Run auditable, budgeted AI workflows with cost caps and receipts

This skill uses Nika (nika.sh), an open-source AGPL Rust engine, as a deterministic workflow worker orchestrated by the Hermes terminal tool - the division of labor being "Hermes orchestrates, Nika captures repeatable work as a checkable file and runs it with receipts." Nika is explicitly not another coding agent (that's the separate opencode skill); it's for work that should be repeatable, budgeted, and auditable - a daily digest, triage, ETL, report, or multi-step LLM pipeline captured as a plain-text *.nika.yaml file instead of re-prompted each time. It runs against local providers (Ollama, llama.cpp, vLLM) or cloud models, needing zero API keys for offline/local runs (--model mock/echo or --model ollama/...). The core discipline is check-before-run: nika check <file> --json is a static pre-flight that spends no tokens and touches no network, verifying plan shape, cost floor, secret-flow analysis, type checks, and tool arguments, with findings carrying self-explaining NIKA-XXXX codes (readable via nika explain) that must be fixed, never suppressed, before running. Workflows are authored by scaffolding from a template (nika new <file> --from <template>), editing the vars:/tasks:/outputs: skeleton, and narrating the result with nika explain before anything runs - a workflow file declares tasks, explicit dependencies via depends_on, a bounded model step, and a declared output, all in one diffable YAML file. Cost honesty is enforced at two points: a pre-start floor prices the effective model (including any --model override) and refuses to start if it exceeds --max-cost-usd (exit 2, zero tokens spent), and mid-run a ledger stops new task admissions the moment real spend crosses budget, failing the run with NIKA-1704 while letting the crossing call finish - though estimates use list rates from a vendored public catalog, so an uncataloged paid model meters as $0 and runs with no real budget protection. Every run writes a tamper-evident trace under .nika/traces/, printed as the run card's trace: line; nika trace verify checks the hash chain (exit 0 intact, 2 broken, 3 pre-chain), and companion commands (trace outputs, trace flow, trace reproduce, trace export) inspect or replay what happened. Long-running workflows should launch with background=true and be polled rather than blocking the turn, since nika run renders live on a TTY but stays quiet until completion when piped. Nika optionally ships a read-only MCP oracle (nika mcp) exposing validation/learning tools, though wiring it into a client is a separate user step, and everything works over the terminal regardless.

Use it when the user asks to run, check, or author a *.nika.yaml workflow; when a task will repeat and should be captured as a file instead of re-prompted; when a hard cost cap, pre-run cost estimate, or audit receipts are wanted; when a pipeline mixes local and cloud models or mixes LLM steps with shell/HTTP/file steps; or when a run needs to be replayable, verifiable, or reproducible later. Do NOT use it for one-off questions or single tool calls, autonomous code implementation/refactoring/PR review (use opencode instead), or interactive back-and-forth tasks, since workflows are non-interactive by design. Never run a workflow that hasn't been checked, and never rely on --max-cost-usd for a custom or uncataloged model endpoint - it meters as $0 and provides no real protection.

Inputs: a repeatable task description or existing *.nika.yaml file, a chosen model/provider, workflow variables (--var), and a budget cap for paid models. Outputs: a checked and executed workflow run producing declared outputs:, a tamper-evident trace file under .nika/traces/ with a verifiable hash chain, and a final run card reporting status, actual cost, and trace path.

nika: v1
workflow: daily-brief
model: ollama/qwen3.5:4b
tasks:
  - id: fetch
    invoke:
      tool: "nika:fetch"
      args: { url: "https://hn.algolia.com/api/v1/search?tags=front_page" }
  - id: brief
    depends_on: [fetch]
    infer:
      max_tokens: 300
      prompt: |
        Five bullet points, most signal first: ${{ tasks.fetch.output }}
outputs:
  brief: ${{ tasks.brief.output }}

Runs against local model providers (Ollama, llama.cpp, vLLM) and cloud providers reading standard shell env vars, orchestrated through the Hermes terminal tool with process(action="poll"|"log") for background runs. Ships an optional read-only MCP oracle (nika mcp) with tools like nika_check, nika_explain, nika_schema, and nika_catalog for clients that wire it in.

Agent operators who need a repeatable, cost-capped, and auditable way to run multi-step LLM/shell/HTTP pipelines - checked before they spend a token and verifiable by a tamper-evident trace afterward.