# sykli 0.6.0

*Released 2026-04-29*

**Local-first CI for the next generation of software developers.**

This is the release that makes that one-liner mean something. The CLI looks the way the project sounds. The runtime layer is decoupled from the engine. The supply chain is signed. AI agents read your runs natively. And the foundation for replacing GitHub Actions — sykli running on your own mesh, GitHub talking to it directly — is in place.

```
sykli · build.exs                                  local · 0.6.0

  ●  test         go test ./...                       1.8s
  ●  build        go build ./cmd/app                  912ms
  ●  lint         golangci-lint run                   220ms

  ─  3 passed                                          2.9s
```

---

## Highlights

### The CLI looks designed now

A full visual reset. One accent color, glyph-driven status, single redraw region for animations, hidden task stdout by default, one summary per run. No more "Level", no more "1L", no more debug headers. Failure mode draws a horizontal rule under the failed task and points at `sykli fix` for AI-readable analysis. Reference set for the aesthetic: Linear, Vercel CLI, Raycast.

### Runtime decoupling — `:test` defaults to a Fake

The execution layer is now properly separated from the engine. `Sykli.Runtime.Resolver` is the single source of truth for runtime selection (priority chain: CLI flag → opts → app env → `SYKLI_RUNTIME` → auto-detect → Shell). `Sykli.Runtime.Fake` is the new in-memory deterministic runtime that `:test` defaults to — your unit tests no longer need Docker. New: `Sykli.Runtime.Podman` (rootless container parity), `mix sykli.runtime.info` for inspection, `--runtime` CLI flag, and test tiers (`mix test.docker`, `mix test.podman`, `mix test.integration`).

### `sykli fix` and friends — AI-readable failures

Four new commands for AI-native CI:

- **`sykli fix`** — failure analysis with source context, git provenance, and a single-line cause statement. The screenshot moment.
- **`sykli mcp`** — MCP server so Claude Code, Cursor, and Copilot can read your run state directly without log scraping.
- **`sykli query`** — structured queries against pipeline / history / health data without an LLM.
- **`sykli plan`** — dry-run execution planning with git-diff-driven task selection.

All `--json` output now flows through a shared envelope (`{ok, version, data, error}`) so agents parse one shape across every command.

### SLSA v1.0 attestations

Every run now produces a DSSE-signed SLSA v1.0 provenance envelope. Per-run and per-task attestations. Configure signing via `SYKLI_SIGNING_KEY` (HMAC) or `SYKLI_ATTESTATION_KEY_FILE` (file-based). The supply-chain story is no longer aspirational.

### GitHub-native foundation

The first slab of the v0.7 line: sykli now ships a GitHub App, a webhook receiver (Plug + Bandit), a Checks API client, and a `:webhook_receiver` mesh role. A signed webhook arrives at the user's mesh, signature is verified (HMAC-SHA256, constant-time, body never logged on mismatch), the receiver opens a `queued` check suite. Pipeline dispatch from the webhook is in progress; PR-diff annotations from `sykli fix` are next.

This means: in v0.7, sykli replaces GitHub Actions instead of running inside it. Local-first throughout — the receiver lives on hardware you control, never on Sykli-owned infrastructure. The new GitHub-native path supersedes the older "run inside Actions + Commit Status API" path, which remains as a documented fallback.

### FALSE Protocol first-class

Internal events are now `Sykli.Occurrence` structs end-to-end (refactor — events used to be wrapped *by* occurrences). New: `chain_id` for correlating retry chains, configurable `source` URI via `SYKLI_SOURCE_URI`, and an `:errored` task status distinct from `:failed` for infrastructure failures. `:failed` gets causality analysis; `:errored` gets infrastructure diagnostics.

### Eval harness + oracle

55 ground-truth oracle cases for AI-agent CI behavior validation. Run via `eval/oracle/run.sh`. The full Claude Code → build → oracle → report loop is in `eval/harness/run.sh` for AI-agent regression testing.

### Hardening

A full sweep across the security and reliability backlog:

- **SEC-001..007** all closed: OIDC TLS verification, secret_refs path traversal, Docker mount containment, webhook SSRF guard, broader secret masking, OIDC-derived runtime cache keys.
- **REL-002..008** closed: graceful shutdown, concurrent-run race fix, S3 cache circuit breaker, async SCM status calls, telemetry duration units, RunRegistry eviction, PubSub failure handling.
- 35+ PR review comments addressed across the release.

---

## Breaking change

**Cache fingerprint scheme now includes the repo-relative workdir.** This prevents cross-project cache pollution but means `.sykli/occurrence.json` payloads from before 0.6.0 are not backward-compatible.

**What you need to do:** nothing. The first run after upgrade rebuilds local cache state automatically. Expect one cold run.

---

## Install / upgrade

```bash
# Single binary
curl -fsSL https://raw.githubusercontent.com/false-systems/sykli/main/install.sh | bash

# Or with a specific version
curl -fsSL https://raw.githubusercontent.com/false-systems/sykli/main/install.sh | bash -s v0.6.0
```

SDKs (all bumped to 0.6.0 in lockstep):

```bash
# Go
go get github.com/false-systems/sykli/sdk/go@v0.6.0

# Rust
cargo add sykli@0.6.0

# TypeScript
npm install sykli@0.6.0

# Python
pip install sykli==0.6.0

# Elixir
{:sykli, "~> 0.6.0"}
```

---

## What's next

- **Phase 2** of the GitHub-native rollout: webhook → mesh placement → executor → check-run lifecycle. Per-task check runs transition through `queued` → `in_progress` → conclusion.
- **Phase 3**: `sykli fix` annotations rendered onto the PR diff via the Checks API's annotation surface.
- **Phase 4**: GitHub App marketplace listing.

---

## Thanks

To everyone who pushed back on early drafts of the visual reset, who reviewed the runtime decoupling RC.0–RC.7 chain, who pointed out the cache-fingerprint cross-project-pollution bug, and to the Codex agents that shipped the visual reset (PR #123) and the GitHub-native foundation (PR #125) cleanly.

---

**Full changelog:** see [`CHANGELOG.md`](../../CHANGELOG.md#060---2026-04-29) for the comprehensive list of additions, changes, fixes, and security closures across all 142 commits.
