v0.108.0

the access layer

published 2026-08-05 · 8 assets · the catalog this site serves

The access layer arrives, and the check stops trusting what it cannot read. From this tag, model: picks the intelligence and access picks the path: the admission-time resolver is a pure function with a strict sovereign order (local · mock · harness · oauth · api), enumeration order can never change the outcome, and every dropped candidate carries its witness: the dimension, the layer, the teaching line. --access pins the path at the launch gates, before a token is spent: unsatisfied refuses, never substitutes. The ACP harness class lands with its mock agent in a quarantined workspace, proving the wire with no vendor in the loop. And the security fix that taught the train its lesson: a shell-string exec with no permits passed check green. The verifiable argv door refused while the unverifiable shell door stood open, the exact inversion of a security gate. The exec capability is now required whatever the spelling, and the runtime deferral owns dynamic values, never the door itself.

echo "2111893a1b3d6fdeb03da0fb9b1ce8814fe6a7855101aec2006f1652db095cec  nika-macos-arm64-0.108.0.tar.gz" | shasum -a 256 -c -

vendored from the public release record · re-vendored at the train cadence