Errors.

max_turns exhausted before completion

named bymax_turns

max_tokens_total exhausted before completion

named bymax_tokens_total

a skills: path does not resolve (file missing/unreadable at compose time)

named byskills

a skills: file is not a valid Agent Skill (frontmatter shape · missing/empty name/description)

named byagentdescriptionskills

an assert: claims a level the evidence does not support (a StaticProof the IR cannot decide · a mis-leveled obligation · spec 15)

builtin invoke violates its statically-checkable arg contract (e.g. nika:fetch without url: · nika:jq arg shape)

named byinvokenikanika:assertnika:chartnika:composenika:convertnika:datenika:decidenika:donenika:editnika:emitnika:fetchnika:globnika:grepnika:hashnika:image_fxnika:image_generatenika:inspectnika:jqnika:json_diffnika:json_merge_patchnika:lognika:notifynika:promptnika:readnika:tts_generatenika:uuidnika:validatenika:waitnika:write

nika:done invoked outside an agent: loop

named byagentnikanika:done

task cancelled (workflow failure gate · user cancellation)

named byworkflow

invoke.workflow: target is not statically resolvable (templated · malformed · unpinned registry ref) — a call graph you cannot draw before the run cannot be bounded (spec 14)

named byinvokeworkflow

the child workflow's effect boundary exceeds the parent capped by the call-site declaration (Authority(child) subset of Authority(parent) intersect declared · spec 14 laws 3/4)

named byworkflow

the static call graph is not acyclic (self-launch · cycle · spec 14 law 7 · NIKA-SEC-003 is the runtime depth backstop)

the typed call does not compose — parent args do not fit child inputs, or child outputs do not fit parent returns (spec 14 law 2)

named byinputsoutputsreturns

cycle in the precedence graph G_p = E_d ∪ E_c (incl. self-dependency · via with:/after:)

named byafterwith

with:/after: references an undeclared task

named byafterwith

on_error.recover references a task downstream of the declaring task (await would deadlock)

named byon_errorrecover

after: predicate outside the closed set (success · failure · skipped · terminal)

named byafter

statically dead task — an incoming edge's pass-set excludes every reachable producer state, or the when: gate is false under every reachable upstream combination (gate algebra v2)

named bywhen

status compared against a literal outside the vocabulary (success · failure · skipped · cancelled) — == never matches, != always holds

the decision bundle is malformed or violates its own laws (float weight · undeclared evidence key in rules · identity key feeding a technical dimension · missing contradictory fixture · monotonicity violated by the bundle's own fixtures) (spec 11)

the evidence snapshot does not satisfy the bundle's evidence schema (type misfit · unauthorized source · integrity below the declared floor · undeclared key) (spec 11)

named byschema

non-zero exit code (default capture modes)

named bycapture

spawn failure (command not found · permission)

named bycommand

provider call failed (HTTP error · provider refusal)

written aboutThe agent workflow spectrum

structured output failed schema validation (after any engine-internal retries)

named byafteroutputschema

unknown tool (unresolvable nika:/mcp: id)

named bynika

tool args failed the tool's schema

named byschema

a dependency resolved that nika.lock does not pin, or a hand-edited lock digest does not match (pin-by-default · the lock's own hash catches the edit · spec 15)

named bynika

MCP server not configured / not reachable at call time

MCP tool call failed (transport · tool-side error)

the YAML itself does not parse (syntax error)

missing envelope field (nika: / workflow: / non-empty tasks:)

named bynikatasksworkflow

nika: version marker is not exactly v1

named bynika

workflow: id violates ^[a-z][a-z0-9-]*$

named byworkflow

unknown field — strict mode rejects anything outside the closed v1 set

task id violates ^[a-z][a-z0-9_]*$ (snake_case · CEL-safe · no hyphens)

duplicate task id within the workflow

named byworkflow

task declares no verb — exactly one of infer/exec/invoke/agent required

named byagentinferinvoke

task declares multiple verbs — exactly one required

timeout: violates the quoted Go-duration contract (positive · max 24h · descending units)

named bytimeout

retry: block violates the spec shape

named byretry

on_error: block violates the spec shape (fields mutually exclusive)

named byon_error

with:/output: binding uses a reserved name (output · status · error · started_at · ended_at · duration_ms)

named byoutputwith

secrets: entry is not a store reference — inline literals forbidden

named bysecrets

typed vars: declaration malformed (type in string/number/integer/boolean/array/object)

duplicate mapping key — no silent last-wins

missing required field in a verb body (infer.prompt · exec.command · invoke.tool)

named bycommandexecinferinvokeprompt

generic structural validation — wrong YAML shape for a field

workflow: is a scalar — the envelope became an object (workflow: then id: <value>)

named byidworkflow

top-level description: — it moved into workflow.description

named bydescriptionworkflow

tasks: is a sequence — it became a map keyed by task id (drop `- id:`, the key IS the identity)

named byidtasks

a task carries an id: field — the map key is the identity, the field is gone

named byid

a task carries depends_on: — dead since W2 (data → with: bindings · control → after: predicates · check --fix migrates)

named byafterwith

decode: with capture: structured — that capture already IS an object · type it with returns:

named bycapturedecodereturns

a hard policy: rule is violated (require.human_gate_before · forbid.exec_after · allow.providers · limits.max_tasks) — the diagnostic names rule + task + witness (order rules: the path) · check-time, before any token (spec 10)

named bypolicy

a gateway artifact (deployment bundle · capabilities report · lowering report · fidelity report · authority delta) is malformed or violates its laws (unknown promoted · permissive_unsafe without refusal · disclosure subset-chain violated · child authority exceeding parent) (spec 12)

policy lowering is permissive_unsafe — the backend would allow what the policy forbids · refused with the divergence witness (spec 12)

named bypolicy

exec: blocklist hit

named byexec

agent tool call outside the tools: whitelist

named byagenttools

run-recursion bound — nested-run depth exceeded OR self-launching workflow

named byworkflow

effect outside the declared permits: capability boundary (fs/net/exec/tool)

named bypermits

written aboutThe blast radius is part of the file

SSRF block — a nika:fetch/nika:notify URL resolves to a loopback/private/link-local/metadata target (always-on engine floor · independent of permits:)

named bynikapermits

secret flow — a secrets.<name> value reaches an unsanctioned sink (exec argument · invoke payload · infer/agent prompt) · the diagnostic carries the taint path + the egress clause that would sanction it (spec 10 · flow rules in 01 §egress)

named byagentinferinvokepromptsecrets

secret egress — a tainted value reaches the workflow boundary (outputs:) · the diagnostic carries the taint path (spec 10 · the to: outputs sanction in 01 §egress)

named byoutputsworkflow

task (or for_each iteration) exceeded timeout:

named byfor_eachtimeout

unknown type name (in types: · returns: · an outputs: type) — did-you-mean when close

named byoutputsreturnstypes

recursive type reference — the types: graph must be acyclic

named bytypes

returns: and schema: on the same task — one contract, one spelling

named byreturnsschema

returns: type unreachable from the declared decode: (an object contract over decode: text · …)

named bydecodereturns

a secret-carrying type in a lowered position (reserved with secret<T> · W4)

regex pattern outside the locked dialect (backreference · lookaround · named group · inline flags · lazy/possessive · word-boundary · unicode-class — spec 09 §the regex dialect)

run-time contract violation — the decoded value does not fit returns: (exec:/invoke: lane)

named byexecinvokereturns

unresolved reference (unknown namespace entry · undeclared env/vars key)

binding cardinality — a jq binding emitted zero or multiple values

provably-invalid path into a declared schema (static walk)

named byschema

jq runtime error while evaluating a binding

static expression violation — outside cel-subset/0.1 · chained relation · unknown function · non-boolean when: root · jq compile error

named bywhen

expression type error at evaluation — cross-type compare · non-boolean when: value · for_each over a non-array

named byfor_eachwhen

bytes value substituted into a string position

unclosed ${{ opener

typed outputs value did not match its declared type: at run end (the output half of the callable contract)

named byoutputoutputs

bare tasks.X is the envelope, not a value — the projection set (.output/.status/.error/.duration_ms) is closed and required (04 §namespaces · 0.103 · #75 D2)

named byoutputtasks

a tasks.* reference outside the boundary (with: · after: · on_error.recover · on_finally parent-only · workflow outputs) — hoist it into with: (check --fix applies it)

named byafteron_erroron_finallyoutputsrecovertaskswithworkflow