See it
Compile it, then run it — both are terminal-native.
You write a skill in plain Markdown. Sigil compiles it into a typed agent harness, a program the model runs inside, so every step, rule and check in the skill is enforced by structure, not hoped for in a prompt. Small and local models included.
SKILL.md → AG-IR → agent.jac · the whole gated pipeline, one command
New postAgent skills should be compiled, not just readRead it →sigil compile ./SKILL.md -e agent.jac
./agent.jac "extract the tables from report.pdf"No API key? Compile on the Claude Code CLI you already have — and serve the skills back to it as tools.
curl -fsSL https://github.com/sigilagent/sigil/releases/latest/download/install.sh | bashA SKILL.md loaded into context is a hope: the model reads the instructions, and you hope it follows them. Sigil's compiler reads the same file and emits a typed, runnable harness: every mandatory step becomes a node the run must visit, every prohibition a constraint, every code snippet a runnable tool body, every check a gate. The model's judgment is confined to typed slots at exactly the points the skill calls for judgment.
Plain-markdown instructions: the skill you'd hand any agent.
A frontier model extracts a typed graph contract, with every rule pinned to a verbatim quote from the skill.
A gate battery audits coverage, drift and structure; the compile oracle round-trips the IR through the real type-checker.
The mechanical back-end lowers the IR as written: every construct has exactly one lowering, zero judgment.
The harness runs on small, cheap, even fully-local models. Structure can't be skipped.
-e packages one self-contained runnable file. No sigil, no session, no graph needed to run it.Why it matters: the compiled harness carries structure a weak model cannot skip: step order, embodied tools, grounded verification. The model isn't asked to be disciplined; the harness is the discipline. That is how a skill written once runs faithfully on any model, and how capability transfers from the frontier model that compiled it to the small one that runs it.
Sigil plugs into the agent harness you already use, in both directions — and needs no API key to do it. Compile on the claude CLI you already have, then serve every skill you compile back into it as a tool. Inside that tool call there is no prompt left to drift from: the skill's steps are nodes the run must visit.
# every model tier runs on the claude CLI — no ANTHROPIC_API_KEY,
# no proxy, no second auth
sigil --claude compile ./SKILL.md
# opt-in: let an agent author the typed IR itself, against the
# compile oracle — grounded spec loop and gate battery still run
sigil --claude compile ./SKILL.md --agent# one MCP tool per compiled skill, triggered by the skill's own
# `description:` frontmatter — the "use when…" line you wrote
claude mcp add sigil -- sigil mcp-serve
# Claude then calls skill_clean_csv, skill_writing_plans, …
# and the harness — not the model — guarantees the stepsclaude -p is just another model. Typed returns and tool-using slots included.The point isn't that Sigil talks to Claude Code — it's what a tool call becomes once the skill behind it is compiled. A prompt-loaded skill is advice the model may follow. A compiled one is a program it runs inside. Read the reference →
Around the compiler, Sigil ships a full agent runtime. Every compiled skill persists as a TaskGraph on one living graph, next to the agent's identity, memory and schedules. Ask for something it has a skill for and it runs it on the small, cheap model. Ask for something new and the frontier model compiles a skill first, then it's cheap forever.
The compiled skills themselves: each one covers a whole class of task, not just one. This is what the agent has learned to do.
Every run, its outcome and a summary. The record of what the agent has done and how it went.
Durable facts, retrieved by deterministic lexical recall and injected at run time, grown automatically by distilling each completed task.
Soul is identity and config as state you mutate in place: persona, ethos, model tiers, channels. The compiled skill stays class-general; instance-specific memory is injected only at execution time, never baked into the harness. On a small-model failure, the frontier mutates the skill and retries; the graph keeps the whole lineage.
A classic two-half design: an AI front-end (LIFT) that owns all the judgment, and a mechanical back-end (LOWER) that owns none, with typed gates between them, so an unfaithful skill can never slip through silently.
The model proposes, code disposes. Every extracted rule must quote the skill verbatim; a hallucinated rule can't produce a matching span, so it's dropped deterministically.
Every candidate IR round-trips through the real back-end and the type-checker before it's accepted: a deterministic ground truth on every iteration. The gates diagnose rather than veto — autofix, scoped repair, then typed findings on whatever remains.
-e emits a single self-contained runnable: shebang'd, runtime embedded. No sigil, no session, no graph needed to run it. Pick the model with an env var.
Compiling offers to lint the skill first: obligations that are underspecified or self-contradictory come back as findings, and one do / maybe / don't answer writes the sentence that settles it into the SKILL.md.
Compile with a frontier model (GPT, Claude, Gemini) and run the harness on anything, including fully local via Ollama. The structure carries the discipline, not the model.
Hand it a plain-Markdown skill (the compiler runs), a hand-authored AG-IR (no model call), or an already-compiled module; all land as skills on the graph.
Connect any tool server and the compiler binds its tools by name into the skills it builds; live runs dispatch to whichever server exposes the tool.
Compile on the Claude Code CLI you already have — no API key. Then serve every compiled skill back to it as a tool: Claude decides when, the harness decides how.
Chat with tool use and exec approvals, Discord / Slack / Telegram channels, cron scheduling, three-layer memory, hooks, all driving the same graph the compiler writes to.
A live web Control-UI: the agent-graph and every compiled skill rendered in real time, with 100% token observability on every run.
One command takes a plain-Markdown skill through the whole gated pipeline. Keep the result on Sigil's graph, or eject it as a single runnable file that needs nothing else.
# the gated pipeline: spec loop → views → gates → compiled skill
sigil compile ./SKILL.md
# …and eject ONE self-contained runnable program
sigil compile ./SKILL.md -e agent.jac
./agent.jac "extract the tables from report.pdf"
# the harness is the discipline: pick any execution model
SIGIL_MODEL=ollama_chat/qwen3:8b ./agent.jac "..."# plain Markdown: the compiler runs
sigil register-skill ./my-skill/SKILL.md
# a hand-authored AG-IR (no model call) · a precompiled module
sigil register-skill ./procedure.agir agir
sigil register-skill ./skills/report_v1.jac osp
# MCP servers: the compiler binds their tools into new skills
sigil add-mcp github stdio gh-mcp# every model tier runs on the claude CLI you already have
sigil --claude compile ./SKILL.md
# opt-in: an agent authors the AG-IR against the compile oracle,
# keeping the grounded spec loop and the whole gate battery
sigil --claude compile ./SKILL.md --agent
# the oracle is a command — for a hand-written IR, or CI
sigil gate agent.ir# one MCP tool per compiled skill, triggered by its own description
claude mcp add sigil -- sigil mcp-serve
# Claude Code decides WHEN. The compiled harness decides HOW —
# inside the tool call there is no prompt left to drift from.The installer pulls the self-contained jac runtime, fetches Sigil, provisions its one compiler dependency, and drops a sigil launcher on your PATH. No root, no pip install, safe to re-run.
curl -fsSL https://github.com/sigilagent/sigil/releases/latest/download/install.sh | bashmacOS & Linux · installs to ~/.sigil/app · override with SIGIL_HOME, SIGIL_BIN_DIR, SIGIL_REF
Installs one small self-contained program; no Python, no dependencies to manage.
Clones the source into ~/.sigil/app (or a tarball if you have no git).
One jac install: the model backend (litellm), the compiler's PyYAML, and the chat REPL.
sigil on PATHA launcher so sigil serve / sigil solve work from anywhere.
# 1 · install one small self-contained runtime
curl -fsSL https://raw.githubusercontent.com/jaseci-labs/jaseci/main/scripts/install.sh | bash
export PATH="$HOME/.local/bin:$PATH"
# 2 · clone Sigil & provision its dependencies (reads jac.toml — don't name packages)
git clone https://github.com/sigilagent/sigil.git && cd sigil
jac install
# 3 · configure cognition (frontier needs a provider key)
export OPENAI_API_KEY=sk-...
export SIGIL_FRONTIER=gpt-5 # default
export SIGIL_SMALL=ollama_chat/qwen3:32b # can be local
Verify the build with the test suite (jac test src/*.test.jac src/report_fix_tests.jac) or launch the live Observatory Control-UI with jac start observatory.jac. Then compile your first skill:
Point it at models once: a frontier one to compile with, and a small or fully-local one (via ollama) to run with. solve compiles a skill the first time it meets a class of task, and reuses it every time after.
# first time: the frontier compiles a skill for this class of task
sigil solve "turn report.pdf into a clean CSV"
# a similar ask is a HIT: it runs the compiled skill on the small model
sigil solve "pull the tables out of invoice.pdf"
# the compiled skills with run stats, and everything else it knows
sigil library
sigil soul
sigil teach "always give me CSV with a header row"In your terminal. sigil compile a skill, or sigil solve "…" and let it compile on demand.
As a dashboard. Run sigil serve for a live web view; watch it compile and run every skill, in your browser.
Standalone. Eject a skill to one file and run it anywhere, no sigil installed at all.
The frontier model is paid once per class of task, to compile the harness.
Every run after rides that structure on a small, cheap model. If the small model fails, the frontier mutates the skill and retries; the skill gets better under pressure.
Teach it something and it remembers. Point it at a different model and it switches. All of it, live.
Sigil is the artifact of a research project on skill compilation: what happens to an agent's faithfulness when the instructions stop being a prompt and start being a program.
arXiv · 2026 · arXiv:2607.27309 [cs.SE] · CC-BY-4.0
of mandated steps executed by a compiled skill
the same skill, read as a prompt
the tokens of the prose baseline
Cite it
Dantanarayana, J., Kashmira, S., Tang, L., & Mars, J. (2026). SIGIL: Compiling agent skills into typed harnesses. arXiv:2607.27309. https://doi.org/10.48550/arXiv.2607.27309
@misc{dantanarayana2026sigil,
title = {SIGIL: Compiling Agent Skills into Typed Harnesses},
author = {Dantanarayana, Jayanaka and Kashmira, Savini and Tang, Lingjia and Mars, Jason},
year = {2026},
eprint = {2607.27309},
archivePrefix = {arXiv},
primaryClass = {cs.SE},
doi = {10.48550/arXiv.2607.27309},
url = {https://arxiv.org/abs/2607.27309}
}Sigil is free and open-source (MIT). Your skills stop being prompts and start being programs.