v0.46.0 — a skill library you can read, and sixteen claims corrected

A release about rules written in one place and not applied to the thing next to them. Nine of those, found by going after the shape of the bug rather than the instance — plus the skill card library that grew out of writing the incidents down.

A curated skill library

23 cards in skills/, 13 written from this project's own incidents.

A card is data, not code: frontmatter plus Trigger / Do / Avoid / Check / Risk, and it executes nothing. Reviewing a contribution is reading a markdown page, not auditing a diff — which makes it the lowest-barrier place to contribute here, and the only one that needs no Python.

Cards are grouped by where in the work they apply — define · build · verify · review · ship — and carry a topic. Browse them at chimeraagent.space/skills, import one with:

chimera skills-import skills/verify-before-claiming

Honest caveat, stated here rather than buried: having the agent read cards into its prompt is opt-in and off by default (--skill-cards, or CHIMERA_SKILL_CARDS=1). The registered A/B that would have turned it on came back +16.7pp but not significant, at +300% tokens — it failed its own flip gate, so it stayed off. The numbers are in bench/skillcard/RESULTS.md.

The card description, body and trigger chips are translated into nine languages, in a sidecar that leaves SKILL.md byte-identical — so the published SHA-256 still attests to exactly what the CLI imports and the agent reads.

The gate that keeps translations honest

tests/test_skill_translations.py separates three states that look identical inside a file:

• stale — claims to translate text that has since changed. Always fails. Nothing renders wrong, but the file now holds a translation nobody will ever see and the next reader cannot tell it from a live one.
• incomplete — four of five sections. Always fails; the renderer demands all five or none, so the rest are orphans.
• missing — honest debt. The reader gets English and the page says so. Counted and capped, not forbidden: a gate demanding nine translations before a card could merge would kill the contribution surface.

It exists because thirteen cards shipped untranslated and one locale had no card translations at all while the site served it. The only symptom was English on the page — found by reading files, not by a failing build.

Fixed

• Five JSON stores lost data without saying so. Read-modify-write with no lock: two processes, and the second silently erased the first's work. One of them was the skill store — so a run that learned something could be erased by the run that learned it. All five now lock and write atomically.
• A fence nobody could switch on. Enabling governance killed the CLI at import. Nobody had ever run with it enabled, so nobody found out.
• The app's Discord bot ran unfenced, and the build gate could not see it.
• The single write gate had three of eight callers.
• One environment variable was read to mean two different things, which broke all six of its legal values.
• Three agent defects that each undermined something load-bearing, plus the last three from a scope audit.

What they have in common: none of them fails. Every one passes tests, passes review, and produces a green run. The allowlist with three call sites does not throw — it just does not fence.

The fix that generalised, and the part worth stealing: a build gate must list the EXEMPTIONS, not the obligations. A check enumerating what it should cover fails open the moment somebody adds a tenth thing. A check enumerating what is allowed to be uncovered fails closed.

Documentation — sixteen claims the code did not support

Corrected in all ten languages. Five were false rather than merely stale: governance is allow / warn / review / block (not ask, which is a different axis); the desktop rail is code · editor · work · knowledge · automation with no chat destination; the Maturity screen renders only under the Vite dev server; chimera skills lists the built-ins while learned skills come from skills-stats; and a recipe sent readers to CHIMERA_TAVILY_API_KEY, a variable with zero occurrences in the product.

Two claims gained the caveat that was missing. "It gets better the more you use it" is the one our own evidence retracted — seven pre-registered runs, no significant effect, and the single positive did not replicate. That caveat now sits next to the claim instead of ninety lines below it.

Also

A benchmark that measures what a poisoned memory costs a later run, not the run that wrote it.

Install

pip install -U chimera-agent
pip install -U 'chimera-agent[desktop]'

Or grab a native installer below. They are not signed by a certificate authority, so Windows and macOS warn on first run.

---

Cut two days after v0.45.1, against this project's own one-stable-a-week rule — deliberately, with the rule read first. The CHANGELOG says so in its own section.