I already see the agent’s steps in Cursor or a README. Why Nika?

Seeing the steps is not the same as enforcing the procedure. A README is documentation; a Nika file is an executable contract: versionable, replayable, permission-bound, auditable, and portable off any platform. You do not just read what it intends to do; the runtime holds it to exactly that.

Isn’t this just YAML, or another workflow engine?

The syntax is plain YAML, but the point is not the syntax. The point is the reviewable, enforced plan. The 4 verbs (infer · exec · invoke · agent) are native execution models, each one explicit and typed, with a permits: block the runtime enforces before anything runs. The file is the control surface, not the formatting.

Why not LangGraph, n8n, or MCP (agent tools)?

They live at a different layer. Frameworks help you orchestrate and assistants help an agent act; MCP exposes tools to call. Nika is the contract-and-control layer underneath: it makes the plan reviewable and enforceable, and it runs their tools through invoke, allow-listed and traced. It complements them rather than replacing them.

Does my data leave my machine?

Local-first, any model: fully local, or any API. Run a local model and nothing leaves at all. Every plan declares its network egress in its permits: block, and it is default-deny: omit the hosts and the workflow physically cannot reach the network. The file states exactly what can leave, and the runtime enforces it. 5 of the 17 providers are local.

Is it production-ready? What’s the license?

Honest answer: Nika is early. Real semver toward a 1.0 launch, currently at v0.114.0, shipping in the open. It is one Rust binary you can install and run today. The engine is AGPL-3.0-or-later; the spec is Apache-2.0. We would rather you trust the spec and the binary than a maturity claim we have not earned yet.

{"invoice-chaser":"nika: invoice-chaser\n\nmodel: ollama/qwen3.5:4b   # local · zero key · swap for groq/llama-3.3-70b (drafting is a fast-model job)\n\nconst:\n  ledger_csv: \"examples/fixtures/invoices.csv\"\npermits:\n  tools: [\"nika:convert\", \"nika:jq\", \"nika:prompt\", \"nika:read\", \"nika:write\"]\n  fs:\n    # Two files, both spelled out — `const.ledger_csv` in, the drafts file\n    # out. A const is baked in and a run cannot move it, so the boundary is\n    # exact: no glob, and nothing else on disk is reachable either way.\n    read: [\"examples/fixtures/invoices.csv\"]\n    write: [\"out/reminders-to-send.md\"]\n\ntasks:\n  ledger:\n    invoke:\n      tool: \"nika:read\"\n      args: { path: \"${{ const.ledger_csv }}\" }\n\n  rows:\n    with:\n      csv: ${{ tasks.ledger.output }}\n    invoke:\n      tool: \"nika:convert\"\n      args:\n        input: \"${{ with.csv }}\"\n        from: csv\n        to: json\n        has_header: true\n\n  overdue:\n    with:\n      rows: ${{ tasks.rows.output }}\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: \"${{ with.rows }}\"\n        expression: 'map(select(.status == \"overdue\"))'\n\n  drafts:\n    with:\n      overdue: ${{ tasks.overdue.output }}\n    when: ${{ size(with.overdue) > 0 }}\n    infer:\n      max_tokens: 900       # a ceiling makes the cost report a number, not UNBOUNDED\n      prompt: |\n        Draft one short, polite payment reminder email per overdue invoice ·\n        ${{ with.overdue }}\n        Markdown · one section per client · firm but warm.\n\n  approve:\n    with:\n      drafts: ${{ tasks.drafts.output }}\n    when: ${{ with.drafts != null && size(with.drafts) > 0 }}   # nothing drafted — OR an empty answer (a thinking seat can spend the budget in its think block) · nothing to approve\n    invoke:\n      tool: \"nika:prompt\"\n      args:\n        message: \"Save the reminder drafts for sending?\"\n        default: false\n\n  save:\n    with:\n      drafts: ${{ tasks.drafts.output }}\n      approved: ${{ tasks.approve.output }}\n    when: ${{ with.drafts != null && size(with.drafts) > 0 && with.approved == true }}   # skipped (null) OR empty drafts → never write a 0-byte deliverable under a green run\n    invoke:\n      tool: \"nika:write\"\n      args:\n        path: out/reminders-to-send.md\n        create_dirs: true\n        content: \"${{ with.drafts }}\"\n\noutputs:\n  overdue:\n    value: ${{ tasks.overdue.output }}\n    description: \"The overdue rows the reminders were drafted for\"\n","deep-research-brief":"nika: deep-research-brief\n\nmodel: ollama/qwen3.5:4b   # local · zero key · `--model mock/echo` rehearses the whole file\n\ninputs:\n  topic:\n    type: string\n    default: \"local-first AI runtimes\"\n    description: \"What to research · free text (--var topic=…), and it never touches a path directly\"\n\npermits:\n  tools: [\"nika:done\", \"nika:fetch\", \"nika:jq\", \"nika:write\"]\n  net:\n    # There is no `*` here and there never will be: `net.http` entries are exact\n    # host names. An agent told to « research the web » therefore cannot — the\n    # corpus it may reach is a decision taken HERE, before the loop starts,\n    # rather than discovered afterwards in a trace. Add the sources you actually\n    # trust; the agent's fetch is judged against this list at RUN, and `check`\n    # cannot see it coming because the agent chooses its own URLs.\n    http:\n      - \"arxiv.org\"\n      - \"export.arxiv.org\"\n      - \"en.wikipedia.org\"\n      - \"hn.algolia.com\"\n  fs:\n    # One brief per topic, written DIRECTLY in ./research/. `*` matches a single\n    # segment and never crosses `/`, so even a slug that somehow kept a slash is\n    # refused rather than steered into a subtree — `./research/**` would let it\n    # through. The slug task below makes that doubly hard; the wall makes it\n    # impossible, and only one of the two is a guarantee.\n    write: [\"./research/*.md\"]\n\ntasks:\n  # The topic is free text — « Local-First AI Runtimes: a survey/2026 » — and it\n  # ends up in a filename. Deriving the slug in jq keeps that arithmetic out of\n  # the model AND out of the path: the expression is total, so there is no input\n  # for which it returns something containing a separator.\n  slug:\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: \"${{ inputs.topic }}\"\n        expression: 'ascii_downcase | gsub(\"[^a-z0-9]+\"; \"-\") | gsub(\"^-|-$\"; \"\")'\n\n  plan:\n    infer:\n      max_tokens: 400              # planning is short · cap it and the cost report is a ceiling\n      prompt: \"Break '${{ inputs.topic }}' into 4 sharp research queries · no overlap.\"\n      schema:\n        # `additionalProperties: false` on every object node — without it the\n        # shape is a suggestion and each provider answers with a slightly\n        # different object. `plan.output.queries` is read below, so it has to be\n        # a promise, not a hope.\n        type: object\n        additionalProperties: false\n        required: [queries]\n        properties:\n          queries:\n            type: array\n            items: { type: string }\n\n  investigate:\n    with:\n      queries: ${{ tasks.plan.output.queries }}\n    agent:\n      system: |\n        You are a rigorous researcher. Work the queries one by one · fetch\n        sources · keep verbatim quotes · note what each source actually\n        supports, and what it does not. If a fetch is refused, record that the\n        source was out of bounds rather than substituting another.\n        Call nika:done when the plan is exhausted.\n      prompt: \"Research plan · ${{ with.queries }}\"\n      tools:\n        # Every id here must also appear in `permits.tools` above — `check`\n        # refuses the mismatch statically (NIKA-SEC-004 · agent tool … is\n        # outside permits.tools). Note what is NOT granted: `nika:write`. The\n        # agent's product is the typed object it returns, so it never needs a\n        # file of its own, and the workflow keeps the only pen in the room.\n        - \"nika:fetch\"                 # the corpus named in permits.net.http\n        - \"nika:done\"                  # the loop-completion sentinel\n      max_turns: 25                    # the leash · a loop that cannot end is a bill\n      max_tokens_total: 150000         # and the second leash, in tokens\n      schema:\n        type: object\n        additionalProperties: false\n        required: [findings, sources]\n        properties:\n          findings:\n            type: array\n            items: { type: string }\n          sources:\n            type: array\n            items: { type: string }\n\n  brief:\n    with:\n      findings: ${{ tasks.investigate.output.findings }}\n      sources: ${{ tasks.investigate.output.sources }}\n    infer:\n      max_tokens: 2000\n      prompt: |\n        Findings · ${{ with.findings }}\n        Sources · ${{ with.sources }}\n        Write the executive brief · what's true · what's contested · what it\n        means · what to do. Two pages max. Anything the sources do not support\n        goes in « contested », never in « true ».\n      thinking:\n        # A reasoning budget, honoured by seats that support extended thinking\n        # and ignored by the ones that do not — declaring it never fails a run.\n        enabled: true\n        budget_tokens: 8000\n\n  save:\n    with:\n      slug: ${{ tasks.slug.output }}\n      brief: ${{ tasks.brief.output }}\n    invoke:\n      tool: \"nika:write\"\n      args:\n        path: \"./research/${{ with.slug }}.md\"\n        content: \"${{ with.brief }}\"\n        create_dirs: true\n\noutputs:\n  brief: ${{ tasks.brief.output }}\n  sources:\n    value: ${{ tasks.investigate.output.sources }}\n    description: \"Every source the agent actually used\"\n  slug:\n    value: ${{ tasks.slug.output }}\n    description: \"The filename stem the brief landed under · ./research/<slug>.md\"\n","localization-factory":"nika: localization-factory\n\nmodel: ollama/qwen3.5:4b   # local default · swap for mistral/mistral-large (EU model for EU locales)\n\nconst:\n  lang: \"fr\"\n  # The committed rehearsal tree. Point this at ./docs (or wherever yours\n  # lives) and change `permits.fs.read` to match, in the same edit.\n  source_root: \"./examples/fixtures/docs\"\n\npermits:\n  tools: [\"nika:glob\", \"nika:jq\", \"nika:read\", \"nika:write\"]\n  fs:\n    # `nika:glob` opens the ROOT of its pattern, so the bound has to cover\n    # the directory AND everything under it — `**` does both (it matches the\n    # dir itself and any descendant at any depth). A bound naming only the\n    # `.md` files refuses the glob before it lists anything:\n    # `NIKA-SEC-004 · ./examples/…/docs resolves outside permits.fs.read`.\n    read: [\"./examples/fixtures/docs/**\"]\n    # The mirror is as deep as the source tree, so this one earns its `**`:\n    # every locale lands under ./i18n/ and nothing lands outside it. Naming\n    # the locale (`./i18n/fr/**`) would be tighter but would have to be\n    # re-edited for every value of `const.lang` — the bound is the tree the\n    # factory owns.\n    write: [\"./i18n/**\"]\n\ntasks:\n  # ── the collection is discovered, never declared ────────────────────\n  files:\n    invoke:\n      tool: \"nika:glob\"\n      args:\n        pattern: \"${{ const.source_root }}/**/*.md\"\n        exclude: [\"**/node_modules/**\"]\n\n  # ── stage 1 · read every file, 8 at a time ─────────────────────────\n  texts:\n    with:\n      files: ${{ tasks.files.output }}\n    for_each:\n      items: ${{ with.files }}\n      max_parallel: 8                    # local disk · the only cost is file handles\n    invoke:\n      tool: \"nika:read\"\n      args: { path: \"${{ item }}\" }\n\n  # ── the zip · path + text, and the source root comes off ───────────\n  # `texts` is an array in the SAME ORDER as `files`, so transpose pairs\n  # them index-for-index. `ltrimstr` makes each path relative to the source\n  # root — that stripped path is what the mirror tree is built from.\n  pairs:\n    with:\n      files: ${{ tasks.files.output }}\n      texts: ${{ tasks.texts.output }}\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: [\"${{ with.files }}\", \"${{ with.texts }}\"]\n        expression: >-\n          transpose\n          | map({ path: (.[0] | ltrimstr(\"${{ const.source_root }}/\")), text: .[1] })\n\n  # ── stage 2 · translate every file, 3 at a time ────────────────────\n  translated:\n    with:\n      pairs: ${{ tasks.pairs.output }}\n    for_each:\n      items: ${{ with.pairs }}\n      max_parallel: 3                    # rate-limit the provider, not the disk\n      fail_fast: false                   # finish the batch · one bad file is not a batch failure\n    on_error:\n      recover: null                    # null holds the index open so the zip below stays aligned\n    infer:\n      max_tokens: 4000                 # a doc page, not a book · the cost ceiling is a real number\n      prompt: |\n        Translate to ${{ const.lang }} · keep the markdown structure, leave\n        code blocks untouched, and keep the original tone ·\n        ${{ item.text }}\n\n  # ── the fan-in · drop the files that failed, keep their paths ──────\n  # Second transpose, same law: `translated` is index-aligned with `pairs`\n  # because `recover: null` filled the failures in place. `select(.[1] !=\n  # null)` is where a failed translation leaves the batch — by VALUE, after\n  # the fact, not by aborting the fan-out.\n  bundle:\n    with:\n      pairs: ${{ tasks.pairs.output }}\n      translated: ${{ tasks.translated.output }}\n    invoke:\n      tool: \"nika:jq\"\n      args:\n        input: [\"${{ with.pairs }}\", \"${{ with.translated }}\"]\n        expression: >-\n          transpose\n          | map(select(.[1] != null))\n          | map({ path: .[0].path, text: .[1] })\n\n  # ── stage 3 · write the mirror ─────────────────────────────────────\n  mirror:\n    with:\n      bundle: ${{ tasks.bundle.output }}\n    for_each:\n      items: ${{ with.bundle }}\n      max_parallel: 8\n    invoke:\n      tool: \"nika:write\"\n      args:\n        path: \"./i18n/${{ const.lang }}/${{ item.path }}\"\n        content: \"${{ item.text }}\"\n        create_dirs: true              # the mirror's subdirectories do not exist yet\n\noutputs:\n  translated:\n    value: ${{ tasks.bundle.output }}\n    description: \"Every file that made it through, as {path, text} · the mirror's manifest\"\n"}

[ NIKA · CHECKED WORKFLOWS FOR AI ]

Intent as Code.

No key. No account. No server to keep running. Install the binary, then run the command it prints as next. On v0.114.0 that is nika try 01-hello. It finishes in a second, and says out loud that it was a rehearsal.

No key. No account. No server. Install, then nika try 01-hello.

Install Nika First workflowThe three steps

nika try 01-hello

✔  greet  infer · mock/echo  0ms
rehearsal · a mock model echoed the prompt — not a real answer

v0.114.0macOS · LinuxAGPL-3.0

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b45# the file IS the blast radius6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:assert", "nika:write" ]910tasks:11  notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }12  inbox: { ◆invoke: { tool: "nika:read", args: { path: ./notes/inbox.md } } }13  calendar: { ◆invoke: { tool: "nika:read", args: { path: ./notes/calendar.md } } }1415  triage:16    with:17      inbox: ${{ tasks.inbox.output }}18    ◇infer: { prompt: "Urgent item, 10 words max: ${{ with.inbox }}", max_tokens: 2048 }19  agenda:20    with:21      calendar: ${{ tasks.calendar.output }}22    ◇infer: { prompt: "Three bullets, 8 words max: ${{ with.calendar }}", max_tokens: 2048 }2324  draft:25    with:26      notes: ${{ tasks.notes.output }}27      triage: ${{ tasks.triage.output }}28      agenda: ${{ tasks.agenda.output }}29    ◇infer:30      prompt: "Three bullets, 8 words max. No preface. Notes: ${{ with.notes }} Urgent: ${{ with.triage }} Plan: ${{ with.agenda }}"31      max_tokens: 20483233  verify:34    with:35      draft: ${{ tasks.draft.output }}36    ◆invoke:37      tool: "nika:assert"38      args:39        condition: "${{ size(with.draft) > 0 }}"40        message: "Empty brief. Increase max_tokens or change model."4142  save:43    after: { verify: success }44    with:45      draft: ${{ tasks.draft.output }}46    ◆invoke:47      tool: "nika:write"48      args: { path: ./brief.md, content: "${{ with.draft }}" }4950outputs:51  brief: "${{ tasks.draft.output }}"

source

audited · 8 tasks · 5 waves · permits declared · 2 hintsnika 0.114.0

FIG.01source → checked topology → bounded run → receipt

One file. One inspectable run.

The interface follows the contract.

Nika does not hide an agent behind chat. The source, permissions, live stages and final receipt stay visible in one operational frame.

Run the workflow Inspect the model

01 · constraintsPermitted surface

Declared capabilities bound the possible run.

02 · causalityExecution trace

Every step remains inspectable in order.

03 · proofDurable receipt

Evidence closes around what actually happened.

One source · one bounded path · one replayable receipt.

Nika Studiorelease-review.nika.yaml live · 019fc7e2

sourcechecked

nika: release-review
permits:
  fs.write:
    - out/receipt.md
  tools:
    - nika:read
    - nika:write
tasks:
  review:
    agent: bounded

execution3 / 4

01inferclassify intent1.82s

02invokeread repository184ms

03agentreview boundaryactive

04execwrite receiptqueued

policy heldnetwork · deniedwrite · out/receipt.mdreceipt pending

4 tasks · 3 edges · 2 permitssha256:a73f…e8a2a

A real Nika product composition: source, checked topology, bounded execution and retained proof.

[ THE READING ]

The file, read back.

An agent’s draft, two keystrokes early. Step through what the checker saw before a token was spent, then the repair: applied by the engine itself, not by hand.

two keystrokes · 3 findings · zero tokens spent

error:CONFORMNIKA-DAG-002

unknown dependency: task judge depends on dif, which does not exist — did you mean diff? · → nika explain NIKA-DAG-002

begin snippet for pr-review.broken.nika.yaml at line 19, column 16

19      changes: ${{ tasks.dif.output }}

━

helpnika explain NIKA-DAG-002

the first keystroke: a reference to a task that does not exist, and the checker names what you meant

Watch the file become the run.

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b45# the file IS the blast radius6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:assert", "nika:write" ]910tasks:11  notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }12  inbox: { ◆invoke: { tool: "nika:read", args: { path: ./notes/inbox.md } } }13  calendar: { ◆invoke: { tool: "nika:read", args: { path: ./notes/calendar.md } } }1415  triage:16    with:17      inbox: ${{ tasks.inbox.output }}18    ◇infer: { prompt: "Urgent item, 10 words max: ${{ with.inbox }}", max_tokens: 2048 }19  agenda:20    with:21      calendar: ${{ tasks.calendar.output }}22    ◇infer: { prompt: "Three bullets, 8 words max: ${{ with.calendar }}", max_tokens: 2048 }2324  draft:25    with:26      notes: ${{ tasks.notes.output }}27      triage: ${{ tasks.triage.output }}28      agenda: ${{ tasks.agenda.output }}29    ◇infer:30      prompt: "Three bullets, 8 words max. No preface. Notes: ${{ with.notes }} Urgent: ${{ with.triage }} Plan: ${{ with.agenda }}"31      max_tokens: 20483233  verify:34    with:35      draft: ${{ tasks.draft.output }}36    ◆invoke:37      tool: "nika:assert"38      args:39        condition: "${{ size(with.draft) > 0 }}"40        message: "Empty brief. Increase max_tokens or change model."4142  save:43    after: { verify: success }44    with:45      draft: ${{ tasks.draft.output }}46    ◆invoke:47      tool: "nika:write"48      args: { path: ./brief.md, content: "${{ with.draft }}" }4950outputs:51  brief: "${{ tasks.draft.output }}"

audited · 8 tasks · 5 waves · permits declared · 2 hintsnika 0.114.0

[ 01 ]run together ×3

notesinvokenika:read✓ 2ms

inboxinvokenika:read✓ 0ms

calendarinvokenika:read✓ 1ms

[ 02 ]run together ×2

triageinferollama/llama3.2:3b✓ 1.1s

agendainferollama/llama3.2:3b✓ 860ms

[ 03 ]then

draftinferollama/llama3.2:3b✓ 745ms

[ 04 ]then

verifyinvokenika:assert✓ 0ms

[ 05 ]then

saveinvokenika:write✓ 1ms

daily-brief.nika.yaml

nika run daily-brief.nika.yaml

workflow daily-brief

scheduled 8 tasks · notes inbox calendar triage agenda draft verify save

notes invoke · nika:read

notes 2ms

inbox invoke · nika:read

inbox 0ms

calendar invoke · nika:read

calendar 1ms

triage infer · ollama/llama3.2:3b

triage 1.1s · 12 tok

agenda infer · ollama/llama3.2:3b

agenda 860ms · 35 tok

draft infer · ollama/llama3.2:3b

draft 745ms · 31 tok

verify invoke · nika:assert

verify 0ms

save invoke · nika:write

save 1ms

run complete · exit 0 · 2.0s

✓ exit 08 tasks ran2.0swrote brief.md$0.00localollama/llama3.2:3b

recorded · nothing staged

recorded from a real nika run · replayed by your scroll · nothing staged

01.1

Press play. It really ran.

The same file, executed by the engine with a local model on a real machine. What you watch is the recorded event stream.

daily-brief.nika.yaml

nika run daily-brief.nika.yaml

workflow daily-brief

scheduled 8 tasks · notes inbox calendar triage agenda draft verify save

notes invoke · nika:read

notes 2ms

inbox invoke · nika:read

inbox 0ms

calendar invoke · nika:read

calendar 1ms

triage infer · ollama/llama3.2:3b

triage 1.1s · 12 tok

agenda infer · ollama/llama3.2:3b

agenda 860ms · 35 tok

draft infer · ollama/llama3.2:3b

draft 745ms · 31 tok

verify invoke · nika:assert

verify 0ms

save invoke · nika:write

save 1ms

run complete · exit 0 · 2.0s

✓ exit 08 tasks ran2.0swrote brief.md$0.00 · ollama/llama3.2:3b

recorded from a real nika run · replayed at reading pace · nothing staged

01.2

One file. A plan you can read.

The engine derives the order from the wiring: a with: binding is a data edge, an after: entry a control edge. Steps with no edge between them run together. Nothing runs that is not written in the file.

[ 01 ]run together ×3

notesinvokenika:read✓ 2ms

inboxinvokenika:read✓ 0ms

calendarinvokenika:read✓ 1ms

[ 02 ]run together ×2

triageinferollama/llama3.2:3b✓ 1.1s

agendainferollama/llama3.2:3b✓ 860ms

[ 03 ]then

draftinferollama/llama3.2:3b✓ 745ms

[ 04 ]then

verifyinvokenika:assert✓ 0ms

[ 05 ]then

saveinvokenika:write✓ 1ms

durations recorded from the real run · hover a step to trace its wires

[ THE BOUNDARY ]

What it's allowed to touch.

The permits: block is part of the file you review. It is the whole list. Everything not on it is denied by default, before it runs. The full reference · families, secrets, the always-on floor · lives at /boundary.

daily-brief.nika.yaml · lines 6–8

6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:assert", "nika:write" ]

the same file as above · the permits block, verbatim

don't write it by hand:nika check --infer-permitsprints the tightest boundary the plan needs. Paste it in, loosen it yourself, or leave it strict.

fs:which files it may read and write
tools:which tools it may call

if a step reaches outside the list, say

✗write ~/.ssh/config   NIKA-SEC-004

effect outside the declared permits: capability boundary. Blocked before it runs, never logged after the fact. (An example: the recorded run above stayed in bounds, exit 0.)

the written law · numbered, public, reviewable

NEP-0003an absent permits: block declares zero authority
NEP-0004untrusted values re-gate under permits, at the effect
NEP-0005a child’s environment is composed, never inherited
NEP-0006a fetch of a code-bearing artifact is never innocent
NEP-0007the trace carries a permit witness · check and run agree
NEP-0008the egress proxy is the permit’s exact projection
NEP-0009a path grant names a path identity, re-judged at dispatch

the full set lives in the spec’s governance register · proposals, numbered and versioned, before they bind the engine

4 verbs · locked forever
28 builtins
one Rust binary
AGPL-3.0 forever
supernovae-st/nika
every claim, one graph · /map

Chats evaporate. Files compound. The prompts you perfect, the steps an agent improvises: gone with the session. Nika turns that work into a file: readable, versioned, runnable.

daily-brief.nika.yamlsource

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b45# the file IS the blast radius6⛨permits:7  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }8  ⛨tools: [ "nika:read", "nika:assert", "nika:write" ]910tasks:11  notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }12  inbox: { ◆invoke: { tool: "nika:read", args: { path: ./notes/inbox.md } } }13  calendar: { ◆invoke: { tool: "nika:read", args: { path: ./notes/calendar.md } } }1415  triage:16    with:17      inbox: ${{ tasks.inbox.output }}18    ◇infer: { prompt: "Urgent item, 10 words max: ${{ with.inbox }}", max_tokens: 2048 }19  agenda:20    with:21      calendar: ${{ tasks.calendar.output }}22    ◇infer: { prompt: "Three bullets, 8 words max: ${{ with.calendar }}", max_tokens: 2048 }2324  draft:25    with:26      notes: ${{ tasks.notes.output }}27      triage: ${{ tasks.triage.output }}28      agenda: ${{ tasks.agenda.output }}29    ◇infer:30      prompt: "Three bullets, 8 words max. No preface. Notes: ${{ with.notes }} Urgent: ${{ with.triage }} Plan: ${{ with.agenda }}"31      max_tokens: 20483233  verify:34    with:35      draft: ${{ tasks.draft.output }}36    ◆invoke:37      tool: "nika:assert"38      args:39        condition: "${{ size(with.draft) > 0 }}"40        message: "Empty brief. Increase max_tokens or change model."4142  save:43    after: { verify: success }44    with:45      draft: ${{ tasks.draft.output }}46    ◆invoke:47      tool: "nika:write"48      args: { path: ./brief.md, content: "${{ with.draft }}" }4950outputs:51  brief: "${{ tasks.draft.output }}"

audited · 8 tasks · 5 waves · permits declared · 2 hintsnika 0.114.0

the session ends · the file stays

Seeing the steps is not the same as enforcing them. Here is what each black box trades away.

Chat sessions

Great for exploring
Gone when the tab closes
Different answer every time

A file you keep

Runs again tomorrow
Same steps, same order
Diff it like code

Glue scripts

200 lines of Python + retries
One person understands it
Breaks when an API changes

Four verbs

The YAML is the logic
Anyone can read it
Engine handles retries & order

Cloud automations

Runs on their servers
Per-seat, per-run pricing
Your data leaves the building

Your machine

One binary, runs local
Free, AGPL forever
Nothing leaves unless you say so

The run explains itself.

One file ran once: audited before it started, storyboarded while it ran, replayable after it ended. Every frame below is real output of the real binary, captured on a terminal against committed fixtures. Offline, on the mock model, for zero dollars. How the proof works · graph, receipt, conformance · lives at /proof.

recorded from a real nika run · replayed at reading pace · nothing staged

Terminal capture of nika check on the signature workflow: the audit ladder passes with a cost floor warning and one permits hint, rc=0. — the pre-flight ladder: plan · cost · secrets · types · tools · args · schema · permits, then one hint. rc=0.

What an agent can do. Declared, not hidden.

Four verbs are the only native execution models. Every action explicit and typed, never improvised from a hidden prompt. Everything callable is a tool under invoke, and tools are allow-listed. Everything about ordering is the plan: which tasks wait on which. No fifth verb, ever.

5.1infer

Think. Ask any model · local or cloud.

5.1.1 providers5.1.2 structured output5.1.3 local models

think.nika.yamlsource

1# the infer verb alone · one bounded model call2nika: think3model: ollama/llama3.2:3b4⛨permits: {}5tasks:6  summarize:7    ◇infer:8      prompt: "Three risks in this release, ranked"9      max_tokens: 2561011outputs:12  summary: ${{ tasks.summarize.output }}

5.2exec

Run. A shell command, captured and typed.

5.2.1 capture & exit codes5.2.2 retry · timeout5.2.3 permitted programs

run.nika.yamlsource

1# the exec verb alone · one program, argv form, allowlisted2nika: run3⛨permits:4  ⛨exec: ["cargo"]5tasks:6  build:7    ▷exec:8      command: ["cargo", "build", "--release"]

5.3invoke

Use a tool. Fetch a page, write a file, call GitHub. Every tool explicit.

5.3.1 builtins5.3.2 extract modes5.3.3 MCP servers

use-a-tool.nika.yamlsource

1# the invoke verb alone · one tool call under the two-part grant2nika: use-a-tool3⛨permits:4  ⛨tools: ["nika:fetch"]5  ⛨net: { http: ["nika.sh"] }6tasks:7  page:8    ◆invoke:9      tool: "nika:fetch"10      args: { url: "https://nika.sh" }

5.4agent

Delegate. An autonomous loop, on a leash you can read.

5.4.1 tool allow-list5.4.2 max turns5.4.3 the human gate

delegate.nika.yamlsource

1# the agent verb alone · goal + tool whitelist, loop bounded2nika: delegate3model: ollama/llama3.2:3b4⛨permits:5  ⛨tools: ["nika:read", "nika:fetch"]6  ⛨net: { http: ["nika.sh"] }7  ⛨fs:8    ⛨read: ["./docs/*"]9tasks:10  audit:11    ✦agent:12      prompt: "Find every dead link in ./docs"13      tools: [ "nika:read", "nika:fetch" ]14      max_tokens_total: 81921516outputs:17  report: ${{ tasks.audit.output }}

infer ◇ · exec ▷ · invoke ◆ · agent ✦ · the whole operation space, declared in one file

What an agent can be permitted to use.

The first run needs none of this. After that, the language stays four verbs. The standard library does the rest: 28 builtins, the seats nika catalog lists, and any agent tools your editor already uses. All reached the same way: invoke:, and none of it runs unless the file's permits: allows it.

0128builtin tools · nothing to install

0217model providers · 5 local, 11 cloud, 1 mock

039extract modes on fetch

04MCPnativeyour agent tools (MCP) · any server, via the same verb

BuiltinsThe everyday tools. All called with invoke:.28 tools · 4 families

Files· 5

read· read a filewrite· save a fileedit· patch a fileglob· find filesgrep· search text

Data· 9

jq· transform JSONconvert· between formatsvalidate· check a schemajson_diff· what changedjson_merge_patch· merge JSONcompose· chain toolshash· fingerprint datauuid· fresh iddate· now · parse · format

Web· 1

fetch· get a page · 9 extract modes

Flow· 13

assert· check a conditiondone· end the loopwait· pauseemit· send an eventlog· say somethingnotify· ping a humanprompt· ask a humaninspect· debug a valuechart· see the docsdecide· see the docsimage_fx· see the docsimage_generate· see the docstts_generate· see the docs

ProvidersPick per task or per file. provider: ollama runs offline.17 total

Local runtimes· 5 · no cloud needed

OllamaLM Studiollama.cppLocalAIvLLM

Cloud · open-weight first· 11

MistralAnthropicOpenAIGeminiDeepSeekxAIGroqOpenRouterhuggingfacenvidiamoonshot

Test· 1

mock· deterministic · zero keys · CI-runnable

Extract modesHow fetch turns a page into typed output.9 modes

articlefeedjqlinksmarkdownmetadataselectorsitemaptext

MCPAny of your agent tools (MCP servers), reached as mcp:.native · unbounded

mcp:· the server your editor already usesstdiohttpdefault-deny· tools whitelisted in the file

every count derives from the spec's canon.yaml · never hand-typed

The catalog. What the released binary knows.

Every seat nika can hold ships inside the binary: models, prices, measured energy, MCP servers. This site vendors those tables from the engine at v0.114.0 and gives every member a room you can open · each number below derives from the vendored bytes, none is typed.

Walk the whole register · /catalog

Not another agent framework. The layer underneath.

Frameworks and assistants help an agent decide and act. Nika is orthogonal: it makes what the agent does reviewable and enforceable the layer between the model wants to act and the system lets it act.

FrameworksLangGraph, n8n: they help you wire and orchestrate the steps.: Nika makes the wired steps a reviewable, enforceable file, not glue code.
AssistantsCursor, Claude Code: they help an agent decide and act in the moment.: Nika turns that intent into a plan you review and the runtime enforces.
Protocols & toolsYour agent tools (MCP servers) expose capabilities an agent can call.: Nika runs them through invoke: allow-listed, permission-bound, traced.

Run a Nika plan from any of them. It's a portable file, not a platform.

nika: standup-digest

model: ollama/qwen3.5:4b   # local · zero key · swap for groq/llama-3.3-70b (a fast one-liner job)

permits:
  exec: ["git"]              # the ONE program this workflow may run
  tools: ["nika:date", "nika:write"]
  fs: { write: ["out/standup-note.md"] }

tasks:
  # No deps between these two → the engine runs them in parallel.
  today:
    invoke:
      tool: "nika:date"
      args: { op: now }

  history:
    exec:
      command: ["git", "log", "--since=yesterday", "--oneline", "--no-merges"]

  digest:
    with:
      today: ${{ tasks.today.output }}
      history: ${{ tasks.history.output }}
    infer:
      max_tokens: 400          # a standup note is short · the ceiling says so
      prompt: |
        Date · ${{ with.today }}
        Commits since yesterday ·
        ${{ with.history }}

        Write my standup note · 3 bullets · done / doing / blocked.
        Plain words · no fluff. If there are no commits, say so in one line.

  save:
    with:
      digest: ${{ tasks.digest.output }}
    invoke:
      tool: "nika:write"
      args:
        path: out/standup-note.md
        create_dirs: true
        content: "${{ with.digest }}"

outputs:
  note: ${{ tasks.digest.output }}

Real files you'd write.

Anything you'd ask an AI to do more than once belongs in a file. Every workflow below is real, projected from nika-spec, audited before it runs: plan, cost, secrets. Pick your métier, open a card, read the exact YAML that runs it.

Ship faster. Let the boring parts run themselves.

standup-digest.nika.yamlwalkthrough ↗

todayinvokenika:datehistoryexecgit

digestinfer

saveinvokenika:write

yamlsource

1nika: standup-digest23model: ollama/qwen3.5:4b   # local · zero key · swap for groq/llama-3.3-70b (a fast one-liner job)45⛨permits:6  ⛨exec: ["git"]              # the ONE program this workflow may run7  ⛨tools: ["nika:date", "nika:write"]8  ⛨fs: { write: ["out/standup-note.md"] }910tasks:11  # No deps between these two → the engine runs them in parallel.12  today:13    ◆invoke:14      tool: "nika:date"15      args: { op: now }1617  history:18    ▷exec:19      command: ["git", "log", "--since=yesterday", "--oneline", "--no-merges"]2021  digest:22    with:23      today: ${{ tasks.today.output }}24      history: ${{ tasks.history.output }}25    ◇infer:26      max_tokens: 400          # a standup note is short · the ceiling says so27      prompt: |28        Date · ${{ with.today }}29        Commits since yesterday ·30        ${{ with.history }}3132        Write my standup note · 3 bullets · done / doing / blocked.33        Plain words · no fluff. If there are no commits, say so in one line.3435  save:36    with:37      digest: ${{ tasks.digest.output }}38    ◆invoke:39      tool: "nika:write"40      args:41        path: out/standup-note.md42        create_dirs: true43        content: "${{ with.digest }}"4445outputs:46  note: ${{ tasks.digest.output }}47

audited · 4 tasks · 3 waves · permits declarednika 0.114.0

Every morning: the note is already written. You glance, you tweak one word, you go.

27 workflows · four tiers · nika-spec/examples the plan, the typed answers and the tools, all checked before it runs

The file becomes a canvas. Open any `.nika.yaml` in VS Code or Cursor: prompts sit on the cards, a run lights the graph wave by wave, and every canvas edit lands back in the file. This miniature works: press ▶ mock.

release-notes.nika.yaml · canvashover a card; its lineage stays lit

$0.00 ceiling · local model · audited before it runs

release-notes.nika.yaml

nika: release-notes
model: ollama/qwen3.5:4b

tasks:
  fetch_commits:
    invoke:
      tool: "nika:fetch"
      args:
        url: "https://api.github.com/repos/acme/app/commits?since=v1.4.0"

  write_notes:
    with:
      commits: ${{ tasks.fetch_commits.output }}
    infer:
      max_tokens: 800
      prompt: "Write the release notes from ${{ with.commits }}: grouped, human, no hype."

  hero_image:
    after:
      fetch_commits: success
    invoke:
      tool: "nika:image_generate"
      args:
        provider: local
        prompt: "A minimal banner for the v1.5 release"
        aspect_ratio: "16:9"
        output_dir: "media/"

  publish:
    after:
      write_notes: success
      hero_image: success
    exec:
      command: ["gh", "release", "create", "v1.5.0", "--notes-file", "notes.md"]

The engine's judgment, as you type. Diagnostics, completions and hovers come from nika check and the schema: codes, fixes and positions are the binary's, not the extension's. Even this demo file passes the real nika check, exit 0.
Run, replay, scrub. The run streams onto the graph live; any recorded run replays with a time-travel scrubber.
Audited before a token is spent. Cost ceiling, permits boundary and secret flows are static facts on the cards. Read them before you press Run.

Install in VS Code Marketplace Open VSX · Cursor / Windsurf

Shipping in the open.

A workflow language earns trust by moving, and by not breaking what you wrote. Here is the recent ship log: the spec opened, the verbs locked: and the engine shipped, one brew install away.

2026 · 08 · 23release
v0.114.0 · loopback HTTP and a named project
Default nika serve stays the resident firer. --bind with --workflows and --token-file opens authenticated loopback HTTP: jobs, SSE and OpenAPI. Cancel, artifacts and POST /v1/run stay 404. A project file names itself (nika: my-project); nika: v1 on nika.yaml is the retired schema tag.
2026 · 08site
nika.sh v4.23 · the origin becomes one story
The six origin records now read as one continuous arc, from the first objection to the name. The series page replaces its generic card grid with a dated ledger that shows reading order, source receipts and the evidence boundary before a reader opens a chapter.
2026 · 08site
nika.sh v4.22 · the honest origin ledger
Four retrospective field notes fill the public story from November through February without pretending they were published then. Story dates and publication dates are now separate across the journal, feeds and structured metadata, and six records form one origin series from the first note to the name.
2026 · 08site
nika.sh v4.21 · the SDK control room
The SDK now connects nika.yaml project setup, local runs, runtime proof and the resident firer, separate from the future HTTP service.

Full changelog

The control is the proof.

No logos to borrow, no quotes to dress up. Just what the engine guarantees: review before it acts · enforced permissions · hash-chained trace · priced before it spends · crash-resume without a server · portable off any platform: verifiable in the open spec and the one binary you install.

9.14verbs · every action explicit, declared not hidden

9.228builtin tools · allow-listed, nothing to install

9.31Rust binary · zero daemons, zero background services

Review before it acts.: The agent writes its plan as a file first: every step, tool and permission. A human reads it before a single action runs.
Enforced permissions.: The file's permits: block is the blast radius: files, hosts, programs, tools. The runtime denies anything outside it. A local seat means PII never has to leave.
Replayable trace.: Every run leaves a hash-chained NDJSON trace: every task, and every agent tool call, in the same chain · nika trace verify walks it and names the first broken link. Same file, same steps, same order: run it again and diff it like code.
Portable off any platform.: One binary, the seat you pick, AGPL-3.0 forever. The file outlives the vendor. It still runs the day the company that made it is gone.
Priced before it spends.: nika check prints the plan’s cost floor before a token is spent, and --max-cost-usd is a hard ceiling: a plan whose floor exceeds it never starts.
Crash-resume without a server.: The trace a run already writes is the checkpoint · --resume is a reader of a file, not a client of a run-store: no supervisor, no database. Two hashes decide skip-or-rerun, recorded work replays instead of re-calling the model, and a cache hit is never silent.

A README is documentation. Nika is an executable contract.

every number derives from the spec's canon.yaml · verifiable, never hand-typed · every repo file declares its provenance in estate.yaml · authored or generated, hashed

Get started.

No key, no account, and nothing left running in the background. Install the binary, run the command it prints as next: nika try 01-hello. Then keep a file. It prints the plan, checks the permits, and stays within bounds.

Install
One Rust binary. Homebrew on macOS, or the install script anywhere.
brew install supernovae-st/tap/nika
curl -LsSf https://nika.sh/install.sh | sh
Installed? See a workflow work before anything else · offline, zero keys, nothing written:
nika try 01-hello

Write a file

A plan is plain YAML: the steps, the verbs, the wiring. This is the same file the page just ran, opened at its first step.

daily-brief.nika.yaml · excerptsource

1nika: daily-brief2# local model · your notes never leave3model: ollama/llama3.2:3b4…5⛨permits:6  ⛨fs: { read: [ ./notes/* ], write: [ ./brief.md ] }7  ⛨tools: [ "nika:read", "nika:assert", "nika:write" ]8…9  ⛨notes: { ◆invoke: { tool: "nika:read", args: { path: ./notes/today.md } } }

audited · 8 tasks · 5 waves · permits declared · 2 hintsnika 0.114.0

real lines, sliced from the file above · read-only

Run it
Point the binary at the file. It prints the plan, checks the permits, and runs within bounds. Every step traced and replayable.
nika run daily-brief.nika.yaml

runs everywhere · same file, same result

6.0.4 In your terminal

One Rust binary. The command is the button: click it, paste it, run.

6.0.5 In your editor

The nika-lang extension: the file as a content-first canvas. Run it live, replay it, audit it before a token is spent, with engine-true diagnostics and completions, in VS Code, Cursor and Windsurf.

VS Code Marketplace Open VSX · Cursor / Windsurf

6.0.6 With your agent

nika init writes AGENTS.md · nika wire claude|cursor adds the read-only oracle (nika_check · nika_explain).

docs.nika.sh

WORKS WITH YOUR STACK

Claude Code · Codex · Cursor · VS Code · Hermes · OpenCode · Zed · GitHub Actions · MCP

nika init teaches whatever agent you run. the full integrations map

Learn it in 5 minutes

Questions, answered straight.

The real objections, and honest answers. No overclaiming, no dunking on the tools you already use.

I already see the agent’s steps in Cursor or a README. Why Nika?
Seeing the steps is not the same as enforcing the procedure. A README is documentation; a Nika file is an executable contract: versionable, replayable, permission-bound, auditable, and portable off any platform. You do not just read what it intends to do; the runtime holds it to exactly that.
Isn’t this just YAML, or another workflow engine?
The syntax is plain YAML, but the point is not the syntax. The point is the reviewable, enforced plan. The 4 verbs (infer · exec · invoke · agent) are native execution models, each one explicit and typed, with a permits: block the runtime enforces before anything runs. The file is the control surface, not the formatting.
Why not LangGraph, n8n, or MCP (agent tools)?
They live at a different layer. Frameworks help you orchestrate and assistants help an agent act; MCP exposes tools to call. Nika is the contract-and-control layer underneath: it makes the plan reviewable and enforceable, and it runs their tools through invoke, allow-listed and traced. It complements them rather than replacing them.
Does my data leave my machine?
Local-first, any model: fully local, or any API. Run a local model and nothing leaves at all. Every plan declares its network egress in its permits: block, and it is default-deny: omit the hosts and the workflow physically cannot reach the network. The file states exactly what can leave, and the runtime enforces it. 5 of the 17 providers are local.
Is it production-ready? What’s the license?
Honest answer: Nika is early. Real semver toward a 1.0 launch, currently at v0.114.0, shipping in the open. It is one Rust binary you can install and run today. The engine is AGPL-3.0-or-later; the spec is Apache-2.0. We would rather you trust the spec and the binary than a maturity claim we have not earned yet.

the noise becomes the file.

Put your agents on a leash you can read.

Install the binary, write the plan as a file, review what it's allowed to touch, run it. Same file, same result, enforced on your machine. Tomorrow, and the day the vendor is gone.

brew install supernovae-st/tap/nika

Star on GitHub Read the spec Learn it in 5 min

Do you repeat an AI task every week, in ChatGPT, Claude, Cursor, Codex, or scripts? Send it. We convert the best ones into runnable .nika.yaml examples, credited to you.

Send a workflow

Intent as Code.

The interface follows the contract.

The file, read back.

Press play. It really ran.

One file. A plan you can read.

What it's allowed to touch.

Chats evaporate. Files compound. The prompts you perfect, the steps an agent improvises: gone with the session. Nika turns that work into a file: readable, versioned, runnable.

The run explains itself.

What an agent can do. Declared, not hidden.

What an agent can be permitted to use.

The catalog. What the released binary knows.

Not another agent framework. The layer underneath.

Real files you'd write.

The file becomes a canvas. Open any .nika.yaml in VS Code or Cursor: prompts sit on the cards, a run lights the graph wave by wave, and every canvas edit lands back in the file. This miniature works: press ▶ mock.

Shipping in the open.

v0.114.0 · loopback HTTP and a named project

nika.sh v4.23 · the origin becomes one story

nika.sh v4.22 · the honest origin ledger

nika.sh v4.21 · the SDK control room

The control is the proof.

Get started.

Install

Write a file

Run it

6.0.4 In your terminal

6.0.5 In your editor

6.0.6 With your agent

Questions, answered straight.

Put your agents on a leash you can read.

The file becomes a canvas. Open any `.nika.yaml` in VS Code or Cursor: prompts sit on the cards, a run lights the graph wave by wave, and every canvas edit lands back in the file. This miniature works: press ▶ mock.