Skip to content
himmel

v1.1.2 release notes

Curated, user-facing summary of what changed since v1.1.1, grouped by theme (81 merged PRs). CHANGELOG.md stays the generated, per-commit record (scripts/gen-changelog.sh, never hand-edited); this file is the readable version.

Release date: 2026-10-11.

Critical fixes

  • The hook-integrity recorder can no longer brick a session. An integrity failure on a Stop hook now skips that hook and lets the session stop; a killed or failed recorder fails open with a notice instead of denying every hook; in a hook chain a member that fails integrity is skipped alone and its intact neighbours keep running; a chain member’s Stop block keeps its own reason.
  • record-hook-integrity runs under macOS bash 3.2 (#2333, reported and fixed by Goomal, an external contributor; closes #2332).
  • Main CI runs on a 7-hour cron plus workflow_dispatch instead of every merge; merge-on-green refuses on a red main unless the PR is the declared fix.

Guardrails and hooks

  • Destructive-command and write fences. Auto-approve never allows a root walk and passes --files0-from, cd-relative walks and CR-glued writer operands correctly; the chokepoint denies any IFS assignment beside a chokepoint word and no longer depends on the ambient locale; its relief now voids on readpipe, executing short options and ripgrep program-running options.
  • The /pr-check literal guard counts git bisect run and rebase --exec as program-running and denies a guarded writer behind a git editor or alias hook.
  • The live-settings fence decodes env -S escapes before judging; the bank-lift write guard trims a classified over-deny.
  • Every Bash chain member runs in time linear in its input, with latency RED controls.
  • himmel-bus store guard denies direct bus-root access and registration verbs from a session’s own tool calls.

Chief and workers

  • grant-round.sh: the chief grants one more review round on a signed judge record, instead of a hand-pasted counter file. write-verdict.sh --bind-reviewed binds a NO-GO to the reviewed head across a test-only or comment-only commit.
  • Review gate. A claude-only delta round cannot strand a PR; one post-cap delta round runs when every prior finding is recorded fixed; the ledger confirms each finding append; gate 4d paths survive quotePath.
  • Merge gate. merge-on-green re-runs the plugin-version bump check from the trusted base-tip checker and requires its success line; merge-forward-check covers a merge-base with the next completed cron or dispatch main run and refuses non-success conclusions.
  • console-judge-ro, a read-only judge agent with a 1 h cache TTL; judge scratch directories are released when a verdict is written and are no longer fully rsynced into tmpfs.
  • The arming gate runs brief-lint on every brief; close-wrapped-worker resolves a claudex worker’s config dir.
  • Launchers register and bind a session on the himmel-bus, and arm-resume rebinds a resumed session.
  • The tick flags stalled cloud sessions, cloud-route sends already-fixed tickets to a local verify, and the cloud environment is declared from the repo with a self-check. Tick and board surface suite-flake ledger rows.
  • Autocompact A/B arm and report.

Lanes

  • Lane canary (scripts/lanes/lane-canary.sh): launches one no-op worker per lane and reports PASS, FAIL or SKIP with time-to-first-bullet.
  • DeepSeek lane workers start without the external-imports prompt; the OpenRouter lane hands the child a thinking EXTRA_BODY so the auto classifier works, and the Haiku pin moved to haiku-5.5.
  • The claudex client-side classifier no longer over-generalises the rm -rf deny rule; the claudex jail hook matching and lane scope are tighter.
  • A stale codex usage cache refreshes once, bounded, and the doctor warns.

himmel-bus

bus wait verb, a worker-bus profile and catalog entry for a live round trip; a bus root that enforces 0700 only on himmel/bus, with a failed launcher register surfaced; the console profile carries himmel-bus so a chief registers on launch. The first live POC recorded five failures; see Known issues.

CI and test tooling

  • Flake handling. A failed suite is retried once; a pass on retry is a FLAKE recorded in a per-repo ledger with a repeat-flake “file a ticket” line.
  • Impacted-suite selector always runs tree-scanning suites, covers lowercase and split uninstall callers, template root files and suites that name a changed script without its extension, and fails closed on a failed temp write.
  • main-sweep-red persists the newest processed run id, closes a report on a green dispatch run and ignores cancelled-shard aggregate failures.
  • The plugin version-bump check compares against the current base tip and passes a PR that never touched the plugin.
  • Live end-to-end suites: chief-kit fixture fleet, review gate and merge-on-green against a throwaway repo, a mock-Anthropic turn proving a registered hook fires and denies.

Telegram

/chief queues to a busy armed chief and matches a unique name fragment; /chief, the fleet verbs and /lockdown accept any case and the /verb@botname form; the break-glass allow-rule refuses symlinks, keeps mode, ignores backups and unless the registry text equals the approved text.

Plugins, tickets and docs

  • i-have-adhd is vendored, pinned, in the base profile and always on in the installer and updater; emilkowalski-skills re-pinned.
  • jira create enforces a plain Impact / What / Why block.
  • Config UI AG-UI stream: the journal fd is opened then verified, and the mapper confirms each ledger verdict.
  • Docs and llms.txt describe the himmel UI surfaces and close the gaps for user-facing surfaces; the release checklist keeps them current.
  • The doctor names a non-qmd listener on the qmd daemon port.

Dependencies

One PR bumped every in-policy dependency (VM-proven): bun 1.4.3, the CI claude CLI pin 2.1.296, in-range lockfile refreshes, marketplace SHA pins and the vault template (0.4.71). claude-hud and the impeccable, superpowers and ponytail fork pins were left for a follow-up.

Station tools: deferred

The three station tools named in the dependency PR did not move on the operator’s station during this release, by ruling:

  • graphify stays at the installed version; the repo pin is 0.9.80, and the update step refuses to swap the install under live graphify-mcp sessions. It rolls once those sessions are gone (himmel-update.sh --only graphify).
  • ast-grep is an opt-in tool and is not installed on the station, so there was nothing to bump.
  • cli-proxy-api stays at v7.3.15, the repo pin. v8.0.23 is a major bump that needs cli-proxy-lane.sh VERSION and checksum overrides and a VM-first upgrade stage.

Known issues

  • claudex auto mode does not block destructive actions: the gateway classifier allowed a force push to main. Run no unattended claudex workers; explicit deny rules and a dontAsk fallback are in flight.
  • Guard gaps (label guards): git global options hide push --force, reset --hard and clean -f; no destructive-verb floor for gh; the Codex hook chain has no deny list; secret-read, exfil and env-dump verbs; tag and ref deletion; remote exec beyond curl | sh; process and host kill verbs; shred, truncate, dd of=/dev and chmod -R; infra, DB and docker destroy verbs; hook-disabling shapes; state and vault repos have no client-side force-push floor; git restore ., checkout -f and reset --keep.
  • himmel-bus has had one live round trip POC with failures recorded; treat the bus as opt-in until its station acceptance closes.
  • The lane canary reports a launcher usage refusal (exit 11, for example OpenRouter credit below its floor) as FAIL rather than SKIP.
  • Windows remains unsupported.