SibillaOS v0.6.0

Three audiences, one release: agent users who want a local model their frameworks can discover, on-premise deployments where the network is not a given, and whoever runs more than one machine. Systems installed from 0.4.0 onward receive it through a plain sudo apt update && sudo apt upgrade - and for the first time that promise is not just kept but tested: CI now installs the previous release from the live repository, upgrades, and requires the serving machine to survive untouched.

What is new

The local model as an MCP server. sudo sibilla mcp enable exposes chat and list_models tools at /mcp, behind the same API keys as the API. The point is the direction of trust: an agent (Claude Code, or any Model Context Protocol client over Streamable HTTP) can delegate work on sensitive material to a model that cannot exfiltrate it. The server is ~250 lines of Python standard library, stateless, loopback-only, sandboxed, and never reads the keys; sudo sibilla connect --mcp prints the ready claude mcp add command. Details in docs/mcp.md.

Air-gapped installs, end to end. Machines with no outbound network are exactly where the on-premise pitch matters, and they are now first-class: prepare a companion volume on a connected machine with tools/build-airgap-payload.sh (every file resolved on Hugging Face by its catalog digest and verified before it enters the payload), label it SIBILLA-AIRGAP, attach it before first boot - the machine imports the models through the signed-catalog digest gate and serves without ever reaching for the network. The same gate powers sibilla model import FILE for by-hand delivery: a USB stick becomes a reviewable channel, because identification and integrity come from the same signed record and there is no --force to bypass it. CI proves the whole story on every push by booting the cloud image in a VM whose outbound network is dropped. Details in docs/airgap.md.

Configuration as code. One KEY=value profile file declares the machine (model, TLS, metrics, MCP, WebUI; every key optional, so partial profiles compose) and the idempotent sudo sibilla apply converges onto it, running only the commands that close a gap. sibilla apply export turns a configured machine into a profile, which makes replication one file copy. cloud-init or a fleet tool writes /etc/llmd/profile and first boot picks it up, on the images and on the apt path alike; the air-gapped payload can carry it too. API keys are deliberately not part of a profile. Details in docs/configuration.md.

Embeddings for local RAG. The curated catalog gains an embedding role - nomic-embed-text v1.5 is the first entry, digests recorded - and /v1/embeddings answers behind the same keys, so a fully local RAG stack points at this one machine. Embedding models can never become the chat default: the selector skips them and sibilla model use refuses them. sibilla model pull stages any catalog model, digest-verified, without switching what is served. Details in docs/embeddings.md.

Developer kit. sudo sibilla connect grows single-purpose outputs that print only their payload: --env (the variables every OpenAI SDK and framework reads), --mcp, --snippet python|node; --write places the aider configuration next to the Continue one (which also covers JetBrains), backups and 600 permissions included. sudo sibilla bench measures what a client of this machine actually experiences - time to first token and generation speed, through the authenticated gateway - and prints a shareable markdown table.

Rate limiting baseline. Appliance first boot installs a kernel-level per-IP limit on new gateway connections (generous for keep-alive clients, a wall for floods), proxy-agnostic by construction; sibilla remove strips it. Per-key fairness limiting is deferred with its design recorded: the gateway evaluation (Caddy vs nginx, all facts verified) lives in the architecture decision log.

Hardening this cycle forced: the MCP unit signals readiness to systemd so sibilla mcp enable returns only when the endpoint answers; the pinned ollama install retries a mid-download reset in setup, cloud bake and ISO alike; the payload builder honors HF_TOKEN and reuses digest-verified files without touching the network.

What has been verified

The full pipeline on every push, now fourteen jobs deep: ISO build, BIOS/UEFI/Secure-Boot boots, unattended install with real inference, TLS and the complete auth matrix, multi-model, digests, metrics, firewall (rate limit rule asserted in the file and in the kernel), sandbox, SBOM and the CVE gate, cloud images on amd64 and arm64, the guest lifecycle (install, setup, MCP initialize/tools/call with a 401 guard, offline import positive and negative, declarative profile drift/idempotence/rejection, bench, doctor without key leaks, connect kit outputs, verified-clean removal), the air-gapped deploy with outbound network dropped, and the upgrade from the published release with key, model and gateway intact. Known limits stay documented: Open WebUI's login flow and vLLM on physical GPUs remain outside CI; arm64 token generation is exercised but not asserted under emulation.

Installation

On an existing Ubuntu 24.04 machine:

$ curl -fsSL https://engineering87.github.io/sibillaos/apt/sibillaos-archive-key.asc \
    | sudo gpg --dearmor -o /usr/share/keyrings/sibillaos-archive-keyring.gpg
$ printf 'Types: deb\nURIs: https://engineering87.github.io/sibillaos/apt/\nSuites: ./\nSigned-By: /usr/share/keyrings/sibillaos-archive-keyring.gpg\n' \
    | sudo tee /etc/apt/sources.list.d/sibillaos.sources
$ sudo apt update && sudo apt install llmd
$ sudo sibilla setup

Trying it is reversible: sudo sibilla remove takes out exactly what was installed, verified in CI. From the ISO (amd64): download the .part files and SHA256SUMS, reassemble, verify, write to USB. From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, boot the qcow2 with your cloud-init user-data - optionally including an /etc/llmd/profile the machine will converge on.

Known limitations

The default gateway mode is plain HTTP with mandatory bearer tokens; enable TLS with sibilla tls before exposing the port beyond the machine. Rate limiting is per-IP; per-key fairness is deferred (design recorded in the architecture log). The MCP surface is tools-only by design. Air-gapped payloads cover the Ollama engine; vLLM machines are out of scope for now. The curated catalog only contains permissively licensed, non-gated models. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs (sbom-llmd-packages.*.json) and the installed-package inventory (installed-packages.tsv) are attached to this release.

What's Changed

• release: v0.6.0 - agents, the road off the network, configuration as code by @engineering87 in #5

Full Changelog: v0.5.0...v0.6.0