Release radar

1nika: release-radar2​3model: ollama/qwen3.5:4b   # local · zero key · swap for any provider in the catalog4​5const:6  releases_feed: "https://github.com/tokio-rs/tokio/releases.atom"7  state_path: "out/release-radar.json"8⛨permits:9  ⛨tools: ["nika:fetch", "nika:jq", "nika:json_diff", "nika:prompt", "nika:read", "nika:write"]10  ⛨net:11    ⛨http: ["github.com"]   # the feed's host · net entries are exact names, never globs12  ⛨fs:13    # The state-file pattern touches exactly ONE path, on both sides: read14    # last run's state, write the next. `const.state_path` names it and a run15    # cannot move a const, so the same literal is the whole boundary —16    # `create_dirs:` makes out/ underneath it on the first run.17    ⛨read: ["out/release-radar.json"]18    ⛨write: ["out/release-radar.json"]19​20tasks:21  # The human gate first (NIKA-SEC-009 · NEP-0002, the Rule of Two as a22  # static check). This boundary permits all three legs — private read23  # (the state file) + untrusted ingress (the release feed) + egress24  # (the state write) — so a blocking prompt (no default:) dominates the25  # flow before a byte moves. Headless surfaces pause durably and resume26  # with `--resume <trace> --answer approve=true`.27  approve:28    ◆invoke:29      tool: "nika:prompt"30      args:31        message: "This run fetches ${{ const.releases_feed }}, diffs against ${{ const.state_path }}, and rewrites that state file. Proceed?"32​33  # First run has no state file · recover to an empty list.34  no_state:35    with:36      go: ${{ tasks.approve.output }}37    when: ${{ with.go == true }}38    ◆invoke:39      tool: "nika:jq"40      args: { input: [], expression: "." }41​42  previous:43    with:44      go: ${{ tasks.approve.output }}45    when: ${{ with.go == true }}46    ◆invoke:47      tool: "nika:read"48      args: { path: "${{ const.state_path }}" }49    on_error:50      on_codes: [NIKA-BUILTIN-READ-001]   # not-found ONLY · a permission error still fails loudly51      recover: ${{ tasks.no_state.output }}52​53  feed:54    with:55      go: ${{ tasks.approve.output }}56    when: ${{ with.go == true }}57    ◆invoke:58      tool: "nika:fetch"59      args:60        url: "${{ const.releases_feed }}"61        mode: feed62    extract:63      entries: "[.items[] | {title, link}]"64    on_error:65      # No network → this sample stands in for the RAW feed response: it66      # carries `items:` under the keys `mode: feed` actually returns67      # (probed live on this feed: title · link · id · author · content —68      # there is no `published` field), so the `extract:` jq above runs over69      # it unchanged. Recovering the BINDING's shape instead makes the jq70      # throw NIKA-VAR-004 — the recovery must mirror the response, never71      # the binding.72      recover:73        items:74          - { title: "tokio 1.48.0", link: "https://github.com/tokio-rs/tokio/releases/tag/tokio-1.48.0" }75          - { title: "tokio 1.47.1", link: "https://github.com/tokio-rs/tokio/releases/tag/tokio-1.47.1" }76​77  # `nika:read` hands back a STRING — a file is text until you parse it.78  # Measured: diffing the unparsed read against the entries array emits ONE79  # whole-document `replace` op at path "" on every run after the first,80  # so everything is reported as new, forever. The first-run recovery is81  # already an array; the guard keeps both shapes.82  previous_parsed:83    with:84      previous: ${{ tasks.previous.output }}85    ◆invoke:86      tool: "nika:jq"87      args:88        input: "${{ with.previous }}"89        expression: 'if type == "string" then fromjson else . end'90​91  fresh:92    with:93      go: ${{ tasks.approve.output }}94      previous: ${{ tasks.previous_parsed.output }}95      entries: ${{ tasks.feed.entries }}96    when: ${{ with.go == true }}97    ◆invoke:98      tool: "nika:json_diff"99      args:100        before: "${{ with.previous }}"101        after: "${{ with.entries }}"102​103  digest:104    with:105      go: ${{ tasks.approve.output }}106      fresh: ${{ tasks.fresh.output }}107      entries: ${{ tasks.feed.entries }}108    when: ${{ with.go == true && size(with.fresh) > 0 }}109    ◇infer:110      max_tokens: 500111      prompt: |112        New releases appeared on our dependency radar (RFC 6902 patch113        against last run) ·114        ${{ with.fresh }}115        Full current feed · ${{ with.entries }}116        Write 3 bullets · what shipped · whether it looks breaking ·117        what to check in our code.118​119  save_state:120    with:121      go: ${{ tasks.approve.output }}122      entries: ${{ tasks.feed.entries }}123    when: ${{ with.go == true }}124    ◆invoke:125      tool: "nika:write"126      args:127        path: "${{ const.state_path }}"128        content: "${{ with.entries }}"129        create_dirs: true130        overwrite: true131​132outputs:133  new_entries:134    value: ${{ tasks.fresh.output }}135    description: "RFC 6902 ops · empty = nothing new since last run"136  # Untyped on purpose: `digest` is `when:`-gated, so on a quiet week it is137  # SKIPPED and this reads null. Exporting it is also what keeps those tokens138  # from being dead spend — an infer whose output nothing consumes is paid for139  # and thrown away, and `check` says so.140  briefing: ${{ tasks.digest.output }}141​