0.53.0 — the terminal is governed too, and a question finds you

A release about the surfaces a person actually sits at — the terminal, the full-screen app, the desktop chat — which were the ones nothing governed, and about the question that now finds you wherever you are.

The terminal is governed too

chimera chat and chimera assist built a bare tool registry: no taint ledger, no fence around what a page said, no kernel, no write region. Measured before a line was changed, with the same corpus the API's governed path is measured on: the terminal blocked 0 of 7 attacks the governed path blocks, and 0 of 15 external reads arrived inside the <<external-data>> fence its own system prompt promises on every turn — to a model obeying that prompt, no marker reads as not external.

Both now build through the governed assembly, and every registered prediction held: 0 of 7 → 7 of 7 blocked, 0 of 12 → 12 of 12 reads fenced. And the approver asks. The terminal is the one surface with a guaranteed human, and it was the only one that built no approver at all. The price is stated as a price: five questions across eight legitimate rows, and with a person answering, nothing legitimate is refused.

chimera tui joins them, for a reason that took a measurement to find: its confirmation prompt was a typer.confirm on stdin from a worker thread, under a Textual app holding the terminal in raw mode — so the question was never drawn, the turn hung 123.8 s against a 120 s timeout, and came back ✗ run_shell with no reason. It now asks through a modal on the app's own message pump: the question appears in 4.8 s, the command runs, and the reply is the real output instead of a fabricated refusal. The four gaps that first change left behind — memory scoped to --workspace, a conversation that outlives the window, agent.json reaching it, --write-region — are closed.

The desktop chat is guarded by default

CHIMERA_GUARD_CHAT shipped off for its whole life: ask the chat to summarise a page carrying a planted instruction and nothing stopped it writing the file that instruction named. Guard off blocks 0 of 7 attacks and fences 0 of 15 reads; guard on blocks 7 of 7.

The reason it stayed off was the cost — over-block 0.750 with nobody to ask. Two thirds of that was not the guard: guard_chat_registry was one of two ledger_registry callers that passed no approver, and the taint layer reads nobody to ask as refuse. With the coding turn's own approver the cost is 0.250. So the guard is on, the chat can ask, and /v1/chat/completions — where nobody is ever sitting — is deliberately left alone with its own session manager.

Set CHIMERA_GUARD_CHAT=0 for the old assembly. The conversation's posture line will say it is unguarded.

A question finds you

Governance can stop a tool call and ask a person, and silence refuses — so a question nobody notices is a refusal nobody decided. Until now it was visible from one of the app's seven screens. A chip in the status bar, mounted under every view, now opens the question itself; it renders nothing at all while nothing is parked. The approval card counts down and at zero removes its buttons and says so, instead of offering two live-looking answers on a question that has already been refused. It never invents time: a card with no deadline draws none.

solve-batch had a gate with nobody behind it

The other ledger_registry caller with no approver. Its own comment said --taint makes dangerous tools "require approval"; what they required was a person who did not exist. Measured: 5 of 8 legitimate rows refused as shipped, 0 of 8 with somebody answering, attacks 7 of 7 blocked either way — the approver buys back false refusals, not defence. The batch also reported ok for a worker that was not allowed to do its work; it now says not allowed and lists what was refused, per task.

One consequence to know about: an unattended batch in CHIMERA_APPROVAL_MODE=ask now writes each question down for chimera approve and waits CHIMERA_APPROVAL_WAIT seconds for it, per refused call, per worker. Set CHIMERA_APPROVAL_WEBHOOK so the question reaches somebody, or deny for a batch that should never wait.

Two refutations, published as refutations

A claim this repository made — "every suite we can author lands the control at 84–92%" — was false, and the file stating it held the number refuting it fifteen lines earlier. Withdrawn where it was made. And the scenario suite built to replace it was piloted live and refuted five of its six family traps for US$ 0.02; the arm that first read as a refutation of the whole design turned out to be a broken reproduction row, which cost another cent to establish.

Also in this release

• The tuning gate decides on evidence. evolve tune promoted on a bare fraction over eight scenarios at k=1 — a candidate byte-identical to the incumbent cleared it about 30% of the time. Promotion now needs a confidence interval on the difference to clear zero, or the search says it cannot decide; the validity gate and the registered holdout are excluded from the objective and reported beside it.
• A command's output arrives as the child wrote it. On Windows, text=True decoded with the ANSI code page while console programs write the OEM one — and bytes the page leaves undefined killed subprocess's reader thread, returning a successful process whose output was None. Five call sites, including the two that run whatever you or the model typed, now decode from the console's own code page.
• serve and the platform bots tell their ledger whose turn it is — worth 9 rows to an owner who has turned governance on, and exactly 0 on a stock install, which was established before the fix was written.
• A run stopped by the dollar ceiling says spend, not the token ceiling's label; chat and assist gain --max-usd, held per conversation, and /solve.

Installers are still unsigned: first run shows a SmartScreen or Gatekeeper warning. That is expected.

Full detail, including what each measurement cannot show, is in CHANGELOG.md.