chore(live): bump dikw-core verification target to 0.6.5

[helebest]

What

Bumps the live-integration verification target DIKW_CORE_VERSION from 0.6.1 to 0.6.5 (latest dikw-core release, 2026-06-28) in both pin sites — .github/workflows/live-integration.yml (CI/nightly) and scripts/live-core/harness.mjs (local default) — plus the compose example comment and the docs/integration-verification.md defaults.

Release notes 0.6.2→0.6.5 show no change to the consumed /v1 contract (0.6.2 adds optional reranking inside retrieval, 0.6.3 is a no-engine-change cadence release, 0.6.4 extracts prompts, 0.6.5 changes init scaffolding defaults + eval internals).

Why manual (auto-bump is broken)

The bump-dikw-core.yml workflow detected 0.6.5 in its 2026-06-29 scheduled run (28360921243) but the push was rejected: DIKW_BUMP_TOKEN lacks the fine-grained Workflows: read/write permission, which GitHub requires for any push that edits a file under .github/workflows/. Regenerating the PAT with that permission un-breaks the auto-bump. The docs' one-time-setup note now records this (it previously claimed contents + pull-requests suffice).

gate-change label

This PR carries the gate-change label because the diff edits .github/workflows/live-integration.yml, which gate-integrity treats as machinery. The workflow edit is the pin value only — no gate is weakened (the verification target is upgraded). Note the same interaction will hit every future auto-bump PR: bump-dikw-core.yml predates the gate and only adds the live-integration label, so even a scope-fixed PAT produces PRs that fail gate-integrity until a maintainer adds gate-change (or the pin moves out of the workflow file). Left unresolved here deliberately — it's a design decision.

Verification

npm run live:verify locally against ghcr.io/opendikw/dikw-core:0.6.5 (postgres backend):

• core healthy, /v1/health reports version=0.6.5
• write pipeline: import (3 committed / 0 rejected) → ingest → synth → lint propose → lint apply, all succeeded
• read-contract smoke: 7/7 checks passed
• Playwright live project: 4/4 passed
• agent↔core check: core tools succeeded over the live core

The live-integration label re-runs the same verification in CI on this PR.

(First local attempt failed on a stale dikw-web-live_postgres-data volume from a June run — the per-run random Postgres password can't apply to an already-initialized volume; live:down -- --volumes cleared it. Environment issue, unrelated to 0.6.5.)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Live integration and local harnesses now default to a newer core version, keeping end-to-end checks aligned with the latest supported image.

• Documentation

  • Updated integration verification docs with the current version default and clearer guidance for version-bump permissions and workflow requirements.

Loop log

• Round 1: all checks green except Container scan (trivy) — npm ci ECONNRESET inside the scan-image build (infra flake, unrelated to the diff). One gh run rerun --failed (flaky budget 1/1 spent).
• Round 2: fully green. Review prose: no reviews / no inline comments; CodeRabbit completed with no actionable comments.
• Merge attempt blocked: base moved (dependabot chore(deps): bump markdown-it from 14.2.0 to 14.3.0 #146/chore(deps): bump @google/genai from 1.52.0 to 2.10.0 #147/chore(deps): bump @opentelemetry/instrumentation-undici from 0.29.0 to 0.30.0 #149) → gh pr update-branch.
• Round 3 (sync SHA): fully green, CodeRabbit re-completed. Squash-merged as e58d3fc.
• 0 fixer escalations, 0 code changes after the initial commit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 83d3ddf8-c69f-462b-9ac5-dc81ef14cb4b

📥 Commits

Reviewing files that changed from the base of the PR and between 2415a70 and 4c94446.

📒 Files selected for processing (4)

• .github/workflows/live-integration.yml
• docker-compose.live-core.yml
• docs/integration-verification.md
• scripts/live-core/harness.mjs

---

📝 Walkthrough

Walkthrough

Updates the default DIKW_CORE_VERSION from 0.6.1 to 0.6.5 across the GitHub Actions workflow, docker-compose configuration, and harness script. Documentation is updated to reflect the new default and expanded with additional details on DIKW_BUMP_TOKEN permission requirements and merge gating behavior.

Changes

DIKW_CORE_VERSION bump

Layer / File(s)	Summary
Version bump across workflow, compose, and harness .github/workflows/live-integration.yml, docker-compose.live-core.yml, scripts/live-core/harness.mjs	The default core image version referenced in the CI workflow env var, the docker-compose error hint, and the harness DEFAULT_CORE_VERSION constant are all updated from 0.6.1 to 0.6.5.
Documentation updates for version and bump setup docs/integration-verification.md	The documented pinned target and configuration knob default are updated to 0.6.5, and the bump-workflow setup section is expanded with more specific DIKW_BUMP_TOKEN permission requirements and merge gating (gate-integrity / gate-change) notes.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely states the main change: bumping the live verification target to dikw-core 0.6.5.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-dikw-core-0.6.5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}