chore(live): bump dikw-core verification target to 0.6.5

.github/workflows/live-integration.yml

@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 30
     env:
       CI: "true"
-      DIKW_CORE_VERSION: "0.6.1"
+      DIKW_CORE_VERSION: "0.6.5"
     steps:
       - uses: actions/checkout@v7
 

docker-compose.live-core.yml

@@ -32,7 +32,7 @@ services:
       retries: 20
 
   dikw-core:
-    image: ghcr.io/opendikw/dikw-core:${DIKW_CORE_VERSION:?set DIKW_CORE_VERSION, e.g. 0.6.1}
+    image: ghcr.io/opendikw/dikw-core:${DIKW_CORE_VERSION:?set DIKW_CORE_VERSION, e.g. 0.6.5}
     depends_on:
       postgres:
         condition: service_healthy

docs/integration-verification.md

@@ -106,7 +106,7 @@ token and Postgres password per run, so those are not secrets.
 
 ## Tracking new dikw-core versions
 
-The verification target is **pinned** (`DIKW_CORE_VERSION`, default `0.6.1`) — by
+The verification target is **pinned** (`DIKW_CORE_VERSION`, default `0.6.5`) — by
 design: a fixed version keeps the nightly reproducible, so a red run means *your*
 code regressed, not that core changed under you. The pin lives in two places:
 `.github/workflows/live-integration.yml` (CI/nightly) and
@@ -120,10 +120,15 @@ weekly (and on `workflow_dispatch`) it resolves dikw-core's latest GitHub releas
 are thus explicit and reviewed (green/red signal per PR), not silent.
 
 > **One-time setup:** the bump workflow needs a repo secret `DIKW_BUMP_TOKEN` — a
-> fine-grained PAT with **contents: read/write** + **pull requests: read/write**
-> on this repo. The default `GITHUB_TOKEN` can't be used: a PR it opens does not
-> trigger the required CI checks or the `labeled` event, so the bump PR would be
-> unmergeable. Without the secret the workflow no-ops with a warning.
+> fine-grained PAT with **contents: read/write** + **pull requests: read/write** +
+> **workflows: read/write** on this repo (the bump commit edits
+> `.github/workflows/live-integration.yml`, and GitHub rejects a push touching
+> workflow files from a token without the workflows permission — observed in the
+> 2026-06-29 scheduled run). The default `GITHUB_TOKEN` can't be used: a PR it
+> opens does not trigger the required CI checks or the `labeled` event, so the
+> bump PR would be unmergeable. Without the secret the workflow no-ops with a
+> warning. Note the bump PR also edits a workflow file, so the `gate-integrity`
+> check requires a maintainer to add the `gate-change` label before it can merge.
 
 To bump manually instead, edit `DIKW_CORE_VERSION` in those two files (or run any
 `live:*` command with `DIKW_CORE_VERSION=<x.y.z>` in the environment).
@@ -132,6 +137,6 @@ To bump manually instead, edit `DIKW_CORE_VERSION` in those two files (or run an
 
 | Env | Default | Purpose |
 | --- | --- | --- |
-| `DIKW_CORE_VERSION` | `0.6.1` | GHCR image tag to verify against. |
+| `DIKW_CORE_VERSION` | `0.6.5` | GHCR image tag to verify against. |
 | `DIKW_CORE_LLM_MODEL` | `MiniMax-M3` | MiniMax model name in the core `dikw.yml` LLM leg. |
 | `DIKW_LIVE_PROJECT` | `dikw-web-live` | Compose project name; override to run parallel stacks. |

scripts/live-core/harness.mjs

@@ -16,7 +16,7 @@ import { dirname, join, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
 export const REPO_ROOT = resolve(here, "..", "..");
-export const DEFAULT_CORE_VERSION = process.env.DIKW_CORE_VERSION || "0.6.1";
+export const DEFAULT_CORE_VERSION = process.env.DIKW_CORE_VERSION || "0.6.5";
 // MiniMax model name for core's LLM leg. Defaults to the value dikw-web's own
 // agent uses; override with DIKW_CORE_LLM_MODEL if core needs a different name.
 export const LLM_MODEL = process.env.DIKW_CORE_LLM_MODEL || "MiniMax-M3";