I already see the agent’s steps in Cursor or a README. Why Nika?

Seeing the steps is not the same as enforcing the procedure. A README is documentation; a Nika file is an executable contract: versionable, replayable, permission-bound, auditable, and portable off any platform. You do not just read what it intends to do; the runtime holds it to exactly that.

Isn’t this just YAML, or another workflow engine?

The syntax is plain YAML, but the point is not the syntax. The point is the reviewable, enforced plan. The 4 verbs (infer · exec · invoke · agent) are native execution models, each one explicit and typed, with a permits: block the runtime enforces before anything runs. The file is the control surface, not the formatting.

Why not LangGraph, n8n, or MCP (agent tools)?

They live at a different layer. Frameworks help you orchestrate and assistants help an agent act; MCP exposes tools to call. Nika is the contract-and-control layer underneath: it makes the plan reviewable and enforceable, and it runs their tools through invoke, allow-listed and traced. It complements them rather than replacing them.

Does my data leave my machine?

Local-first, any model: fully local, or any API. Run a local model and nothing leaves at all. Every plan declares its network egress in its permits: block, and it is default-deny: omit the hosts and the workflow physically cannot reach the network. The file states exactly what can leave, and the runtime enforces it. 5 of the 17 providers are local.

Is it production-ready? What’s the license?

Honest answer: Nika is early. Real semver toward a 1.0 launch, currently at v0.111.0, shipping in the open. It is one Rust binary you can install and run today. The engine is AGPL-3.0-or-later; the spec is Apache-2.0. We would rather you trust the spec and the binary than a maturity claim we have not earned yet.

{"invoice-chaser":"nika: invoice-chaser\n\nmodel: ollama/qwen3.5:4b   # local · zero key · swap for groq/llama-3.3-70b (drafting is a fast-model job)\n\nconst:\n  ledger_csv: \"examples/fixtures/invoices.csv\"\npermits:\n  tools: [\"nika:convert\", \"nika:jq\", \"nika:prompt\", \"nika:read\", \"nika:write\"]\n  fs:\n    # Two files, both spelled out — `const.ledger_csv` in, the drafts file\n    # out. A const is baked in and a run cannot move it, so the boundary is\n    # exact: no glob, and nothing else on disk is reachable either way.\n    read: [\"examples/fixtures/invoices.csv\"]\n    write: [\"out/reminders-to-send.md\"]\n\ntasks:\n  ledger:\n    invoke:\n      tool: \"nika:read\"\n      args: { path: \"${{ const.ledger_csv }}\" }\n\n  rows:\n    with:\n      csv: ${{ tasks.ledger.output }}\n    invoke:\n      tool: \"nika:convert\"\n      args:\n        input: \"${{ with.csv }}\"\n        from: csv\n        to: json\n        has_header: true\n\n  overdue:\n    with:\n      rows: ${{ tasks.rows.output }}\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: \"${{ with.rows }}\"\n        expression: 'map(select(.status == \"overdue\"))'\n\n  drafts:\n    with:\n      overdue: ${{ tasks.overdue.output }}\n    when: ${{ size(with.overdue) > 0 }}\n    infer:\n      max_tokens: 900       # a ceiling makes the cost report a number, not UNBOUNDED\n      prompt: |\n        Draft one short, polite payment reminder email per overdue invoice ·\n        ${{ with.overdue }}\n        Markdown · one section per client · firm but warm.\n\n  approve:\n    with:\n      drafts: ${{ tasks.drafts.output }}\n    when: ${{ with.drafts != null && size(with.drafts) > 0 }}   # nothing drafted — OR an empty answer (a thinking seat can spend the budget in its think block) · nothing to approve\n    invoke:\n      tool: \"nika:prompt\"\n      args:\n        message: \"Save the reminder drafts for sending?\"\n        default: false\n\n  save:\n    with:\n      drafts: ${{ tasks.drafts.output }}\n      approved: ${{ tasks.approve.output }}\n    when: ${{ with.drafts != null && size(with.drafts) > 0 && with.approved == true }}   # skipped (null) OR empty drafts → never write a 0-byte deliverable under a green run\n    invoke:\n      tool: \"nika:write\"\n      args:\n        path: out/reminders-to-send.md\n        create_dirs: true\n        content: \"${{ with.drafts }}\"\n\noutputs:\n  overdue:\n    value: ${{ tasks.overdue.output }}\n    description: \"The overdue rows the reminders were drafted for\"\n","deep-research-brief":"nika: deep-research-brief\n\nmodel: ollama/qwen3.5:4b   # local · zero key · `--model mock/echo` rehearses the whole file\n\ninputs:\n  topic:\n    type: string\n    default: \"local-first AI runtimes\"\n    description: \"What to research · free text (--var topic=…), and it never touches a path directly\"\n\npermits:\n  tools: [\"nika:done\", \"nika:fetch\", \"nika:jq\", \"nika:write\"]\n  net:\n    # There is no `*` here and there never will be: `net.http` entries are exact\n    # host names. An agent told to « research the web » therefore cannot — the\n    # corpus it may reach is a decision taken HERE, before the loop starts,\n    # rather than discovered afterwards in a trace. Add the sources you actually\n    # trust; the agent's fetch is judged against this list at RUN, and `check`\n    # cannot see it coming because the agent chooses its own URLs.\n    http:\n      - \"arxiv.org\"\n      - \"export.arxiv.org\"\n      - \"en.wikipedia.org\"\n      - \"hn.algolia.com\"\n  fs:\n    # One brief per topic, written DIRECTLY in ./research/. `*` matches a single\n    # segment and never crosses `/`, so even a slug that somehow kept a slash is\n    # refused rather than steered into a subtree — `./research/**` would let it\n    # through. The slug task below makes that doubly hard; the wall makes it\n    # impossible, and only one of the two is a guarantee.\n    write: [\"./research/*.md\"]\n\ntasks:\n  # The topic is free text — « Local-First AI Runtimes: a survey/2026 » — and it\n  # ends up in a filename. Deriving the slug in jq keeps that arithmetic out of\n  # the model AND out of the path: the expression is total, so there is no input\n  # for which it returns something containing a separator.\n  slug:\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: \"${{ inputs.topic }}\"\n        expression: 'ascii_downcase | gsub(\"[^a-z0-9]+\"; \"-\") | gsub(\"^-|-$\"; \"\")'\n\n  plan:\n    infer:\n      max_tokens: 400              # planning is short · cap it and the cost report is a ceiling\n      prompt: \"Break '${{ inputs.topic }}' into 4 sharp research queries · no overlap.\"\n      schema:\n        # `additionalProperties: false` on every object node — without it the\n        # shape is a suggestion and each provider answers with a slightly\n        # different object. `plan.output.queries` is read below, so it has to be\n        # a promise, not a hope.\n        type: object\n        additionalProperties: false\n        required: [queries]\n        properties:\n          queries:\n            type: array\n            items: { type: string }\n\n  investigate:\n    with:\n      queries: ${{ tasks.plan.output.queries }}\n    agent:\n      system: |\n        You are a rigorous researcher. Work the queries one by one · fetch\n        sources · keep verbatim quotes · note what each source actually\n        supports, and what it does not. If a fetch is refused, record that the\n        source was out of bounds rather than substituting another.\n        Call nika:done when the plan is exhausted.\n      prompt: \"Research plan · ${{ with.queries }}\"\n      tools:\n        # Every id here must also appear in `permits.tools` above — `check`\n        # refuses the mismatch statically (NIKA-SEC-004 · agent tool … is\n        # outside permits.tools). Note what is NOT granted: `nika:write`. The\n        # agent's product is the typed object it returns, so it never needs a\n        # file of its own, and the workflow keeps the only pen in the room.\n        - \"nika:fetch\"                 # the corpus named in permits.net.http\n        - \"nika:done\"                  # the loop-completion sentinel\n      max_turns: 25                    # the leash · a loop that cannot end is a bill\n      max_tokens_total: 150000         # and the second leash, in tokens\n      schema:\n        type: object\n        additionalProperties: false\n        required: [findings, sources]\n        properties:\n          findings:\n            type: array\n            items: { type: string }\n          sources:\n            type: array\n            items: { type: string }\n\n  brief:\n    with:\n      findings: ${{ tasks.investigate.output.findings }}\n      sources: ${{ tasks.investigate.output.sources }}\n    infer:\n      max_tokens: 2000\n      prompt: |\n        Findings · ${{ with.findings }}\n        Sources · ${{ with.sources }}\n        Write the executive brief · what's true · what's contested · what it\n        means · what to do. Two pages max. Anything the sources do not support\n        goes in « contested », never in « true ».\n      thinking:\n        # A reasoning budget, honoured by seats that support extended thinking\n        # and ignored by the ones that do not — declaring it never fails a run.\n        enabled: true\n        budget_tokens: 8000\n\n  save:\n    with:\n      slug: ${{ tasks.slug.output }}\n      brief: ${{ tasks.brief.output }}\n    invoke:\n      tool: \"nika:write\"\n      args:\n        path: \"./research/${{ with.slug }}.md\"\n        content: \"${{ with.brief }}\"\n        create_dirs: true\n\noutputs:\n  brief: ${{ tasks.brief.output }}\n  sources:\n    value: ${{ tasks.investigate.output.sources }}\n    description: \"Every source the agent actually used\"\n  slug:\n    value: ${{ tasks.slug.output }}\n    description: \"The filename stem the brief landed under · ./research/<slug>.md\"\n","localization-factory":"nika: localization-factory\n\nmodel: ollama/qwen3.5:4b   # local default · swap for mistral/mistral-large (EU model for EU locales)\n\nconst:\n  lang: \"fr\"\n  # The committed rehearsal tree. Point this at ./docs (or wherever yours\n  # lives) and change `permits.fs.read` to match, in the same edit.\n  source_root: \"./examples/fixtures/docs\"\n\npermits:\n  tools: [\"nika:glob\", \"nika:jq\", \"nika:read\", \"nika:write\"]\n  fs:\n    # `nika:glob` opens the ROOT of its pattern, so the bound has to cover\n    # the directory AND everything under it — `**` does both (it matches the\n    # dir itself and any descendant at any depth). A bound naming only the\n    # `.md` files refuses the glob before it lists anything:\n    # `NIKA-SEC-004 · ./examples/…/docs resolves outside permits.fs.read`.\n    read: [\"./examples/fixtures/docs/**\"]\n    # The mirror is as deep as the source tree, so this one earns its `**`:\n    # every locale lands under ./i18n/ and nothing lands outside it. Naming\n    # the locale (`./i18n/fr/**`) would be tighter but would have to be\n    # re-edited for every value of `const.lang` — the bound is the tree the\n    # factory owns.\n    write: [\"./i18n/**\"]\n\ntasks:\n  # ── the collection is discovered, never declared ────────────────────\n  files:\n    invoke:\n      tool: \"nika:glob\"\n      args:\n        pattern: \"${{ const.source_root }}/**/*.md\"\n        exclude: [\"**/node_modules/**\"]\n\n  # ── stage 1 · read every file, 8 at a time ─────────────────────────\n  texts:\n    with:\n      files: ${{ tasks.files.output }}\n    for_each:\n      items: ${{ with.files }}\n      max_parallel: 8                    # local disk · the only cost is file handles\n    invoke:\n      tool: \"nika:read\"\n      args: { path: \"${{ item }}\" }\n\n  # ── the zip · path + text, and the source root comes off ───────────\n  # `texts` is an array in the SAME ORDER as `files`, so transpose pairs\n  # them index-for-index. `ltrimstr` makes each path relative to the source\n  # root — that stripped path is what the mirror tree is built from.\n  pairs:\n    with:\n      files: ${{ tasks.files.output }}\n      texts: ${{ tasks.texts.output }}\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: [\"${{ with.files }}\", \"${{ with.texts }}\"]\n        expression: >-\n          transpose\n          | map({ path: (.[0] | ltrimstr(\"${{ const.source_root }}/\")), text: .[1] })\n\n  # ── stage 2 · translate every file, 3 at a time ────────────────────\n  translated:\n    with:\n      pairs: ${{ tasks.pairs.output }}\n    for_each:\n      items: ${{ with.pairs }}\n      max_parallel: 3                    # rate-limit the provider, not the disk\n      fail_fast: false                   # finish the batch · one bad file is not a batch failure\n    on_error:\n      recover: null                    # null holds the index open so the zip below stays aligned\n    infer:\n      max_tokens: 4000                 # a doc page, not a book · the cost ceiling is a real number\n      prompt: |\n        Translate to ${{ const.lang }} · keep the markdown structure, leave\n        code blocks untouched, and keep the original tone ·\n        ${{ item.text }}\n\n  # ── the fan-in · drop the files that failed, keep their paths ──────\n  # Second transpose, same law: `translated` is index-aligned with `pairs`\n  # because `recover: null` filled the failures in place. `select(.[1] !=\n  # null)` is where a failed translation leaves the batch — by VALUE, after\n  # the fact, not by aborting the fan-out.\n  bundle:\n    with:\n      pairs: ${{ tasks.pairs.output }}\n      translated: ${{ tasks.translated.output }}\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: [\"${{ with.pairs }}\", \"${{ with.translated }}\"]\n        expression: >-\n          transpose\n          | map(select(.[1] != null))\n          | map({ path: .[0].path, text: .[1] })\n\n  # ── stage 3 · write the mirror ─────────────────────────────────────\n  mirror:\n    with:\n      bundle: ${{ tasks.bundle.output }}\n    for_each:\n      items: ${{ with.bundle }}\n      max_parallel: 8\n    invoke:\n      tool: \"nika:write\"\n      args:\n        path: \"./i18n/${{ const.lang }}/${{ item.path }}\"\n        content: \"${{ item.text }}\"\n        create_dirs: true              # the mirror's subdirectories do not exist yet\n\noutputs:\n  translated:\n    value: ${{ tasks.bundle.output }}\n    description: \"Every file that made it through, as {path, text} · the mirror's manifest\"\n"}

[ INTENT AS CODE ]

Your agent writes the workflow. Nika reads it back.

The checked workflow language for AI: audited before a token is spent, every fix named (the typo, the unbounded cost, the permit wider than the code), with a verifiable receipt after every run. The runtime enforces the file as a contract: permits default-deny, the trace hash-chained, cost capped.

The checked workflow language for AI: audited before a token is spent, a receipt after every run. The file is a contract the runtime enforces.

See it runtry it in your browseror in VS Code / Cursor

v0.111.0macOS · LinuxAGPL-3.0

see it run

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b45# the file IS the blast radius6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:write" ]910tasks:11  notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }12  inbox: { ◆invoke: { tool: "nika:read", args: { path: ./notes/inbox.md } } }13  calendar: { ◆invoke: { tool: "nika:read", args: { path: ./notes/calendar.md } } }1415  triage:16    with:17      inbox: ${{ tasks.inbox.output }}18    ◇infer: { prompt: "Flag what is urgent: ${{ with.inbox }}", max_tokens: 300 }19  agenda:20    with:21      calendar: ${{ tasks.calendar.output }}22    ◇infer: { prompt: "Plan the day around: ${{ with.calendar }}", max_tokens: 300 }2324  draft:25    with:26      notes: ${{ tasks.notes.output }}27      triage: ${{ tasks.triage.output }}28      agenda: ${{ tasks.agenda.output }}29    ◇infer:30      prompt: "Write the morning brief. Notes: ${{ with.notes }} Urgent: ${{ with.triage }} Plan: ${{ with.agenda }}"31      max_tokens: 5003233  save:34    with:35      draft: ${{ tasks.draft.output }}36    ◆invoke:37      tool: "nika:write"38      args: { path: ./brief.md, content: "${{ with.draft }}" }3940outputs:41  brief: "${{ tasks.draft.output }}"

source

audited · 7 tasks · 4 waves · permits declarednika 0.111.0

nika check: audited · 7 tasks · 4 waves · permits declarednika 0.111.0

[ THE READING ]

The file, read back.

An agent’s draft, two keystrokes early. Step through what the checker saw before a token was spent, then the repair: applied by the engine itself, not by hand.

two keystrokes · 3 findings · zero tokens spent

error:CONFORMNIKA-DAG-002

unknown dependency: task judge depends on dif, which does not exist — did you mean diff?

begin snippet for pr-review.broken.nika.yaml at line 19, column 16

19      changes: ${{ tasks.dif.output }}

━

helpnika explain NIKA-DAG-002

the first keystroke: a reference to a task that does not exist, and the checker names what you meant

Watch the file become the run.

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b45# the file IS the blast radius6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:write" ]910tasks:11  notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }12  inbox: { ◆invoke: { tool: "nika:read", args: { path: ./notes/inbox.md } } }13  calendar: { ◆invoke: { tool: "nika:read", args: { path: ./notes/calendar.md } } }1415  triage:16    with:17      inbox: ${{ tasks.inbox.output }}18    ◇infer: { prompt: "Flag what is urgent: ${{ with.inbox }}", max_tokens: 300 }19  agenda:20    with:21      calendar: ${{ tasks.calendar.output }}22    ◇infer: { prompt: "Plan the day around: ${{ with.calendar }}", max_tokens: 300 }2324  draft:25    with:26      notes: ${{ tasks.notes.output }}27      triage: ${{ tasks.triage.output }}28      agenda: ${{ tasks.agenda.output }}29    ◇infer:30      prompt: "Write the morning brief. Notes: ${{ with.notes }} Urgent: ${{ with.triage }} Plan: ${{ with.agenda }}"31      max_tokens: 5003233  save:34    with:35      draft: ${{ tasks.draft.output }}36    ◆invoke:37      tool: "nika:write"38      args: { path: ./brief.md, content: "${{ with.draft }}" }3940outputs:41  brief: "${{ tasks.draft.output }}"

audited · 7 tasks · 4 waves · permits declarednika 0.111.0

[ 01 ]run together ×3

notesinvokenika:read✓ 2ms

inboxinvokenika:read✓ 0ms

calendarinvokenika:read✓ 0ms

[ 02 ]run together ×2

triageinferollama/llama3.2:3b✓ 4.5s

agendainferollama/llama3.2:3b✓ 10.3s

[ 03 ]then

draftinferollama/llama3.2:3b✓ 6.5s

[ 04 ]then

saveinvokenika:write✓ 0ms

daily-brief.nika.yaml

nika run daily-brief.nika.yaml

workflow daily-brief

scheduled 7 tasks · notes inbox calendar triage agenda draft save

notes invoke · nika:read

notes 2ms

inbox invoke · nika:read

inbox 0ms

calendar invoke · nika:read

calendar 0ms

triage infer · ollama/llama3.2:3b

triage 4.5s · 122 tok

agenda infer · ollama/llama3.2:3b

agenda 10.3s · 300 tok

draft infer · ollama/llama3.2:3b

draft 6.5s · 315 tok

save invoke · nika:write

save 0ms

run complete · exit 0 · 16.8s

✓ exit 07 tasks ran16.8swrote brief.md$0.00localollama/llama3.2:3b

recorded · nothing staged

recorded from a real nika run · replayed by your scroll · nothing staged

01.1

Press play. It really ran.

The same file, executed by the engine with a local model on a real machine. What you watch is the recorded event stream.

daily-brief.nika.yaml

nika run daily-brief.nika.yaml

workflow daily-brief

scheduled 7 tasks · notes inbox calendar triage agenda draft save

notes invoke · nika:read

notes 2ms

inbox invoke · nika:read

inbox 0ms

calendar invoke · nika:read

calendar 0ms

triage infer · ollama/llama3.2:3b

triage 4.5s · 122 tok

agenda infer · ollama/llama3.2:3b

agenda 10.3s · 300 tok

draft infer · ollama/llama3.2:3b

draft 6.5s · 315 tok

save invoke · nika:write

save 0ms

run complete · exit 0 · 16.8s

✓ exit 07 tasks ran16.8swrote brief.md$0.00 · ollama/llama3.2:3b

recorded from a real nika run · replayed at reading pace · nothing staged

01.2

One file. A plan you can read.

The engine derives the order from the wiring: a with: binding is a data edge, an after: entry a control edge. Steps with no edge between them run together. Nothing runs that is not written in the file.

[ 01 ]run together ×3

notesinvokenika:read✓ 2ms

inboxinvokenika:read✓ 0ms

calendarinvokenika:read✓ 0ms

[ 02 ]run together ×2

triageinferollama/llama3.2:3b✓ 4.5s

agendainferollama/llama3.2:3b✓ 10.3s

[ 03 ]then

draftinferollama/llama3.2:3b✓ 6.5s

[ 04 ]then

saveinvokenika:write✓ 0ms

durations recorded from the real run · hover a step to trace its wires

[ THE BOUNDARY ]

What it's allowed to touch.

The permits: block is part of the file you review. It is the whole list. Everything not on it is denied by default, before it runs. The full reference · families, secrets, the always-on floor · lives at /boundary.

daily-brief.nika.yaml · lines 6–8

6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:write" ]

the same file as above · the permits block, verbatim

don't write it by hand:nika check --infer-permitsprints the tightest boundary the plan needs. Paste it in, loosen it yourself, or leave it strict.

fs:which files it may read and write
tools:which tools it may call

if a step reaches outside the list, say

✗write ~/.ssh/config   NIKA-SEC-004

effect outside the declared permits: capability boundary. Blocked before it runs, never logged after the fact. (An example: the recorded run above stayed in bounds, exit 0.)

the written law · numbered, public, reviewable

NEP-0003an absent permits: block declares zero authority
NEP-0004untrusted values re-gate under permits, at the effect
NEP-0005a child’s environment is composed, never inherited
NEP-0006a fetch of a code-bearing artifact is never innocent
NEP-0007the trace carries a permit witness · check and run agree
NEP-0008the egress proxy is the permit’s exact projection
NEP-0009a path grant names a path identity, re-judged at dispatch

the full set lives in the spec’s governance register · proposals, numbered and versioned, before they bind the engine

4 verbs · locked forever
28 builtins
17 providers · local-first
one Rust binary
AGPL-3.0 forever
supernovae-st/nika
every claim, one graph · /map

Chats evaporate. Files compound. The prompts you perfect, the steps an agent improvises: gone with the session. Nika turns that work into a file: readable, versioned, runnable.

daily-brief.nika.yamlsource

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b45# the file IS the blast radius6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:write" ]910tasks:11  notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }12  inbox: { ◆invoke: { tool: "nika:read", args: { path: ./notes/inbox.md } } }13  calendar: { ◆invoke: { tool: "nika:read", args: { path: ./notes/calendar.md } } }1415  triage:16    with:17      inbox: ${{ tasks.inbox.output }}18    ◇infer: { prompt: "Flag what is urgent: ${{ with.inbox }}", max_tokens: 300 }19  agenda:20    with:21      calendar: ${{ tasks.calendar.output }}22    ◇infer: { prompt: "Plan the day around: ${{ with.calendar }}", max_tokens: 300 }2324  draft:25    with:26      notes: ${{ tasks.notes.output }}27      triage: ${{ tasks.triage.output }}28      agenda: ${{ tasks.agenda.output }}29    ◇infer:30      prompt: "Write the morning brief. Notes: ${{ with.notes }} Urgent: ${{ with.triage }} Plan: ${{ with.agenda }}"31      max_tokens: 5003233  save:34    with:35      draft: ${{ tasks.draft.output }}36    ◆invoke:37      tool: "nika:write"38      args: { path: ./brief.md, content: "${{ with.draft }}" }3940outputs:41  brief: "${{ tasks.draft.output }}"

audited · 7 tasks · 4 waves · permits declarednika 0.111.0

the session ends · the file stays

Seeing the steps is not the same as enforcing them. Here is what each black box trades away.

Chat sessions

Great for exploring
Gone when the tab closes
Different answer every time

A file you keep

Runs again tomorrow
Same steps, same order
Diff it like code

Glue scripts

200 lines of Python + retries
One person understands it
Breaks when an API changes

Four verbs

The YAML is the logic
Anyone can read it
Engine handles retries & order

Cloud automations

Runs on their servers
Per-seat, per-run pricing
Your data leaves the building

Your machine

One binary, runs local
Free, AGPL forever
Nothing leaves unless you say so

The run explains itself.

One file ran once: audited before it started, storyboarded while it ran, replayable after it ended. Every frame below is real output of the real binary, captured on a terminal against committed fixtures. Offline, on the mock model, for zero dollars. How the proof works · graph, receipt, conformance · lives at /proof.

recorded from a real nika run · replayed at reading pace · nothing staged

Terminal capture of nika check on the signature workflow: the audit ladder passes with a cost floor warning and one permits hint, rc=0. — the pre-flight ladder: plan · cost · secrets · types · tools · args · schema · permits, then one hint. rc=0.

What an agent can do. Declared, not hidden.

Four verbs are the only native execution models. Every action explicit and typed, never improvised from a hidden prompt. Everything callable is a tool under invoke, and tools are allow-listed. Everything about ordering is the plan: which tasks wait on which. No fifth verb, ever.

5.1infer

Think. Ask any model · local or cloud.

5.1.1 providers5.1.2 structured output5.1.3 local models

think.nika.yamlsource

1# the infer verb alone · one bounded model call2nika: think3model: ollama/llama3.2:3b4⛨permits: {}5tasks:6  summarize:7    ◇infer:8      prompt: "Three risks in this release, ranked"9      max_tokens: 2561011outputs:12  summary: ${{ tasks.summarize.output }}

5.2exec

Run. A shell command, captured and typed.

5.2.1 capture & exit codes5.2.2 retry · timeout5.2.3 permitted programs

run.nika.yamlsource

1# the exec verb alone · one program, argv form, allowlisted2nika: run3⛨permits:4  ⛨exec: ["cargo"]5tasks:6  build:7    ▷exec:8      command: ["cargo", "build", "--release"]

5.3invoke

Use a tool. Fetch a page, write a file, call GitHub. Every tool explicit.

5.3.1 builtins5.3.2 extract modes5.3.3 MCP servers

use-a-tool.nika.yamlsource

1# the invoke verb alone · one tool call under the two-part grant2nika: use-a-tool3⛨permits:4  ⛨tools: ["nika:fetch"]5  ⛨net: { http: ["nika.sh"] }6tasks:7  page:8    ◆invoke:9      tool: "nika:fetch"10      args: { url: "https://nika.sh" }

5.4agent

Delegate. An autonomous loop, on a leash you can read.

5.4.1 tool allow-list5.4.2 max turns5.4.3 the human gate

delegate.nika.yamlsource

1# the agent verb alone · goal + tool whitelist, loop bounded2nika: delegate3model: ollama/llama3.2:3b4⛨permits:5  ⛨tools: ["nika:read", "nika:fetch"]6  ⛨net: { http: ["nika.sh"] }7  ⛨fs:8    ⛨read: ["./docs/*"]9tasks:10  audit:11    ✦agent:12      prompt: "Find every dead link in ./docs"13      tools: [ "nika:read", "nika:fetch" ]14      max_tokens_total: 81921516outputs:17  report: ${{ tasks.audit.output }}

infer ◇ · exec ▷ · invoke ◆ · agent ✦ · the whole operation space, declared in one file

What an agent can be permitted to use.

The language stays four verbs. The standard library does the rest: 28 builtins, 17 model providers, and any of your agent tools (MCP servers) your editor already uses. All reached the same way: invoke:, and none of it runs unless the file's permits: allows it.

0128builtin tools · nothing to install

0217model providers · 5 local, 11 cloud, 1 mock

039extract modes on fetch

04MCPnativeyour agent tools (MCP) · any server, via the same verb

BuiltinsThe everyday tools. All called with invoke:.28 tools · 4 families

Files· 5

read· read a filewrite· save a fileedit· patch a fileglob· find filesgrep· search text

Data· 9

jq· transform JSONconvert· between formatsvalidate· check a schemajson_diff· what changedjson_merge_patch· merge JSONcompose· chain toolshash· fingerprint datauuid· fresh iddate· now · parse · format

Web· 1

fetch· get a page · 9 extract modes

Flow· 13

assert· check a conditiondone· end the loopwait· pauseemit· send an eventlog· say somethingnotify· ping a humanprompt· ask a humaninspect· debug a valuechart· see the docsdecide· see the docsimage_fx· see the docsimage_generate· see the docstts_generate· see the docs

ProvidersPick per task or per file. provider: ollama runs offline.17 total

Local runtimes· 5 · no cloud needed

OllamaLM Studiollama.cppLocalAIvLLM

Cloud · open-weight first· 11

MistralAnthropicOpenAIGeminiDeepSeekxAIGroqOpenRouterhuggingfacenvidiamoonshot

Test· 1

mock· deterministic · zero keys · CI-runnable

Extract modesHow fetch turns a page into typed output.9 modes

articlefeedjqlinksmarkdownmetadataselectorsitemaptext

MCPAny of your agent tools (MCP servers), reached as mcp:.native · unbounded

mcp:· the server your editor already usesstdiohttpdefault-deny· tools whitelisted in the file

every count derives from the spec's canon.yaml · never hand-typed

The catalog. What the released binary knows.

Every seat nika can hold ships inside the binary: models, prices, measured energy, MCP servers. This site vendors those tables from the engine at v0.111.0 and gives every member a room you can open · each number below derives from the vendored bytes, none is typed.

Walk the whole register · /catalog

Not another agent framework. The layer underneath.

Frameworks and assistants help an agent decide and act. Nika is orthogonal: it makes what the agent does reviewable and enforceable the layer between the model wants to act and the system lets it act.

FrameworksLangGraph, n8n: they help you wire and orchestrate the steps.: Nika makes the wired steps a reviewable, enforceable file, not glue code.
AssistantsCursor, Claude Code: they help an agent decide and act in the moment.: Nika turns that intent into a plan you review and the runtime enforces.
Protocols & toolsYour agent tools (MCP servers) expose capabilities an agent can call.: Nika runs them through invoke: allow-listed, permission-bound, traced.

Run a Nika plan from any of them. It's a portable file, not a platform.

nika: standup-digest

model: ollama/qwen3.5:4b   # local · zero key · swap for groq/llama-3.3-70b (a fast one-liner job)

permits:
  exec: ["git"]              # the ONE program this workflow may run
  tools: ["nika:date", "nika:write"]
  fs: { write: ["out/standup-note.md"] }

tasks:
  # No deps between these two → the engine runs them in parallel.
  today:
    invoke:
      tool: "nika:date"
      args: { op: now }

  history:
    exec:
      command: ["git", "log", "--since=yesterday", "--oneline", "--no-merges"]

  digest:
    with:
      today: ${{ tasks.today.output }}
      history: ${{ tasks.history.output }}
    infer:
      max_tokens: 400          # a standup note is short · the ceiling says so
      prompt: |
        Date · ${{ with.today }}
        Commits since yesterday ·
        ${{ with.history }}

        Write my standup note · 3 bullets · done / doing / blocked.
        Plain words · no fluff. If there are no commits, say so in one line.

  save:
    with:
      digest: ${{ tasks.digest.output }}
    invoke:
      tool: "nika:write"
      args:
        path: out/standup-note.md
        create_dirs: true
        content: "${{ with.digest }}"

outputs:
  note: ${{ tasks.digest.output }}

Real files you'd write.

Anything you'd ask an AI to do more than once belongs in a file. Every workflow below is real, projected from nika-spec, audited before it runs: plan, cost, secrets. Pick your métier, open a card, read the exact YAML that runs it.

Ship faster. Let the boring parts run themselves.

standup-digest.nika.yamlwalkthrough ↗

todayinvokenika:datehistoryexecgit

digestinfer

saveinvokenika:write

yamlsource

1nika: standup-digest23model: ollama/qwen3.5:4b   # local · zero key · swap for groq/llama-3.3-70b (a fast one-liner job)45⛨permits:6  ⛨exec: ["git"]              # the ONE program this workflow may run7  ⛨tools: ["nika:date", "nika:write"]8  ⛨fs: { write: ["out/standup-note.md"] }910tasks:11  # No deps between these two → the engine runs them in parallel.12  today:13    ◆invoke:14      tool: "nika:date"15      args: { op: now }1617  history:18    ▷exec:19      command: ["git", "log", "--since=yesterday", "--oneline", "--no-merges"]2021  digest:22    with:23      today: ${{ tasks.today.output }}24      history: ${{ tasks.history.output }}25    ◇infer:26      max_tokens: 400          # a standup note is short · the ceiling says so27      prompt: |28        Date · ${{ with.today }}29        Commits since yesterday ·30        ${{ with.history }}3132        Write my standup note · 3 bullets · done / doing / blocked.33        Plain words · no fluff. If there are no commits, say so in one line.3435  save:36    with:37      digest: ${{ tasks.digest.output }}38    ◆invoke:39      tool: "nika:write"40      args:41        path: out/standup-note.md42        create_dirs: true43        content: "${{ with.digest }}"4445outputs:46  note: ${{ tasks.digest.output }}47

audited · 4 tasks · 3 waves · permits declarednika 0.111.0

Every morning: the note is already written. You glance, you tweak one word, you go.

27 workflows · four tiers · nika-spec/examples the plan, the typed answers and the tools, all checked before it runs

The file becomes a canvas. Open any `.nika.yaml` in VS Code or Cursor: prompts sit on the cards, a run lights the graph wave by wave, and every canvas edit lands back in the file. This miniature works: press ▶ mock.

release-notes.nika.yaml · canvashover a card; its lineage stays lit

$0.00 ceiling · local model · audited before it runs

release-notes.nika.yaml

nika: release-notes
model: ollama/qwen3.5:4b

tasks:
  fetch_commits:
    invoke:
      tool: "nika:fetch"
      args:
        url: "https://api.github.com/repos/acme/app/commits?since=v1.4.0"

  write_notes:
    with:
      commits: ${{ tasks.fetch_commits.output }}
    infer:
      max_tokens: 800
      prompt: "Write the release notes from ${{ with.commits }}: grouped, human, no hype."

  hero_image:
    after:
      fetch_commits: success
    invoke:
      tool: "nika:image_generate"
      args:
        provider: local
        prompt: "A minimal banner for the v1.5 release"
        aspect_ratio: "16:9"
        output_dir: "media/"

  publish:
    after:
      write_notes: success
      hero_image: success
    exec:
      command: ["gh", "release", "create", "v1.5.0", "--notes-file", "notes.md"]

The engine's judgment, as you type. Diagnostics, completions and hovers come from nika check and the schema: codes, fixes and positions are the binary's, not the extension's. Even this demo file passes the real nika check, exit 0.
Run, replay, scrub. The run streams onto the graph live; any recorded run replays with a time-travel scrubber.
Audited before a token is spent. Cost ceiling, permits boundary and secret flows are static facts on the cards. Read them before you press Run.

Install in VS Code Marketplace Open VSX · Cursor / Windsurf

Shipping in the open.

A workflow language earns trust by moving, and by not breaking what you wrote. Here is the recent ship log: the spec opened, the verbs locked: and the engine shipped, one brew install away.

2026 · 08 · 19release
v0.111.0 · the authoring loop closes
The checker now distinguishes a legal file from one ready to spend: paid_ready goes quiet only when no paid-run hint remains, compiled means the law was proven, and next names the first repair. nika:inspect is live from the first task and follows the run after every wave, so a workflow can read its DAG, records, spend and threads. nika:compose stays inside an agent loop after nika:done, where the model can draft, read the whole check verdict and revise without making check execute the draft. The arm lock now survives the shot, and the paid extract wave repairs structured hashing, string schemas, scalar anyOf coercion and resumed for_each item fields.
2026 · 08 · 18release
v0.109.2 · the nine-key envelope ships
The envelope is nine keys: nika: is the mark and the name, never a version marker. Values come from three authorities (inputs · const · secrets). The first two 0.109 tags died at the release gates before any asset landed; this is the one a visitor can install. Linux builders now install bubblewrap so a permits: file is judged confined, the same way macOS already was.
2026 · 08 · 05release
v0.108.0 · the access layer
The access layer arrives, and the check stops trusting what it cannot read. From this tag, model: picks the intelligence and access picks the path: the admission-time resolver is a pure function with a strict sovereign order (local · mock · harness · oauth · api), enumeration order can never change the outcome, and every dropped candidate carries its witness: the dimension, the layer, the teaching line. --access pins the path at the launch gates, before a token is spent: unsatisfied refuses, never substitutes. The ACP harness class lands with its mock agent in a quarantined workspace, proving the wire with no vendor in the loop. And the security fix that taught the train its lesson: a shell-string exec with no permits passed check green. The verifiable argv door refused while the unverifiable shell door stood open, the exact inversion of a security gate. The exec capability is now required whatever the spelling, and the runtime deferral owns dynamic values, never the door itself.
2026 · 08 · 02release
v0.107.2 · the adversarial pass
An adversary was set on 0.107.1’s six boundaries with one instruction, break it. Three of six claims fell, and hunting what the first repairs still let through found four more · every fix proven on the binary before the code was touched, each carrying the mutation that makes it fail. Two doors were open: a permit could name a system root by shouting it (/ROOT/x* passed where /root/./x* refused: macOS folds case, so the comparison does now, and the Linux side can only ever refuse a path that does not exist), and a secret redacted in the trace was printed on stdout (outputs: rides RunOutcome past the event lane · the map is scrubbed at any depth now). Three guards judged less than they claimed: the dangerous-environment floor is proven entry by entry (forty names, both halves pinned), a tainted nika:notify target is judged whatever channel carries it, and the run guard speaks only about runs (an unreadable payload no longer blocks ls). And one law had two implementations: the MCP spawn now composes its child environment through the same function as the exec runner · the copy was equivalent, and equivalence was exactly what nothing guaranteed.

Full changelog

The control is the proof.

No logos to borrow, no quotes to dress up. Just what the engine guarantees: review before it acts · enforced permissions · hash-chained trace · priced before it spends · crash-resume without a server · portable off any platform: verifiable in the open spec and the one binary you install.

9.14verbs · every action explicit, declared not hidden

9.228builtin tools · allow-listed, nothing to install

9.317/5 localmodel providers · any model, cloud or fully offline

9.41Rust binary · zero daemons, zero background services

Review before it acts.: The agent writes its plan as a file first: every step, tool and permission. A human reads it before a single action runs.
Enforced permissions.: The file's permits: block is the blast radius: files, hosts, programs, tools. The runtime denies anything outside it (5 local providers mean PII never has to leave).
Replayable trace.: Every run leaves a hash-chained NDJSON trace: every task, and every agent tool call, in the same chain · nika trace verify walks it and names the first broken link. Same file, same steps, same order: run it again and diff it like code.
Portable off any platform.: One binary, 17 model providers, AGPL-3.0 forever. The file outlives the vendor. It still runs the day the company that made it is gone.
Priced before it spends.: nika check prints the plan’s cost floor before a token is spent, and --max-cost-usd is a hard ceiling: a plan whose floor exceeds it never starts.
Crash-resume without a server.: The trace a run already writes is the checkpoint · --resume is a reader of a file, not a client of a run-store: no supervisor, no database. Two hashes decide skip-or-rerun, recorded work replays instead of re-calling the model, and a cache hit is never silent.

A README is documentation. Nika is an executable contract.

every number derives from the spec's canon.yaml · verifiable, never hand-typed · every repo file declares its provenance in estate.yaml · authored or generated, hashed

Get started.

One binary, one file, one command. Install it, write a plan, run it, and watch it print the plan, check the permits, and stay within bounds.

Install
One Rust binary. Homebrew on macOS, or the install script anywhere.
brew install supernovae-st/tap/nika
curl -LsSf https://nika.sh/install.sh | sh
Installed? See a workflow work before anything else · offline, zero keys, nothing written:
nika try 01-hello

Write a file

A plan is plain YAML: the steps, the verbs, the wiring. This is the same file the page just ran, opened at its first step.

daily-brief.nika.yaml · excerptsource

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b4…5⛨permits:6  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }7  ⛨tools: [ "nika:read", "nika:write" ]8…9  ⛨notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }

audited · 7 tasks · 4 waves · permits declarednika 0.111.0

real lines, sliced from the file above · read-only

Run it
Point the binary at the file. It prints the plan, checks the permits, and runs within bounds. Every step traced and replayable.
nika run daily-brief.nika.yaml

runs everywhere · same file, same result

6.0.4 In your terminal

One Rust binary. The command is the button: click it, paste it, run.

6.0.5 In your editor

The nika-lang extension: the file as a content-first canvas. Run it live, replay it, audit it before a token is spent, with engine-true diagnostics and completions, in VS Code, Cursor and Windsurf.

VS Code Marketplace Open VSX · Cursor / Windsurf

6.0.6 With your agent

nika init writes AGENTS.md · nika wire claude|cursor adds the read-only oracle (nika_check · nika_explain).

docs.nika.sh

WORKS WITH YOUR STACK

Claude Code · Codex · Cursor · VS Code · Hermes · OpenCode · Zed · GitHub Actions · MCP

nika init teaches whatever agent you run. the full integrations map

Learn it in 5 minutes

Questions, answered straight.

The real objections, and honest answers. No overclaiming, no dunking on the tools you already use.

I already see the agent’s steps in Cursor or a README. Why Nika?
Seeing the steps is not the same as enforcing the procedure. A README is documentation; a Nika file is an executable contract: versionable, replayable, permission-bound, auditable, and portable off any platform. You do not just read what it intends to do; the runtime holds it to exactly that.
Isn’t this just YAML, or another workflow engine?
The syntax is plain YAML, but the point is not the syntax. The point is the reviewable, enforced plan. The 4 verbs (infer · exec · invoke · agent) are native execution models, each one explicit and typed, with a permits: block the runtime enforces before anything runs. The file is the control surface, not the formatting.
Why not LangGraph, n8n, or MCP (agent tools)?
They live at a different layer. Frameworks help you orchestrate and assistants help an agent act; MCP exposes tools to call. Nika is the contract-and-control layer underneath: it makes the plan reviewable and enforceable, and it runs their tools through invoke, allow-listed and traced. It complements them rather than replacing them.
Does my data leave my machine?
Local-first, any model: fully local, or any API. Run a local model and nothing leaves at all. Every plan declares its network egress in its permits: block, and it is default-deny: omit the hosts and the workflow physically cannot reach the network. The file states exactly what can leave, and the runtime enforces it. 5 of the 17 providers are local.
Is it production-ready? What’s the license?
Honest answer: Nika is early. Real semver toward a 1.0 launch, currently at v0.111.0, shipping in the open. It is one Rust binary you can install and run today. The engine is AGPL-3.0-or-later; the spec is Apache-2.0. We would rather you trust the spec and the binary than a maturity claim we have not earned yet.

the noise becomes the file.

Put your agents on a leash you can read.

Install the binary, write the plan as a file, review what it's allowed to touch, run it. Same file, same result, enforced on your machine. Tomorrow, and the day the vendor is gone.

brew install supernovae-st/tap/nika

Star on GitHub Read the spec Learn it in 5 min

Do you repeat an AI task every week, in ChatGPT, Claude, Cursor, Codex, or scripts? Send it. We convert the best ones into runnable .nika.yaml examples, credited to you.

Send a workflow

Your agent writes the workflow. Nika reads it back.

The file, read back.

Press play. It really ran.

One file. A plan you can read.

What it's allowed to touch.

Chats evaporate. Files compound. The prompts you perfect, the steps an agent improvises: gone with the session. Nika turns that work into a file: readable, versioned, runnable.

The run explains itself.

What an agent can do. Declared, not hidden.

What an agent can be permitted to use.

The catalog. What the released binary knows.

Not another agent framework. The layer underneath.

Real files you'd write.

The file becomes a canvas. Open any .nika.yaml in VS Code or Cursor: prompts sit on the cards, a run lights the graph wave by wave, and every canvas edit lands back in the file. This miniature works: press ▶ mock.

Shipping in the open.

v0.111.0 · the authoring loop closes

v0.109.2 · the nine-key envelope ships

v0.108.0 · the access layer

v0.107.2 · the adversarial pass

The control is the proof.

Get started.

Install

Write a file

Run it

6.0.4 In your terminal

6.0.5 In your editor

6.0.6 With your agent

Questions, answered straight.

Put your agents on a leash you can read.

The file becomes a canvas. Open any `.nika.yaml` in VS Code or Cursor: prompts sit on the cards, a run lights the graph wave by wave, and every canvas edit lands back in the file. This miniature works: press ▶ mock.