0.54.0 — the auditor reads what a slice can do, a runaway is bounded, and the approval question names the command

The auditor reads what a slice can do, a runaway is bounded, and the approval question names the command

Two days of measured changes (#425–#447), every one pre-registered, sabotage-verified and published with the predictions that failed.

What changes for someone running an agent

• Long worker outputs no longer lose their critical finding on the way to the synthesis. The spot-check auditor used to pass 19 of 23 summaries that had dropped a release blocker or a data exposure. Told what it is holding — a mechanical head-and-tail slice, which can omit but cannot invent — it catches 23 of 23, and 20 of 23 when the finding is a clause inside a sentence. A dropped finding is recovered (the auditor's own sentence goes back into the summary), never a reason to re-ask or reject. The two-call blind audit that shipped in between is off the default path: behind the one-call check it recovered nothing and grew half the clean summaries.
• A reasoning model can no longer spend the provider's whole ceiling thinking and return nothing. CHIMERA_COMPLETION_CEILING (32,000 by default; 0 keeps the provider's) bounds every call whose caller set no budget; the fusion judge and synthesiser ask under their own budgets and ask once more on an empty reply; finish_reason is on the trace. Measured on 342 judge runs: the same accuracy at 14% of the cost, with the 52-minute run gone.
• The synthesis carries the figures verbatim. On a weak backbone that was dropping the workers' numbers it helped; on the production synthesiser it changes no answer and writes 15% fewer tokens. On thirty tasks the weak-backbone gain is +3 pp, not the +26 pp the first ten showed — the corpus grew for that reason, and the notes say so.
• The approval question names the command, the tainted page and who asked for that read, and the queue puts block before an older review. chimera approve reports the answer rate and the wait. Installing a package by name is a question; a lockfile install is not.
• A spec test counts as evidence only if it could have failed before the change; the generator asks twice and bounds its runaway, and its abstain says why.
• The fusion judge reads letters, not vendors — and on the one corpus built where it could not answer alone, its verdict followed neither the vendor name nor the position, on two samples.
• Precedents are keyed on the action and its lineage; the judge and the precedent store are declared a library, not a shipped surface, with the numbers, and the build guards the decision.
• The evolution loop spends one error budget across its rounds; a halt is not a failure; bench/PROTOCOL.md says what every bench owes before its number is read.

Honest caveats

Governance is off on a stock install — chimera guard prints what would happen; the ceiling is a bound on spend and not a fix for a model that reasons in circles; the multi-agent hierarchy still loses to one re-reading agent at equal calls on a weak backbone, and the tab says so. Installers are unsigned and warn on first run; cancellation is cooperative.

Full detail per entry: CHANGELOG.md, section 0.54.0.