The honesty ledger

This page exists so the docs never quietly overclaim. It is maintained deliberately: when something ships, it moves up; when we find a limit, it gets written down here before it gets written around. Last reviewed 2026-07-07.

Works today

The CLI, end to end on Linux x86_64. tally init, signin, backup, connect, whoami, doctor, and the rest of the verb surface exist and are documented from the binary’s own help in the CLI reference.
The local encrypted log, with verification. tally log append writes events, tally status prints the event count and whether the hash chain verifies, and tally log verify walks the entire chain and exits non-zero on tamper or gap. You do not have to trust the log; you can check it.
Structurally end-to-end encrypted relay messaging. tally push seals log deltas with your seed-derived sync key (AES-256-GCM) and publishes ciphertext; tally pull backfills and decrypts on your other device. The relay only ever sees ciphertext. This is a structural property of the design: the operator does not hold the keys, so the operator cannot read content. We claim exactly that and nothing more; in particular, we do not claim any hardware-enclave or attestation property for the relay.
Built-in harness launch. tally start, tally continue, and tally run launch agents under the three built-in harnesses: claude-code, pi, and codex. The built-ins are compiled in and verified.
Portable sessions across harnesses. tally session export, materialize, show, and verify move a session’s context between harnesses, and session verify checks the repo against the context’s acceptance criteria independently of the harness’s self-report.
Rooms between seats. tally channel and tally msg run the full owner/joiner handshake (create, invite, join, admit) and exchange MLS-encrypted messages over the relay. See Rooms.

Not live yet

The one-line installer URL. curl -fsSL https://skytale.sh/install.sh | sh is the install path at launch, and the whole funnel is already built and verified end to end against a staged copy of the release bundle: the installer downloads the Linux x86_64 tarball, verifies its SHA-256 checksum before installing, installs to ~/.local/bin without sudo, and the installed tally --version runs. What has not happened is the publish: https://skytale.sh/install.sh does not serve the script yet. It goes live at beta launch. Until then, build from source.
macOS and ARM builds. Only the x86_64-unknown-linux-gnu target has been built. There are no macOS artifacts (either architecture) and no aarch64 Linux artifact. They are planned targets, not available ones.
Durable cloud saves. The relay does store your pushed ciphertext hosted-side, but as a bounded catch-up buffer, not a durable save: entries older than 7 days are purged, and each channel keeps at most a capped number of recent entries (10,000 on the hosted sync relay; the open-source relay defaults to 1000). What ages out of that window is recoverable only from a device that still holds the local log. A durable hosted save tier (retention until you delete it) is not live. Your devices are the durable copies, so do the backup ceremony.
Paid plans. A paid team tier is coming soon at ten dollars per user per month; it is announced with its price, not purchasable yet. Beta members lock the beta price for life. Nothing in the beta requires payment.
Community adapter launches. Community adapters (declarative adapter.toml manifests) reach the session verbs (session export --harness <name>, session materialize --into <name>) but not the launch verbs. Launching is built-ins only for the beta.

Known limits and gotchas

glibc 2.41 floor. The one built binary links glibc 2.41 (Debian 13 era). Older distros may refuse to run it. Recent distros only, for now.
musl is untested. A static musl build would lift the glibc floor, but it has not been built or tested. We do not claim it works.
The :5000 relay URL is broken. Some older docs and defaults mention a relay endpoint with port :5000; that port is internal and does not work externally. The working relay endpoint has no port suffix.
Beta caps. The beta policy is 100 seats and 3 agents per seat on the free tier. At the cap, signup waitlists you automatically. Details in the beta FAQ.
A cargo name collision. An unrelated crates.io crate (tally-cli) also installs a binary named tally. If tally behaves strangely, run which tally and check tally --help (the first line of this project’s help names it tally-coding-cli).
Checksums are integrity, not provenance. Release artifacts ship with SHA-256 checksums served from the same origin as the binaries, and the installer verifies them before installing. That protects against truncation, corruption, and bad mirrors; it does not protect against a compromised origin. Artifact signing is a known follow-up, not something we claim today.
Sizes are padded everywhere; one-shot timing is not masked. Every tally send path pads ciphertext to fixed buckets (plus Padme above 32KB), and long-lived connections emit cover traffic by default, so the relay sees quantized sizes and, while a watch or room is open, cannot distinguish real frames from cover. What remains: the relay observes THAT a one-shot push or pull happened and when. The security model has the precise accounting.

If you catch this page being wrong in either direction, that is a bug. See the beta FAQ for where to report it.