v0.45.0 — the agent nobody is watching

v0.44.0 made the desktop app an editor. This one is about the other half: the agent that runs on a schedule, with money, while you sleep.

It came out of a multi-agent study of the field — 31 arXiv papers read in full, five surveys of competitors, forums and security literature, and an audit of our own code. The first finding was the uncomfortable one: the defences this project sells existed and were switched off on exactly the path that runs unattended. Most of this release is wiring them in, measuring what that costs, and saying out loud what still has not been measured.

If you deploy Chimera, read this first

The shipped docker-compose.yml published port 8765 on every interface, .env.example left the token empty, and auth is opt-in. Following the README's one-command deployment gave you an agent gateway, with tools, answering anyone who found the port.

• serve now refuses to bind a non-loopback address without a token, and tells you the three ways to fix it.
• The compose publishes to 127.0.0.1.
• --allow-insecure-bind exists, because 0.0.0.0 behind an authenticating proxy is a real deployment — and a guard people have to work around is one they learn to disable everywhere.

This is a breaking change if you were reaching the gateway from another machine. Set CHIMERA_SERVER_TOKEN, or pass the escape, or put it behind your proxy.

Money has a ceiling now

Three of them, and none is derivable from the others: per run, per scheduled job, and a daily aggregate that stops the cron from firing. Until now the only limits were step counters, and a job in a retry loop spent until the provider's balance ran out.

An unpriced call stops the run — a ceiling that skips what it cannot price shows green while the spend climbs. A local model is priced at zero rather than unknown, or the cap would refuse the one configuration that cannot overspend. chimera doctor tells you, before you set a cap, whether your default model can be priced at all.

Governance that reaches the five surfaces that run alone

serve, cron, MCP, A2A and the messaging adapters each built a bare tool registry. One governed_profile() now assembles the stack for all five, and an AST test fails the build if any of them goes back to building its own.

CHIMERA_GOVERNANCE=observe is the point, not enforce. It runs the whole stack, refuses nothing, and records every action enforcement would have refused — so the price of turning it on is a number you measure over a week rather than a risk you take in production. Default is off: governance arriving through an upgrade is not a thing an upgrade may decide.

And there is finally someone on the other side of the gate. Both governance layers had accepted an approver since they were written and never been given one — measured at 100% of dangerous-class calls refused on any run that read something external. Wiring it moves over-block from 50% to 0% without moving the attack block rate.

Chimera inside your editor

chimera acp speaks the Agent Client Protocol from the agent side, so Zed, JetBrains or Neovim can drive the loop, the verifier and the receipt without installing a second tool. Point your editor's agent setting at chimera acp --workspace <repo>.

What we did not measure, said plainly

• The context curve has no data. Its first output is 0 joined attempts out of 706 real ones, and it says so rather than drawing a line through nothing. A null result would license leaving compaction unbuilt; an absence of data licenses nothing.
• The first over-block measurement was wrong, reported 100%, and is recorded rather than quietly fixed. A number that absurd should trigger an audit of the apparatus before a conclusion.
• Published numbers caught up with the runs that produced them. docs/benchmarks.md still promised, in the future tense and in nine translations, a Terminal-Bench result that had already come out against us (7.5% → 2.5%); the SWE-bench table stopped two runs short; and the README claimed fusion cost "no loss of accuracy" where the source says 0 to −8.3pp.
• Governance A/B, AgentDojo and a weak-model SWE-bench run are deliberately unbuilt: each needs paid model calls this phase has no budget for, and a runner nobody can execute is code that ages without ever being exercised.

Still true

The installers are unsigned — Windows SmartScreen and macOS Gatekeeper warn on first run. An external agent driven over ACP has its own file tools, so the guarantee there is checkpoint and revert, not prevention.

Full detail in the CHANGELOG.