3c))
- **nika-schema** — Spec-facing error codes — NIKA-<NS>-<NNN> surface ([a50f45bc7](https://github.com/supernovae-st/nika/commit/a50f45bc75a7ee4258b9dcec25454d628778e8e8))
- **nika-schema** — Core conformance harness + spec examples — 46/46 GREEN ([207a8db2e](https://github.com/supernovae-st/nika/commit/207a8db2e2763e3b3543ba981169d0cfa410c05f))
- **nika-schema** — One-obvious-way lint pass · 7 spec preference rules ([d3d62f797](https://github.com/supernovae-st/nika/commit/d3d62f7970c44b7ad4a35c51869baf593871f4be))
- **nika-schema** — Static binding validation · NIKA-VAR-003 at parse time ([752207aaa](https://github.com/supernovae-st/nika/commit/752207aaa9f035cf87ee91f3b3294862a4a98c9b))
- **nika-schema** — Parse the permits capability boundary ([9dfe2fda6](https://github.com/supernovae-st/nika/commit/9dfe2fda699dd9b7a2498bf8230613793beb5499))
- **nika-schema** — The check module — the nika check static pre-flight ([c369fc7ba](https://github.com/supernovae-st/nika/commit/c369fc7ba482393b854bc0f00a533199f7492c35))
- **nika-schema** — Runnable check example — the pre-flight, available now ([057b4bdd1](https://github.com/supernovae-st/nika/commit/057b4bdd15de30f7542f7083078525e5c7a02540))
- **nika-schema** — Cel parser learns cel-subset/0.1 — ternary, has, string tests ([5ad47b298](https://github.com/supernovae-st/nika/commit/5ad47b298644be245596048c723f15d5b335e4a6))
- **nika-schema** — Cost ceiling accounts for for_each fan-out ([c391e6183](https://github.com/supernovae-st/nika/commit/c391e61834839daa1bbc41ff18cf03b6b09e27df))
- **nika-schema** — Exec command string|array — the argv injection-safe form ([0a26e8703](https://github.com/supernovae-st/nika/commit/0a26e8703c57c374eaa4380b8ddfbffe6da75887))
- **nika-schema** — Spec catch-up — the four static-validator gaps close ([#121](https://github.com/supernovae-st/nika/issues/121)) ([0168f4abf](https://github.com/supernovae-st/nika/commit/0168f4abfd8360a1fc55c759b30dbf6257e7b087)) ([#121](https://github.com/supernovae-st/nika/pull/121))
- **nika-schema** — Deep conformance tier + DAG-004 + the registry remaps ([#122](https://github.com/supernovae-st/nika/issues/122)) ([3f3439cb2](https://github.com/supernovae-st/nika/commit/3f3439cb23b1f614ac0408a90202ad3ea80ecacd)) ([#122](https://github.com/supernovae-st/nika/pull/122))
- **nika-schema** — Ifc taint engine — provable information-flow control (ADR-092) ([1d1d231cd](https://github.com/supernovae-st/nika/commit/1d1d231cd749826daf5a5260ac42b8bb851be37e))
- **nika-schema** — Capability inference — --infer-permits (adr-092 #2) ([7b634d600](https://github.com/supernovae-st/nika/commit/7b634d60053c21839ceff33ee1e6d0c94508d3a1))
- **nika-schema** — Dataflow schema typing — typo'd fields caught statically (adr-092 #4) ([db7178c10](https://github.com/supernovae-st/nika/commit/db7178c1052ef92e432010de3af9b0cadcadcf75))
- **nika-schema** — Structural cost interval — retry and when:-aware envelope (adr-092 #5) ([e97e1e2a0](https://github.com/supernovae-st/nika/commit/e97e1e2a03441d60f33e709cc1d30d01f62dba56))
- **nika-schema** — Agent intelligence layer — deterministic suggestions + json repair surface ([1345259c6](https://github.com/supernovae-st/nika/commit/1345259c6dc937f37486e21b7564a9edbe294d16))
- **nika-schema** — Improvement hints — the deterministic ameliorateur ([3122669a4](https://github.com/supernovae-st/nika/commit/3122669a4cb7517eb3ebecd2a70dc97c6063b8b3))
- **nika-schema** — Analyzer did-you-mean + infallible maximal check report ([f82e2b2ef](https://github.com/supernovae-st/nika/commit/f82e2b2ef918dfc34e93d784dc17d597dc57e55f))
- **nika-schema** — Strictness hint — deterministic structured-output shape ([b1f395282](https://github.com/supernovae-st/nika/commit/b1f395282677e339bcbd325a377e6b68d79a6b07))
- **nika-schema** — Close the untrusted-input bound trio + bank proptests ([dcb76d1f1](https://github.com/supernovae-st/nika/commit/dcb76d1f119e68da58442a2337a29a6ba21c4327))
- **nika-schema** — Check example visual polish — DAG lanes + the colour seam ([c3a62b8ec](https://github.com/supernovae-st/nika/commit/c3a62b8eccf0c75f7853ed5bf62dfbed7ce8aba6))
- **nika-schema** — Builtin arg-shapes close four ledger rows + the lints corpus moves to the spec ([#123](https://github.com/supernovae-st/nika/issues/123)) ([af19c751f](https://github.com/supernovae-st/nika/commit/af19c751f4a0de132cc5dc16d610f5a5ca12872f)) ([#123](https://github.com/supernovae-st/nika/pull/123))
- **nika-schema** — Canonical theme — Role taxonomy + verb-gate colour logic ([3c69cfd2f](https://github.com/supernovae-st/nika/commit/3c69cfd2ff58ec4ff03bb7e4443bcca1ccb2df6e))
- **nika-schema** — Theme owns the glyph grammar too — first-class ASCII set ([2da0174b8](https://github.com/supernovae-st/nika/commit/2da0174b82a41aacb2566459fdd6443ae449c95d))
- **nika-schema** — Rustc-grade span diagnostics — source excerpts under findings ([634570aa3](https://github.com/supernovae-st/nika/commit/634570aa3df59580e0e53fed8cf6ef2781439b59))
- **nika-schema** — The verb theater — four execution models, animated ([10176204e](https://github.com/supernovae-st/nika/commit/10176204e1300d64028bda1602538da680761bfa))
- **nika-schema** — The event tape — real telemetry, one truth, two renderers ([d2fcfaf4d](https://github.com/supernovae-st/nika/commit/d2fcfaf4d4094aabef1541a0c732c8707888bda3))
- **nika-schema** — The tape speaks the full vocabulary — retry arc, stream, live meters ([a0b839829](https://github.com/supernovae-st/nika/commit/a0b839829a174df0818979b6c7b83201ba5c67c7))
- **nika-schema** — The third renderer — NDJSON wire for the event tape ([517798c31](https://github.com/supernovae-st/nika/commit/517798c31183d0abf754986b4701ea6cf5c99392))
- **nika-schema** — Ladder #6 — when:-gate reachability, arXiv-grounded, no SMT ([ddfff6198](https://github.com/supernovae-st/nika/commit/ddfff6198961b7953068930e75048a2d8f3ebe9f))
- **nika-schema** — Ladder #7 — the run certificate (AARA degree-1, no solver) ([fbdcd1684](https://github.com/supernovae-st/nika/commit/fbdcd16841fb85a567bc7b16d23999df1c7742a9))
- **nika-schema** — Parametric spend axis + ladder #9 first slice (metamorphic) ([2e6d045d1](https://github.com/supernovae-st/nika/commit/2e6d045d1f9db18bc309b977796ad4469fe20f90))
- **nika-schema** — Fetch arg-shape rules — closed mode set + pairings ([98db1a815](https://github.com/supernovae-st/nika/commit/98db1a815ed0b2fb98b35e9f742c0c27c1c58ef8))
- **nika-schema** — The certificate becomes CERTIFYING — witness + audit checker ([89ae459f4](https://github.com/supernovae-st/nika/commit/89ae459f4e6c91b49c205010a80990a9b0833378))
- **nika-schema** — The span axis + the research-conformance suite ([182f30807](https://github.com/supernovae-st/nika/commit/182f30807d5e7f9cb674d284c3e30cee134459a4))
- **nika-schema** — Fetch requires url — the check-time net widens ([5d3ae81c7](https://github.com/supernovae-st/nika/commit/5d3ae81c75e0ebecbdd2f32359dd21d18a0cec68))
- **nika-schema** — The parallelism rung — exact width, pinch, blast ([c929ee0dd](https://github.com/supernovae-st/nika/commit/c929ee0dd9cd9c63ea1f207fb6148c009e6e441f))
- **nika-schema** — Retry-effects hint — at-least-once made visible ([275a3ce1e](https://github.com/supernovae-st/nika/commit/275a3ce1e88439ecc55b9de97809a0126ed6e4b1))
- **nika-schema** — One-obvious-way/008 — steer to the injection-safe array form ([09255b4ff](https://github.com/supernovae-st/nika/commit/09255b4ffb26c3b4a400b731a12b6cc6ad938bd8))
- **nika-schema** — Arg-injection rule-pack — the array-form differentiator ([10623905b](https://github.com/supernovae-st/nika/commit/10623905b7f9393b8797bc82010c32914f6aa386))
- **nika-schema** — Sanctioned secret egress (IFC declassification) ([636de96ae](https://github.com/supernovae-st/nika/commit/636de96ae1dfbea79ae5c3a28bbd95333767027c))
- **nika-schema** — Flag unknown builtin arg keys in nika check ([e9f0a5f59](https://github.com/supernovae-st/nika/commit/e9f0a5f5971938eef90e536cf29b90a1af17fe6a))
- **nika-schema** — Cost pre-flight counts a static vars-array for_each ([102e99ed9](https://github.com/supernovae-st/nika/commit/102e99ed9f44209d9f83fbf02b9a13a981c7000e))
- **nika-schema** — Schema check catches enum/type + numeric-bound conflicts ([fda7e38f3](https://github.com/supernovae-st/nika/commit/fda7e38f354a148e8f577f17ac0021a3efd14da1))
- **nika-schema** — Static jq compile-check closes deep-gap 006 ([b2a62e7ad](https://github.com/supernovae-st/nika/commit/b2a62e7ad0a65399f1b604c190d859d79573a7a0))
- **nika-schema** — Static schema meta-check closes deep-gap 005 ([c82036db6](https://github.com/supernovae-st/nika/commit/c82036db685c8e4638c71a046d09f1046e69f441))
- **nika-schema** — One-obvious-way/009 warns on bare-iterator output bindings ([7fd27776d](https://github.com/supernovae-st/nika/commit/7fd27776de5465eef6b5e75fdb1ccef0495cd01f))
- **nika-screen** — Error one-voice — ScreenError speaks NikaErrorCode ([1cfbc8812](https://github.com/supernovae-st/nika/commit/1cfbc88123d7d2a3c7a5deb71dc9d71f3d22a418))
- **nika-types** — Gate no_std/alloc seam (Phase F1 — forward-compat WASM) ([d48db4897](https://github.com/supernovae-st/nika/commit/d48db48976833c299705e9b0e4a68865601ba1d3))
- **nika-types** — Reserve EmbeddingSpec (wave 4a r1, adr-029 seed) ([001ae0b6f](https://github.com/supernovae-st/nika/commit/001ae0b6f2680e4086621036203871087445f43d))
- **nika-types** — Reserve trust on MemoryFrameRef + tenant on RecallQuery (wave 4a r2+r3) ([41e8a1467](https://github.com/supernovae-st/nika/commit/41e8a1467212aa4cd6bcb6eb08a25d91bf42cbd9))
- **nika-types** — Add Timestamp + WallDuration value types (q9, wave 4b #3 seed) ([c5d292b6e](https://github.com/supernovae-st/nika/commit/c5d292b6eb8d28c60452a81d856b6a7bd379ada8))
- **nika-types** — Docid + score + rankeddoc newtypes for 9-satellite cascade ([3ae189ae7](https://github.com/supernovae-st/nika/commit/3ae189ae79c8b989713111c3e59e0eacf13f0f0c))
- **nika-types** — Extract-mode vocabulary — closed stdlib v0.1 set ([0ea48316c](https://github.com/supernovae-st/nika/commit/0ea48316c442a62b466aaa40bb5affe7670431bd))
- **nika-types** — Delay_for_ms — the shared backoff-with-jitter semantics ([2c5ee514c](https://github.com/supernovae-st/nika/commit/2c5ee514c472ca6621f17a6c69eb92264c9ed130))
- **nika-types** — Retry budget + retry-after honoring — the anti-storm kit ([f373fd645](https://github.com/supernovae-st/nika/commit/f373fd645b4c427ea52df6795e804525d8f9db44))
- **nika-verb-agent** — The intelligence layer — routing, stall guard, compose, telemetry ([f252b1500](https://github.com/supernovae-st/nika/commit/f252b1500129dd2ba086a4d31a4050709e5ed438))
- **nika-verb-agent** — Run_observed — the run-scoped observer seam ([56885ef3d](https://github.com/supernovae-st/nika/commit/56885ef3d0eed07b8071fee2f61a4e2707ebfee8))
- **nika-verb-agent** — Parallel intra-turn dispatch — concurrent resolve, request-order fold ([397d79e84](https://github.com/supernovae-st/nika/commit/397d79e84b3734663a3c8f3648020614f69c0244))
- **nika-verb-exec** — Scaffold the s10 L2 verb crate — WIP pre-admission ([733c113d8](https://github.com/supernovae-st/nika/commit/733c113d8f8a7f76a50ba5b3ab7cbbd91da34cb5))
- **nika-verb-exec** — Real argv execution, no shell (injection fix) ([75d8e59cb](https://github.com/supernovae-st/nika/commit/75d8e59cb13397aab88b3086568ae83a60149343))
- **nika-verb-infer** — Scaffold the s9 L2 verb crate — WIP pre-admission ([cf4783180](https://github.com/supernovae-st/nika/commit/cf478318096b9dc19e0ca9f739f25eaa27ce56f2))
- **nika-verb-invoke** — Scaffold the s11 L2 verb crate — WIP pre-admission ([da1d55d96](https://github.com/supernovae-st/nika/commit/da1d55d960cb454dd2c5db1477350c0a1925813f))
- **schema** — Static missing-required-arg check for all 22 builtins ([8456f1f6e](https://github.com/supernovae-st/nika/commit/8456f1f6e3909c6d83987837868c5ec36c39a61c))
- **screen** — M2.1.b2 crate skeleton + nika-1000..1009 codes ([546fb201c](https://github.com/supernovae-st/nika/commit/546fb201cb1b7b4fbf97998fa22edda2cbf0e6dc))
- **screen** — M2.1.b3 single-shot capture via xcap · close skeleton ([cf9d4cd80](https://github.com/supernovae-st/nika/commit/cf9d4cd80c7461b19352da9e40b77eb08bb65849))
- **screen** — M2.1.b4 capture_stream via mpsc · skeleton fully closed ([08a5c180a](https://github.com/supernovae-st/nika/commit/08a5c180a84c923d320139a895e840b6459a49c2))
- **screen** — M2.1.b5 adr-081 guards 6+7 real + enforced ([0daec9bf7](https://github.com/supernovae-st/nika/commit/0daec9bf7c0998b8cd28dc5eed97ced63c1fd803))
- **screen** — M2.1.b6 12-gate close · gap-3 shim carry-forward ([e975320cd](https://github.com/supernovae-st/nika/commit/e975320cd772026961d194cbd9c1e6fd245eafa6))
- **workspace** — Scaffold nika-infer-local — sovereign inference seam (ADR-091) ([00ed3ee96](https://github.com/supernovae-st/nika/commit/00ed3ee968a8221782240d593247308072cac3e0))
- **workspace** — Nika-infer-local generation-control core — template, sampling, stop ([9ef8f4a4a](https://github.com/supernovae-st/nika/commit/9ef8f4a4a6293c56a4146226cd2109dfaf7f65f4))

### 🐛 Bug Fixes
- **release** — Bump post-0.90 development to `0.91.0-dev` and fail releases whose tag does not match the Cargo workspace version, preventing Homebrew/local binaries from sharing a version while exposing different CLI flags.
- **adr** — Address review P0 + P1 findings from 3-agent swarm ([9a395bb6f](https://github.com/supernovae-st/nika/commit/9a395bb6ff782e4efbb35d3920418b540a6a93bb))
- **adr** — Resolve 13 relationship asymmetries + harden scripts ([baa680cac](https://github.com/supernovae-st/nika/commit/baa680cace9e23c91ecfe590eddc6ee387c7838e))
- **adr** — Refresh evidence paths for kernel subdir reorg ([fcbb00841](https://github.com/supernovae-st/nika/commit/fcbb008418540c50fc393051b27090af773f3b8f))
- **adr** — Adr-034 requires add adr-016 · close adr-016 enables backref ([9745be740](https://github.com/supernovae-st/nika/commit/9745be740d93e439aa54c38d0da251c73056cdd2))
- **adr** — Adr-007 + adr-014 related add adr-016 · close cascade backrefs ([ee841d42f](https://github.com/supernovae-st/nika/commit/ee841d42f211c655f7d3bd3ae58add2bc225893e))
- **adr** — Batch close 54 bidirectional related backrefs · diamond w2 cascade ([4e8ca67a7](https://github.com/supernovae-st/nika/commit/4e8ca67a7f98f1cb83925200b432fc66773492e6))
- **catalog** — Correct COMMUNITY_EXTENSIONS.md doc link post tools→crates ([9ecca6af3](https://github.com/supernovae-st/nika/commit/9ecca6af385fa93b9fc044aa1adb9933af3ed2dd))
- **catalog** — Total_cmp + name tie-break for deterministic suggestions ([ef7d873ad](https://github.com/supernovae-st/nika/commit/ef7d873ad960f49bc84bad17452a17b461174643))
- **ci** — Make crate-size glob recursive (P1-6) ([898e2de1e](https://github.com/supernovae-st/nika/commit/898e2de1ee86adbc72bf2e7b16a480f4b761018e))
- **ci** — Add scoped-fail for new crate ADR coverage (P1-5) ([593394b8b](https://github.com/supernovae-st/nika/commit/593394b8b49ea3993e4daad3a4c7cc9016703c83))
- **ci** — Add allowlists for pre-existing ratchet violations (P1-2 follow-up) ([b22e49cb9](https://github.com/supernovae-st/nika/commit/b22e49cb969931556788d2bbb4dd53b69574ce52))
- **ci** — Update allowlists + deny.toml for crates/ rename ([f780c37e5](https://github.com/supernovae-st/nika/commit/f780c37e566aee3ac9f0e4a2061702eb62e5f3a4))
- **ci** — Mutation-floor v2 — budget-as-budget + cross-platform honesty ([74f1c1409](https://github.com/supernovae-st/nika/commit/74f1c1409560d8b520d5156c52f1b13fefa52b22))
- **ci** — Vector 40 audits ai/ traits — vision + audio Pattern-A gap surfaced ([5da3a02c6](https://github.com/supernovae-st/nika/commit/5da3a02c65fb0160448a4fb1480defe218a63150))
- **ci** — Allowlist first_balanced_span — fn-length heuristic false positive ([495119ade](https://github.com/supernovae-st/nika/commit/495119adec921bae9e93a0ce50e50895f164d1a8))
- **ci** — Unblock the push train — char-literal-aware fn counter + mit-0 ([ed10784c7](https://github.com/supernovae-st/nika/commit/ed10784c7504ea91dbbea7c68909475d839becc4))
- **ci** — Adr validator learns the l1.5 service layer ([4737bf184](https://github.com/supernovae-st/nika/commit/4737bf18411ac21b53e3ac0662e08f9f0674222b))
- **ci** — Crate-size counts prod LOC — the mutation ratchet must not fight the size budget ([e023a73e8](https://github.com/supernovae-st/nika/commit/e023a73e860304f2f4b9aa5d6694cc8e29ac292f))
- **ci** — Mutation-sandbox skip at the SOURCE — the global --lib had blast radius ([9c2683625](https://github.com/supernovae-st/nika/commit/9c2683625bc13d25efb4bd3cd8a9ad59128c8765))
- **ci** — Adr-validate catches duplicate IDs — the gate was blind to collisions ([9a3c9d2b4](https://github.com/supernovae-st/nika/commit/9a3c9d2b408667f868ef5e5e17b651d18a813757))
- **ci** — Strip string literals + line comments in brace-counting gates ([d970e3f4e](https://github.com/supernovae-st/nika/commit/d970e3f4e8f835c313a9233c558f5affedf0c2c2))
- **ci** — Refresh-status survives an empty wip array ([d0fb8d17b](https://github.com/supernovae-st/nika/commit/d0fb8d17b83240166b2d93250db4261aaab78f1a))
- **cli** — Surface nika:log + nika:emit on stderr, not /dev/null ([bc5179392](https://github.com/supernovae-st/nika/commit/bc5179392f6239de5bd64465216068c202ca89cb))
- **docs** — Close 3 review-swarm P1s — MetricsExporter, sealing, L4 label ([54a402efe](https://github.com/supernovae-st/nika/commit/54a402efe2dcd9c940c94d0eff03af97a4db9540))
- **dx** — Address phase c-g review-swarm p1 findings ([d1469b5cf](https://github.com/supernovae-st/nika/commit/d1469b5cf5b101a83e362538083e715844736a03))
- **dx** — Gitnexus auto-reindex hook — match compound git commands ([56e793d0b](https://github.com/supernovae-st/nika/commit/56e793d0bc2ca6f907e5b836ab974cf49ee51ed5))
- **dx** — Apply compound-command regex to all 4 git posttooluse hooks ([4d6430e34](https://github.com/supernovae-st/nika/commit/4d6430e34b5e39f408023267104c86fae1eb493e))
- **dx** — Privacy-strict refactor + pretooluse compound regex + reindex lockfile ([66a8846bb](https://github.com/supernovae-st/nika/commit/66a8846bbf47ba176a5dd56db0f32d060f389dd5))
- **dx** — Address executive-swarm findings — privacy + injection + stale counts ([983463154](https://github.com/supernovae-st/nika/commit/98346315468abe2923faa2b6da03fb2c56540fcb))
- **dx** — Remove trailing commas from settings.json ([d24de258f](https://github.com/supernovae-st/nika/commit/d24de258f912c5975da636be00004ca49024a2f0))
- **dx** — Roadmap.sh WIP seam + L1.5 row + derived M2 frontier ([dd8a88b5f](https://github.com/supernovae-st/nika/commit/dd8a88b5fae055fe4e158268761d1d59addb23ef))
- **error** — Register kernel code ranges + private MemoryId + mock imports ([544da1ad3](https://github.com/supernovae-st/nika/commit/544da1ad3c6b7d5dd16d963dbbf8d7e93f045a94))
- **error** — Code_help covers Schema + Provider; fix stale ranges ([00352928c](https://github.com/supernovae-st/nika/commit/00352928c97cba4c92c389afc641f38c500802ad))
- **hooks** — Anchor co-author trailer check to line boundaries (P0-2) ([3f4cb1650](https://github.com/supernovae-st/nika/commit/3f4cb16501454f1757a14159fbf53b6fb54c47ea))
- **hooks** — Remove escaped backslash in privacy pattern (P0-3) ([f8e89bb1d](https://github.com/supernovae-st/nika/commit/f8e89bb1d227a08cc7b2a0f437d9e71d832f9c1b))
- **hooks** — Simplify squash co-author detection (P0-5) ([451919c68](https://github.com/supernovae-st/nika/commit/451919c685e854b4904f8a32e634442fcea3a142))
- **hooks** — Use --prefix=none + sed for reverse-dep resolution (P1-1) ([b71bf9f7c](https://github.com/supernovae-st/nika/commit/b71bf9f7c39b46ea8845e0d88b9114d4e01a1408))
- **hooks** — Use git toplevel for activity-log path (P1-9) ([7514b7942](https://github.com/supernovae-st/nika/commit/7514b79427ca4b76957f8249ab8c376c96e7bce4))
- **hooks** — Capture ratchet exit code before errexit kills subshell (P1-2) ([1991acb0e](https://github.com/supernovae-st/nika/commit/1991acb0eb210256cded149a9c7db816aa81d7c6))
- **hooks** — Portable stdin detection in force-push-guard (P1-3) ([a8092f2a5](https://github.com/supernovae-st/nika/commit/a8092f2a5365a853bd272d73bf558a62132f21f2))
- **hooks** — Wire post-rewrite hook for ADR seal check (P1-4) ([62dc35cb3](https://github.com/supernovae-st/nika/commit/62dc35cb39c13619d6c947c5b1b87dcd37c135a5))
- **hygiene** — V2 — 5 new vectors, bug fixes, catalog-verify alpha.4 ([495efc5f5](https://github.com/supernovae-st/nika/commit/495efc5f5c1eabe1d1043e1006a52444a97d690c))
- **hygiene** — Rename lefthook-engine.yml → lefthook.yml ([7a148c13c](https://github.com/supernovae-st/nika/commit/7a148c13c7d4c7faae86df64026dfb3ab252c794))
- **hygiene** — Forward pre-push stdin to force-push-guard ([ed2345055](https://github.com/supernovae-st/nika/commit/ed2345055e5f225f259e90e9282b86f8e492b3cc))
- **hygiene** — Force-push-guard works without stdin forwarding ([d6ef7989e](https://github.com/supernovae-st/nika/commit/d6ef7989ed744db28eeac8910c5c4801ffd26b0f))
- **hygiene** — Gate engine-hygiene on RED only, not YELLOW ([8167ffc9e](https://github.com/supernovae-st/nika/commit/8167ffc9e5ef2ab38546762d84e0a7affc2243d7))
- **hygiene** — Drop unused COMMIT_TYPE + FOUND_BLANK from validator ([06bda01a1](https://github.com/supernovae-st/nika/commit/06bda01a1d874f8aee3684f0e2222a49733e9931))
- **hygiene** — Expand block-private-paths self-exclusion (P1-7) ([501fc13d1](https://github.com/supernovae-st/nika/commit/501fc13d1c4eb9ce228627247f9aa3c4367c8074))
- **hygiene** — Tighten Claude trailer detection (vector 13, P0-1) ([41b6451a0](https://github.com/supernovae-st/nika/commit/41b6451a030e2fd08f5f91f628c6ab9471d7fc8b))
- **kernel** — Add displayid::new constructor · inv-19 gap ([0dfb13683](https://github.com/supernovae-st/nika/commit/0dfb13683bc755944c8a01965304b8b6b76f4f91))
- **kernel-browser** — Doc render · arc generic prose · adr-081 enables schema clean ([1245e976f](https://github.com/supernovae-st/nika/commit/1245e976f9bc4e1ffa910675f154615b70059e80))
- **kernel-core** — Redact credential headers in HttpStreamResponse Debug ([b67be8da3](https://github.com/supernovae-st/nika/commit/b67be8da30772b99cdd78d23bc38c82c3d116327))
- **kernel-mock** — Real glob matching in MockFs, not substring ([ec30145da](https://github.com/supernovae-st/nika/commit/ec30145daaa70584bd0552996ed243350058dbf4))
- **kernel-mock** — Fs/http/clock mocks implement the Dyn seams ([ea2e30902](https://github.com/supernovae-st/nika/commit/ea2e30902f3a654c3a86ebf2832579088bbf4e8e))
- **m2** — Suppress panic-payload leak in all JoinError mappings (Guard-1 class) ([f1aae8164](https://github.com/supernovae-st/nika/commit/f1aae8164df99f939eca628829e478f86347b3da))
- **mintlify** — Revert docs.json rename + Node 22 setup ([6f772968f](https://github.com/supernovae-st/nika/commit/6f772968fbeb2b086ed221d9c0d1ec4e3cb28440))
- **mintlify** — Escape <500 MDX parse error in crates.mdx ([f8f604d25](https://github.com/supernovae-st/nika/commit/f8f604d25a59c6b76af529e3dd3faccbc36d2511))
- **nika** — Polish stale docs + error messages + honest Gate-5 note ([a46a30d84](https://github.com/supernovae-st/nika/commit/a46a30d840d0bc4c455abb1a5ea9bce50412e09e))
- **nika-a11y** — Guard 3 fail-closed on secure-marker read error ([a84d96438](https://github.com/supernovae-st/nika/commit/a84d96438e97d7d6513e47032606d6debfd27d67))
- **nika-a11y** — Guard 3 scrubs the secure field's ENTIRE subtree ([8273bae27](https://github.com/supernovae-st/nika/commit/8273bae2730e5539b5d570ea2b90016199f006e2))
- **nika-blob** — Clean the temp file on write failure, not just rename ([a812217e6](https://github.com/supernovae-st/nika/commit/a812217e625fd4ac4c88022c767c28eae8ee7c81))
- **nika-bm25** — Test-scope expect allow + the stale-rlib lesson banked ([c8bbd5f03](https://github.com/supernovae-st/nika/commit/c8bbd5f03bb7eb1829122677e467f7d3c0b746d6))
- **nika-bm25** — Export PruneStats — top_k_pruned_stats return type was unnameable ([6bf6a2508](https://github.com/supernovae-st/nika/commit/6bf6a2508fde688283a43fa7a781c23b8dc47fc0))
- **nika-browser** — Harden Guard 5 — node-identity pin + no failure-downgrade ([fba1360c1](https://github.com/supernovae-st/nika/commit/fba1360c13b587cbcd4bbca596dd9ea993f1b7d6))
- **nika-browser** — Occlusion hardening — scroll-stable point + full-depth subtree ([5ec5415f9](https://github.com/supernovae-st/nika/commit/5ec5415f94f2e63b3427f5355f3476d638479f0e))
- **nika-builtin** — Prompt rejects a wrong-typed default value ([892802fcb](https://github.com/supernovae-st/nika/commit/892802fcb739be025304e9af1172294953d2e1db))
- **nika-builtin** — Nika:glob exclude string form + nika:date weeks unit ([763b15aec](https://github.com/supernovae-st/nika/commit/763b15aec7afb815b3ad623f3048e110729c013a))
- **nika-builtin** — Nika:date add/subtract calendar units via Zoned ([d787d5879](https://github.com/supernovae-st/nika/commit/d787d5879de41e34ede173c904c7ef8c7ef0d5d9))
- **nika-builtin** — Canonicalize fs paths before permits.fs match ([457f27213](https://github.com/supernovae-st/nika/commit/457f2721355e67e989ab1ae1106711970da1c745))
- **nika-builtin** — Nika:convert has_header is a strict bool ([3bab272fc](https://github.com/supernovae-st/nika/commit/3bab272fc17e1f9eeacf7d9b084caeac62b18276))
- **nika-builtin** — Glob absolute patterns + grep-on-file error ([01e49cc39](https://github.com/supernovae-st/nika/commit/01e49cc39bdaa78a812da111d8f086ca85554e9f))
- **nika-builtin** — Nika:prompt confirm-default error names mode: input ([93072824d](https://github.com/supernovae-st/nika/commit/93072824d729c1dede579d6f67b37420d3cca683))
- **nika-builtin** — Nika:inspect reports unavailable, not fake-empty ([ab44c3ee9](https://github.com/supernovae-st/nika/commit/ab44c3ee96e46ff22ee9da3c38e7bcebc215ccac))
- **nika-builtin** — Classify transient nika:fetch failures as retryable ([98507a7f2](https://github.com/supernovae-st/nika/commit/98507a7f262baefae79b9a2ddf29160f777d25d2))
- **nika-builtin** — Exact-file permits.fs path admits its own new file ([e4863ddcb](https://github.com/supernovae-st/nika/commit/e4863ddcb04aa950986446740ec77d2b6a2deba6))
- **nika-builtin** — Nika:glob strips a leading ./ from a relative pattern ([a59429475](https://github.com/supernovae-st/nika/commit/a59429475b87b98440c1c725c7ec88a8ef6a0616))
- **nika-builtin** — Map an SSRF block to NIKA-SEC-005 (F-01) ([64e5f7215](https://github.com/supernovae-st/nika/commit/64e5f7215b3f38466d80576b34d162f7979cee5f))
- **nika-builtin** — Grep re-enforces the fs boundary per matched file ([ec84d9e39](https://github.com/supernovae-st/nika/commit/ec84d9e3908cfd096d9e22abaa8ee4c10433410b))
- **nika-builtin** — Doc-integrity + model-facing description cleanup ([91c3acdfa](https://github.com/supernovae-st/nika/commit/91c3acdfa65b67e6fac2ffeef804390605e2bdcf))
- **nika-catalog** — Address 3-agent review findings (P0 + P1) ([ffe8af986](https://github.com/supernovae-st/nika/commit/ffe8af986e825d50d4d16553c676e3bd7b3f749d))
- **nika-catalog** — Address 2b review swarm — 2 P0 + 2 P1 same session ([ce0eab1bd](https://github.com/supernovae-st/nika/commit/ce0eab1bd7f74e318e3c7c20c1e049e884d21f09))
- **nika-catalog** — Validate_caps_patch — require every field on [defaults] ([731f11bfe](https://github.com/supernovae-st/nika/commit/731f11bfec9092f3711b9b5e85e1ff9f7df81f5e))
- **nika-catalog** — Canonicalise scope.providers at parse — check_any_last_in_scope ([2d1f53c15](https://github.com/supernovae-st/nika/commit/2d1f53c15277b1cd6fc7558b5c173a4df9997574))
- **nika-catalog** — Address session 3 review swarm p1/p2 findings ([fe311de4b](https://github.com/supernovae-st/nika/commit/fe311de4b59f468d991773b8989bd7baa2db9ba6))
- **nika-catalog** — Renumber NIKA-230..235 → NIKA-010..015 (code collision) ([1d9f85c13](https://github.com/supernovae-st/nika/commit/1d9f85c138f061112a6431b8ee08339ec9305890))
- **nika-catalog** — Remove broken doc link to OverlayCatalogDataSource ([e44bb0789](https://github.com/supernovae-st/nika/commit/e44bb07895b6da7adc9a8cc6572448fd12f5cd56))
- **nika-catalog** — Review swarm P0 fixes (inv #19 + region guard) ([cbc5209bb](https://github.com/supernovae-st/nika/commit/cbc5209bb04b7cfeae45a8a4a4430487efc96d10))
- **nika-catalog** — Add #[non_exhaustive] to ParseRegionError ([aedfdf4c4](https://github.com/supernovae-st/nika/commit/aedfdf4c4a9d3ec40480b8e443912c977eac81d9))
- **nika-catalog** — Wire tokenizer variants into TOML rules (review P1) ([820bd1949](https://github.com/supernovae-st/nika/commit/820bd1949b3759caf7a41047a7c43e0bc8e13e37))
- **nika-cel** — Close 2 Gate-11 review P1s + 2 forward-compat gaps ([e70950c04](https://github.com/supernovae-st/nika/commit/e70950c04e7bce21540d793eb9a7c562982ccffa))
- **nika-cel** — Bound expression depth, close stack-overflow DoS ([e4e474762](https://github.com/supernovae-st/nika/commit/e4e474762fef429d449620043a03f67488d2554c))
- **nika-cel** — Numbers compare by value on the continuous number line ([2396e6d4c](https://github.com/supernovae-st/nika/commit/2396e6d4c823a13cc56c6e479bb5fb99325e54dc))
- **nika-cli** — Fold the S6 review — §6 permits field + ANSI-safe columns + stable explain contract ([7354d40c8](https://github.com/supernovae-st/nika/commit/7354d40c85d1e1e5879a4b17abde97a4dfd7b273))
- **nika-cli** — Exempt the provider HTTP path from the SSRF guard ([ffd4cf600](https://github.com/supernovae-st/nika/commit/ffd4cf6004ddecabe971ababb926cd96f0cf0616))
- **nika-cli** — Report the resolved provider's response_format (BUG#11) ([c1355f515](https://github.com/supernovae-st/nika/commit/c1355f51548fc9bace8e4453393c2b72e1d7ea95))
- **nika-cli** — Examples-run help no longer claims the run verb is unshipped ([3cdf1b37c](https://github.com/supernovae-st/nika/commit/3cdf1b37c3e125e32a5cb6c40acf9ad581defb48))
- **nika-cli** — Parse-stage errors now carry their spec code ([b355fb918](https://github.com/supernovae-st/nika/commit/b355fb91818a37ad0b834018cb0fe27adb5c3f80))
- **nika-cli** — Escape model/tool in graph mermaid+dot labels ([a9fef08c9](https://github.com/supernovae-st/nika/commit/a9fef08c90a94c527177a3adf23f3ff3850ef9ff))
- **nika-cli** — `new --from '?'` lists templates without a dest ([7de9107ec](https://github.com/supernovae-st/nika/commit/7de9107eca08f3da4f35b90d685e78538f56220d))
- **nika-cli** — Route_intent ignores boilerplate/stopword queries ([c6aa0020e](https://github.com/supernovae-st/nika/commit/c6aa0020eadc32d2b8ac6cc8c7a2efa5ac4436c9))
- **nika-cli** — Trace recovers a crashed run's truncated tail ([b5d27519c](https://github.com/supernovae-st/nika/commit/b5d27519cecab0b6ba2d7cc7febbee7cbc643b73))
- **nika-cli** — Human run flags conflict with the machine modes ([343423a6b](https://github.com/supernovae-st/nika/commit/343423a6bc9e2750077f4fbc159fe5712f34b1aa))
- **nika-cli** — The public binary name is `nika`, not `nika-cli` ([4857d4819](https://github.com/supernovae-st/nika/commit/4857d48197d5ac2c2f9a7f28b2cc43b9ef9ceb63))
- **nika-engine** — Rules index + gitignore generated skills dir ([068e1e31b](https://github.com/supernovae-st/nika/commit/068e1e31bc2fa09aaea09088c75bf3a8645e1221))
- **nika-engine** — Reconcile memory satellite count 3 → 9 crates ([68240f922](https://github.com/supernovae-st/nika/commit/68240f922222d589cf08ece98084f97d82a0a2c3))
- **nika-error** — Remove colliding NIKA-XXX placeholders (Wave 1.3) ([2fe8401d1](https://github.com/supernovae-st/nika/commit/2fe8401d1803ab43c246b5c56adac6e1333eaff2))
- **nika-exec-runner** — Cap captured output at 64 MiB — NIKA-054 ([dd788d7d9](https://github.com/supernovae-st/nika/commit/dd788d7d9908e1e63fddf363374e027ef5ddac24))
- **nika-exec-runner** — Close the argv re-exec bypass + shell expansion TOCTOU ([31614bbd9](https://github.com/supernovae-st/nika/commit/31614bbd959b89788007262369132b0cf2afb45f))
- **nika-extract** — Depth guard — close 2 under-count bypass P0s ([ef6f13477](https://github.com/supernovae-st/nika/commit/ef6f13477c0d3598a045c31080f57e264a027f4d))
- **nika-extract** — Unblock the push gates — fn split + brace-balanced fixture ([0edf354fe](https://github.com/supernovae-st/nika/commit/0edf354fe60a6e7400d9666d0ca9326e020feebd))
- **nika-extract** — Article fallback compares trimmed length ([a5f6a7eb3](https://github.com/supernovae-st/nika/commit/a5f6a7eb30fc669335f949f30f9724e13f4ca03c))
- **nika-extract** — Review-swarm fixes + microdata property cap ([a643466c4](https://github.com/supernovae-st/nika/commit/a643466c46bdd4d3d195b6d1236a9103afe54221))
- **nika-fs** — Clean the temp file on write failure, not just rename ([9c6dfaca1](https://github.com/supernovae-st/nika/commit/9c6dfaca1a00d2344ca7d141da717e264f94e31a))
- **nika-http** — Widen the SSRF oracle to every non-public-unicast range ([52c182691](https://github.com/supernovae-st/nika/commit/52c182691bc0c89b0dc4ed755b378b57e6c97f42))
- **nika-http** — Drop the dead metadata-IP hostname entry — the IP branch is authoritative ([0bc0d71c4](https://github.com/supernovae-st/nika/commit/0bc0d71c4d0e5365f80ecc63ea71755baf7f4307))
- **nika-http** — Comma-join repeated response headers — rfc 9110 lowering ([d09a8ba47](https://github.com/supernovae-st/nika/commit/d09a8ba47fde9682775856c3f8d32169f3a8697d))
- **nika-http** — Enforce permits.net.http at runtime (NIKA-SEC-004) ([8c2d1d87a](https://github.com/supernovae-st/nika/commit/8c2d1d87aa900fa86c87cba630685572b1f9992f))
- **nika-http** — Permits.net.http gates before DNS resolution ([8e9df5568](https://github.com/supernovae-st/nika/commit/8e9df5568453340d104642559f15f4b6ed626c36))
- **nika-infer-local** — Fold the 3-lens review — 2 P1 + 4 P2/P3, e2e wire contract ([6f8ec45fd](https://github.com/supernovae-st/nika/commit/6f8ec45fde6bfd9e15fb449fa2cd0d1022fe91be))
- **nika-infer-local** — Execute the mutation audit — kill survivors, wire min-p, O(window) stop ([803469a3c](https://github.com/supernovae-st/nika/commit/803469a3c17c9b3ca1533163b7d41e00014f1211))
- **nika-infer-local** — Enforce the context window — ContextOverflow fires ([67d56b0d8](https://github.com/supernovae-st/nika/commit/67d56b0d8bf15cf361582c8c0c701bc75a0b04c6))
- **nika-infer-local** — Fold candle-backend review + gate-7 bench + GGUF arch de-hardcode ([d982f5e12](https://github.com/supernovae-st/nika/commit/d982f5e12050ab30355ce271689dd0f114b47699))
- **nika-kernel** — Seal SecretResolver + Acquire/Release CancelCtx + reserve NIKA-700..819 ([940908c7a](https://github.com/supernovae-st/nika/commit/940908c7ad28194b9415a129dbcb86910d49f551))
- **nika-kernel** — Close 5 bug-hunt findings before review swarm ([5a5b1e6fa](https://github.com/supernovae-st/nika/commit/5a5b1e6fa1df4a7ea74614b7206212d168c7a5a4))
- **nika-kernel** — Close review-swarm P1s — registry, proptest, cost bridge, oracle doc ([244dcc807](https://github.com/supernovae-st/nika/commit/244dcc807796f8c3bea8e3bd9c5e9852f2324f67))
- **nika-kernel** — Intra-doc link TenantId::DEFAULT → default_tenant (gate 8) ([fdc10d916](https://github.com/supernovae-st/nika/commit/fdc10d916361aedc2dad1e6e3eac0abf6340f380))
- **nika-kernel-mock** — Tool-executor doubles implement the Dyn seam ([b063577f4](https://github.com/supernovae-st/nika/commit/b063577f44f4af39cc05ac184570343adfc5ae31))
- **nika-lsp** — Complete admission hygiene — layer registry · status block · error-voice ([2f17dfeac](https://github.com/supernovae-st/nika/commit/2f17dfeacfaac93cc55eee982558f0e0e94998f9))
- **nika-mcp** — Fold checkpoint review — version negotiation · batch · full report ([c7dc18e25](https://github.com/supernovae-st/nika/commit/c7dc18e2530e984c806f7a62f01074b1193a83d5))
- **nika-ocr** — Saturating bbox span avoids i32 overflow panic ([3970a83e7](https://github.com/supernovae-st/nika/commit/3970a83e7f96b350aad8d68b9f6cf20154922724))
- **nika-pack** — Tojson structured data before nika:write in 3 showcases ([72f253e7e](https://github.com/supernovae-st/nika/commit/72f253e7ee2b5dd425473602d77dafa0cbd1bfb9))
- **nika-pack** — Re-sync embedded canon to SSOT (builtins 22→23 · compose) + derive-test ([1244973d3](https://github.com/supernovae-st/nika/commit/1244973d385a1e37a603ee6e069cd2737b8db14d))
- **nika-pack** — Re-vendor embedded pack from spec SSOT ([de5029602](https://github.com/supernovae-st/nika/commit/de5029602517cb520986caa72916d4ef37948e57))
- **nika-providers** — Gemini in-band errors speak the shared status table ([d6727ad7d](https://github.com/supernovae-st/nika/commit/d6727ad7df71180331df6892978bfc4a431baf00))
- **nika-providers** — Normalize openai strict structured-output schema ([6afce214a](https://github.com/supernovae-st/nika/commit/6afce214abe37fa2b0be2e9f6089e23f6a7f9bba))
- **nika-providers** — Sanitize tool names for openai + anthropic ([91c360a01](https://github.com/supernovae-st/nika/commit/91c360a016f8752b26f7144e189bcbd189748958))
- **nika-providers** — Adapt gemini structured-output schema ([a679beddb](https://github.com/supernovae-st/nika/commit/a679beddb48b64fe73cdd297719ad45f412e2fe3))
- **nika-providers** — Gemini output_tokens fold thoughts — budget guard was blind ([a5e42ebdd](https://github.com/supernovae-st/nika/commit/a5e42ebddf0702cb70a7a0a93676a0c9f368aef0))
- **nika-providers** — Rewrite oneOf to anyOf for openai strict ([ca08eca45](https://github.com/supernovae-st/nika/commit/ca08eca45c0d1224ed6bdd56ee2eb17edcc80574))
- **nika-providers** — Rewrite const + strip uniqueItems for openai ([08c8977d5](https://github.com/supernovae-st/nika/commit/08c8977d5d151deed65cb2f267d9d69a300983cb))
- **nika-providers** — Inline $ref/$defs for gemini, error on cycle ([4d2d59904](https://github.com/supernovae-st/nika/commit/4d2d59904f80e9c600c7e39b4f799a803a557a59))
- **nika-providers** — Map multi-type unions to anyOf for gemini ([232f06655](https://github.com/supernovae-st/nika/commit/232f066555731691a3a5c514c6e460dc72af6bce))
- **nika-providers** — Preserve integer enum value types for gemini ([ea1715512](https://github.com/supernovae-st/nika/commit/ea17155124105789d88f9e5daf9c1e673a1d7703))
- **nika-providers** — Rewrite const + strip uniqueItems for gemini ([718c82125](https://github.com/supernovae-st/nika/commit/718c821259720e8585d5511e825995899e91145b))
- **nika-providers** — Stringify gemini enum members (revert ea1715512) ([c274216d9](https://github.com/supernovae-st/nika/commit/c274216d9f98f4f0184f77ff9b08a6e7d1f77a98))
- **nika-runtime** — Land the v2 module files — repair the lagging-file commit ([0c38a5698](https://github.com/supernovae-st/nika/commit/0c38a56982ceb540a788302e91a882df3a2dd8a8))
- **nika-runtime** — Agent telemetry review fold — evidence survives the timeout ([7818280df](https://github.com/supernovae-st/nika/commit/7818280dfde758cc8418e10276d9196d111a96b3))
- **nika-runtime** — Review fold — registry consts, spec-code pins, the gate-scope hazard ([b9fbff9f3](https://github.com/supernovae-st/nika/commit/b9fbff9f34345d2e726cc289e958e76118804caf))
- **nika-runtime** — Deny shell under a program allowlist; fan-out on_finally permits ([4277d2bb8](https://github.com/supernovae-st/nika/commit/4277d2bb86d4aba2268f926c1536295172b071f2))
- **nika-runtime** — Wire exec cwd/env/stdin through to the spawn ([c4a4136b5](https://github.com/supernovae-st/nika/commit/c4a4136b5715db5b2d9e463b8bd3067e47c63c88))
- **nika-runtime** — Match on_codes against the user-facing spec code ([76139737d](https://github.com/supernovae-st/nika/commit/76139737d6a3ae170c9bdd477e0aabe1bd4d1524))
- **nika-runtime** — Enforce NIKA-VAR-009 — typed outputs validated at run end ([46a45a0db](https://github.com/supernovae-st/nika/commit/46a45a0db4e66f708c70ab63b50373a63dafcae2))
- **nika-runtime** — Run banner states the declared permits boundary ([530dde4cf](https://github.com/supernovae-st/nika/commit/530dde4cf05314561656854d601553e205aa4e64))
- **nika-runtime** — Cel eval errors carry spec-plane wire codes ([c5c8f19bd](https://github.com/supernovae-st/nika/commit/c5c8f19bdf67ec9d9553b6af4e5cf13a401ba317))
- **nika-runtime** — Fold adversarial review findings on the error surface ([789391b2e](https://github.com/supernovae-st/nika/commit/789391b2e42c94484a6663bfa72b87103a206a4b))
- **nika-runtime** — Render honors the backslash-escape (spec 04) ([1b0c9a82c](https://github.com/supernovae-st/nika/commit/1b0c9a82cad5fdab893fef364dc943ff21bd55de))
- **nika-runtime** — Render close-find is quote-aware (spec 04) ([f296fc10b](https://github.com/supernovae-st/nika/commit/f296fc10b871277ab05f6796c4d6057a65d61aab))
- **nika-sandbox-seatbelt** — Refuse over-granting permits (audit P1) ([f5ee11962](https://github.com/supernovae-st/nika/commit/f5ee11962a925a7f3a9b32b64f6672ae7c9924e5))
- **nika-schema** — Rename lints module to preference_rules · doc collision ([b8d3609f4](https://github.com/supernovae-st/nika/commit/b8d3609f4ba2e962cf8adabac840d339abfa29d5))
- **nika-schema** — Fold review findings — net/fs literal escapes, secret + cost fixes ([9a0c20510](https://github.com/supernovae-st/nika/commit/9a0c20510707816a115c828510f4c26a6d7626af))
- **nika-schema** — Repair-fix idiom unified + convergence test + honest gaps (review fold) ([73b24bb0b](https://github.com/supernovae-st/nika/commit/73b24bb0b7654ed8723949afa064440d33dfaf10))
- **nika-schema** — Close the proven stack-overflow class — two loud depth bounds ([41a6dcb81](https://github.com/supernovae-st/nika/commit/41a6dcb81efa4f4c3c7fad9612737f41e8ec1f78))
- **nika-schema** — Check honors the locked exit-code contract + json parse payload ([0188d4e3a](https://github.com/supernovae-st/nika/commit/0188d4e3a0cac57a41d7b411f1c8cf92c061425e))
- **nika-schema** — Fold the review-swarm round — ascii contract + Verdict + hardening ([de517b532](https://github.com/supernovae-st/nika/commit/de517b5320967c89774de78a7514157834558f9c))
- **nika-schema** — Unbreak mutation testing + kill the predicted span survivor ([f2eec1917](https://github.com/supernovae-st/nika/commit/f2eec19172b6da2475a87025ab2aa13d369ea023))
- **nika-schema** — The loud-skip allow names the right lint (print_stderr) ([a55a7428a](https://github.com/supernovae-st/nika/commit/a55a7428aeec93688d0dbefecb595086cbe69842))
- **nika-schema** — Review fold — HK bound restored, DoS cap, one voice ([250a05f72](https://github.com/supernovae-st/nika/commit/250a05f7291b9d35aaafc30ae2a9b53a51280267))
- **nika-schema** — Agent-whitelist namespace gate — reject a second colon (invoke parity) ([2a5f26ec5](https://github.com/supernovae-st/nika/commit/2a5f26ec54219ae0ea126469087659d9d5c88fca))
- **nika-schema** — Arg-injection catalog holes + per-kind suggestions (audit) ([c5a19ccf4](https://github.com/supernovae-st/nika/commit/c5a19ccf4c78847abe3f57451fa27943b6846b76))
- **nika-schema** — Treat infer/agent prompt as an IFC egress sink ([1dcaa5d2f](https://github.com/supernovae-st/nika/commit/1dcaa5d2f924c981204f7d78be891a44b755b64d))
- **nika-schema** — Closed-island CEL grammar errors are NIKA-VAR-005 not VAR-008 ([7f7816941](https://github.com/supernovae-st/nika/commit/7f7816941c47aa6e5ecdfb33e8f8400d62d636e0))
- **nika-schema** — Cap postfix chain depth — untrusted-input stack overflow ([d782f16ad](https://github.com/supernovae-st/nika/commit/d782f16ad3d1917d30412251942cae9923dcdd34))
- **nika-schema** — Intern the IFC taint-trace to kill an O(n2) DoS ([50598fac5](https://github.com/supernovae-st/nika/commit/50598fac56972ee055c7e85a965f8bdf5e6eb826))
- **nika-schema** — Bound the gate in-list scan and secrets membership ([d05abe56b](https://github.com/supernovae-st/nika/commit/d05abe56bbd935b636394dc31caf060bcfedd0a6))
- **nika-schema** — Remove quadratic dedup in when-gate literal scan ([fe9fdf72d](https://github.com/supernovae-st/nika/commit/fe9fdf72d054156e6a32291af6f5ca5b89565bbf))
- **nika-schema** — Non_exhaustive on public source-position types ([8ab013bd4](https://github.com/supernovae-st/nika/commit/8ab013bd4c57ce5888879f0d6b651a5c8953e6c5))
- **nika-schema** — Adapt flow.rs IFC test to interned-taint signature ([e1127ed74](https://github.com/supernovae-st/nika/commit/e1127ed747bfd53e81b836c7f9296771abf624f4))
- **nika-types** — Negative sub-ms remainder in WallDuration Display ([e2bd999ad](https://github.com/supernovae-st/nika/commit/e2bd999adf225840a31f0e37ed12b108270ead1d))
- **nika-types** — Permits.net.http host match is case-insensitive (RFC 4343) ([fd0c3277a](https://github.com/supernovae-st/nika/commit/fd0c3277a86918d74a8137d702f5062d60d11a8d))
- **nika-verb-agent** — Review fold — reach invariant, wire shape, amplification ([d0c5bf125](https://github.com/supernovae-st/nika/commit/d0c5bf125e3a7e2367b28a35374cb0603a762b27))
- **nika-verb-agent** — Agent:compose is not a tool invocation — stop reporting it as one ([aac3170a1](https://github.com/supernovae-st/nika/commit/aac3170a14c0c64f3a20812002920c3cb6a1390c))
- **nika-verb-agent** — Enforce agent schema at the wire (BUG#11) ([7a0e94e43](https://github.com/supernovae-st/nika/commit/7a0e94e432c4615387e4fe8d32b104524d516757))
- **nika-verb-agent** — Agent schema re-ask drops orphan tool_calls (openai) ([f82e4ba4d](https://github.com/supernovae-st/nika/commit/f82e4ba4d482ba963c0abdbd8c34d0e76ccb237b))
- **nika-verb-exec** — Fold gate-11 swarm findings — 3 lenses, 0 P0 ([f82c76d1e](https://github.com/supernovae-st/nika/commit/f82c76d1e39630b31c85333080031393ef79760e))
- **nika-verb-exec** — Reject NUL in an env value (review F2) ([62a7ff8b3](https://github.com/supernovae-st/nika/commit/62a7ff8b34a6100356f6e2c28a6160c83f085f27))
- **nika-verb-exec** — Exec blocklist hit speaks NIKA-SEC-001 not EXEC-002 ([09dd0816b](https://github.com/supernovae-st/nika/commit/09dd0816b5f59b00ae84f16cdf2d5cee208b90df))
- **nika-verb-infer** — Fold gate-11 swarm findings — 3 lenses, 0 P0 ([ff4865ff8](https://github.com/supernovae-st/nika/commit/ff4865ff8b5eec9e1c73ee382174ef1a145ab275))
- **nika-verb-invoke** — Fold gate-11 swarm findings — 3 lenses, 0 P0 ([23500f7ce](https://github.com/supernovae-st/nika/commit/23500f7ce80b5a71a539af8d0c93701093e58f0b))
- **schema** — Stop double-backticking task ids in DAG-003 + loop-local ([befd93e90](https://github.com/supernovae-st/nika/commit/befd93e901d11cfdac4a00525fd67a6cdfb497f0))
- **spec** — Correct nika-catalog-verify layer L2 → L4 ([5f9e9553f](https://github.com/supernovae-st/nika/commit/5f9e9553f4bab5e5f0ec5372eb71bf7bd3279938))
- **stabilize** — Allow MIT-0 + refresh exec-runner LOC anchor ([2a8553942](https://github.com/supernovae-st/nika/commit/2a85539425cb74accd096116e1b3fd064edebdc2))
- **workspace** — Add crates/ to index after rename ([20a49306a](https://github.com/supernovae-st/nika/commit/20a49306a247056132c54a9897376bdc53acf788))
- **workspace** — Defer nika-bm25 layer entry to W3 admission · adr-038 cleanup ([8ddb750e6](https://github.com/supernovae-st/nika/commit/8ddb750e64f605e6cc2d6753df42b52c3af4c001))
- **workspace** — Invoke tool outputs keep their structured type ([8d556aada](https://github.com/supernovae-st/nika/commit/8d556aadafe35cc0c33e5fce8cb81cdfc1b64040))

### ⚡ Performance
- **diamond** — Release profile + const fn + blueprint v1.3 amendments ([def291c2b](https://github.com/supernovae-st/nika/commit/def291c2b2f8fbbdcc86a7c8b00495d3f1808644))
- **nika-bm25** — Post-admission stabilization · architect + rust-perf converge ([7fcd75fef](https://github.com/supernovae-st/nika/commit/7fcd75feffdff3f0ce8fe33392aca5c6cf8bc806))
- **nika-extract** — Single-pass tidy_text — drop two full-size copies ([c8781a6ec](https://github.com/supernovae-st/nika/commit/c8781a6ecb010bdef54f813445ef2fa560ba9b58))

### 🔨 Refactors
- **catalog** — Reconcile builtin set to spec 26 + ADR-084 ([a7193eba0](https://github.com/supernovae-st/nika/commit/a7193eba0e59cafdaf208661d4b8a080dc30f03f))
- **catalog** — Nika:csv_to_json → nika:convert · ADR-086 rams sweep ([c346cba19](https://github.com/supernovae-st/nika/commit/c346cba19a5d69ee1422a974db87af099f56e666))
- **catalog** — Nika:sleep + wait_until → nika:wait · ADR-087 rams ([bcf5c8e63](https://github.com/supernovae-st/nika/commit/bcf5c8e63380ab4755681e7b0e368082a46de59b))
- **catalog** — 4 introspection → nika:inspect · ADR-088 rams sweep ([37af410a4](https://github.com/supernovae-st/nika/commit/37af410a4c17fe8669953eba2c4b7109ef2ecc5a))
- **ci** — Centralise the workspace-members parser in _lib.sh ([13e2e6c8c](https://github.com/supernovae-st/nika/commit/13e2e6c8c51719e5070787577d6aa1413483d02c))
- **dx** — DX file routing cleanup + mintlify v4 rename ([14edf9b68](https://github.com/supernovae-st/nika/commit/14edf9b6830f672dd00df96139ef1fdd9747375a))
- **dx** — Add commit-granularity rules ([c87fc9372](https://github.com/supernovae-st/nika/commit/c87fc937274e951dd19e0a27a3e4baa84247a318))
- **dx** — Expand post-commit hooks for admission + push reminders ([218933375](https://github.com/supernovae-st/nika/commit/2189333759299c0c90620360a0b0e75e8386a111))
- **dx** — Move hq dashboard to port 4242 + wire shadcn/magicui/tailwind/threejs MCPs ([55d8c4beb](https://github.com/supernovae-st/nika/commit/55d8c4beb03f9d1c78074eb87c33afb0f2d13fa6))
- **dx** — Count nika-screen WIP · refresh status block to fe2b ([3b2daaf02](https://github.com/supernovae-st/nika/commit/3b2daaf02eb173407438fc6264a4668fb48fb456))
- **dx** — Lock v0.90 crate target at 42 (was 40-42 range) ([ba2f65236](https://github.com/supernovae-st/nika/commit/ba2f652366000597c99177e06d38245b818b1f29))
- **dx+docs** — Hygiene all GREEN + mintlify rewrite ([cd3cde9a1](https://github.com/supernovae-st/nika/commit/cd3cde9a101ad364d49a4847903dc743b344d748))
- **error** — As_str on Category/Severity — delete explain's parallel taxonomy ([bafa20762](https://github.com/supernovae-st/nika/commit/bafa2076234fce76299a8271c390401235d136e6))
- **hygiene** — Single-source the WIP split + fix vector 3 LOC drift ([7af76eeb5](https://github.com/supernovae-st/nika/commit/7af76eeb5097274f701c0b67ecabd192838153f3))
- **kernel** — Co-locate memoryerror nikaerrorcode impl · diamond w2.2 nuke drift ([ba9bd9c1b](https://github.com/supernovae-st/nika/commit/ba9bd9c1b259c53c5e91288a6542a04141fb285c))
- **kernel** — M1 polish · contract fix h1 h2 + sprint 0 additive ([4836cf7aa](https://github.com/supernovae-st/nika/commit/4836cf7aa97aeb359a7a8b42add7b63c6a7f8162))
- **kernel** — Ec-4 ratchet · captured_at_ms → captured_at_ns · ns canonical ([438234ad2](https://github.com/supernovae-st/nika/commit/438234ad2dc98488e7a0cec980d3f52fad6f89c3))
- **kernel** — M2 trio implements the Send trait variants ([9c455e2cd](https://github.com/supernovae-st/nika/commit/9c455e2cdfe316dd5cdc63423226d626f0bedb21))
- **mintlify** — Restructure nav to 2 tabs (Guide | Reference) ([365a31d5f](https://github.com/supernovae-st/nika/commit/365a31d5f8056ed16aca1e7b14492309ae7455e5))
- **mintlify** — Reference workspace — live snapshot + constellation + delete duplicate ([8e85241af](https://github.com/supernovae-st/nika/commit/8e85241afb30744a75b3122178f8feeafe4e429f))
- **mintlify** — Split docs out to supernovae-st/nika-docs repo ([eb671f8a6](https://github.com/supernovae-st/nika/commit/eb671f8a6bc640d80d45eeeeb444905de008fd25))
- **nika-a11y** — Migrate to Pattern A — A11yError typed at the kernel ([29b749631](https://github.com/supernovae-st/nika/commit/29b74963156296a35d87a15ef2c0bca8fb5844e6))
- **nika-bm25** — Q6 split · core (pure-algo) + kernel (adapter) ([0c3b3f4a2](https://github.com/supernovae-st/nika/commit/0c3b3f4a275fe6c45b492ec27a6c7986480b04a4))
- **nika-bm25** — Revert q6 split · option e feature-gated · v1.4 reinforce ([edb72e9cb](https://github.com/supernovae-st/nika/commit/edb72e9cb2aed74f9c4ab5a1ec4d8a3fe10360af))
- **nika-bm25** — Sota rust 2026 perfecting pass post rust-pro + rust-architect audit ([3fa8e5eb8](https://github.com/supernovae-st/nika/commit/3fa8e5eb8d2f27e69ca3d2b3741e91b3ad775824))
- **nika-bm25** — Rank.rs — ONE selection algorithm, heap-bounded, tie-bug caught ([e655948f5](https://github.com/supernovae-st/nika/commit/e655948f5aeb5925b2d732aa8a4ff2474b2d3d4e))
- **nika-catalog** — Collapse public API from 3 paths to 2 — data/ is pub(crate) ([3360f1023](https://github.com/supernovae-st/nika/commit/3360f1023749a1a5a11c2d495654ce038937f904))
- **nika-catalog** — Migrate model_capabilities to TOML-driven rule table ([8c5cb4866](https://github.com/supernovae-st/nika/commit/8c5cb48668d9520dfea60a6e853a91ed7ae983be))
- **nika-catalog** — Hardening pass on Session 2a (5-agent review) ([e766a122c](https://github.com/supernovae-st/nika/commit/e766a122c2843a2ec2965964aa48222ff2c614ad))
- **nika-catalog** — Post-commit 5-agent audit findings ([9feb96956](https://github.com/supernovae-st/nika/commit/9feb9695668e309b5400930744650149e6a79cdf))
- **nika-catalog** — All_pricing — struct literals → ModelPricing::new ([e123acafc](https://github.com/supernovae-st/nika/commit/e123acafc45d7e2d6f60fb84f20c802253f96a3f))
- **nika-catalog** — Retire supports_vision — use input_modalities.contains(Image) ([34a488207](https://github.com/supernovae-st/nika/commit/34a4882073c2e2997426c12781dec254e27274c2))
- **nika-catalog** — Wire build.rs to nika-catalog-codegen · nuke twin ([0e85c9618](https://github.com/supernovae-st/nika/commit/0e85c9618b7f5416953b9606c058c904c5159bf1))
- **nika-catalog-codegen** — Satisfy push-hook ratchets · fn-length + loc-limits + machete ([074fc0614](https://github.com/supernovae-st/nika/commit/074fc0614baef084c669e38f3a138f4d97d094b6))
- **nika-cli** — Fed_back helper — the wave-3 test ducks under the fn cap ([be582b247](https://github.com/supernovae-st/nika/commit/be582b2470daff888808b966274a53d40562c822))
- **nika-clock** — Implement the ClockDyn Send companion ([9d2f58d88](https://github.com/supernovae-st/nika/commit/9d2f58d880522ff2168d34360a93840bc986214f))
- **nika-error** — Split into nika-types + nika-error ([5baeee044](https://github.com/supernovae-st/nika/commit/5baeee044d12c94b767a22cbe28cd1b81fff0e15))
- **nika-extract** — Sitemap event arms move into SitemapParser ([61e63159e](https://github.com/supernovae-st/nika/commit/61e63159e10d0060b57de4bebad9098a1e4f1658))
- **nika-http,nika-cli** — Give net the NetBoundary newtype + one capabilities_of derivation ([3f86e33ba](https://github.com/supernovae-st/nika/commit/3f86e33baa0f3101eaf7ab44dd2e60f3750b7a71))
- **nika-input** — Extract pure keymap module + structural proptest ([c7943ab9b](https://github.com/supernovae-st/nika/commit/c7943ab9bea6a470fabe6f328ec449ccc4c5fe07))
- **nika-kernel** — Prepare split — descend shared types to nika-error ([1513da3a2](https://github.com/supernovae-st/nika/commit/1513da3a2d0f7464c750f3db0c0a9ad488509c38))
- **nika-kernel** — Drop ObservabilitySink (Q12 Phase A — 5 → 4 channels) ([1119f42a5](https://github.com/supernovae-st/nika/commit/1119f42a53a6b94c5fa7fa9331da66070bf247d8))
- **nika-kernel** — Reassign provider error codes 380-429 → 330-379 ([1b812e664](https://github.com/supernovae-st/nika/commit/1b812e6643df01e2fb7dd62049568f6467acd19f))
- **nika-kernel** — Trim facade hub to actual deps — Gate 11 review finding ([a41db4098](https://github.com/supernovae-st/nika/commit/a41db4098858b6c5f1f9e313121a94a38ba4d216))
- **nika-kernel-mock** — Align MockShell to the Send-variant traits ([c5b44e170](https://github.com/supernovae-st/nika/commit/c5b44e1703614d5962b93c76e666779a4d54d5d3))
- **nika-ocr** — Migrate to Pattern A — OcrError typed at the kernel ([a6719e213](https://github.com/supernovae-st/nika/commit/a6719e2131c4c419f1ff4f93cfdb5bfdb1e33569))
- **nika-pack** — Error_codes() typed accessor — one parser, every consumer ([1e0d8b83d](https://github.com/supernovae-st/nika/commit/1e0d8b83d874aaaab86eaeb8c771dc6404d54f1f))
- **nika-providers** — Split gemini schema adapter to its own module ([4c6b0cc23](https://github.com/supernovae-st/nika/commit/4c6b0cc23ac118773bae8bbefc55e832cc3266a1))
- **nika-runtime** — Split run() under the fn-length ratchet ([47b7f43d2](https://github.com/supernovae-st/nika/commit/47b7f43d26d20fda21dc9c68f3e37dc0424ab234))
- **nika-runtime** — Extract dispatch_result from attempt_loop ([153f74d66](https://github.com/supernovae-st/nika/commit/153f74d66655dd1975f41dccdf82f7b70b85b36b))
- **nika-schema** — Nuke brouillon-era types ([5d08fd5be](https://github.com/supernovae-st/nika/commit/5d08fd5be60e7f89eecadfd0a32378e3497ac860))
- **nika-schema** — Rename parser expect to expect_token ([e6a1630f3](https://github.com/supernovae-st/nika/commit/e6a1630f36db3231fe706138a6c5b1a6610ea268))
- **nika-schema** — Split preference_rules into a tests.rs dir module ([292adc31d](https://github.com/supernovae-st/nika/commit/292adc31dcd8f4eb04a93a92a7aabb9e5371b9fe))
- **nika-screen** — Migrate to Pattern A — ScreenError typed at the kernel ([b8043ea96](https://github.com/supernovae-st/nika/commit/b8043ea96d2896a6cc99701e638a35b864740250))
- **nika-verb-agent** — Run() under the 100-line cap — extract classify_turn ([9dec6fff9](https://github.com/supernovae-st/nika/commit/9dec6fff9d9db19fa5cb9b90ca5a693ec5cecba8))
- **nika-verb-agent** — Tests split to src/tests.rs — the file cap unblocks the train ([15e0558b7](https://github.com/supernovae-st/nika/commit/15e0558b7eb0f79bde3a77b28ba125c2d5a54025))
- **nika-verb-agent** — Nuclear-review judo fold — fence parity, dead path, one predicate ([a9bd9f9d4](https://github.com/supernovae-st/nika/commit/a9bd9f9d4531d49dd65f5ab57864e965c9ccc10d))
- **schema** — Drop fetch verb · nika:fetch is a builtin not a verb ([b8e736d32](https://github.com/supernovae-st/nika/commit/b8e736d32add62009bf6be31384f71391fd80722))
- **scripts** — Cluster by responsibility + 3 READMEs ([d3099f99a](https://github.com/supernovae-st/nika/commit/d3099f99a576951a613edc7e669c3e8ab1d2f763))
- **types** — Privatise TaskId + ToolCallId inner fields (Wave 1.2) ([0e3ca19de](https://github.com/supernovae-st/nika/commit/0e3ca19dee9aff94fc2fcfa967eb8d5785ad63cb))
- **workspace** — Rename tools/ to crates/ + add layer metadata ([bb6863714](https://github.com/supernovae-st/nika/commit/bb6863714dcbddc101d9322d0a72113b53a4c16a))
- **workspace** — Split four functions under the 100-LOC fn cap ([76e4f8d0d](https://github.com/supernovae-st/nika/commit/76e4f8d0d55298751d86dd39ae0eea5240d604c9))

### 📚 Documentation
- **adr** — Bootstrap diamond adr process + 9 inaugural decisions ([4cac646e9](https://github.com/supernovae-st/nika/commit/4cac646e9d99e287654e029831370812280b7754))
- **adr** — Add adr-010 through adr-014 (5 sota improvement decisions) ([f0e032bd3](https://github.com/supernovae-st/nika/commit/f0e032bd3906d5e26441a4039e36e83c47c94517))
- **adr** — Add adr-015 expect-test for inline snapshot assertions ([751e85ec8](https://github.com/supernovae-st/nika/commit/751e85ec861107c49c004d476b4b199d093bd89f))
- **adr** — Add bidirectional cross-references in Related sections ([199119e94](https://github.com/supernovae-st/nika/commit/199119e9439e94f4f6058bd9ec9f9874e71cd5c2))
- **adr** — Add ADR DX system -- schema, scripts, updated template ([fe75f384f](https://github.com/supernovae-st/nika/commit/fe75f384f38d0a1c47ee272f1ce3fa5cc3b081d9))
- **adr** — Migrate 15 ADRs to YAML frontmatter + generate indexes ([196ba13ce](https://github.com/supernovae-st/nika/commit/196ba13cef763e64e2c11179c2fd437dfaaab738))
- **adr** — Write ADRs 016-020 — kernel design decisions (Batch F part 1) ([9b9e75d15](https://github.com/supernovae-st/nika/commit/9b9e75d1553001bd09d5003997200dc4b75f0445))
- **adr** — Write ADRs 033-034 — Phase C L0/L0.5 expansion plans ([69c284245](https://github.com/supernovae-st/nika/commit/69c2842458ee689452f3fa2cdf3714d92ac732e3))
- **adr** — Regenerate index.toml + index.json (22 ADRs) ([8bced775c](https://github.com/supernovae-st/nika/commit/8bced775c0d5bcc119d2470eec98f823ef299bfa))
- **adr** — Lock foundation v0.81 — 7 new ADRs + ADR-006 amendment ([6ee7d99de](https://github.com/supernovae-st/nika/commit/6ee7d99decc171d391d23e474d79b5c707101642))
- **adr** — Add ISP capability-axes × crate matrix (batch v.2) ([1718f2cc1](https://github.com/supernovae-st/nika/commit/1718f2cc151ee7992a6b038ec70464b5b87f8acb))
- **adr** — Regenerate index.toml + index.json (22 → 30) ([66beb4d17](https://github.com/supernovae-st/nika/commit/66beb4d177d49415f87dfdd47b975b0b981e01f0))
- **adr** — Stub ADR-029/030/031/032/035 for Wave 4A/4B reservations ([d58d981f8](https://github.com/supernovae-st/nika/commit/d58d981f8b77cbe38f600d9e4798883f47d60cff))
- **adr** — Add adr-037 bottom-up diamond progression (Accepted) ([50cbf9d2b](https://github.com/supernovae-st/nika/commit/50cbf9d2be3b05a7dd5f98540a748980682b6cc1))
- **adr** — Amend adr-028 — feature scheduling dropped per ADR-037 ([c3c4be389](https://github.com/supernovae-st/nika/commit/c3c4be3898414d738548039b8c522c72b2ab9703))
- **adr** — Add adr-036 MSRV policy stub (reserves FCI-036) ([61d3e830b](https://github.com/supernovae-st/nika/commit/61d3e830b8e77937fc3902823497665480355c0a))
- **adr** — Revert adr-028 status to accepted (schema valid enum) ([06c92950b](https://github.com/supernovae-st/nika/commit/06c92950b9da228a444f88336c3972a9da42517f))
- **adr** — Fix adr-028 date format (YYYY-MM-DD) + separate amended_date ([ac700434b](https://github.com/supernovae-st/nika/commit/ac700434b9e20f8955cd60f8052e2ccd9ae2eb47))
- **adr** — Fix adr-036/037 schema validation (id + affects_crates) ([bed1aabe0](https://github.com/supernovae-st/nika/commit/bed1aabe0b1d958c1ea3772266c5d549cf07d5c8))
- **adr** — Adr-038 nika-bm25 admission pre-flight · 12-gate readiness · proposed ([a632d3ca3](https://github.com/supernovae-st/nika/commit/a632d3ca35845e525df850dd91f7d6506e7c0fb2))
- **adr** — Nika-bm25 l1 row + workspace metadata · diamond w2.5 ([4c5fa01da](https://github.com/supernovae-st/nika/commit/4c5fa01daf18a39e5e48f4999b46a605dff0c658))
- **adr** — Adr-038 enables [] · drop ADR-NNN placeholders ([93d7f245c](https://github.com/supernovae-st/nika/commit/93d7f245c3fd877100d7713a0cd1dcd6b4bd1bcf))
- **adr** — Adr-040 cargo feature matrix · zero-cost modularity ([1934fcb62](https://github.com/supernovae-st/nika/commit/1934fcb62339d060d600931983d6fa7cb2352475))
- **adr** — Adr-039 + adr-041 + adr-042 · phase 1.5 architecture trio ([0f1ef3f25](https://github.com/supernovae-st/nika/commit/0f1ef3f25b4abd412fa528942c535140e2a90bd9))
- **adr** — Review-cycle amendments · adr-039 040 041 042 ([1612fb800](https://github.com/supernovae-st/nika/commit/1612fb80069a3399b01cd9de0fe0a21c48608506))
- **adr** — Ship ADR-078/079/080 trio · v1.5 best-architects 2030 audit close ([6317a8b27](https://github.com/supernovae-st/nika/commit/6317a8b27d13a210ed75875e8ca99263a36bfe02))
- **adr** — Adr-081 l1 effect-crate guard contract · 7 guards forever ([3e40c18b3](https://github.com/supernovae-st/nika/commit/3e40c18b3b92ea5d5498bef10643510978b411c5))
- **adr** — Adr-089 nika:json_diff jq-subsume REJECTED · keep rfc-6902 patch ([27c563c79](https://github.com/supernovae-st/nika/commit/27c563c79327d4af4da15da24d0e9a34b1808fe4))
- **adr** — Reciprocate related cross-links across the 081-089 cohort ([6c3b12a85](https://github.com/supernovae-st/nika/commit/6c3b12a8590700e44d4ec379475c29cf12ca2ee6))
- **adr** — Lock enables[] = curated-highlight (DRI D-2026-05-30) ([5cd40bb4c](https://github.com/supernovae-st/nika/commit/5cd40bb4c994f2685f7fe40e21a8651508901b1d))
- **adr** — Sovereign local inference via pure-Rust candle sidecar (ADR-091) ([eb60cbb94](https://github.com/supernovae-st/nika/commit/eb60cbb948eb839286b154b1ed21339ec250ba58))
- **adr** — Adr-092 — make nika check a verifier, not a linter ([1810d241a](https://github.com/supernovae-st/nika/commit/1810d241acd2e5b9829acbb91339e45f0865df89))
- **adr** — Adr-093 tiny_http sidecar server + adr-094 nika-pck registry architecture ([300c52a3f](https://github.com/supernovae-st/nika/commit/300c52a3f36bf772cc079e4a353b5bbbe928a753))
- **adr** — Adr-092 evidence path follows suggest.rs out of check/ ([1c6f56456](https://github.com/supernovae-st/nika/commit/1c6f56456cb3913f6dfd2a9d7c88ff5365607716))
- **adr** — Adr-092 second check-example path follows the dir migration ([6822e1206](https://github.com/supernovae-st/nika/commit/6822e120678639c3181e6773b60143c5133ad03a))
- **adr** — Exec verb security architecture (ADR-095) ([9e9462636](https://github.com/supernovae-st/nika/commit/9e9462636623299a42fc171ab333e1e6f19b1515))
- **adr** — Reconcile ADR-095 with the reserved plugin::sandbox (per-platform crates) ([651fef111](https://github.com/supernovae-st/nika/commit/651fef11157415b9ae0b52e961a7a17adbf0c9d4))
- **adr** — Nika-sandbox-seatbelt crate-spec (Gate 1) ([8734fdc44](https://github.com/supernovae-st/nika/commit/8734fdc44ae8a9b3c18678763e8f235674225881))
- **adr** — Amend ADR-002 — real semver toward a 1.0 launch ([e8c7aad64](https://github.com/supernovae-st/nika/commit/e8c7aad648c9c21d8637a05aee4392fb86d333c7))
- **adr** — Align ADR cross-refs to real semver toward 1.0 (D-2026-06-20-N1) ([a1548d8e8](https://github.com/supernovae-st/nika/commit/a1548d8e8ee6a29bab3bf6ae28b50bb61124d8ea))
- **adr-003** — Record social→structural gate enforcement (Gate 5 + ADR-081) ([65787a058](https://github.com/supernovae-st/nika/commit/65787a05844c0326f5745696a93489b3cc04060f))
- **adr-080** — V1.1 amendment · phantom-CVE scrub + nika error code migration + seccomp-bpf ([80d5da96b](https://github.com/supernovae-st/nika/commit/80d5da96bd22478c29d7df078588ed7559088312))
- **adr-090** — Structural doctrine enforcement — gates project the SSOT ([ff54083af](https://github.com/supernovae-st/nika/commit/ff54083af2911c616e06c8e38a5b3de18aecba2f))
- **agents** — Un-ignore AGENTS.md + refresh HEAD + olympus rename ([44dd2ac2f](https://github.com/supernovae-st/nika/commit/44dd2ac2faaf43598b6eb1bf90f37496988c5962))
- **agents** — De-drift the agnostic entry — projection-by-default snapshot ([91f65f237](https://github.com/supernovae-st/nika/commit/91f65f237f6f44c7f262301bf5473e5dd9e0db44))
- **agents** — Route workflow authoring to the spec protocol ([8497207c2](https://github.com/supernovae-st/nika/commit/8497207c2734b1a7f98637a4283d7898875421cd))
- **arch** — Land v0.81 forward-compat seams + L0-L4 layer registry ([61d229547](https://github.com/supernovae-st/nika/commit/61d229547fc52000b14e8b19ed393a3769dd7a8f))
- **arch** — Land L0 brainstorm decisions + dep audit alignment ([e36dd8de7](https://github.com/supernovae-st/nika/commit/e36dd8de7527a34a7ef3d16f72a21a21dd5a600b))
- **arch** — L0/l0.5 swarm audit — revert q8, add q9-q10, fix incoherences ([5e810a94a](https://github.com/supernovae-st/nika/commit/5e810a94adbb377816500588eaebac4f87e3de97))
- **arch** — Blueprint 2036 final v0.x · 10-year nika horizon ([3a6e36869](https://github.com/supernovae-st/nika/commit/3a6e3686989e7ea7469e478eac065b19e8c2457b))
- **arch** — Blueprint 2036 v1.1 · per-crate detail + best-enemies sota ([efdf7c114](https://github.com/supernovae-st/nika/commit/efdf7c114452822a757a799b5cfb98275edf0c03))
- **arch** — Blueprint v1.2 · 11/10 amplifiers + ai-2027 guardian doctrine ([f9f4f6e1a](https://github.com/supernovae-st/nika/commit/f9f4f6e1a5cebff586651e4c555e30fa60a45f82))
- **arch** — Blueprint v1.2 fold-pass · 9→4 amplifier adrs · prose-only ([1fb3a5d63](https://github.com/supernovae-st/nika/commit/1fb3a5d636dcf61de0486b6f8e700abf4986f8a5))
- **arch** — Blueprint v1.5 · best-architects 2030 discipline ratchet ([3741eae91](https://github.com/supernovae-st/nika/commit/3741eae91a52379fc9aff764777a16e7f6293660))
- **architecture** — Reconcile layer model to 6-tier L0..L5 (P0-6A) ([0bc4df618](https://github.com/supernovae-st/nika/commit/0bc4df61880ee1de97e45c61aeb21e862b0e2d4f))
- **architecture** — Add FCI-NNN and INV-NNN numbered anchors ([9fdfea52b](https://github.com/supernovae-st/nika/commit/9fdfea52b12dd0389a712fc516540f6d58ab858d))
- **architecture** — Add constellation reconciliation 2026-04-17 report ([e7bef7e74](https://github.com/supernovae-st/nika/commit/e7bef7e74bb3eb96aeab082e4ed13925911c47c2))
- **architecture** — Review fixes · templatable carve-out + honest codegen claim + registry parity ([b5c9d15ae](https://github.com/supernovae-st/nika/commit/b5c9d15ae5821ac93ee288b3c067d0776783d64b))
- **architecture** — Gate-12 error-code contract + kernel split trigger status ([5959bd88a](https://github.com/supernovae-st/nika/commit/5959bd88af6f3268f0bf3c0c4a4015cb9c459ed6))
- **architecture** — Kernel 4-way split · census freeze + 4 sibling specs ([b837b3cc4](https://github.com/supernovae-st/nika/commit/b837b3cc430fa49da85065edc8fcd46badf6584b))
- **architecture** — Kernel split step 6 — registry + status + evidence-path cascade ([a1f065efa](https://github.com/supernovae-st/nika/commit/a1f065efa137053f5ed10703508c2ed927812488))
- **architecture** — R4 error-trait completeness audit table — b5 close ([a06662dca](https://github.com/supernovae-st/nika/commit/a06662dca01db8408538c65a0b34a43f70a97917))
- **architecture** — Blueprint-2036 catalog count derives from spec canon ([de174e317](https://github.com/supernovae-st/nika/commit/de174e317357177a093e80380af8a08346d5cda5))
- **canon** — Cascade 4-verb taxonomy · fetch is a tool not a verb ([efcc4df94](https://github.com/supernovae-st/nika/commit/efcc4df946c1aaba4d7eba3faebeddc23da10e7f))
- **canon** — Lock nika: v1 envelope · ADR-082 supersedes ADR-021 ([a7d0c656f](https://github.com/supernovae-st/nika/commit/a7d0c656f7abc60ed8e12ceff9c58353eb83b377))
- **canon** — Live docs state the current canon only — narrative purged ([31335c42c](https://github.com/supernovae-st/nika/commit/31335c42c7015a94131fd042fa6f098ea0cd2d34))
- **changelog** — Record swarm-3 batch i.b + wave 3a/4a/4b/4c session ([6f394aa23](https://github.com/supernovae-st/nika/commit/6f394aa23a20c1d80b4832bcc4f1b8b51429dfae))
- **changelog** — Fix stale MCP alias count 113 to 105 (grep-verified) ([ed443d081](https://github.com/supernovae-st/nika/commit/ed443d081050c0e79ecd6b0f6f3222f6d42dd60a))
- **changelog** — Document the v0.1-v0.28 public version history ([ea4af285c](https://github.com/supernovae-st/nika/commit/ea4af285c32e78343837eff205e2ac861083eba6))
- **claude** — Sync narrative with canonical block (905 tests, 32 providers) ([8241ab7ed](https://github.com/supernovae-st/nika/commit/8241ab7edcdd9550b6979fe79b27c56ae9cea6b8))
- **claude** — Refresh auto-state HEAD to ee74d97e0 · post-rename drift fix ([611ccdf7e](https://github.com/supernovae-st/nika/commit/611ccdf7ed08aaae303df310a8e8ae9fa697c410))
- **coherence** — Deep de-stale sweep — shipped names, 1+10, no hand-counts ([bacf5385c](https://github.com/supernovae-st/nika/commit/bacf5385c71319aea8c2255d87df535b3490c3b3))
- **contributing** — Add CONTRIBUTING.md with 12-gate workflow ([1f750c800](https://github.com/supernovae-st/nika/commit/1f750c8006cdd6bc2f90da889d1be4a0cafdc3da))
- **crate-spec** — Add nika-catalog-codegen Gate 1 spec ([41da7e565](https://github.com/supernovae-st/nika/commit/41da7e565745e53d7e74210d6cf95a4dbb3899e1))
- **crate-specs** — Nika-bm25 gate table update · 7/12 shipped ([c0d3a8f40](https://github.com/supernovae-st/nika/commit/c0d3a8f40f32eb9fc2f5d712e4af84bb0b9b606c))
- **crate-specs** — Nika-bm25 gate 5 mutation 96.9% kill ✅ ([636da4a21](https://github.com/supernovae-st/nika/commit/636da4a21ca9fc9a4a756c402d5c2cc632650aae))
- **crate-specs** — Reconcile fs/http/blob gate evidence to ground truth ([a5d214c00](https://github.com/supernovae-st/nika/commit/a5d214c00cde169c4510abed902174b084a5b4b0))
- **crate-specs** — Nika-policy (s8) — design locked, impl sequenced post-kernel-migration ([130019031](https://github.com/supernovae-st/nika/commit/130019031141beb5e27f3451842ed5bd9ba53562))
- **crate-specs** — Nika-providers (s8.5) — design proposal, kernel seam verified ([8b7529540](https://github.com/supernovae-st/nika/commit/8b752954060c5dab7f4a8895017018a49a2440db))
- **crate-specs** — Nika-browser (m2.5) — gate-1 spec, backend resolved ([e8afd8f1a](https://github.com/supernovae-st/nika/commit/e8afd8f1a2e681275aa8a7cb7780b35faf067d68))
- **crate-specs** — Nika-browser — b.2+b.3 shipped, headful-default clarified ([dd111a0e4](https://github.com/supernovae-st/nika/commit/dd111a0e41558675a8b717b9909c8cff64bf6b0f))
- **crate-specs** — Scaffold Connectome climb — 10 Gate-1 specs ([#113](https://github.com/supernovae-st/nika/issues/113)) ([618cdb2df](https://github.com/supernovae-st/nika/commit/618cdb2df2a367910c187f13076428e143cd40fa)) ([#113](https://github.com/supernovae-st/nika/pull/113))
- **crate-specs** — Nika-browser — guard-5 hardened §5b + gates B.2/B.3 shipped ([fdb42d3e4](https://github.com/supernovae-st/nika/commit/fdb42d3e40f35f10cb255cdd12fdfac382a149a0))
- **crate-specs** — Nika-infer-local — Gate-1 contract + candle loop design ([311e49870](https://github.com/supernovae-st/nika/commit/311e498700ca019a4a8c05f54833b346abff04c7))
- **crate-specs** — Flip 12 stale status rows to admitted + convention readme ([e611f612a](https://github.com/supernovae-st/nika/commit/e611f612a8a5d09378ea5913e49cec5aa55619fe))
- **crate-specs** — Nika-infer-local §5bis — the connection path (build-ready) ([7ab0ed1fa](https://github.com/supernovae-st/nika/commit/7ab0ed1faefc839350551660a6573520f1945cec))
- **crate-specs** — Nika-cli display contract + runnable render prototype ([0b714eee4](https://github.com/supernovae-st/nika/commit/0b714eee4a4bea1c52c95e012e4616312437cef6))
- **crates** — Readme for codegen + verify + schema + types crates ([3ba6de3b8](https://github.com/supernovae-st/nika/commit/3ba6de3b8d7d786061534fab78c61ad9acd64b86))
- **diamond** — Refresh auto-state · post pre-w3 stabilization ([37534abaf](https://github.com/supernovae-st/nika/commit/37534abaf58187b9f3bbe6cb1df6c9a8be09334a))
- **diamond** — Pre-w3 doc quality · 5 critical fixes ([40dde1110](https://github.com/supernovae-st/nika/commit/40dde1110afb3015fde46b96916469e8a16ee52b))
- **diamond** — Ship 4 per-crate readmes + code-of-conduct + security ([d0ef54445](https://github.com/supernovae-st/nika/commit/d0ef54445d8c1565f1b02529690a301712b9e0e1))
- **diamond** — Refresh auto-state + changelog · 2026-05-12 session arc ([41797d452](https://github.com/supernovae-st/nika/commit/41797d452b78aefbd418a1a0a4760ab0029f4289))
- **diamond** — Security lens audit · adr-071/072/073 + cross-link cohesion ([20c0f21eb](https://github.com/supernovae-st/nika/commit/20c0f21eb9ddda1ba355e7a5e73962d6c1f0f025))
- **diamond** — Contributing · cross-link + branch rename carry ([5f7510a32](https://github.com/supernovae-st/nika/commit/5f7510a32cf4b5b7a275921bc27306fd9dd33987))
- **diamond** — Connectome cluster count 9→10 satellites — rerank m13 ([144c5bca6](https://github.com/supernovae-st/nika/commit/144c5bca65530fc4ca176ff3a5d45b12aa75f555))
- **diamond** — Crate tree mirrors the layer registry — shipped reality ([492068e68](https://github.com/supernovae-st/nika/commit/492068e6846c580ab7b9895860b90388cdb605ff))
- **docs** — Rebuild readme with current v0.80 state + docs.nika.sh links ([460ef9851](https://github.com/supernovae-st/nika/commit/460ef9851603f7da832f1dc974c05a56298d5154))
- **docs** — Add wave 4e mintlify split entry to unreleased ([b2b4dceeb](https://github.com/supernovae-st/nika/commit/b2b4dceeb2cc0e2ad618c72242eb698cc4952752))
- **docs** — Refresh roadmap current-state adr/hygiene numbers + docs repo ([942b18aec](https://github.com/supernovae-st/nika/commit/942b18aec843df927d64a8cf2099879ecafd3978))
- **docs** — Rewrite diamond.md to current state ([3ec8c6456](https://github.com/supernovae-st/nika/commit/3ec8c645636b8238b03265d9e85d6f0367a83d1a))
- **docs** — Purge internal handoff + superseded docs from docs/ ([9ebaf05ca](https://github.com/supernovae-st/nika/commit/9ebaf05ca48221aea5de7f0ed674e9ca2c8855b1))
- **docs** — Nika 2040 intelligence-layer vision + llms.txt agent on-ramp ([3d283738f](https://github.com/supernovae-st/nika/commit/3d283738ff7a1cc6e8d467c4d7dc8afaf6a055c7))
- **docs** — Adr-090 evidence paths — list literals, not a brace glob ([51d50ffbe](https://github.com/supernovae-st/nika/commit/51d50ffbebed6fe46aeea2366bb2d3f367d3573b))
- **docs** — Reconcile FCI-016 (public fields require non_exhaustive) ([a8d5da279](https://github.com/supernovae-st/nika/commit/a8d5da279b19a5064c5894fb01b55f9d4a1fda92))
- **docs** — Mark error one-voice unification done (was TRANSITIONAL) ([5ff7bc488](https://github.com/supernovae-st/nika/commit/5ff7bc488b31100cc9b99e70fa3fa129ecdd7dab))
- **docs** — Add machine-readable GATE5-EXEMPT marker to nika-screen spec ([4cb4a9fbc](https://github.com/supernovae-st/nika/commit/4cb4a9fbc0fe7748f81d6aeadbeff55e2fe93d88))
- **docs** — Record nika-types Gate-5 measured result + exempt marker ([5540eda3d](https://github.com/supernovae-st/nika/commit/5540eda3ddd2a6dfbb81eac8345e56deccda95f8))
- **docs** — Bm25 spec — correct false "postings list" claim (P-4 perf) ([c1301e1a8](https://github.com/supernovae-st/nika/commit/c1301e1a83109712716d25b98bef416535ce6268))
- **docs** — Attest nika-catalog Gate-5 (measured 96.8% + exempt marker) ([ba8257021](https://github.com/supernovae-st/nika/commit/ba8257021261af375320b21aa8cae414b9be672e))
- **docs** — Nika-schema parser untrusted-input DoS gates (pre-admission) ([ce8106275](https://github.com/supernovae-st/nika/commit/ce810627568a0cfb09b40eabd57c935105accfae))
- **docs** — Document kernel I/O error-typing convention (FCI-023bis) ([587b58bfb](https://github.com/supernovae-st/nika/commit/587b58bfb4c0e2eedd7264236fe83839596807c3))
- **dx** — Add NEXT_SESSION orientation + /admit command + golden-commits ([5b222f795](https://github.com/supernovae-st/nika/commit/5b222f795909691fb9577f328a8a40fc53ddba1a))
- **dx** — Sync .claude/CLAUDE.md current-state to 2026-04-15 ([5c877aad6](https://github.com/supernovae-st/nika/commit/5c877aad6a71127be7e6f9a3fb2f29b587454f0a))
- **dx** — Sync diamond-progress + roadmap + claude current-state ([a1076cc2a](https://github.com/supernovae-st/nika/commit/a1076cc2a80b1a17ff9928c0a5c71369fef97b49))
- **dx** — Sync .claude/CLAUDE.md current-state — S2b+3 done ([12e88c610](https://github.com/supernovae-st/nika/commit/12e88c610a0e10862dbb7e0f7cc2600d24e62c7a))
- **dx** — Post-hygiene spot-fix — mintlify + diamond + readme + specs ([47889add5](https://github.com/supernovae-st/nika/commit/47889add54a00831723a0c78dbcd16590045fb0c))
- **engine** — Refresh status block head to ba2f65236 post 42-lock ([07525dbc3](https://github.com/supernovae-st/nika/commit/07525dbc3bf4ebd47f02f668864bbf5e20298871))
- **engine** — Sync status block — L0 6, admitted 9/42 post nika-event ([ab9302037](https://github.com/supernovae-st/nika/commit/ab930203722cc19f9a83052115083df567245663))
- **engine** — Sync roadmap status block — L0 6, admitted 9/42 ([b6ec46dde](https://github.com/supernovae-st/nika/commit/b6ec46ddef8b2048b1b32b8fee0b640ef6d00f80))
- **engine** — Sync status block · admitted 10 of 42 · l1 2 post nika-clock ([386024d6b](https://github.com/supernovae-st/nika/commit/386024d6b5ad58e152f48ccad35ed936411cbfef))
- **fci** — De-number the provider rationale (counts rot in prose) ([a6c87bf81](https://github.com/supernovae-st/nika/commit/a6c87bf8129ba276ae518803f950b2a689706de6))
- **gate12** — Forward-compat invariants — connectome names + verb range truth ([d21902cf0](https://github.com/supernovae-st/nika/commit/d21902cf0e5b7874c5491c6dd4c9078784293197))
- **hygiene** — Refresh vector count 15/20 → 31 across 5 files ([a08077b62](https://github.com/supernovae-st/nika/commit/a08077b625555e17457716336ee2271aad147323))
- **invariants** — Extend §9 with Wave 4A/4B reservations (FCI-035) ([2027856be](https://github.com/supernovae-st/nika/commit/2027856beb0fa20bfabb227eba362fe888956fed))
- **invariants** — Correct §See-also ADR-021..028 titles + status ([3f9fdb208](https://github.com/supernovae-st/nika/commit/3f9fdb20836fedeb05687a2f9dfe7bc7bf119370))
- **kernel** — Register computer-use error ranges 1000-1499 in the hub ([aa51f00da](https://github.com/supernovae-st/nika/commit/aa51f00da36c13ab91e63e9a283c7bba4cf094d1))
- **kernel** — Browser trait — typed BrowserError refs, drop stale ErrorKind ([33ab17247](https://github.com/supernovae-st/nika/commit/33ab17247735761f25e4e0602b67e6a3a3b2e3b3))
- **mintlify** — Add crate inventory reference page ([58d009df8](https://github.com/supernovae-st/nika/commit/58d009df86be370b8277c36aa9939919568bfa56))
- **mintlify** — Dark theme diagrams + status page + live numbers ([39b53e331](https://github.com/supernovae-st/nika/commit/39b53e331c297a2448f5b6e8939504127a7fd5c3))
- **mintlify** — Sync crates.mdx numbers with ground truth ([6135a5f0c](https://github.com/supernovae-st/nika/commit/6135a5f0c9e4f8a77e026a155086f36a60fcdc9a))
- **nika** — Adr-083 cross-platform doctrine for l1 computer-use ([1e94191ea](https://github.com/supernovae-st/nika/commit/1e94191ea62564bb91cccceeb8a2400837fbc312))
- **nika** — Refresh status block + active-arc narrative to 0b558f7f8 ([847529fec](https://github.com/supernovae-st/nika/commit/847529fec849c56fb95022a391182fa5ebbdc027))
- **nika-browser** — Module doc — guard-5 hardened contract (node_ref · peek/consume) ([85e282fce](https://github.com/supernovae-st/nika/commit/85e282fceb1021c04a8db6cc4525d5459b7466ec))
- **nika-browser** — Gate-5 budget 4→5 post-occlusion — honest re-measure ([4cc631e30](https://github.com/supernovae-st/nika/commit/4cc631e30e6efc15b6fd812e55bbe4e355123638))
- **nika-builtin** — Retire GATE5-EXEMPT budget → clean FLOOR 91.3% ([a67baa391](https://github.com/supernovae-st/nika/commit/a67baa3919d109b092de125942d5a5b49a4de2be))
- **nika-catalog** — Adr-008 addendum — materialize defaults source of truth ([42fb140e4](https://github.com/supernovae-st/nika/commit/42fb140e4ff5bc4996177e84b236bed98f91f770))
- **nika-catalog** — Renumber wire decision N3 to N4 · de-collide ([86e2ebd36](https://github.com/supernovae-st/nika/commit/86e2ebd360e4df28d3ece8462d49e5a62a52927f))
- **nika-cel** — Re-measure Gate 5 post the Gate-11 fixes (0 missed) ([29b1ec288](https://github.com/supernovae-st/nika/commit/29b1ec2884dc0bbc51c17eeff93cf562d3578bc7))
- **nika-error** — Refresh NIKA-464 explain — engine now enforces schema ([9751f8843](https://github.com/supernovae-st/nika/commit/9751f8843c57ec3028efa87945d95c37c06190d0))
- **nika-kernel-core** — Fs cancel-safety teaches detach-not-abort ([4fd7cd3cc](https://github.com/supernovae-st/nika/commit/4fd7cd3cc60e97242408e4213346c2561e4d2c70))
- **nika-providers** — Fix broken intra-doc links (Gate 8) ([3a03558d5](https://github.com/supernovae-st/nika/commit/3a03558d5f7276a70606ed30e1db6c858bd578fd))
- **nika-schema** — Cascade csv_to_json → convert in 2 doc-comments ([82c5ca980](https://github.com/supernovae-st/nika/commit/82c5ca980af0f9a647fb525a8d947eb7b65d9199))
- **nika-schema** — Nika check section — shipped surface, honest gaps, next steps ([f8e350070](https://github.com/supernovae-st/nika/commit/f8e350070bf4a2f0c406b8acd31982547d805380))
- **nika-schema** — Backtick argv[0] — rustdoc read it as an intra-doc link ([d9b8f1027](https://github.com/supernovae-st/nika/commit/d9b8f1027ae41d09e984e6b99b505498ab8e9cc4))
- **nika-schema** — Spec audit row — span axis + research-conformance suite ([8ad72b33b](https://github.com/supernovae-st/nika/commit/8ad72b33b5a510c3200c940e0226a8d22b43dcb4))
- **nika-schema** — Infer/agent prompt-secret sink is now canonical (F-03) ([510c2cde0](https://github.com/supernovae-st/nika/commit/510c2cde085be0046f0a72162b37d741bd40140e))
- **nika-schema** — Author the 12-gate admission ledger (11/12 green) ([2777d83fa](https://github.com/supernovae-st/nika/commit/2777d83fa28d2b70f2068a208f94cb6480207feb))
- **nika-schema** — Record the Gate-5 floor v2 + survivor rounds 1-2 ([aa096b0c0](https://github.com/supernovae-st/nika/commit/aa096b0c04d5a687a8041e801f68135b6fc7bc09))
- **nika-types** — Doctests import nika_types, not nika_error ([e41c33708](https://github.com/supernovae-st/nika/commit/e41c33708a5cfad2cec74fea15e193ad92e3418d))
- **nika-verb-agent** — Gate 1 spec — s12 the 4th verb, impl deferred ([6f6d63cb5](https://github.com/supernovae-st/nika/commit/6f6d63cb538ac07a0f87fda58a2f4d628730d8be))
- **nika-verb-agent** — Record the ToolDefinitionProvider blocker ([7709b6e5f](https://github.com/supernovae-st/nika/commit/7709b6e5f8e9b187685c0205407b4094b2b57f3f))
- **nika-verb-agent** — Close the spec↔impl coherence debt the agent arc introduced ([3f15d4e54](https://github.com/supernovae-st/nika/commit/3f15d4e5498625dd5dfbedcf3cd67b1d0b710ac2))
- **nika-verb-exec** — Gate 1 spec — s10 second L2 verb crate ([a9df92fee](https://github.com/supernovae-st/nika/commit/a9df92fee59b17fe8f50fa1187082c0095ab6baa))
- **nika-verb-exec** — Note NIKA-442 has no spec counterpart ([0c8504e16](https://github.com/supernovae-st/nika/commit/0c8504e162a9f8045f250a4f6b535594e12ef877))
- **nika-verb-infer** — Gate 1 spec — s9 first L2 verb crate ([5943503f6](https://github.com/supernovae-st/nika/commit/5943503f6d34afa288009bf8b8411642bc9e8078))
- **nika-verb-invoke** — Gate 1 spec — s11 third L2 verb crate ([1d83e12a4](https://github.com/supernovae-st/nika/commit/1d83e12a4d9af9bedc6413d015d332ac71c31219))
- **observability** — Purge ObservabilitySink ghost refs (Q12 rev.3) ([8dc307a98](https://github.com/supernovae-st/nika/commit/8dc307a98cb4e7f25cd4273eb426f44163fb3b2c))
- **plan** — Nika run shipped — mark B1-B5 done + the CEL follow-ups ([3211457ee](https://github.com/supernovae-st/nika/commit/3211457eefe54fbc1ee5cf80c58689d61340358b))
- **plans** — Record swarm-3 audit implementation plan ([6d9c92f85](https://github.com/supernovae-st/nika/commit/6d9c92f856ab1db12365b857618c4c840b081da8))
- **readme** — Mermaid architecture + timeline, honest status, fix stale badges ([24bd193d0](https://github.com/supernovae-st/nika/commit/24bd193d0a88b0cb5d33ecb9e94fa924cbddf0b2))
- **readme** — Cross-link the Nika language spec (engine ↔ spec coherence) ([c5651a12a](https://github.com/supernovae-st/nika/commit/c5651a12ae6b54fdfd0e564967321036a3c2636b))
- **readme** — Intent-as-code framing + connectome codename ([51b4c27b9](https://github.com/supernovae-st/nika/commit/51b4c27b9cd6565e6dc29900297f42d6e71a949b))
- **readme** — Clean up for NLnet readiness · de-confuse legacy version ([b162acf1c](https://github.com/supernovae-st/nika/commit/b162acf1c9751b0eb656ca6b7c5df932c7f3add7))
- **readme** — Drop legacy nika-diamond branch note from status table ([d9121a3a5](https://github.com/supernovae-st/nika/commit/d9121a3a57aa7d15f412d5a0e26fabafba054aa5))
- **roadmap** — Refresh canonical status block to HEAD 6d9c92f85 ([ee6b60a77](https://github.com/supernovae-st/nika/commit/ee6b60a772b9cd55c9b215732636e69cbaba2958))
- **roadmap** — Fix ADR count (021-027 → 021-028) + flag Wave 4A/4B stubs ([ac961b72b](https://github.com/supernovae-st/nika/commit/ac961b72b729650c64d0b6eac5d39078b17a1b17))
- **roadmap** — Add bottom-up progression banner per ADR-037 ([c46cdcc35](https://github.com/supernovae-st/nika/commit/c46cdcc358185497d24c21d992fe02c2edfc0e26))
- **roadmap** — Restructure per ADR-037 bottom-up progression ([cb157fa0e](https://github.com/supernovae-st/nika/commit/cb157fa0efafd026c7475782239aad35b3e08fa4))
- **roadmap** — Correct "spec curates 42→26" + flag pre-d-n6 builtin lists ([e5f262c56](https://github.com/supernovae-st/nika/commit/e5f262c563f0cd7eeb298e3fa9620132d523ecf8))
- **roadmap** — Fix line 96 spec-contract "42 builtins" → 26 ([c06192270](https://github.com/supernovae-st/nika/commit/c06192270a88b7eade8aaeb49b6f6d8c113d08e4))
- **roadmap** — 14 providers · openrouter promotion cascade ([64144a0fb](https://github.com/supernovae-st/nika/commit/64144a0fb202c3be215da3c985c87560e5b9f577))
- **roadmap** — Connectome cluster 1+10 — memory section de-staled to ratified canon ([272c942a7](https://github.com/supernovae-st/nika/commit/272c942a7929fe0576ab8eea6ba160de137a426c))
- **roadmap** — Providers rows reflect the shipped shape — rig not carried ([5301dd873](https://github.com/supernovae-st/nika/commit/5301dd8733ea3b7d70e380caf11c26e2bf64ee3e))
- **roadmap** — Refresh the auto-block — 32 crates, 2325 tests (vector 23) ([60998274f](https://github.com/supernovae-st/nika/commit/60998274f142d508c1d988fb753d86d4941f43bb))
- **roadmap** — Sync status block to the nika-cli admission (38/42) ([b85b2722b](https://github.com/supernovae-st/nika/commit/b85b2722b883bd66a4bfe46bac7279ef231669b6))
- **rules** — Collapse-vs-publish status precision — proposal not locked ([b9b4b8b91](https://github.com/supernovae-st/nika/commit/b9b4b8b91625d97fa2a4ef1505b4946129454e45))
- **screen** — Add crate-spec + sync status block · hygiene v6+v23 green ([fe2be76b0](https://github.com/supernovae-st/nika/commit/fe2be76b00e875e97e450efbeb9f35f3b415493a))
- **skills** — Adopt gitnexus MCP integration guide ([2343e89f1](https://github.com/supernovae-st/nika/commit/2343e89f146b4dbacf2f5c29a21551d090c1de44))
- **spec** — Attest nika-schema Gate-5 budget + when-gate DoS mitigation ([c56eddc0f](https://github.com/supernovae-st/nika/commit/c56eddc0f9e3a84d356debb092bd7efb1c53ae5b))
- **spec-sync** — Sweep engine docs to the curated-22 + closed namespaces ([#118](https://github.com/supernovae-st/nika/issues/118)) ([d0f76c632](https://github.com/supernovae-st/nika/commit/d0f76c632ea77dde517d26b95d590e0596401d73)) ([#118](https://github.com/supernovae-st/nika/pull/118))
- **state** — Refresh auto-block + ladder prose — s7 admitted, next s8 ([7c258d83f](https://github.com/supernovae-st/nika/commit/7c258d83f7cdc44c4bed5c740074246538948d61))
- **state** — Re-sync canonical blocks from main — vector 23 green ([1ca15ac3e](https://github.com/supernovae-st/nika/commit/1ca15ac3eee320826a1766ea883a9a6213f08b28))
- **state** — Re-sync canonical blocks post-merge — vector 23 green ([bfc654c4d](https://github.com/supernovae-st/nika/commit/bfc654c4d8ddf3f5b52e684b78ec88cbe7b17579))
- **state** — Narrative — m2.4 b.2+b.3 shipped, dyn-variant canon uniform ([0a6a227af](https://github.com/supernovae-st/nika/commit/0a6a227af53ec6c47c1dc35b312441ed6dc9e98d))
- **state** — Re-sync auto-block post s8.5 — L1.5 layer row added ([c1d86f02f](https://github.com/supernovae-st/nika/commit/c1d86f02fcb46ff32fc5fc3b1aa5851999e4b81c))
- **state** — Post-rebase block re-sync — 24/42 admitted, 1459 tests ([95bce169a](https://github.com/supernovae-st/nika/commit/95bce169a952bc36869516d65d7e0e7158be3587))
- **state** — Re-splice canonical blocks — vector 23 parity ([7a51e4db7](https://github.com/supernovae-st/nika/commit/7a51e4db78a0b873c81e64b740781f499b8930c3))
- **status** — Refresh status block HEAD 6d9c92f85 → 9ebaf05ca ([393fdefa8](https://github.com/supernovae-st/nika/commit/393fdefa8f89e174cbb8ea608e699b5589414521))
- **status** — Refresh canonical block · m1 kernel sealed · 1110 tests ([98f5a61b7](https://github.com/supernovae-st/nika/commit/98f5a61b7233f9ad7e45387f8f1a86833c42d39e))
- **status** — Refresh canonical block — HEAD b5a528e84 · 1267 lib tests ([d3693506b](https://github.com/supernovae-st/nika/commit/d3693506bfd2f4b89a90148ba741d60a92cc056c))
- **status** — Correct leaked branch name in canonical block — main not feat ([20375a62e](https://github.com/supernovae-st/nika/commit/20375a62e481bd9d9998f481de0c6ede9f98d3f3))
- **status** — Refresh auto-generated block — nika-runtime admitted ([a55b0f11e](https://github.com/supernovae-st/nika/commit/a55b0f11edefa05e737c0165e90e46da69282acd))
- **status** — Refresh the auto-block — 32 crates admitted, 2325 tests ([dc34ce450](https://github.com/supernovae-st/nika/commit/dc34ce4509a52f7c4b99d58e082fdc89c3019fe8))
- **status** — Refresh the status-block HEAD to the audit-fix tip ([4d94a7179](https://github.com/supernovae-st/nika/commit/4d94a717942308b339da6c8b81846e0f4a8b79e2))
- **workspace** — Post-wave-3 coherence review — align all logs + arch docs ([e5c17e781](https://github.com/supernovae-st/nika/commit/e5c17e781d0c69f074bebffddcd4f97e6413b5e5))
- Scaffold docs.nika.sh via Mintlify ([90ce455b0](https://github.com/supernovae-st/nika/commit/90ce455b039e3965900290df67c628665d114563))
- Ultrathink alignment — zero feature lost, philosophy clear ([8a2ef99fa](https://github.com/supernovae-st/nika/commit/8a2ef99fad3bf8e20b20de59cec52e682dba00b4))
- Update CHANGELOG + ROADMAP post Phase D Session 1 ([883112cdc](https://github.com/supernovae-st/nika/commit/883112cdcdb286c690c3c36e5601ebdf397753a7))
- Align DX + rules + public docs post Phase D Session 1 ([1a29bd32f](https://github.com/supernovae-st/nika/commit/1a29bd32fc9e6a5ff665a2781f7b32c3bd47be59))
- Ecosystem bible + GitNexus safe-install protocol ([9495d1a07](https://github.com/supernovae-st/nika/commit/9495d1a07a982ae4ce816467bc58a5468bcceb59))
- Align DX + CHANGELOG + ROADMAP post Phase D Session 2a ([133ffa0ff](https://github.com/supernovae-st/nika/commit/133ffa0ff8d5094e778334f8f84eb0ea21deddee))
- Deep DX audit — fix 6 stale P0 findings ([b708edf58](https://github.com/supernovae-st/nika/commit/b708edf58c3ef8535dfa0dce082b9f79b99bb0a5))
- Update ROADMAP + CHANGELOG for Session 4A stabilization ([c4ae1ab5e](https://github.com/supernovae-st/nika/commit/c4ae1ab5e9c010c9176ec19a97dbd7388d26df2f))
- Update ROADMAP + CHANGELOG for Session 4B data enrichment ([d6d30b810](https://github.com/supernovae-st/nika/commit/d6d30b8100b9e6113a035d7a13e3d0834550f974))
- Rewrite readme from scratch · SOTA · destination not journey ([e2d6fbf16](https://github.com/supernovae-st/nika/commit/e2d6fbf1633b2287c8587f34c8c4d6ce313fa3e9))
- Pillar-1 de-hardcode — agents.md + roadmap totals + claude narrative ([7bfceee91](https://github.com/supernovae-st/nika/commit/7bfceee913cdbe376ffe0e8c8273320a526c9ac5))
- Annotate the branch rename in 7 live mentions of nika-diamond ([945b9ef8c](https://github.com/supernovae-st/nika/commit/945b9ef8cfca7a0f979ec6b033df587b755fd82a))
- One-voice release ladder + canonical mcp tool ref ([dc9227445](https://github.com/supernovae-st/nika/commit/dc9227445f1ed2be3120e62c9ecdaa1f67a00b0e))
- CITATIONS.md — credit every work the engine stands on ([c915d592e](https://github.com/supernovae-st/nika/commit/c915d592e65549660d25067750d68c6eae107f39))
- CITATIONS — the Lv & Zhai row reflects BM25+ activation ([612326942](https://github.com/supernovae-st/nika/commit/6123269420f413354de3c38ee49452e061d26749))
- Post-runtime truth sweep — counts · claims · the error census ([9dfc5fd7a](https://github.com/supernovae-st/nika/commit/9dfc5fd7a2eb9c8ee4944f30c8fe0d8d035ddeab))
- Fix versioning residuals + restore ADR-002 status + sync mirror ([060998f2e](https://github.com/supernovae-st/nika/commit/060998f2ef31865ae963cb8cc61cb54d8bed7b15))

### 🧪 Tests
- **catalog** — Kill 14 mutation survivors (CapPatchBuilder + suggest_in) ([18f529271](https://github.com/supernovae-st/nika/commit/18f529271651f7393ad3c8a066928708d95a230e))
- **error** — Proptest registry uniqueness + memory cross-mapping · diamond w2.3 ([f13847f63](https://github.com/supernovae-st/nika/commit/f13847f635ed781a20333d3a2ea86a4b9bf52f01))
- **event** — Pin EventKind wire slug — serde and as_str() must agree ([636873ebe](https://github.com/supernovae-st/nika/commit/636873ebe26983600f22d196ede48672055be8d5))
- **hygiene** — Add batch-h-plus red-team harness scaffold ([ebfa16b44](https://github.com/supernovae-st/nika/commit/ebfa16b44bae3b5ff08aaec5454e0234612dd9b1))
- **nika-a11y** — Real-walk smoke skips on no-focus, never false-fails ([f88ef62dc](https://github.com/supernovae-st/nika/commit/f88ef62dcddfda151ff719992dbc3a1dc1f8861e))
- **nika-bm25** — Gate 2 red · manning iir ch.11 fixture + tdd tests ([82b70662f](https://github.com/supernovae-st/nika/commit/82b70662fa0718b403d93ffef46c4eb6b07d255e))
- **nika-bm25** — Gate 5 mutation killers · ranking parity tests ([23d648572](https://github.com/supernovae-st/nika/commit/23d648572c61a06c2f019badeb8a375c495d70fc))
- **nika-bm25** — Gate 5 golden values · pin exact scores within 1e-9 ([be751ea63](https://github.com/supernovae-st/nika/commit/be751ea635318b22cd99d6a4cc7fbdbf0d63de98))
- **nika-bm25** — Ultrathink improvements · okapibm25 parity + 10k bench + sourced 2030 ratchet ([bedb92929](https://github.com/supernovae-st/nika/commit/bedb92929f6510ef2d6ae8e47f8722b752ccfb93))
- **nika-bm25** — Property-test the BM25 invariants over the input space ([04c62417d](https://github.com/supernovae-st/nika/commit/04c62417dbce674644f7f34646b8a53a2c5c03e2))
- **nika-browser** — Pin backend_ref + bbox guard exact — 6 mutants killed ([16c4d8631](https://github.com/supernovae-st/nika/commit/16c4d8631df6bb81e7d77b34603aff4d19879991))
- **nika-browser** — Kill consume + epoch-timestamp mutants ([02f1502ac](https://github.com/supernovae-st/nika/commit/02f1502ac03c672d86d05953307dcb3f7d6c53d5))
- **nika-builtin** — Gate-6 property tests — the seed's promise kept ([b337e4372](https://github.com/supernovae-st/nika/commit/b337e437203572c1073edf2dd0b376dec5268659))
- **nika-builtin** — The polynomial proof is completion, not wall-clock ([a43a29ec1](https://github.com/supernovae-st/nika/commit/a43a29ec19f1d6b51589ca630c38c4813a81b395))
- **nika-builtin** — Decoder padding-gate pin + the disjoint-bits note ([5968ed3cf](https://github.com/supernovae-st/nika/commit/5968ed3cf66fb455c897dc8cf6d1e8bcdfbd7fed))
- **nika-builtin** — Harden Gate-5 surfaces + 12-gate readiness table ([59984a287](https://github.com/supernovae-st/nika/commit/59984a287d6cd89e6c3360d004157a0466def45c))
- **nika-catalog** — Add pricing proptest invariants (1000 cases) ([7f9625cfa](https://github.com/supernovae-st/nika/commit/7f9625cfa1da82f9fc1be0b96bae4681768cebbb))
- **nika-catalog** — Add capabilities proptest invariants (10k cases) ([0fba30556](https://github.com/supernovae-st/nika/commit/0fba305567e6fcfe7b3b33cb474a7500a15498b7))
- **nika-catalog** — Extend merge_with + estimate_cost regression tests ([9da58d7ac](https://github.com/supernovae-st/nika/commit/9da58d7ac96ce788000e6dc87f3f31fc51e3ffbb))
- **nika-catalog-codegen** — Kill 43 mutation survivors — 87% → 98.9% ([f0b5367e3](https://github.com/supernovae-st/nika/commit/f0b5367e3e86b9162b080f2f182065eb5f8bdab2))
- **nika-cli** — Kill the display-fold mutation survivors + deny wrapper ([5bf733032](https://github.com/supernovae-st/nika/commit/5bf733032264590c8451f407e4df67cda4ca0c3e))
- **nika-cli** — Pin per-task cost attribution — graph projector 100% viable-kill ([ac1d598dc](https://github.com/supernovae-st/nika/commit/ac1d598dc5e42d45147528e8183f0c083395b96b))
- **nika-cli** — Rehearse the agent loop over the real builtin dispatcher ([2c7e60f78](https://github.com/supernovae-st/nika/commit/2c7e60f78383deb3b250cd5a5bf1a9cd65f3b819))
- **nika-cli** — Wave-2 agent rehearsal — repair · batch · security · budget · schema ([0e712ce80](https://github.com/supernovae-st/nika/commit/0e712ce80dff1b972395ac2f8dba12cb6511e078))
- **nika-cli** — Golden frames for the two new §3.1 states + doc truth ([7a8a0b694](https://github.com/supernovae-st/nika/commit/7a8a0b6948282a3b4534900e1b9ba40c7f9bd14c))
- **nika-cli** — Wave-3 rehearsal — binary round-trip + tz through the real chain ([7f41b7d90](https://github.com/supernovae-st/nika/commit/7f41b7d90a18db1013d4d4981c750d42a7e5adad))
- **nika-cli** — E2e offers reflect the 23rd builtin (nika:compose) ([638f51b5b](https://github.com/supernovae-st/nika/commit/638f51b5b463263c3bf076549af760983ea131ec))
- **nika-cli** — E2e failure card expects the spec code NIKA-EXEC-001 ([0b558f7f8](https://github.com/supernovae-st/nika/commit/0b558f7f8139bcbb4f96ba4b54decea702ad08f7))
- **nika-cli** — Un-stale two pre-existing verbs_static failures ([560a483b9](https://github.com/supernovae-st/nika/commit/560a483b943425084dd965111abf257271adc6ce))
- **nika-cli** — Pin the run verb's locked exit codes (0/1/2) ([3f533bbb7](https://github.com/supernovae-st/nika/commit/3f533bbb7eb732f4c82002f212db5bf2a1b06bc9))
- **nika-cli** — Ignore the env-dependent examples-run smoke ([e0f2be722](https://github.com/supernovae-st/nika/commit/e0f2be72249fc4e95abd031c88337df7a9035d50))
- **nika-cli** — Harden render surface to Gate-5 mutation 91% ([e0f0cfa4e](https://github.com/supernovae-st/nika/commit/e0f0cfa4e6991afc429df345496dc5b9c89ad595))
- **nika-cli** — Add the Gate-6 fold property battery ([c43a8d0cd](https://github.com/supernovae-st/nika/commit/c43a8d0cdc2401e42606f8766d9af37b52cd525c))
- **nika-error** — Proptest lattice/identity laws + sealed.rs doc truthing ([2e61823c3](https://github.com/supernovae-st/nika/commit/2e61823c3895fd0124190d1755a86c7620097fa6))
- **nika-error** — Commit proptest regression seed for codes ([73244e50f](https://github.com/supernovae-st/nika/commit/73244e50f64106dc15e251e1c5328dca3b62b301))
- **nika-event** — Defuse the stale integration landmine — contract suite synced to 17 ([856964f10](https://github.com/supernovae-st/nika/commit/856964f10531f6ed4d183104db90833f3c35cc67))
- **nika-extract** — Real-socket fetch rehearsal + mutation killers · finalize deps ([b743babce](https://github.com/supernovae-st/nika/commit/b743babce61b49a239208c60eca554938cb03da2))
- **nika-extract** — Mutation ladder 83% → 100% — every viable mutant dies ([24309511e](https://github.com/supernovae-st/nika/commit/24309511e78ef04ebd6cd8a762136f38c7119adb))
- **nika-extract** — Harden the Gate-6 totality proptest ([be1edb25e](https://github.com/supernovae-st/nika/commit/be1edb25e20718212329970c220dac44c6795be7))
- **nika-extract** — Kill 73 mutation survivors to Gate-5 93% ([361f755d7](https://github.com/supernovae-st/nika/commit/361f755d74108aa43b0fe48fe8017f2ff5a5789e))
- **nika-http** — E2e over real loopback sockets — redirect · cred-strip · caps · timeout · stream ([5fe95b405](https://github.com/supernovae-st/nika/commit/5fe95b4051b3173fd4ccad263368d809b018471a))
- **nika-http** — Fix stale tls smoke test — TEST-NET is SSRF-blocked ([e14688c0f](https://github.com/supernovae-st/nika/commit/e14688c0f2e0cb4e4d8bbb16395daf857ae98388))
- **nika-http,nika-schema** — Pin check↔runtime host-extraction parity ([89396a1e0](https://github.com/supernovae-st/nika/commit/89396a1e0d066236373983567f47d281f0aabe33))
- **nika-kernel** — Add MemoryId deserialize error path tests ([a325cd564](https://github.com/supernovae-st/nika/commit/a325cd564d2632472baf3ab65cc024887b252c0c))
- **nika-providers** — Json-mode structured-output parity ([2ce6912cb](https://github.com/supernovae-st/nika/commit/2ce6912cb10adc52f5a4adc4fe20d206d9120a51))
- **nika-providers** — Cross-provider tool-call parse parity ([a07ff35f5](https://github.com/supernovae-st/nika/commit/a07ff35f5a3b0dfb83a47ca43a1ff80c1cb5011c))
- **nika-runtime** — The theorems extend over the buffered agent telemetry ([6fee61350](https://github.com/supernovae-st/nika/commit/6fee613506b87f35d811a7fbc64f46191c049c9f))
- **nika-runtime** — Close the agent-adapter mutation gaps — attempt stamps, compose, streak ([65ebb0153](https://github.com/supernovae-st/nika/commit/65ebb015352c488757e7d7dc355e3048425cc1d4))
- **nika-runtime** — Add required path to floor wide-fan write fixture ([8f6fd84ce](https://github.com/supernovae-st/nika/commit/8f6fd84cee0882107cc925ec1e407e1ade5051cc))
- **nika-runtime** — Lock for_each on_error:skip positional-null path ([81ca81976](https://github.com/supernovae-st/nika/commit/81ca81976527ec7b2335957514314edadacc94d0))
- **nika-schema** — Pin canonical envelope contract (RED · admission-prep) ([991700643](https://github.com/supernovae-st/nika/commit/991700643630ca1b050fb65be819e2f63fae5768))
- **nika-schema** — Kill the 5 mutation survivors — 100% on the new modules ([927f23b3b](https://github.com/supernovae-st/nika/commit/927f23b3bd6a74b390a6275a342cc6ab0229c8d0))
- **nika-schema** — Snapshot-pin both glyph themes + themed chrome typography ([453d3fa5b](https://github.com/supernovae-st/nika/commit/453d3fa5bf51a338ce24e2317e2e82f1dc2057a9))
- **nika-schema** — Gate-6 properties on the reference fold ([1fa313ffb](https://github.com/supernovae-st/nika/commit/1fa313ffb7a51acb20184c73d51ec7edcd298c84))
- **nika-schema** — Fetch fixtures gain their url — the new net caught them ([c57ea8b8d](https://github.com/supernovae-st/nika/commit/c57ea8b8d56132fa5402a5686e30350fa2bad84c))
- **nika-schema** — Deep conformance verdicts against the full check() surface ([afa8c10b4](https://github.com/supernovae-st/nika/commit/afa8c10b40f823f57e10915319c9a210f532c729))
- **nika-schema** — Gate-7 criterion benchmarks for the parse hot path ([7853d3c03](https://github.com/supernovae-st/nika/commit/7853d3c034ebb7a9f071174c1b4a501ddf71adb0))
- **nika-schema** — Cover gate-5 survivor clusters across four files ([8cf1225eb](https://github.com/supernovae-st/nika/commit/8cf1225ebadd5728003ee1ecd4f7a72dd45ec7db))
- **nika-schema** — Cover the remaining preference_rules lint survivors ([42667ef19](https://github.com/supernovae-st/nika/commit/42667ef195d4d5b8d206a0641156ddd26dbeab1a))
- **nika-schema** — Close the gate-5 long-tail survivors across ten files ([2f8817f17](https://github.com/supernovae-st/nika/commit/2f8817f17a7f0211c6520f0fd704bb9d5352d4fc))
- **nika-schema** — Kill the three lexer survivors (round 4) ([6134aca00](https://github.com/supernovae-st/nika/commit/6134aca00ac1b365f8351ddfb731f02deb1dfded))
- **nika-schema** — Cover parser/mod source-bounds + check/mod codes (round 5) ([6c9a078ac](https://github.com/supernovae-st/nika/commit/6c9a078acc0935f1860c7f21716178183959c484))
- **nika-schema** — Cover read_dag cap + pinch boundaries (round 6) ([c8350ee40](https://github.com/supernovae-st/nika/commit/c8350ee40588339d7d54b2da9b39c455b801b99b))
- **nika-schema** — Pin default-gate runnable path in reach ([27e0f3ddf](https://github.com/supernovae-st/nika/commit/27e0f3ddf5429abfbaca4e3df6f442ceb9b2e4b1))
- **nika-schema** — Kill expression-parser mutation gaps (round 7) ([7bba982a0](https://github.com/supernovae-st/nika/commit/7bba982a08789ecd1e205cd93e91de1708923800))
- **nika-schema** — Add parser + check benchmark (Gate 7) ([bcc1c8f32](https://github.com/supernovae-st/nika/commit/bcc1c8f329cd4696e6ebe55abc4906821b34009a))
- **nika-types** — Proptest audit for TrustLevel lattice + ID serde roundtrip ([73518494c](https://github.com/supernovae-st/nika/commit/73518494cd1c47b25ae7add3d487148a85812126))
- **nika-types** — Loom interleaving tests for CancelCtx (inv-029, batch ii ε.2) ([3a54b80d4](https://github.com/supernovae-st/nika/commit/3a54b80d46040ec54572f5e744526a7206cb82f4))
- **nika-types** — Kill from_unix_ms + unix_us surviving mutants ([ec479108d](https://github.com/supernovae-st/nika/commit/ec479108d933705e8130258f80ce9a78b34efd03))
- **nika-types** — Kill 3 baggage.rs mutation survivors (Gate-5 gap) ([ea66e301d](https://github.com/supernovae-st/nika/commit/ea66e301d607417d7059f26e5a4c9674dad6de85))
- **nika-types** — Close Gate-5 — kill 24 mutation survivors across 5 files ([0b03a0569](https://github.com/supernovae-st/nika/commit/0b03a0569652c4b58ab21bf15ad976f07fa7fda5))
- **nika-types** — Add tab/CRLF host-extraction bypass vectors ([3cd1a346d](https://github.com/supernovae-st/nika/commit/3cd1a346da8ff02f6f2272660db60a6a8765e028))
- **nika-verb-exec** — Pin stderr-tail boundary walk; note equivalent mutant ([7b0d7477f](https://github.com/supernovae-st/nika/commit/7b0d7477f0f1ffd0cb9a5cd62b6b4491cf464dc1))
- **nika-verb-infer** — Gate 10 parity — request shaping pinned vs brouillon ([0f2f5126a](https://github.com/supernovae-st/nika/commit/0f2f5126ae17b793f74df263dfd98a81b5e1d592))
- **nika-verb-infer** — Pin render_schema cap boundaries — mutants 8/8 killed ([db070e4b3](https://github.com/supernovae-st/nika/commit/db070e4b359ad7a71bf7faff86931ebe6e7aff0f))
- **nika-verb-invoke** — Pin the control-char byte rule exactly ([42acd7826](https://github.com/supernovae-st/nika/commit/42acd782688ab6837cb06f901176464a6607b313))

### 📦 Build
- **release** — Cross-platform binary pipeline + homebrew formula bump ([a77153ae3](https://github.com/supernovae-st/nika/commit/a77153ae300fa232138af69f1c1ca88054b75be3))
- Align prod-scoped size/unwrap checks with the tests.rs convention ([4c4113181](https://github.com/supernovae-st/nika/commit/4c411318101d8d8078e4c13f153267935cf500c0))

### 🧹 Chore
- **ci** — Allowlist proptest .expect() in cfg(all(test, ...)) modules ([4c22a5c17](https://github.com/supernovae-st/nika/commit/4c22a5c175be2116e365707bd02643e621cbb7fe))
- **ci** — Add nika-kernel to tokio deny wrappers (dev-dep) ([edb7283a9](https://github.com/supernovae-st/nika/commit/edb7283a9fce8777cd8f6905b8164f3e464c2269))
- **ci** — Wire cargo-public-api snapshots (P0 — Gate 12 enforcement) ([3edfc6fa0](https://github.com/supernovae-st/nika/commit/3edfc6fa0c2e24c3644455e2869d7778bbdeee68))
- **ci** — Floor nika-exec-runner public-api + re-sync status block ([499133308](https://github.com/supernovae-st/nika/commit/4991333080d224c199c67550ed5d695352ea83e9))
- **ci** — Wire s8.5 into the gate scripts — first L1.5 crate ([4f1a9fb8d](https://github.com/supernovae-st/nika/commit/4f1a9fb8d11c68e4816698516fd405af51b83b1d))
- **ci** — Floor nika-pack public-api baseline — ratchet 23/25 ([51896b145](https://github.com/supernovae-st/nika/commit/51896b145b39f8eaedb0f88bed46fcd37259ca53))
- **ci** — Floor the 3 L2 verb-crate public-api baselines — ratchet 26/28 ([4d56b8b5b](https://github.com/supernovae-st/nika/commit/4d56b8b5bb663461ef9bc302d8ea057a4185b110))
- **ci** — Retire the first_balanced_span allowlist entry — parser fixed ([fdd5ea3f0](https://github.com/supernovae-st/nika/commit/fdd5ea3f0562e3b4506988bc8fde05fa54cdcd3a))
- **ci** — Deny wrappers — tower-http + nika-infer-local ([5e52bfce4](https://github.com/supernovae-st/nika/commit/5e52bfce442ee12579789b7d3a7c593bcda99410))
- **ci** — Unblock the train — block re-splice + infer-local exemption ([ec602f000](https://github.com/supernovae-st/nika/commit/ec602f00021b72222f93b7c092c0a20c4305d13e))
- **ci** — Green the shared push train — extract gate rows + anchors ([870b0eb3c](https://github.com/supernovae-st/nika/commit/870b0eb3c9d09a1fd8deb37e4a5278e9a45b7841))
- **ci** — Fix-forward the push train — schema clippy + adr-093 frontmatter ([d7367c242](https://github.com/supernovae-st/nika/commit/d7367c242e0a07485638f4826f0244d5dd7d6ad7))
- **claude** — Harden CC hooks — A2 + P1-10 + P1-11 ([a7311be98](https://github.com/supernovae-st/nika/commit/a7311be9817b984b4c2d8881a2c8ed853f7ff5af))
- **crates-io** — Publish=false on 7 foundation crates (Phase B.0) ([a4ed8c309](https://github.com/supernovae-st/nika/commit/a4ed8c3092fa0222cc66646c75c83c2e400df59c))
- **deny** — Scope tokio wrapper to nika-clock · l1 time effect ([b529d8759](https://github.com/supernovae-st/nika/commit/b529d8759276aef6653af659e24617d618d021b6))
- **deny** — Tokio ban-wrappers follow the kernel split ([d1b9bffa7](https://github.com/supernovae-st/nika/commit/d1b9bffa7de1aeb3989a5d378d123a99fa0164fd))
- **deny** — Allow the chromiumoxide transitive stack through l1 wrappers ([d1df5dd18](https://github.com/supernovae-st/nika/commit/d1df5dd18f02033afd61e4b6a514eea3d3ecddf8))
- **diamond** — Pre-w3 stabilization · 5 fixes ([dd2ec28e5](https://github.com/supernovae-st/nika/commit/dd2ec28e5831bc4cb66e95f5d92cb4f5409a074c))
- **dx** — Add miri + cargo-hack ci jobs + activate tokio layer bans ([7beb24dcb](https://github.com/supernovae-st/nika/commit/7beb24dcb1290a1f83c864d990840db03f5a01b4))
- **dx** — Add machete + semver-checks + typos CI + fix unused deps ([31128e9a2](https://github.com/supernovae-st/nika/commit/31128e9a209cf4204a4b7b59d2cf05d85ab33f1d))
- **dx** — Wire gitnexus session-status + auto-reindex hooks ([f7479cb08](https://github.com/supernovae-st/nika/commit/f7479cb0831dc3df7eff8dadf30bb70c650be222))
- **dx** — Add cliff.toml v2 for changelog automation (A1) ([a99abb9bd](https://github.com/supernovae-st/nika/commit/a99abb9bdc8c5d1f9e48b366d5f5e34be0b5dd77))
- **dx** — Decommission gitnexus — spn-insight replaces it (S8-S9) ([fd7b9f672](https://github.com/supernovae-st/nika/commit/fd7b9f6728c9bb8e1bd22d71ca5d4b7cf4b42ce0))
- **dx** — Remove scripts/gitnexus/ + clean remaining refs ([5d4a49a5f](https://github.com/supernovae-st/nika/commit/5d4a49a5fa79e7e5e4acfbb90624fa712ea30134))
- **dx** — Drop legacy tools/ fallback in SessionStart hook ([1ee7b31dd](https://github.com/supernovae-st/nika/commit/1ee7b31dd5087b56e9cece235fc88baf54e869f5))
- **hooks** — Add prepare-commit-msg auto-inject Nika trailer (A3) ([73ab5ff8f](https://github.com/supernovae-st/nika/commit/73ab5ff8f464d47546c54435f6870df5cc2d60c1))
- **hooks** — Register screen scope for nika-screen m2.1 ([be8cc6749](https://github.com/supernovae-st/nika/commit/be8cc6749424ce307776cd827c0b2dd76f8d27d9))
- **hygiene** — Install lefthook pipeline + hook scripts ([320563165](https://github.com/supernovae-st/nika/commit/3205631651ebc0bc4016e25d37e59ff26714673c))
- **hygiene** — Add layering enforcement + fix stale paths → 21/21 green ([27eca5cf6](https://github.com/supernovae-st/nika/commit/27eca5cf6c2fdcbfa8d30c050e5563d1079bc402))
- **hygiene** — Unblock push — fix 4 REDs from accumulated debt (Phase B.0) ([8e18475e2](https://github.com/supernovae-st/nika/commit/8e18475e2cc7febf96ae4b5dd577444630df4fd5))
- **hygiene** — Vector 27 grows the box-dyn-ok exemption marker ([bd013f8b3](https://github.com/supernovae-st/nika/commit/bd013f8b3273a01e21ac3129492efb077dd30a7b))
- **hygiene+claude** — Wire vector 25 into dashboard + cargo-yank/publish guard (K2) ([7a8b2f9fd](https://github.com/supernovae-st/nika/commit/7a8b2f9fd237defdd99a852743b619cf1970c7e2))
- **mintlify** — Status snapshot infra + purge 8 dead pages ([c5225d5b8](https://github.com/supernovae-st/nika/commit/c5225d5b821b32b811cd9a3e1c527fa15228b30b))
- **nika** — Refresh auto-state block — HEAD 3a03558d5 · 2524 lib tests ([42e8cd1bc](https://github.com/supernovae-st/nika/commit/42e8cd1bc28d1cb32c1f55755ff068ad3cc80930))
- **nika-builtin** — Drop the seed template's dead deps — machete gate ([ff2b5c59f](https://github.com/supernovae-st/nika/commit/ff2b5c59f1244caa63500c14e466d5b334b95188))
- **nika-catalog** — Mark supports_vision deprecated — session 3 decommission ([bcb2adc36](https://github.com/supernovae-st/nika/commit/bcb2adc362942e0ddb7e03c24f3eab595eee1631))
- **nika-catalog** — Machete ignore for build-dep generator ([ac3eb0263](https://github.com/supernovae-st/nika/commit/ac3eb02630e0f902d22abcc497fc1e0485c7eaf3))
- **nika-event** — Regenerate the public-api baseline — vocabulary cohort ([a716f292c](https://github.com/supernovae-st/nika/commit/a716f292cc9ea0e5766821d2719a3f56022aae8e))
- **nika-infer-local** — Converge tokenizers on candle's 0.22 — one copy ([c6ce23dc5](https://github.com/supernovae-st/nika/commit/c6ce23dc55f85646b92c1cef0ae76a80965fb538))
- **nika-pack** — Re-sync pack — spec divergence-audit hardening ([#114](https://github.com/supernovae-st/nika/issues/114)) ([24a167bda](https://github.com/supernovae-st/nika/commit/24a167bda92885a6710022e270dd2c54a25bbba9)) ([#114](https://github.com/supernovae-st/nika/pull/114))
- **nika-pack** — Re-sync pack — rounds 2+3 (spec 6c18927) ([#116](https://github.com/supernovae-st/nika/issues/116)) ([923ec04d4](https://github.com/supernovae-st/nika/commit/923ec04d4074c75a42e54eb6cc60c6ab8c9317f9)) ([#116](https://github.com/supernovae-st/nika/pull/116))
- **nika-pack** — Re-sync pack — argv exec, CEL expansion, permits, registry 30 ([#119](https://github.com/supernovae-st/nika/issues/119)) ([cbf0bbb50](https://github.com/supernovae-st/nika/commit/cbf0bbb50ad490438a15ac585abed172658f8511)) ([#119](https://github.com/supernovae-st/nika/pull/119))
- **nika-pack** — Re-sync pack — quickstart one-voice posture ([#120](https://github.com/supernovae-st/nika/issues/120)) ([688bc8357](https://github.com/supernovae-st/nika/commit/688bc83573a21cd1534b1e01e7121c13941439e0)) ([#120](https://github.com/supernovae-st/nika/pull/120))
- **nika-pack** — Re-sync extract-modes — jq one-output law · metadata-links unphantomed ([4c7de7da6](https://github.com/supernovae-st/nika/commit/4c7de7da6b28bd2cfdd7e258a9d15dc5bc4644bd))
- **nika-pack** — Re-sync 08-out-of-scope — H23 cursor-pagination posture ([0c23589ab](https://github.com/supernovae-st/nika/commit/0c23589ab106191940f00977e42f0f5daceb06b8))
- **nika-pack** — Re-sync builtins-v0.1 — notify data: field ([6b7d2eef7](https://github.com/supernovae-st/nika/commit/6b7d2eef75ced4f1859bbd3528d038a1147ca9cb))
- **nika-pack** — Re-vendor 14 clean SSOT pack files to embed ([807abedc7](https://github.com/supernovae-st/nika/commit/807abedc76d36b7e1c086908dd90bbaee0204ff9))
- **nika-pack** — Re-vendor embedded pack (egress reconcile + F-01 + F-03) ([7bdf1390d](https://github.com/supernovae-st/nika/commit/7bdf1390d3a45c7211a296d222f939dff613a4f1))
- **nika-schema** — Exclude analysis.rs graph divergers from cargo-mutants ([d2f05b970](https://github.com/supernovae-st/nika/commit/d2f05b97015ed7b06b3aba60d324f6263fbc935e))
- **nika-types** — Refresh stale public-api baseline ([78fe6a1ed](https://github.com/supernovae-st/nika/commit/78fe6a1edeae8115c871a1471261b61e058f3e08))
- **rename** — Pre-rename cascade · nika-diamond → main · main → brouillon ([94ebc0954](https://github.com/supernovae-st/nika/commit/94ebc0954593c9838932cca360a1474a5f9dfe94))
- **rename** — Post-rename cleanup · branch refs + rustls advisory ([ee74d97e0](https://github.com/supernovae-st/nika/commit/ee74d97e043633845ccfbeacce58ca4e96b5ab27))
- **state** — Sync status docs to 37/42 after admission + origin rebase ([9bdbd70e7](https://github.com/supernovae-st/nika/commit/9bdbd70e711b407994b7dc4eb8cfc6b5d25328d6))
- **status** — Regenerate baseline from single source of truth (Phase A) ([cd9602ca0](https://github.com/supernovae-st/nika/commit/cd9602ca0854510b86d4add8ac38335df711d8de))
- **status** — Refresh canonical block post-merge (20 crates, 1334 tests) ([c4fdab692](https://github.com/supernovae-st/nika/commit/c4fdab692fa9dfacb527cb530d08707600bd08e7))
- **status** — Re-sync canonical block after main merge ([4cd3fed39](https://github.com/supernovae-st/nika/commit/4cd3fed39b9c796ef80ecee1222a8a5fda7f7dfd))
- **status** — Refresh auto-block — 31 crates · 3 WIP · L4=2 · 1814 lib tests ([04301ca88](https://github.com/supernovae-st/nika/commit/04301ca88607de12273bc69d9010c0b7e5e93a48))
- **status** — Refresh auto-block — 32 crates · 29/42 admitted · L2=4 (all verbs) · 1860 lib tests ([454a764db](https://github.com/supernovae-st/nika/commit/454a764db643ce4191579fa40217c4f457177a4d))
- **status** — Refresh auto-block — 33 crates · 29/42 admitted · L1.5=3 · 1915 lib tests ([2baaaa22d](https://github.com/supernovae-st/nika/commit/2baaaa22dbe774f8087926e3fabdf1a991d4ba4a))
- **status** — Refresh auto-block — 34 crates · 2000 lib tests · L1.5=4 ([d768d0120](https://github.com/supernovae-st/nika/commit/d768d012040df441b44d6d472ec228a1e293d081))
- **workspace** — Pin zeroize=1.8 + nika-error mutation report (H8) ([47c2284cb](https://github.com/supernovae-st/nika/commit/47c2284cb8e3ce319c984f6e0685f43e85425db4))
- **workspace** — Refresh 4 stale public-api baselines ([7dd8fd081](https://github.com/supernovae-st/nika/commit/7dd8fd081d13cbd831eaabd42d0c14e5c308637b))
- **workspace** — Format the nika-compose commit output ([c3739147a](https://github.com/supernovae-st/nika/commit/c3739147aacbbedffd80c1f6a92cc3554b9ec56b))
- **workspace** — Clear pre-push hygiene RED (spec LOC, doc link, error-voice) ([1944737f4](https://github.com/supernovae-st/nika/commit/1944737f4c9949e8b2b55288c2091caae9aeb638))
- Re-version engine 0.80.0 → 0.90.0 + propagate versioning docs ([2a596209a](https://github.com/supernovae-st/nika/commit/2a596209a10d448f218de5c812b5e862d1aef65e))

### 💼 Other
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs

# Conflicts:
#	.claude/CLAUDE.md
#	AGENTS.md
#	ROADMAP.md ([f76e397cd](https://github.com/supernovae-st/nika/commit/f76e397cd314e0fe597058bb58447fceed50a557))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([a8e734f02](https://github.com/supernovae-st/nika/commit/a8e734f02d26062d76a2134132d0ddd940569c43))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([4816e636b](https://github.com/supernovae-st/nika/commit/4816e636b77d134da7425c15f5e18ff846467f5d))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([d6bb9fd7e](https://github.com/supernovae-st/nika/commit/d6bb9fd7ee0598caf9aa84ac171c70d41c7762f7))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([2d5a3301b](https://github.com/supernovae-st/nika/commit/2d5a3301b8ea7de524bc2c76c9c4ab32285410e5))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([b1f81aafe](https://github.com/supernovae-st/nika/commit/b1f81aafef81cbca4319b1b4c01c3e4d36bac352))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([98d60e66c](https://github.com/supernovae-st/nika/commit/98d60e66ca8d4210527c5beaa57666408ce15d56))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([3421467c0](https://github.com/supernovae-st/nika/commit/3421467c020a29499dd1777c093e41648e70e8c8))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([c78d73a4a](https://github.com/supernovae-st/nika/commit/c78d73a4a95040d9b79ce9928d5a503576b731d3))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([47cb6a763](https://github.com/supernovae-st/nika/commit/47cb6a763160dba69a11414c3aff393f85ef66fc))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([6250721fd](https://github.com/supernovae-st/nika/commit/6250721fd51d83462b250f354dbf9840236b573a))
- Merge remote-tracking branch 'origin/main' into feat/s4-nika-fs ([d7636a08d](https://github.com/supernovae-st/nika/commit/d7636a08db9d3117f1591b732fee73ddaf7dc3de))
- Merge branch 'feat/s4-nika-fs' — canon purge + hygiene vector 41

Brings the docs-canon truth pass (live docs state current canon only ·
crate tree mirrors the layer registry · gate12 connectome names + verb
range truth) and scripts/hygiene/check-canon-stale-terms.sh (vector 41:
dead names cannot return).
 ([6dbca5baa](https://github.com/supernovae-st/nika/commit/6dbca5baaa09de0a005172e6422471d9ea217a6b))
- Merge branch 'feat/permits-fit-analyzer' — builtin arg-shapes ([#123](https://github.com/supernovae-st/nika/issues/123))

Brings the analyzer builtin arg-shape pass: four ledger rows close and
the lints corpus moves to the spec repo (companion nika-spec c9233c9,
already on its main).
 ([20aea2143](https://github.com/supernovae-st/nika/commit/20aea21432891cfe39c575ecf4a2402bc1036743))

### 🏁 Both WIP crates ADMITTED — the engine wip array is EMPTY (39/42 · 2026-06-21)

- **`nika-cli` crate** admitted (L4 · the operator surface · the `nika` verb
  tree: check · run · trace · inspect · graph · explain · spec · schema ·
  examples · new · doctor · pack · completions · lsp · mcp). New this admission:
  the spec §3.5 reduced surfaces — `--no-progress` (plain · CI default),
  `--quiet` (the compact verdict card), `--dry-run` (plan only · zero effects) —
  via a 3-mode `RenderMode` over a shared, drift-free failure-card render.
  - **Gate 5** mutation 91% (264/290) · **Gate 6** the fold property battery
    (`tests/fold_property.rs` — cost-conservation · one-row-per-task ·
    permutation-invariance · sequential ≡ interleaved-wave).
  - **Review swarm** caught + fixed a real P1: `--dry-run --output json` had
    corrupted the clean-JSON lane → the human flags now `conflicts_with_all`
    the machine modes (clap).
- **`nika-extract` crate** admitted (L1.5 · the 9 fetch extract modes behind
  the `nika:fetch` extract step — article Trafilatura cascade · feed · sitemap ·
  metadata + schema.org microdata · blocks · zones · page-type · links).
  - **Gate 5** mutation 79.7% → 93.2% (~50 boundary tests killed 73/81
    survivors in the heuristic functions) · **Gate 6** totality over all 9 modes.
  - **Review swarm** (3 agents): the adversarial refuter SURVIVED (totality +
    DoS-bounding hold); fixed og:video/audio absolutization + host-only search
    URLs; added a per-item microdata property cap (defense-in-depth). One agent
    finding was **rejected** verify-before-fix (`<a itemprop=url>` with no href
    → `""` is W3C-correct, not a text fallback).

### 🚚 Release engineering — cross-platform binary pipeline (2026-06-21)

- **`.github/workflows/release.yml`** — on a `vX.Y.Z` tag, builds the four
  `nika` binaries (macOS arm64/x64 · Linux arm64/x64), cuts the GitHub release
  with the exact tarballs the Homebrew formula points at, and (with a
  `TAP_GITHUB_TOKEN` secret) bumps the tap formula. Fires only on a tag —
  nothing publishes until you tag. `scripts/release/update-formula.sh` does the
  version + sha256 rewrite (runnable by hand too). Unblocks the Homebrew path
  that had no pipeline.

### 🏛️ nika-schema L0 admission — parser + analyzer + static-check (ADMITTED · all 12 gates · 2026-06-18)

- **`nika-schema` crate** admitted — the workflow AST, parser, analyzer, and
  the ADR-092 `nika check` static-check ladder (the last L0 WIP crate).
- **Gate 5** closed in BUDGET mode (`survivors ≤ 300`): 269 timeout-divergers
  + 21 enumerated equivalents, each scoped-re-verified. Rounds 1-7 (~190 tests)
  killed the floor's real-gap tail — analyzer/check collection + lint logic,
  the `read_dag` cap/pinch boundaries, the default-gate runnable path, and the
  expression-parser offset/depth/byte-scanner.
- **Security**: two complementary `when:`-gate DoS fixes integrated — a
  `MAX_GATE_LIST_ITEMS` cap on the leaf-evaluation re-scan and a `BTreeSet`
  dedup in `collect_bad_literals` (an O(n²) `Vec::contains` scan that burned
  ~3 s of CPU on a 2-task workflow before the fix). Plus 7 `#[non_exhaustive]`
  source types (FCI-002) and a parse+check criterion benchmark (Gate 7 · parse
  10-task 30.9 µs).

### 🧩 Announce ladder s19.6 · nika-lsp L4 admission — the `nika lsp` language server (ADMITTED · 12-gate closed · 2026-06-15)

- **`nika-lsp` crate** · the Nika language server (`nika lsp`, stdio) — the
  v0.1 editor brain for `.nika.yaml`. ONE crate (nika-lsp-core collapsed in as
  internal `analysis::*` modules · per `nika-invariants` + collapse-vs-publish ·
  reconciles `D-2026-06-10-N6` steps 19.6/19.7). Stack: `lsp-server` 0.7 sync
  stdio loop + `lsp-types` 0.97 · pure analysis over `nika-schema`.
- **Diagnostics** reuse the SAME ADR-092 `nika check` ladder (one source of
  truth · task-anchored ranges) · **hover** on the 4 verbs + keywords AND on a
  task reference (`depends_on` item / `${{ tasks.X }}` → the target task's id +
  verb) · **completion** (keys · verbs · `model:` providers · the workflow's own
  task ids · auto-trigger on `.` `/` `[`) · **document symbols** ·
  **go-to-definition** for task refs.
- Feeds the `nika-vscode` extension, auto-detected via `caps.lsp` once
  `nika --help` lists `lsp` — zero extension change. 124 lib tests · mutation
  96.9% · the `nika lsp` subcommand wired into `nika-cli` (owns stdout · LSP
  exit-code convention).

### 🤖 Announce ladder s12 · nika-verb-agent L2 admission (ADMITTED · 12-gate closed · 2026-06-11)

- **`nika-verb-agent` crate** · the `agent` verb executor — the multi-turn
  ReAct loop (model → whitelisted tool dispatch → results fed back → repeat)
  per `nika-spec spec/02-verbs.md §agent`. The **4th and last verb**
  (`D-2026-05-22-N18` · the verb count is 4, absolute). Generic over three
  injected kernel seams: `ProviderInferDyn` (inference) · `ToolExecuteDyn`
  via `InvokeVerb` (dispatch) · `ToolDefinitionProviderDyn` (the tool-def
  source). Zero runtime tokio dep — every turn rides the injected providers.
- **The ToolDefinitionProvider seam** (`nika-kernel-ai`) · resolves the s12
  §8 blocker found 2026-06-11: the agent hands the model its whitelisted
  tools as `ToolDef`s, but only tool NAMES were in hand — nothing enumerated
  definitions. A new kernel trait (the `ToolExecute` pattern · `Dyn` twin ·
  `ToolDefsError` → NIKA-234) + `MockToolDefinitionProvider`. The wiring
  layer implements it over the builtin catalog + (later) live MCP
  `tools/list`.
- **Loop semantics (normative · spec §2)** · terminal-1 (no tool calls →
  `Completed`) and terminal-2 (`nika:done` → `ExplicitCompletion`, with the
  `result:` arg or the last assistant message) BOTH precede the budget gate
  — a concluded answer is a success even if its turn crossed the budget.
  Budgets FAIL (max_turns → NIKA-460 · max_tokens_total → NIKA-461, `>=`
  exhaustion, checked before spending more) with `partial_output` preserved.
- **Security (spec §3 · default-deny)** · the whole tool batch is whitelist-
  validated BEFORE any dispatch (a denied sibling fails the turn with zero
  side effects · NIKA-462 immediate, not fed back). `nika:done` is loop-owned
  (never dispatched · wins over batch-mates). Model-emitted names are length-
  capped + control-char-rejected, and the violation error carries a REDACTED
  name (NIKA-450 log-injection parity). Source-supplied tool defs are
  sanitized before reaching the model.
- **The glob whitelist** · gitignore semantics canonically (a spec
  portability invariant): `*` bounded by `/` and `:`, `**` crosses them,
  `!` negation, last-match-wins. Matched by an O(n·m) DP (correct under
  interleaved `*`/`**`) + a totality proptest on the model-controlled input.
- **Structured output** · the final message validates against the task
  `schema:` (NIKA-464) with `infer.schema:` parity — bare-parse then a
  string-aware balanced-span extraction (tolerates fences + prose).
- **3-lens review swarm** (spn-nika + rust-pro + feature-dev) · all findings
  folded same session: the budget-before-completion bug, the batch-validate
  security ordering, the `**`/`*` glob backtrack gap, log-injection
  redaction, saturating token math, INV-019 `AgentOutput::new()`, the
  max_turns ceiling. NIKA_460..466 registered · hub 460-469 row · API-locked.

### 📡 Telemetry vocabulary closes over the display contract (nika-event · additive)

- **6 new `EventKind`s** · `task_retrying` · `task_cancelled` ·
  `workflow_cancelled` · `cost_incurred` · `infer_chunk` ·
  `permit_checked` — every state the run UI can show (contract §3.1
  state machine) and every live-meter refold driver the contract names
  (§3.3) is now expressible by a canonical engine event. Cancellation is
  terminal-not-failure (a decision, not a defect). `permit_checked`
  makes the declared `permits:` boundary observable at runtime (the
  ADR-092 audit moat).
- **`EventClass`** · the coarse 7-class classifier (`EventKind::class()`)
  — renderers/routers branch on stable classes, not 17 variants.
- **Reference fold** · the `nika-schema` `verbs` example consumes the
  full vocabulary: `--events` renders the whole tape digestibly; `verbs
  workflow` folds the SAME tape into the animated DAG (retry arc ↻ ·
  live stream · ticking cost meter · permits counter). The state-machine
  coverage test pins « every UI row status is event-reachable ».

### 🔌 Announce ladder s11 · nika-verb-invoke L2 admission (ADMITTED · 12-gate closed · 2026-06-11)

- **`nika-verb-invoke` crate** · the `invoke` verb executor per
  `nika-spec spec/02-verbs.md §invoke` (third of the 4 verbs). Rides the
  kernel `ToolExecuteDyn` seam with the engine's builtin+MCP dispatcher
  injected — zero tool implementation of its own, zero Cargo dep on
  `nika-builtin`/`nika-mcp`.
- **The closed-namespace contract** · the tool-ref namespace set is CLOSED
  at v1 (`nika:` · `mcp:` only · `mcp:` requires the `server/tool` slash);
  the verb does the lightweight semantic check before dispatch (grammar
  SHAPE stays the upstream `nika-schema` `NIKA-PARSE` concern). Result
  mapping: `is_error: true` → NIKA-451, dispatcher `NotFound` →
  `UnresolvableTool`, other dispatch failures → NIKA-452.
- **Security guards (swarm)** · whitespace padding and ASCII control chars
  in the tool id are rejected before it reaches a `ToolCall`/log field
  (log-injection class); the derived fallback `call_id` appends a
  process-monotonic counter so repeated same-tool invokes don't collide on
  the kernel's unique-call-id contract.
- **Error one-voice** · NIKA-450..452 registered in the Verb range; the
  verb-range help moved into a `verb_help` helper (keeps `code_help` under
  the 100-line cap).
- 16 lib tests (1 totality proptest cross-checked against an independent
  predicate) · mutation all viable killed bar one documented equivalent ·
  clippy 0 · doc 0 · layering + deny green · tag `v0.80.0-alpha.7`.

### ⚙️ Announce ladder s10 · nika-verb-exec L2 admission (ADMITTED · 12-gate closed · 2026-06-11)

- **`nika-verb-exec` crate** · the `exec` verb executor per
  `nika-spec spec/02-verbs.md §exec` (second of the 4 verbs). Rides the
  kernel `ShellRunDyn` seam with the effect injected (`TokioShell` in prod ·
  `MockShell` in tests) — zero subprocess code of its own, zero Cargo dep on
  `nika-exec-runner` (the L2→L1 inversion through the kernel trait).
  `pre_validated` is NEVER set, so the s7 runner blocklist stays the floor
  (structurally pinned by test).
- **The capture one-obvious-way split** · default modes (`stdout` · `stderr`
  · `combined`) fail the task on a non-zero exit (NIKA-440 / spec
  NIKA-EXEC-001 · with a capped stderr tail); `capture: structured` returns
  `{ stdout, stderr, exit_code }` as DATA — the workflow branches on it, the
  task succeeds.
- **Verb-boundary input guards (NIKA-442)** · a NUL byte in command/stdin
  (silent shell truncation) and a malformed env key (`=` · NUL · empty ·
  child-env corruption) are refused before the runner call — the security
  swarm's two findings.
- **Error one-voice** · NIKA-440..442 registered in the Verb range ·
  `MockShell` aligned to the Send-variant traits + gained `enqueue_result`.
- 19 lib tests (3 proptests · Gate 10 parity vs brouillon) · mutation all
  viable killed bar one documented equivalent · clippy 0 · doc 0 · layering
  + deny green · tag `v0.80.0-alpha.6`.

### 🗣️ Announce ladder s9 · nika-verb-infer L2 admission (ADMITTED · 12-gate closed · 2026-06-11)

- **`nika-verb-infer` crate** · FIRST L2 verb crate — the `infer` verb executor
  per `nika-spec spec/02-verbs.md §infer` (one of the 4 verbs locked forever ·
  D-2026-05-22-N18). Resolves `model: provider/name` through the s8.5
  `nika-providers` registry (D-N17: providers live BELOW the verbs · no
  verb→verb sideways dep), shapes the kernel `InferRequest`, returns the full
  `InferResponse` for the future L3 engine's event/cost seam.
- **Structured-output floor in-crate** · `schema:` tasks get native
  `ResponseFormat::JsonSchema` when the profile supports it (instruction
  fallback otherwise), lenient JSON extraction (bare → fenced → first balanced
  string-aware span), `jsonschema` 0.33 validation (compiled ONCE per run —
  an uncompilable schema is NIKA-432 with zero paid round-trips), and a
  bounded validation retry (default 2 · spec-sanctioned before NIKA-INFER-002).
  Schema text re-injected into prompts is capped at 4096 chars.
- **Error one-voice** · `VerbInferError` speaks `NikaErrorCode` via the new
  registry-owned NIKA-430..433 (Verb range 430-479 opened · same pattern as
  the M2 computer-use ranges) · transience inherited from `ProviderError`,
  never overridden.
- **Gate 11 swarm (3 lenses · 0 P0)** folded same-session: compile-once
  validator · u8→u32 attempts counter (closes the u8::MAX budget saturation
  loop) · schema render cap · both transience branches pinned.
- 33 lib tests (3 proptests · Gate 10 parity vs brouillon shaping pinned) ·
  mutation 95.8% overall + 8/8 on the cap helpers · clippy 0 · doc 0 ·
  layering + deny bans green. New workspace dep `jsonschema` (default-features
  off · no network resolver).

### ♿ Phase 2 M2.3 · nika-a11y L1 admission (ADMITTED · 12-gate closed · 2026-05-25)

- **`nika-a11y` crate** · third computer-use L1 effect crate · implements the
  L0.5 `io::a11y::AccessibilityTree` trait (`snapshot` + `find` + `resolve_ref`)
  exposing the active window's accessibility tree as `AxNode` records. **macOS-first**
  (decision §4 of `docs/crate-specs/nika-a11y.md`): backend via the safe
  **`accessibility` 0.2** crate (`AXUIElement` · `TreeWalker` · the unsafe
  `ApplicationServices` FFI is encapsulated → crate stays `unsafe_code = forbid`);
  Linux `atspi` / Windows `uiautomation` deferred to a consumer signal (LOCK-031).
  B.1 spec (backend research: 3 vetted permissive crates verified on crates.io)
  → B.2 skeleton (`A11yError` NIKA-1200..1206 · `AxBackend` · `snapshot`/`find`/
  `resolve_ref` route through a `walk_tree` placeholder returning `BackendNotWired`).
- **ADR-081 Guard 3 (AX-secure-field redaction · MANDATORY-at-admission) is
  headless-complete at B.2** · a pure recursive tree-transform (`redact_secure_fields`
  / `is_secure_field`) strips `value` from any secure-text node (macOS
  `AXSecureTextField` subrole · AT-SPI `STATE_SENSITIVE`) to `None` (zero leak),
  applied before any node leaves the crate. The pure `find` filter
  (`matches_query` + depth-bounded `collect_matches`) ships too. 12 lib tests
  (incl. a proptest pinning the redaction invariant) · clippy 0 · doc 0 ·
  `cargo-machete` clean · `cargo deny` ok. `nika-a11y` added to `deny.toml`
  tokio wrapper allowlist. API primary-source verified via context7
  (`/eiz/accessibility`) before recommending the backend.
- **B.3 macOS `AXUIElement` walk wired** · `system_wide().focused_window()`
  rooted recursive `build_node` (role/label/value/subrole → `AxNode`) inside
  `spawn_blocking` (the `!Send` handle stays worker-local · CANCEL SAFETY) ·
  macOS-gated deps `accessibility` 0.2 + `core-foundation` 0.10 (CFString/CFType
  reads · all upstream symbols — `focused_window` · `value().downcast::<CFString>()`
  · `children().iter()` · `subrole()` — verified against the crate source before
  use). Non-macOS compiles to `BackendUnavailable` (NIKA-1205). `resolve_ref`
  backed by a `Mutex<Option<AxNode>>` cache of the last redacted snapshot + pure
  `find_by_id`. Pure `ax_role_from_str`. Closed the `BackendNotWired` placeholder
  (NIKA-1200 retired · slot reserved). `bbox` deferred (`None` · frame→`Rect`
  refinement).
- **B.4 12-gate close · ADMITTED** · extracted the pure `assemble_node` (role
  map + empty-title/subrole filter + `AxNode::new`) out of the FFI `build_node`
  to maximize headless coverage; added a `MAX_WALK_DEPTH` (512) recursion cap so
  an untrusted/deep/cyclic focused-app tree can't overflow the stack (caught by
  the Foreman-direct review). **Gate 5 mutation 34/41 viable caught (82.9 %)** ·
  100 % of the headless surface · 7 `AXUIElement`-walk mutants documented-exempt
  per ADR-003 Rule 2 (`docs/crate-specs/nika-a11y.md` §7.1). **Gate 11** ·
  sub-agents hit the 1M-context credit wall → Foreman-direct 3-lens review
  (PE-5.1 · rust-pro + Diamond + bug-hunt · all ADMIT). 14 lib tests + 1
  `#[ignore]` smoke · clippy 0 · doc 0 · machete clean · deny ok · workspace
  `--lib` 1170. Workspace 13/42 admitted · WIP nika-schema only.

### 🔤 Phase 2 M2.2 · nika-ocr L1 admission (ADMITTED · 12-gate closed · 2026-05-25)

- **`nika-ocr` crate** · second computer-use L1 effect crate · implements the
  L0.5 `io::ocr::OcrEngine` trait (`read` + `read_region`) via the pure-Rust
  **`ocrs` 0.12** engine (**`rten` 0.24** runtime · no C system dep · keeps
  `unsafe_code = forbid`). B.1 spec → B.2 skeleton (`OcrError` NIKA-1100..1109
  · pure frame/region validation · `BackendNotWired` placeholder) → B.3 real
  inference: `OcrBackend::with_models(detection, recognition)` eager-loads two
  `.rten` weight files from **explicit local paths** (sovereignty Rule 1 ·
  reads local files only · NEVER auto-downloads · models are operator/daemon-
  provisioned), `read`/`read_region` validate the RGBA8 `Frame` purely then run
  `prepare_input → detect_words → find_text_lines → recognize_text` inside
  `tokio::task::spawn_blocking` (the sync CPU-bound engine runs off the async
  runtime · kernel CANCEL SAFETY: a dropped future abandons the read with no
  side effects). The B.2 `BackendNotWired` placeholder is CLOSED (NIKA-1100
  retired · slot reserved) per `skeleton-option-a-pattern.md` §5.
- **`nika-ocr` 12-gate close (B.4)** · admitted — all 12 gates green
  (registry L1 · ADR-081 inherits 7-guard contract, owns none mandatory ·
  `#[non_exhaustive]` · zero-unwrap src · ~290 LOC · NIKA-1101..1109 ·
  cancel-safety · `test --workspace --lib` 1156 · clippy 0 · `cargo doc` 0 ·
  `cargo-machete` clean · `cargo deny` ok). **Gate 5 mutation 81/87 viable
  caught (93.1 %)** · 100 % of headless-reachable logic · 6 model-inference
  mutants documented-exempt per ADR-003 Rule 2 (need real `.rten` weights ·
  `docs/crate-specs/nika-ocr.md` §6.1). Pure helpers (`rgba_to_rgb` ·
  `crop_rgba` · `words_bbox_union` · `validate_frame` · `validate_region`)
  proptested + 100 % mutation-killed. **Gate 11 review** · sub-agents hit the
  1M-context credit wall → Foreman-direct 3-lens review per
  `orchestrator-autonomous-v6.md` PE-5.1 (rust-pro + Diamond-discipline +
  bug-hunt · all ADMIT · 1 P1 stale-module-doc fixed). Deps: `+ocrs +rten`
  (workspace) `+tokio` rt + `tempfile` dev · `nika-ocr` added to `deny.toml`
  tokio wrapper allowlist. API primary-source verified via context7
  (`/robertknight/ocrs`) before wiring · no phantom symbols.

### 🖥️ Phase 2 M2.1 · nika-screen L1 admission (ADMITTED · 12-gate closed · 2026-05-23)

- **`nika-kernel` `io::screen`** · NEW `capture_stream` additive trait method +
  `FrameStream` type alias (`Pin<Box<dyn Stream<Item = io::Result<Frame>> + Send>>`),
  the canonical kernel streaming idiom (cohérent `ai::provider::InferEventStream`).
  Zero breaking change · uses `futures-core` (NOT `tokio-stream`, which is
  L0.5 layer-banned per `Cargo.toml`). Begins the M2.1 6-batch dispatch (B.1).
- **`crate-layer-registry`** · `nika-screen` registered L1 — first computer-use
  effect crate (Gate 1). ADR-081 7-guard contract already shipped (`3e40c18b3`).
- **`nika-screen` crate** · B.2 skeleton (`ScreenError` NIKA-1000..1009 · 10 codes
  · `ScreenBackend` + consent/LED guard skeletons) → B.3 single-shot capture WIRED
  via `xcap` 0.9.5 (`list_displays` / `capture_full` / `capture_region` · sync OS
  calls wrapped in `spawn_blocking` so the `!Send` `Monitor` stays worker-local and
  dropped futures surrender promptly · zero-copy RGBA8 `Frame`) → B.4 wires
  `capture_stream` (bounded `tokio::mpsc` + dedicated capture thread · ~30fps
  cadence · drop-stop cancellation via channel-close · `futures_core::Stream`
  adapter over `poll_recv`). All 4 `ScreenCapture` methods now real — the B.2
  `BackendNotWired` skeleton is fully CLOSED. B.5 makes the ADR-081 guards real
  + ENFORCED · a fail-closed `ConsentGate` (guard 7 · in-memory · session-scoped
  · revocable · per-frame re-check inside the stream worker) gates every pixel
  capture, and a RAII `LedIndicator` (guard 6 · engaged-count) stays lit for the
  whole capture. xcap encapsulates the OS FFI
  (objc2 / x11 / windows) so the crate is `unsafe_code = forbid`-clean. Plan-dep
  correction · the
  plan's `nokhwa` is a WEBCAM lib (docs.rs verbatim); `xcap` is the screen-capture
  crate (per `cross-source-validation.md` §2.7).
- **`nika-screen` 12-gate close (B.6)** · admitted as the first L1 effect crate —
  all 12 gates green (registry · ADR-081 · `#[non_exhaustive]` · zero-unwrap ·
  LOC 943 · NIKA-1000..1009 · cancel-safety · `test --workspace --lib` 1125 ·
  clippy 0 · `cargo deny` ok · forward-compat). GAP-3 `From<ScreenPoint>` shim
  CARRIED FORWARD to M2.4 `nika-input` · `ScreenPoint` is a `cockpit_overlay`
  (Olympus) type, so a `From` impl in `nika-screen` would violate cross-flow
  D-2026-05-08-N1 (Nika→Olympus) and is an `io::input` (cursor) concern, not
  `io::screen`; the conversion lives on the Olympus consumer side (where
  `cockpit-input-injection` already mirrors it).

### ⚡ Perf profile + craft amendments (2026-05-12)

Pre-W3 perf-craft + architecture polish per 2-agent SOTA audit
(`spn-rust:rust-async-expert` + `spn-rust:rust-perf` parallel) ·

- **`Cargo.toml [profile.release]`** · `lto=fat` + `codegen-units=1` +
  `strip=symbols` + `panic=unwind` + `debug=line-tables-only` +
  `incremental=false` · matches ADR-061 SLSA L3 prep · ~5-10% perf
  delta on BGE-M3 cosine + BM25 + RRF hot paths · 2× build cost
  release only · dev unaffected.
- **`Cargo.toml [profile.bench]`** · inherits release + `debug=true`
  for `cargo flamegraph` + `perf annotate` at W3 admission Gate 7.
- **4 `const fn` promotions in `nika-types`** · `Cost::new` ·
  `Cost::zero` · `Cost::is_zero` · `Trust::new` · `Trust::is_at_least` ·
  unlocks `const SATELLITE_COST: Cost = Cost::from_milli_usd(5)` at
  call-sites = zero runtime eval. `From`-trait + `Option::map` blocked
  (not const-stable yet · 2027+ horizon · per Rust 1.91 limits).
  Forward-compat per ADR-007 · `pub fn → pub const fn` non-breaking.

### 📐 BLUEPRINT_2036 v1.3 amendments (2026-05-12)

Cumulative cascade v1.0 → v1.1 → v1.2 → v1.3 per `docs/architecture/
BLUEPRINT_2036.md` frontmatter · status proposal · annual decennial
review 2027-04+.

- **v1.1 (per-crate detail + best-enemies SOTA)** · 42-crate table
  with LOC + deps + trait + Gate-9 + admission target per row ·
  Restate/LangGraph/Temporal/Mem0/Letta differentiation matrix ·
  collapse-vs-publish principle § 1.5 locked
- **v1.2 (11/10 amplifiers + guardian framing)** · 9→4 amplifier ADR
  fold (saves 5 empty shells · `socratic-research-discipline.md`
  Step 5 Option D) · §4.7 anti-Palantir + AI-2027 trajectory mapping ·
  14 prior Nika-mappings re-validated 2026-Q2
- **v1.3 (perf craft + async depth · this entry)** · §4 RRF fairness ·
  Loom scope (2-thread minimal + Shuttle PCT for full DAG) ·
  `consume_budget` cooperative scheduling · `[profile.release]`
  mirror · §4.5 ADR-066 `#[tracing::instrument]` discipline · NEW
  ADR-070 (`TaskTracker` + child-token fan-out · kernel-pure preserved
  per ADR-016 Alt-A) · ADR-041 `#[track_caller]` builder amendment

### 📚 Pre-launch hygiene shipped (2026-05-12)

- **Per-crate READMEs** · 4 missing of 8 shipped (`nika-error` ·
  `nika-catalog` · `nika-kernel` · `nika-kernel-mock`) following
  tokio/serde/thiserror SOTA pattern (~80-120L each)
- **`CODE_OF_CONDUCT.md`** · Contributor Covenant v2.1 boilerplate ·
  conduct@supernovae.studio · 4-tier enforcement ladder
- **`SECURITY.md`** · vulnerability disclosure policy · 72h ack · 90d
  disclosure · 11-row NIKA-271..389 defense layers table
- **`Cargo.toml [workspace.lints.rustdoc]`** · compile-time doc gate
  (broken_intra_doc_links=deny · private=warn · invalid_codeblock=deny)
- **`.github/workflows/diamond-ci.yml`** · semver-checks baseline ·
  `origin/nika-diamond` (renamed branch · stale since 2026-05-06) →
  `origin/main` · was silently failing

### 📚 Wave 4E — Mintlify rebuild + docs repo split (2026-04-17)

End-user documentation split out to a dedicated public repository and
rebuilt from the current workspace state.

- **`supernovae-st/nika-docs`** — new public repo, serves
  [`docs.nika.sh`](https://docs.nika.sh) via Mintlify. Replaces the
  in-engine `docs/mintlify/` directory, which is removed from this
  repo. Engine-internal docs (`docs/adr/`, `docs/architecture/`,
  `docs/crate-specs/`) stay here.
- **Mintlify content refreshed** — 2-tab navigation (Guide / Reference),
  honest v0.80 pre-release framing, live snapshot of 32 providers, 49
  capability rules, 35 ADRs (11 thematic groups), L0 architecture
  decisions, admission 12-gate walkthrough.
- **Dead pages purged** — 8 Mintlify pages that no longer mapped to the
  Diamond workspace state removed pre-split.
- Cross-links from this repo's README + ROADMAP point to
  `docs.nika.sh` for end-user content.

### ⚡ Swarm-3 Batches I.b + II ε.2/ε.3 + Wave 3A + Wave 4A + 4B seeds + Wave 4C (2026-04-17)

**Hygiene — Batch I.b vectors 30-33 (+4 new):**

- **Vector 30 `check-cancel-safety.sh`** — every `async fn` in
  `crates/nika-kernel/src/**` now carries a `// CANCEL SAFETY:` or
  `/// CANCEL SAFETY:` marker. 43 kernel methods annotated
  (cancel-safe contract: drop semantics, atomic vs non-atomic writes,
  `kill_on_drop` requirement, billing/telemetry exposure).
- **Vector 31 `check-owned-strings.sh`** — preventive ratchet: bans
  non-static `&str` in nika-catalog `pub` fields / `pub fn` return
  types. Catalog stays 100% `&'static str` per ADR-008 codegen pragma.
- **Vector 32 `check-unsafe-count.sh`** — `unsafe` token counter
  vs `scripts/hygiene/baselines/unsafe-count.txt` (currently 0).
  Substitutes cargo-geiger which is hostile to virtual manifests.
- **Vector 33 `check-layer-deps.sh`** — per-layer banned third-party
  deps (`[workspace.metadata.diamond] layer-bans`). L0 rejects 17
  deps (tokio family, rayon, async-std, smol, futures family,
  reqwest, hyper, axum, actix-web); L0.5 rejects 11.
- **Killed vector 7** (linear-issue-states stub) **and vector 18**
  (adr-dangling duplicate of vector 16).

**Wave 3A — engine post-commit hook for Olympus snapshots:**

- `scripts/hooks/post-commit-olympus-xtask.sh` wired via lefthook.
  Background `pnpm tsx olympus/scripts/xtask.ts` regenerates
  workspace.json + snapshots + hygiene-status.json on every engine
  commit; Olympus live-refreshes `/timeline`, `/graph/diff`,
  `/graph/fitness`, `/hygiene`.

**Wave 4A — v0.95 Cortex + v0.100 WASM reservations (R1-R5):**

- **R1 `EmbeddingSpec`** (`nika-types::embedding`) — Dtype,
  DistanceMetric, EmbeddingSpec; `#[non_exhaustive]` + snake_case wire.
- **R2 `MemoryFrameRef.trust: TrustLevel`** — sticky ingest taint;
  `#[serde(default)]` → UNTRUSTED fail-safe.
- **R3 `RecallQuery.tenant: TenantId`** — mandatory multi-tenant
  keyspace scope. `TenantId::default_tenant()` → `"default"`.
- **R4 `WasmPluginError::OutOfFuel` + `Trap { kind: TrapKind }` +
  `PluginCallContext`** — fuel metering, W3C-style trap taxonomy,
  per-call context with trust + cancel + budget.
- **R5 `MemoryLifecycle` trait** with default-impl consolidate/prune
  returning empty reports. Standalone; Cortex opts in at v0.95.

**Wave 4B seeds (telemetry foundations):**

- **#1 `SpanGuard.parent_span_id` + `links: Vec<SpanRef>`** — W3C
  Trace Context parent linkage unblocks Olympus `/trace`. Default
  `TracerProvider::start_child_span` backfills parent.
- **#3 `Timestamp(i64 unix_ns)` + `WallDuration(i64 nanos)`** in
  `nika-types::timestamp`. RFC 3339 Display via inlined Hinnant
  civil-from-days algorithm. Serde-transparent wire. Field retrofit
  (`_ms: u64` → `timestamp`) deferred.

**Batch II — test depth:**

- **ε.2 Loom** — `#[cfg(loom)]` interleaving tests for `CancelCtx`
  (INV-029). Conditional `[target.'cfg(loom)'.dependencies]`.
  Run explicitly via `RUSTFLAGS="--cfg loom" cargo test`.
- **ε.3 proptest audit** — 14 new properties: TrustLevel lattice
  invariants (meet/join bounds, idempotence, commutativity,
  associativity, absorption); ID serde roundtrip (TenantId,
  ProviderId, ModelId, TaskId, TraceId full 2^128 surface, SpanId
  full 2^64 surface).
- **ε.1 mutation baseline** — `cargo mutants -p nika-error` run:
  60 mutants, 31 caught, 13 missed (mostly miette::Diagnostic
  accessor returns — no observable behaviour), 16 unviable.
  Viable kill rate 70.5%. Pushing to ≥90% requires dedicated
  miette diagnostic-method assertion tests; deferred to a focused
  follow-up session.

**Batch V.2** — `docs/architecture/axes.md`: 12-axis × crate ISP
matrix with shipped/reserved/not-yet markers. Source of truth for
Olympus `/graph/architecture` edge rendering + Gate 12 audits.

**Observability locks (parallel work already landed):**

- Q12 — `ObservabilitySink` dropped (5→4 effect channels);
  `AuditSink` added as compliance-grade 5th channel.
- Q13 — `GenAiAttrs` OTel semconv bridge on Infer{Request,Response}.

**CI ratchets:**

- `cargo-public-api` snapshot workflow (Gate 12 mechanical).
- `cargo-semver-checks` workflow.
- Public-api baseline files regenerated on every reservation commit
  (`--all-features --omit auto-trait-impls` to match CI invocation).

**Forward-compat seams:**

- nika-types `no_std`/`alloc` seam at module level (F1 complete;
  shipped 2026-04-17 morning).
- F2 (full per-module cfg-gating) deferred — requires uuid dep
  re-architecture (currently in `serde` feature but used in
  non-serde struct fields in RunId/EventId/CorrelationId/MemoryId).
  Re-open trigger: uuid becomes unconditional OR UUID-backed IDs
  move to a dedicated feature separate from serde.

**Numbers at close:**

| field              | value                                      |
|--------------------|--------------------------------------------|
| HEAD               | (updated at commit time)                   |
| lib tests          | 905 (+58 this session)                     |
| integration tests  | 10                                         |
| loom tests         | 2 (cfg-gated)                              |
| clippy             | 0 warnings                                 |
| hygiene vectors    | 31 deployed (27 green / 4 yellow)          |
| crates admitted    | 6 + 1 WIP (unchanged)                      |
| ADRs               | 25+ (seeds ADR-029-032 + 035 authored)     |

### ⚡ Phase D Session 4B — Data enrichment (2026-04-16)

Pure data expansion on the structural foundation laid by Session 4A.
Zero trait/struct changes — only enum variants, TOML data, and tests.

- **6 new `ParamFlag` variants** — `BatchApi`, `ContextCaching`,
  `PredictedOutputs`, `ComputerUse`, `Citations`, `IncludeReasoning`.
  Aligned with `OpenRouter` 25-value `supported_parameters` vocabulary.
  Enum: 7→13 variants.
- **3 new `Modality` variants** — `Embedding` (vector output), `Speech`
  (TTS/ASR), `ImageGen` (text-to-image). Covers non-LLM provider
  capabilities. Enum: 5→8 variants.
- **4 new `TokenizerFamily` variants** — `LlamaV4` (~200k vocab, distinct
  from LlamaV3), `Granite` (IBM `StarCoder` BPE), `Glm` (Zhipu
  `SentencePiece`), `Grok` (xAI custom). Enum: 8→12 variants.
- **7 new providers** — nvidia-nim (FIX: inventory discrepancy),
  deepinfra, replicate, hyperbolic, writer, databricks, cloudflare.
  All `openai-chat` dialect. Count: 25→32.
- **7 new capability rules** — one `Matcher::Any` fallback per new
  provider (text-only, `json_schema` where applicable). Count: 42→49.
- `mock-full` rule updated with all 13 `ParamFlag` variants.
- Cross-catalog overlap allowlist: replicate + cloudflare (dual-role).

### ⚡ Phase D Session 4A — Catalog structural enrichment (2026-04-16)

Context-window + output-limit + JSON mode enrichment. First structural
expansion of capabilities beyond the Session 2a/2b foundation.

- **3 new CapPatch fields** — `context_window_tokens: Option<u32>`,
  `max_output_tokens: Option<u32>`, `json_mode: Option<JsonMode>`.
  Per-model context windows and output limits are now expressible in the
  TOML-driven capability resolver.
- **`JsonMode` enum** — `Schema` (tool_use enforcement) / `Object`
  (unstructured json_object mode). Per-provider granularity.
- **`ContainsAny` matcher** — word-boundary-anchored substring matching
  with left/right boundary chars (`-`, `_`, `/`, `.`, `@`). Prevents
  "sonnet-4" from matching "sonnet-4-60" (the `6` after "sonnet-4" is
  not a boundary character).
- **`#[non_exhaustive]` on 20 mock structs** — all `nika-kernel-mock`
  types now enforce invariant #19 (attribute + `pub fn new()`).
- **`HttpStreamResponse::new()`** — invariant #19 compliance for the
  only `#[non_exhaustive]` struct that was missing a constructor.
- **12-field merge_with regression guard** — all CapPatch fields covered
  by a single test with confirmed RED on removal.
- **estimate_cost edge cases** — zero tokens → $0.00, nonexistent model → None.
- **MemoryId deserialize error paths** — missing `mem-` prefix and invalid
  UUID now have dedicated tests.
- Token count: 625 → **630 lib tests** (+5).

### 🛡️ Phase C Wave 3 — Stabilization + review-swarm defense (2026-04-16)

Hardening pass after the foundational-types expansion. Mutation testing,
proptest campaigns, and a 3-agent review swarm closed all P0/P1 findings.

- **Seal `SecretResolver`** — `cargo-expand` verified private supertrait;
  community can't implement, allowing future method additions (P1-1).
- **`CancelCtx` Acquire/Release** — correctness fix for v0.95 DAG cancel
  semantics (P1-6). Drop guard prevents leaked tokens.
- **Reserve NIKA-700..819** + `Category::Memory` / `WasmPlugin` / `Sandbox`
  / `Observability` — error-code real estate for v0.95+ subsystems.
- **Cost stdlib arithmetic** — `Add`/`Sub`/`AddAssign`/`SubAssign` with
  panic-in-debug, wrap-in-release semantics. `checked_add` / `checked_sub`
  for fallible callers.
- **Remove `TrustLevel::Default`** — safe-by-default inversion (P1-2).
  All trust must be explicitly stated.
- **`InferResponse.cost: Option<Cost>`** — structured cost replaces the
  deprecated `cost_usd` float. Provider-side cost tracking now type-safe.
- **Structured `DenialKind`** — replaces `CapabilityDenied { reason: String }`
  with enum variants (`FsReadNotGranted`, `FsWriteNotGranted`, `NetEgressBlocked`,
  `ExecBlocked`, `EnvReadBlocked`, `Custom`).
- **20 proptest lattice/identity laws** — cost commutativity, associativity,
  identity; trust lattice meet/join; baggage merge idempotence (integration tests).
- **MemoryId UUIDv7** — `MemoryId(u128)` → `MemoryId { uuid: Uuid }`.
  Time-sortable, standard format, `Display`/`FromStr` roundtrip.
- **`#[deprecated]` cost_usd** on `InferResponse`, `AgentOutcome`,
  `AgentCheckpoint` + `Cost::to_usd_f64()` bridge for deprecation window.
- **Pin zeroize=1.8** — workspace-wide version lock for `SecretString`.
- **cargo-mutants 88.5% kill rate** on nika-error L0 (cost/trust/baggage).
- Token count: 572 → **585 lib / 621 total** (+13 lib, +49 total).

### ⚡ Phase C Wave 2 — L0 foundational types + L0.5 traits (2026-04-16)

23 pure-data types landed in L0 crates, 6 kernel traits in L0.5, plus
forward-compat seams for v0.95 Cortex and v0.100 WASM.

- **23 L0 value types** across nika-error and nika-kernel — cost, budget,
  trust, retry, schema versioning, baggage, resource URI, content hash,
  memory frame, deny kind, cancel context, plugin DTOs, sandbox policy,
  observability event.
- **6 L0.5 kernel traits** — `IdGenerator`, `SecretResolver`, `MetricsExporter`,
  `TracerProvider`, `EventSink`, `BillingSink`. Sealed: `SecretResolver`,
  `EventSink`, `BillingSink`. Open: `IdGenerator`, `MetricsExporter`,
  `TracerProvider`. All have mock implementations in nika-kernel-mock.
- **Sealing pattern** — `Provider`, `EventSink`, `BillingSink`,
  `SecretResolver` now sealed via `mod sealed { pub trait Sealed {} }`.
  Open traits (`MemoryStore`, `EmbeddingProvider`, `ToolExecutor`) remain
  community-implementable.
- **Forward-compat seams** — `cancel.rs`, `plugin.rs`, `sandbox.rs`,
  `observability.rs` in nika-kernel. `MemoryFrame` gains reserved
  `Option<_>` fields (`cipher`, `provenance`, `retention`, `redactions`).
- **ADRs 016-020** — cancellation, streaming, runtime, retry, WASM
  (Batch F part 1). **ADRs 033-034** — L0/L0.5 expansion plans.
- Token count: 416 → **572** (+156 tests).

### ⚡ Phase D Session 2a — TOML-driven model capabilities (2026-04-14)

Zero-allocation capability resolver migrated from hardcoded Rust to a
TOML-driven rule table. Zero-alloc, proptest-verified, forward-compatible.

- **`data/model-capabilities.toml`** — 9 ordered rules covering OpenAI o-series,
  GPT-5, Claude family, Anthropic catch-all, DeepSeek reasoner, DeepSeek any,
  and xAI Grok-4. Schema `nika/model-capabilities@1.0`. First-match-wins
  semantics with build-time FK checks (providers must exist in
  `llm-providers.toml`, api_dialect must be in the closed dialect set).
- **`src/types/capabilities.rs`** — `CapPatch` (5 `Option<T>` fields,
  `const fn merge_with`, `fn materialize`), `Matcher` (Any/Exact/ExactAny/PrefixAny,
  zero-alloc `eq_ignore_ascii_case`), `Rule` (providers + api_dialect scope + matcher + caps).
- **`build/capabilities.rs`** — extracted from `build.rs` (380 LOC) to stay under
  the 1500-LOC-per-file budget. Validates TOML schema, FK checks, closed-set
  enum validation, all-None rule prevention, emits static Rust arrays at compile time.
- **`api_dialect`** — `Option<&'static str>` added to all 21 providers in
  `llm-providers.toml`. Closed set: anthropic / openai-chat / openai-responses /
  gemini / cohere / ai21 / bedrock / voyage / mock. Reserved for Session 2b+
  dialect-scoped rule authoring.
- **`supports_thinking` → `reasoning` rename** — aligns with 2026 industry
  convention (LiteLLM `supports_reasoning`, models.dev `reasoning`, OpenRouter
  `reasoning`). No compat shim (forever-v0.x nuke-and-rebuild).
- **`TokenLimitParam::MaxOutputTokens`** — variant added (OpenAI Responses API
  future-proofing). No rule maps to it yet; the `#[non_exhaustive]` enum can
  grow without a schema bump.
- **Proptest parity harness** — 10,000 random (provider, model) pairs compared
  against frozen legacy body in `mod parity_tests`. Regex widened to cover slash
  syntax, uppercase, underscore (HF-style), long names.
- **Insta snapshot** — 31 golden (provider, model) pairs reviewable under
  `src/data/snapshots/`.
- **Invariant #19 FULL** — 15 `new()` constructors across the crate (every
  `#[non_exhaustive]` public struct). Includes: `ProviderModel`, `Provider`,
  `ProviderModel`, `McpServer`, `Embedding`, `TransformDef`, `Builtin`,
  `EnvVarSpec`, `McpPackage`, `McpRemote`, `ModelCapabilities`, `ModelPricing`,
  `CostEstimate`, `ParseTagError`, `ParseCategoryError`, `Suggestion`.
- **Gate 8 GREEN** — `RUSTDOCFLAGS="-D warnings" cargo doc --no-deps` clean.
  8+ broken intra-doc links fixed across the crate.
- **5-agent review** — rust-architect + rust-pro + rust-perf + spn-nika +
  feature-dev:code-reviewer. All P0/P1 findings addressed in same session
  across 2 hardening commits.

### 🏷️ Phase D Session 1 — Tag vocabulary + Cargo features (2026-04-14)

Typed tag system for catalog entries, Cargo feature gating, and Shield
safety invariant enforcement.

- **42-variant `Tag` enum** (`#[non_exhaustive]`) — model I/O modalities,
  reasoning/generation behaviour, economics, deployment/sovereignty,
  specialisation, domain, and MCP-server permissioning. Kebab-case wire
  format (`Tag::as_str()` + `FromStr`). Locked as enum (not `&str`) so
  pck authors get compile errors on typos.
- **`tags` + `extra_tags` fields** on `Provider`, `McpServer`, `Embedding` —
  `&'static [Tag]` (validated at build time) + `&'static [&'static str]`
  (passthrough escape hatch for community-specific vocabulary).
- **All 139 catalog entries tagged** (21 providers + 13 embeddings + 105 MCP
  servers). build.rs enforces: known tags only, sorted, deduplicated, and
  MCP entries MUST carry exactly one of `read-only` / `destructive` (Shield
  security-filter invariant, compile-time enforced).
- **Cargo features for subset compilation** — `full` (default), `minimal`,
  `mcp`, `providers`, `embeddings`, `pricing`, `capabilities`,
  `builtins-transforms`, `extension-author`. Community crates depend on
  `features = ["extension-author"]` for types-only (no bundled data).
- **7 runtime tag invariant tests** — XOR, Budget/Frontier mutex,
  Embedding/Reranker presence, sort/dedup codegen integrity, spot-checks
  (anthropic tags, stripe MCP tags).
- **COMMUNITY_EXTENSIONS.md** — pck-author pattern documentation for
  `nika-catalog-cn`, `nika-catalog-eu`, etc.
- **3-agent review** (spn-nika + feature-dev + rust-pro) — all P0/P1
  findings addressed: `f64::INFINITY` validation gap, `#[allow(dead_code)]`
  scoping, `tag_variant` drift guard, `Tag::Sandbox` doc clarification,
  `extra_tags` Gate 1 SAFETY note, version pin fix.

### ⚙️ Hygiene + automation (2026-04-14 PM)

Autonomous ecosystem hygiene stack added to prevent drift over the 11-12 month build:

- **15-vector hygiene dashboard** (`scripts/hygiene/check-all.sh`) — MEMORY HEAD,
  crate count, LOC, CHANGELOG, ROADMAP, crate specs, Linear, GitHub milestones,
  org profile, CITATION, unwraps, file LOC cap, Claude coauthor leak, private
  path leak, cargo audit. Green/yellow/red table, exit codes 0/1/2.
- **Claude Code hooks** — PreToolUse blocks 5 dangerous ops (force push,
  `git add -A`, `cargo test --test`, checkout main, `--no-verify`); PostToolUse
  inspects HEAD commit for Claude coauthor + auto-runs hygiene on admissions;
  SessionStart injects grep-verified HEAD + crate count + hygiene state.
- **Skills** — `/gate-check` and `/crate-admit` for 12-gate discipline;
  `review-swarm.md` subagent for parallel 3-agent review (Gate 11).
- **CI workflows** — `hygiene-nightly.yml` (cron 3h UTC, idempotent drift issue),
  `forward-compat.yml` (cargo-public-api + cargo-semver-checks on PR),
  `changelog-cliff.yml` (auto-PR prepend CHANGELOG on tag push).
- **git-cliff config** (`cliff.toml`) — groups match content pipeline.

## [0.80.0-alpha.4] - 2026-04-14

### 🆕 Crate admitted: nika-catalog-verify

The immune system.

Where `nika-catalog` answers "what do we know?" in O(1) from compile-time data,
`nika-catalog-verify` answers "is what we know still true?" It probes real
package registries (npm, PyPI, Docker) and remote MCP endpoints in parallel,
producing a JSON drift report. Binary, not library — runs nightly from CI or
on-demand via `cargo run -p nika-catalog-verify`.

This is the second catalog crate and the first L4 binary admitted. It exists
because static catalogs decay: a package gets deprecated, an API endpoint goes
away, a provider renames a model. Without verify, the catalog silently rots.

Exempted from Gate 5 (mutation ≥90%) because binary I/O code produces
tautological mutations. Gate 10 (legacy parity) is N/A — this is new tooling.

| Metric | Value |
|--------|-------|
| LOC | ~600 |
| Tests | partial (logic only, I/O excluded) |
| Clippy warnings | 0 |
| Unwraps in src/ | 0 |

Commit `a977e35b1`. 🦋

---

## [Previously Unreleased] — moved to 0.80.0-alpha.4

### 🔨 Refactors

- **nika-catalog Phase C migration** — migrating catalog data from hardcoded
  Rust arrays to `data/*.toml` source files, compiled at build time via
  `build.rs` + `phf_codegen`. Same zero-runtime-overhead phf maps, but the
  source of truth is now human-readable TOML. This unblocks community
  contributions to the catalog (PR a TOML file, not a Rust array).

### 🐛 Fixes

- **nika-catalog Phase A cleanup** (db0bf8e3f) — a 5-agent deep audit
  discovered 29 of our 131 MCP aliases were broken. Some pointed to
  Anthropic reference servers that were quietly deprecated ("Package no
  longer supported" on npm). Others referenced npm packages that never
  existed — Python-only tools, Go binaries, or names we'd fabricated from
  incomplete documentation. Three were community forks with zero weekly
  downloads.

  We removed all 29 and added a regression test (`removed_broken_aliases_not_present`)
  so they can't sneak back. The catalog went from 131 to 102 aliases.
  Every remaining alias now resolves to a real, installable package.

---

## [0.80.0-alpha.3] - 2026-04-13

### 🆕 Crates admitted: nika-kernel + nika-kernel-mock

The nervous system.

`nika-kernel` defines the **trait contracts for every side effect** in Nika.
It sits at L0.5 — above the pure types (error, catalog) and below the
implementations (fs, http, process, provider). Zero implementations live here.
This crate is the constitution: it says what each organ *must* do, not how.

The design follows Interface Segregation Principle to the max: ~20 fine-grained
atomic traits (`FsRead`, `FsWrite`, `HttpGet`, `ShellRun`...) grouped into ~6
super-traits of convenience (`Fs`, `HttpClient`, `ShellExecutor`, `Provider`...).
Consumers depend on exactly the surface they need — a context loader imports
`FsRead` alone, not the entire filesystem umbrella.

All async traits use `trait_variant` (Rust 1.91 native AFIT) instead of
`async_trait`. Zero boxing on the static dispatch path. The kernel carries no
tokio dependency — pure trait definitions that any async runtime can implement.

We also planted the **Cortex + agent-v2 hooks** now: `MemoryStore`,
`EmbeddingProvider`, `ToolExecutor`, `ContextCompressor`, and agent checkpoint
types. These won't be implemented until v0.95, but defining them in Phase 1
means we won't need breaking changes to `#[non_exhaustive]` structs later.
Forward compatibility bought cheaply.

`nika-kernel-mock` is the companion: deterministic mocks for every kernel trait
(`MockClock`, `InMemoryFs`, `MockHttp`, `MockShell`, `MockProvider`...).
Test hermeticity from day one — no test in Nika will ever touch a real
filesystem, a real network, or a real LLM provider.

| Metric | nika-kernel | nika-kernel-mock |
|--------|-------------|------------------|
| LOC | 3,369 | 1,731 |
| Tests | 99 | 88 |
| Mutation killed | 100% | 95.7% |
| Clippy warnings | 0 | 0 |
| Unwraps in src/ | 0 | 0 |

### Key decisions

- **Clock is SYNC, everything else ASYNC** — YAGNI on network time. Hot paths
  stay simple.
- **`BTreeMap` over `HashMap`** — deterministic iteration order, no hasher
  dependency. Tests are reproducible.
- **Cancel as `fn` param, not in struct** — keeps `ShellCommand` free of
  tokio-util. The kernel stays runtime-agnostic.
- **Provider = Infer + Stream + Meta** — all providers MUST stream (even mock).
  Embed and Vision are opt-in traits.
- **Errors per subsystem** — `ProviderError`, `ShellError`, `ToolExecError`,
  `MemoryError`. No god-enum.

All 12 gates passed. Commit `ef8804371`. 🦋

---

## [0.80.0-alpha.2] - 2026-04-13

### 🆕 Crate admitted: nika-catalog

The memory.

`nika-catalog` is Nika's static knowledge of the world: every LLM provider it
can talk to, every MCP server it knows how to install, every builtin tool it
ships, every pipe transform it supports, and the pricing of every model it's
seen.

The catalog is compiled into the binary at build time. No runtime I/O, no
config files, no network calls. You ask "do you know `anthropic`?" and the
answer comes back in O(1) via a [perfect hash function](https://en.wikipedia.org/wiki/Perfect_hash_function).

Why this matters: when a user writes `provider: claude` in their YAML, the
engine resolves the alias → canonical provider → model → capabilities → pricing
in a chain of zero-allocation lookups. No guessing, no fuzzy matching, no
"did you mean?" The catalog is the ground truth.

The lookup strategy is hybrid by design:
- **phf + unicase** for case-insensitive lookups (providers, MCP aliases) —
  because users write `Claude`, `claude`, `CLAUDE` and they all mean Anthropic.
- **Sorted arrays + binary_search** for case-sensitive lookups (builtins,
  transforms) — because `nika:read` and `nika:Read` are different things
  (actually `nika:Read` doesn't exist, and the catalog should say so clearly).

At admission: 16 providers, 105 MCP aliases, 63 builtins, 65 transforms,
61 model pricing entries. All from a single `cargo build`.

| Metric | Value |
|--------|-------|
| LOC | 2,235 |
| Tests | 85 |
| Mutation killed | 94.7% |
| Clippy warnings | 0 |
| Unwraps in src/ | 0 |

All 12 gates passed. Commit `55a451695`. 🦋

---

## [0.80.0-alpha.1] - 2026-04-13

### 🆕 Crate admitted: nika-error

The DNA.

Every error in Nika carries a code. `NIKA-001` means schema validation failed.
`NIKA-053` means a blocked command was attempted. `NIKA-382` means a canary
token leaked (prompt injection detected). There are hundreds of these codes,
and every single one must roundtrip through Display, parse back from a string,
serialize to JSON, and match the exact same format across every provider, every
verb, every transport layer.

`nika-error` is the crate that makes this possible. It defines:

- **`NikaErrorCode`** — a trait that every per-crate error enum must implement.
  This is the contract: if you want to be a Nika error, you carry a code, a
  severity, a category, and you format yourself as `"NIKA-XXX: message"`.
- **`NikaError`** — a `Box<dyn NikaErrorCode>` wrapper. The unified error type
  that flows through `?` propagation across the entire codebase.
- **`NikaCode`** — the code itself. Dual format: Display gives you `"NIKA-140"`,
  serde gives you `{"num":140,"category":"ast","severity":"error","slug":"ast-analysis-failure"}`.
- **`CoreError`** — cross-cutting errors that don't belong to any specific crate
  (Validation, NotFound, Unsupported, Internal).

This is the L0 anchor. Zero `nika-*` dependencies. Reachable from every crate
in the workspace. The first cell of the organism.

It also resolves **shadow zone 6** from the pre-launch audit: every admitted
`NIKA-XXX` now ships with a Display parity golden test against the legacy
format. No silent drift.

| Metric | Value |
|--------|-------|
| LOC | 1,013 |
| Tests | 44 |
| Mutation killed | 100% |
| Clippy warnings | 0 |
| Unwraps in src/ | 0 |

All 12 gates passed. Commit `42909b1c7`. 🦋

---

## [0.80.0-alpha.0] - 2026-04-13

### The beginning

Orphan branch `nika-diamond` (renamed `main` on 2026-05-06) created from scratch. No code inherited from legacy.
Clean slate, edition 2024, Rust 1.91.

From the start, the workspace enforces:
- `clippy::unwrap_used = "deny"` — zero unwraps, everywhere, always.
- `clippy::panic = "deny"` — if it can panic, it doesn't compile.
- `clippy::expect_used = "warn"` — we'll get there.

32 legacy crate directories excluded via `.gitignore` — they exist on disk
(the orphan branch inherits the working tree) but cargo ignores them. We read
legacy code via `git show main:path/to/file.rs` when we need guidance, but
nothing is copied verbatim. Every line is rewritten.

The organism's skeleton is in place. Now it grows. 🦋

---

[Unreleased]: https://github.com/supernovae-st/nika/compare/v0.80.0-alpha.4...HEAD
[0.80.0-alpha.4]: https://github.com/supernovae-st/nika/compare/v0.80.0-alpha.3...v0.80.0-alpha.4
[0.80.0-alpha.3]: https://github.com/supernovae-st/nika/compare/v0.80.0-alpha.2...v0.80.0-alpha.3
[0.80.0-alpha.2]: https://github.com/supernovae-st/nika/compare/v0.80.0-alpha.1...v0.80.0-alpha.2
[0.80.0-alpha.1]: https://github.com/supernovae-st/nika/compare/v0.80.0-alpha.0...v0.80.0-alpha.1
[0.80.0-alpha.0]: https://github.com/supernovae-st/nika/commits/v0.80.0-alpha.0

---

## The brouillon era (0.1 → 0.79 · 2026-01-01 → 2026-04-13)

The language was conceived earlier still — through private prototypes
and vibe-code experiments from **summer 2025** (the *exploration* era,
before git). It entered git on **New Year's Day 2026** (21:29 CET) on a
branch literally named `brouillon` (draft), and found its shape by
shipping: **79 minor versions in 103 days**, from « initial nika v0.1
with strict templating system » to a 138K-line monolith at v0.79.3. DAG validation landed hours after the first
commit; providers, tools, and the check-before-run discipline followed
version by version.

The era has a public spine: seven releases shipped to
[crates.io](https://crates.io/crates/nika/versions) in March 2026
(0.20.0 on March 4 → 0.47.1 on March 26 — later yanked in favor of the
rewrite, but the dated trail is permanent). The full branch and its
192 tags live in a private archive; the dated milestones are recorded
and machine-verified in the spec repo's
[timeline](https://github.com/supernovae-st/nika-spec/blob/main/timeline/timeline.yaml).

The version line is continuous — 0.80 picks up where 0.79 stopped —
because the LANGUAGE is the continuity. The engine is the rewrite.