# sykli 0.7.0

*Released 2026-06-11*

**The hardening release.**

In May, sykli ran a six-dimension audit against itself — security, determinism,
OTP correctness, eval coverage, architecture, test quality — and wrote down
everything it found. 0.7.0 ships the remediation: every security finding fixed,
the determinism contract widened and enforced, the full evaluation pyramid
wired into CI, and the black-box suite at **zero known-broken cases** for the
first time. The audit report is in the repo (`docs/audit-2026-05-22.md`);
the fixes are in this release. That's the standard going forward: claims you
can check.

---

## Highlights

### Team Mode security, end to end

The self-hosted coordinator path got the full treatment:

- **No plaintext tokens.** The coordinator client refuses to send the Team
  Mode bearer token over plaintext HTTP to a non-loopback host. HTTPS and
  loopback are unaffected; `SYKLI_COORDINATOR_INSECURE=1` is a loud,
  explicit opt-in.
- **Per-team authorization.** Stateless signed team tokens
  (`sykli coordinator mint-token --org <o> --team <t> --role <r>`) scope
  every coordinator read and write. A team token cannot list, read, or
  mutate another team's work items, runs, gates, or sessions.
- **Resolved secrets are masked everywhere.** Secret values resolved at
  runtime — from `secret_refs`, OIDC exchange, or secret-like env keys —
  are now masked in occurrence persistence, notifications, run-summary
  sync, and SLSA attestations.
- **SSRF-guarded webhooks.** Gate and notification webhook URLs are
  resolved and rejected if they point at loopback, link-local (including
  the cloud metadata range), or private addresses — IPv4 and IPv6, across
  every resolved DNS record.

### Determinism you can bank on

`contract_hash` now canonicalizes by recursively sorting object keys, so
semantically identical contracts hash identically across OTP versions and
map sizes. The custom `NoWallClock` Credo check widened from simulator
transport to every pure contract and output-shaping transform. The engine
was already deterministic — now the guards prove it stays that way.

### The evaluation pyramid runs in CI

Credo, black-box CLI tests, cross-SDK conformance, and merge-to-main oracle
evals all run on every change — reproducible locally with `mix verify` or
`make verify`. Black-box expected-failure flags now require a tracking issue
URL, and with GH-004 reframed against the documented runtime trust model
(`docs/runtime-trust-model.md`), the suite carries **no known-broken cases**.

### A front door

`CONTRIBUTING.md` documents the build, the test tiers, and the
tested-and-enforced project rules. GitHub Discussions are open. The
conformance suite makes SDK contributions verifiable by construction — a
new review primitive or a new SDK is a well-bounded first contribution.

### Housekeeping that matters

The repository moved to `github.com/false-systems/sykli`, and as of 0.7.0
everything agrees: the Go SDK module path, `install.sh`, the GitHub Action,
`sykli init` scaffolding, docs, and error hints. Go SDK versions up to
`sdk/go/v0.4.0` remain fetchable under the old path via the Go module proxy;
new versions publish under `github.com/false-systems/sykli/sdk/go`.

---

Full details in [CHANGELOG.md](../../CHANGELOG.md#070---2026-06-11).
