v0.7.0

sykli 0.7.0

Released 2026-06-11

The hardening release.

In May, sykli ran a six-dimension audit against itself — security, determinism,
OTP correctness, eval coverage, architecture, test quality — and wrote down
everything it found. 0.7.0 ships the remediation: every security finding fixed,
the determinism contract widened and enforced, the full evaluation pyramid
wired into CI, and the black-box suite at zero known-broken cases for the
first time. The audit report is in the repo (docs/audit-2026-05-22.md);
the fixes are in this release. That's the standard going forward: claims you
can check.

---

Highlights

Team Mode security, end to end

The self-hosted coordinator path got the full treatment:

• No plaintext tokens. The coordinator client refuses to send the Team
  Mode bearer token over plaintext HTTP to a non-loopback host. HTTPS and
  loopback are unaffected; SYKLI_COORDINATOR_INSECURE=1 is a loud,
  explicit opt-in.
• Per-team authorization. Stateless signed team tokens
  (sykli coordinator mint-token --org <o> --team <t> --role <r>) scope
  every coordinator read and write. A team token cannot list, read, or
  mutate another team's work items, runs, gates, or sessions.
• Resolved secrets are masked everywhere. Secret values resolved at
  runtime — from secret_refs, OIDC exchange, or secret-like env keys —
  are now masked in occurrence persistence, notifications, run-summary
  sync, and SLSA attestations.
• SSRF-guarded webhooks. Gate and notification webhook URLs are
  resolved and rejected if they point at loopback, link-local (including
  the cloud metadata range), or private addresses — IPv4 and IPv6, across
  every resolved DNS record.

Determinism you can bank on

contract_hash now canonicalizes by recursively sorting object keys, so
semantically identical contracts hash identically across OTP versions and
map sizes. The custom NoWallClock Credo check widened from simulator
transport to every pure contract and output-shaping transform. The engine
was already deterministic — now the guards prove it stays that way.

The evaluation pyramid runs in CI

Credo, black-box CLI tests, cross-SDK conformance, and merge-to-main oracle
evals all run on every change — reproducible locally with mix verify or
make verify. Black-box expected-failure flags now require a tracking issue
URL, and with GH-4 reframed against the documented runtime trust model
(docs/runtime-trust-model.md), the suite carries no known-broken cases.

A front door

CONTRIBUTING.md documents the build, the test tiers, and the
tested-and-enforced project rules. GitHub Discussions are open. The
conformance suite makes SDK contributions verifiable by construction — a
new review primitive or a new SDK is a well-bounded first contribution.

Housekeeping that matters

The repository moved to github.com/false-systems/sykli, and as of 0.7.0
everything agrees: the Go SDK module path, install.sh, the GitHub Action,
sykli init scaffolding, docs, and error hints. Go SDK versions up to
sdk/go/v0.4.0 remain fetchable under the old path via the Go module proxy;
new versions publish under github.com/false-systems/sykli/sdk/go.

---

Full details in CHANGELOG.md.