Introduction

Audit first, then run. A meeting-notes job you would otherwise redo in a chat, kept as one .nika file: nika check audits it before any model is called, then a local model (ollama/llama3.2:3b) turns a sample transcript into typed action items and the run leaves a hash-chained record. Captured from the real CLI, on one machine, with no API key: the check on nika 0.121.0, the local-model run on nika 0.109.2. The file is a shorter demo version of the meeting actions example.

​

Your first result

nika: order-report
permits:
  tools: ["nika:jq", "nika:write"]
  fs:
    write: ["./report.md"]
const:
  orders:
    - {id: a, amount: 10}
    - {id: b, amount: 20}
tasks:
  summarize:
    invoke:
      tool: nika:jq
      args:
        input: ${{ const.orders }}
        expression: '{count: length, total: (map(.amount) | add)}'
  save:
    with:
      summary: ${{ tasks.summarize.output }}
    invoke:
      tool: nika:write
      args:
        path: ./report.md
        content: |
          # Order report
          Orders: ${{ with.summary.count }}
          Total: ${{ with.summary.total }}
outputs:
  summary: ${{ tasks.summarize.output }}
  report: ${{ tasks.save.output }}

nika check report.nika
nika run report.nika --output json
cat report.md

{"report":"./report.md","summary":{"count":2,"total":30}}

# Order report
Orders: 2
Total: 30

​

A real job, when you are ready

​

What just happened, one concept at a time

1. The file is the contract. The verbs infer, exec, invoke and agent — nothing else: fetching a URL or writing a file is a tool under invoke, declared and auditable.
2. Admission before execution. nika run audits the file before anything executes; a refused file never starts. nika check is the same audit on its own, for CI.
3. Permits are the blast radius. permits: {} declares zero authority. A workflow that touches a file, a host or a shell must say so, or admission refuses it (NIKA-SEC-004; with no permits: block at all, NIKA-AUTH-006).
4. Runs leave evidence. Each run writes a hash-chained trace under .nika/traces/; nika trace verify inspects the record and reports whether it is sealed. Verification proves the record was not tampered with — not that a model was right.

​

Ask the file three questions

​

Where next

​

The Nika ecosystem