{"row":{"n":"0005","slug":"nep-0005-env-permit-dimension","file":"nep-0005-env-permit-dimension.md","headline":"The environment permit: a child's environment is composed, never inherited","title":"`env:` is a permit category: the child process environment is composed from a published floor plus the declared passthrough, never inherited","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 made the absent boundary fail-closed and NEP-0004 made the\npresent boundary honest against attacker-controlled values.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Migration plan","anchor":"migration-plan"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1491,"sha256":"e5fc719bcec4ed72be32303560b38483b16c076f19ac39a5c7b31f2f001561c3"},"prev":{"n":"0004","slug":"nep-0004-permit-parameterization-taint","file":"nep-0004-permit-parameterization-taint.md","headline":"Permit-parameterization taint: untrusted values re-gate under permits","title":"An untrusted value never reaches a permit bound, and reaches a permitted verb's argument only through the re-gate","status":"Draft","type":"Standards Track","created":"2026-07-22","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 made the boundary fail-closed when the block is absent.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Migration plan","anchor":"migration-plan"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1842,"sha256":"0e388b555a3ffce4c7cae697067deb944181e50163fbafd1f69d83e670f4e484"},"next":{"n":"0006","slug":"nep-0006-data-as-code-sink","file":"nep-0006-data-as-code-sink.md","headline":"The data-as-code sink: a fetch of a code-bearing artifact is never innocent","title":"The contract distinguishes inert reads from code-bearing reads: a fetch whose artifact class can execute is refused, unless the read is declared inert","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 sealed the absent boundary, NEP-0004 the values flowing under\nit, NEP-0005 the environment plane.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Migration plan","anchor":"migration-plan"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1230,"sha256":"465beb460148e07bac89375b0876e98b66a2a791ad60bd1bc0e516fc389c5aa6"},"total":18}

[{"k":"h","depth":1,"text":"NEP-0005 · The environment permit: a child's environment is composed, never inherited","id":"nep-0005--the-environment-permit-a-childs-environment-is-composed-never-inherited"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"NEP"},{"k":"text","text":": 0005 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint)"}],[{"k":"strong","text":"Title"},{"k":"text","text":": "},{"k":"code","text":"env:"},{"k":"text","text":" is a permit category: the child process environment is composed from a published floor plus the declared passthrough, never inherited"}],[{"k":"strong","text":"Author"},{"k":"text","text":": Thibaut Melen (SuperNovae Studio)"}],[{"k":"strong","text":"Status"},{"k":"text","text":": Draft"}],[{"k":"strong","text":"Type"},{"k":"text","text":": Standards Track"}],[{"k":"strong","text":"Created"},{"k":"text","text":": 2026-07-23"}]]},{"k":"h","depth":2,"text":"Abstract","id":"abstract"},{"k":"p","inline":[{"k":"text","text":"NEP-0003 made the absent boundary fail-closed and NEP-0004 made the\npresent boundary honest against attacker-controlled values. This NEP\ncloses the one capability plane the "},{"k":"code","text":"permits:"},{"k":"text","text":" block still does not name:\nthe process environment. Cloud and cluster credentials live in\nenvironment variables, and today a spawned subprocess inherits the\nengine's ENTIRE environment minus a dangerous-name denylist, so one\nallowlisted program can read "},{"k":"code","text":"AWS_SECRET_ACCESS_KEY"},{"k":"text","text":" without a single\ndeclared grant. "},{"k":"code","text":"env:"},{"k":"text","text":" becomes a permit category. A child process\nenvironment is COMPOSED: the runner env floor (a fixed, spec-published\nname list) ∪ the declared "},{"k":"code","text":"env:"},{"k":"text","text":" passthrough (exact names, resolved from\nthe engine's environment at spawn) ∪ the task's explicit "},{"k":"code","text":"env:"},{"k":"text","text":" map\n(authored values) − the dangerous-name floor. Inheritance is dead: a\nworkflow that declares no "},{"k":"code","text":"env:"},{"k":"text","text":" spawns children that see the floor and\nnothing else."}]},{"k":"h","depth":2,"text":"Motivation","id":"motivation"},{"k":"p","inline":[{"k":"text","text":"HF incident stage 3: the pivot from one compromised process to the\nplatform's cloud account rode ambient credentials in the environment.\nA denylist scrub (the engine's dangerous-name floor) kills the INJECTION\nclass ("},{"k":"code","text":"LD_PRELOAD"},{"k":"text","text":", "},{"k":"code","text":"BASH_ENV"},{"k":"text","text":", interpreter hooks) and can never kill\nthe DISCLOSURE class: no list enumerates every secret-bearing name an\noperator exports. Deny-by-default with a declared passthrough is the only\nshape that contains the credential plane, and it is the exact posture the\nengine's MCP stdio spawn already runs as an implementation choice\n("},{"k":"code","text":"env_clear"},{"k":"text","text":" plus a curated 8-name passthrough). This NEP promotes that\nposture from an engine detail to the LAW of every child, governed by the\nfile: the "},{"k":"code","text":"permits:"},{"k":"text","text":" block finally names the reach that credentials ride."}]},{"k":"h","depth":2,"text":"Specification","id":"specification"},{"k":"p","inline":[{"k":"text","text":"Definitions (normative · closed):"}]},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"CHILD PROCESS"},{"k":"text","text":" · any OS process an engine spawns on behalf of a\nworkflow: the "},{"k":"code","text":"exec"},{"k":"text","text":" verb's subprocess (argv and shell forms) and a\nstdio tool server ("},{"k":"code","text":"mcp:*"},{"k":"text","text":"). The engine process itself is not a child:\n"},{"k":"code","text":"infer"},{"k":"text","text":" provider calls, first-party builtins, and the in-engine\ncomposition of a child WORKFLOW (14-composition) spawn nothing here."}],[{"k":"strong","text":"RUNNER ENV FLOOR"},{"k":"text","text":" · the fixed name list "},{"k":"code","text":"PATH"},{"k":"text","text":", "},{"k":"code","text":"HOME"},{"k":"text","text":", "},{"k":"code","text":"TMPDIR"},{"k":"text","text":",\n"},{"k":"code","text":"LANG"},{"k":"text","text":", "},{"k":"code","text":"LC_ALL"},{"k":"text","text":", "},{"k":"code","text":"TZ"},{"k":"text","text":", "},{"k":"code","text":"USER"},{"k":"text","text":", "},{"k":"code","text":"LOGNAME"},{"k":"text","text":". A loader path, a home for\ncaches, scratch, locale and timezone: what a child needs to RUN, and\nnothing that names a credential. The list is a normative MAXIMUM: an\nengine MUST NOT pass any undeclared name beyond it and MAY pass fewer."}],[{"k":"strong","text":"DANGEROUS-NAME FLOOR"},{"k":"text","text":" · the injection-vector names an engine strips\nunconditionally and LAST: dynamic-linker injection, shell startup\nsourcing, tool command hooks, interpreter pre-exec hooks, and\nfield-splitting ("},{"k":"code","text":"IFS"},{"k":"text","text":"). The engine's canonical list\n("},{"k":"code","text":"DANGEROUS_ENV_VARS"},{"k":"text","text":") is the reference; no grant overrides it."}],[{"k":"strong","text":"`env:` CATEGORY"},{"k":"text","text":" · a list of exact environment variable names. A\nname MUST match the POSIX shape "},{"k":"code","text":"[A-Za-z_][A-Za-z0-9_]*"},{"k":"text","text":". No globs. A\nname is a permit BOUND: LAW-AUTH-0325 literality applies, so an\ninterpolation in the list is a hard refusal ("},{"k":"code","text":"NIKA-AUTH-007"},{"k":"text","text":")."}],[{"k":"strong","text":"COMPOSED ENVIRONMENT"},{"k":"text","text":" · floor-resolved ∪ passthrough-resolved ∪ the\ntask-level "},{"k":"code","text":"env:"},{"k":"text","text":" map, minus the dangerous-name floor. Resolution reads\nthe ENGINE's environment at spawn time; a declared name absent from the\nengine environment passes nothing (no error, no empty-string synthesis)."}]]},{"k":"p","inline":[{"k":"text","text":"The law (MUST/SHOULD):"}]},{"k":"list","ordered":true,"items":[[{"k":"text","text":"A child process environment MUST be composed, never inherited. With no\n"},{"k":"code","text":"env:"},{"k":"text","text":" category (or no "},{"k":"code","text":"permits:"},{"k":"text","text":" block at all · NEP-0003), the child\nsees at most the runner env floor plus the task's explicit "},{"k":"code","text":"env:"},{"k":"text","text":" map."}],[{"k":"text","text":"A declared "},{"k":"code","text":"env:"},{"k":"text","text":" list passes exactly the named engine variables to\nevery child process of the workflow. Presence in the list grants\nREACH; the engine environment supplies the value or nothing."}],[{"k":"text","text":"A name on the dangerous-name floor is never passable: an "},{"k":"code","text":"env:"},{"k":"text","text":" entry\nnaming one is an inert dead grant and MUST be flagged at check\n("},{"k":"code","text":"NIKA-AUTH-009"},{"k":"text","text":" · security_error), and a task-map entry naming one is\nstripped last (the floor wins, today's behavior kept)."}],[{"k":"text","text":"An "},{"k":"code","text":"env:"},{"k":"text","text":" bound MUST be a literal exact POSIX name: interpolation in\nthe list is "},{"k":"code","text":"NIKA-AUTH-007"},{"k":"text","text":" (LAW-AUTH-0325 covers every bound, this\ncategory included); a non-name string is a parse-level refusal."}],[{"k":"text","text":"Under composition (14) the effective category is the meet: child ∩\nparent, exact-name intersection. An absent parent block still means\nzero (NEP-0003): no child obtains a passthrough its parent could not\ngrant."}],[{"k":"text","text":"The task-level "},{"k":"code","text":"env:"},{"k":"text","text":" map (02-verbs §exec) stays authored data: values\nthe file carries, visible at review distance, applied AFTER the\npassthrough (an authored entry wins over an inherited one on the same\nname), still under the dangerous-name floor. Nothing about its grammar\nchanges."}],[{"k":"code","text":"env:"},{"k":"text","text":" is not inferable. Permit-inference tooling MUST NOT invent the\nlist: a subprocess's environment reads are opaque to static analysis.\nThe undeclared-read failure mode is the child tool's own\nmissing-variable error; an engine SHOULD document the one-line repair\n("},{"k":"code","text":"env: [NAME]"},{"k":"text","text":") next to that story."}]]},{"k":"p","inline":[{"k":"text","text":"Registry and prose touched:"}]},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"LAW-AUTH-0326"},{"k":"text","text":" is added to "},{"k":"code","text":"canon/laws/authority.yaml"},{"k":"text","text":" (status\nactive) · the machine row of this law."}],[{"k":"code","text":"spec/01-envelope.md"},{"k":"text","text":" §permits gains the "},{"k":"code","text":"env"},{"k":"text","text":" category row, the sample\nline, and « The environment category (normative) » · "},{"k":"code","text":"spec/02-verbs.md"},{"k":"text","text":"\n§exec "},{"k":"code","text":"env:"},{"k":"text","text":" gains the composed-never-inherited pointer ·\n"},{"k":"code","text":"spec/10-authority.md"},{"k":"text","text":" §the permit-parameterization taint counts env\nnames among the literal bounds."}],[{"k":"code","text":"canon/diagnostics/registry.yaml"},{"k":"text","text":" gains "},{"k":"code","text":"NIKA-AUTH-009"},{"k":"text","text":" (the AUTH\nfamily carries the defects of the boundary block itself: 006 absent ·\n007 non-literal bound · 008 re-gate escape · 009 dead grant; the SEC\nfamily stays the run-time floor and flow classes); the "},{"k":"code","text":"NIKA-AUTH-007"},{"k":"text","text":"\nteaching names env alongside host/glob/program."}],[{"k":"text","text":"Implementation surfaces: the schema parser (the strict "},{"k":"code","text":"permits:"},{"k":"text","text":"\ngrammar) · the check (dead-grant flag, bound literality, composition\ncontainment) · the spawn sites (the exec runner's clean slate, the MCP\nstdio scrub's declared allowlist) · the permits algebra (the meet)."}]]},{"k":"h","depth":2,"text":"Conformance test","id":"conformance-test"},{"k":"p","inline":[{"k":"text","text":"Four static pairs ship in "},{"k":"code","text":"conformance/tests/core/authority/"},{"k":"text","text":" (014-017,\ncontinuing the NEP-0004 suite) plus two behavioral contracts\n("},{"k":"code","text":"runtime/permits/005-006"},{"k":"text","text":" · the reserved tier: the executable proof\nlands engine-side, one canary flipped by one declared line).\nEngine/reference differential per LAW-AUTH-0319."}]},{"k":"h","depth":2,"text":"Compatibility impact","id":"compatibility-impact"},{"k":"p","inline":[{"k":"text","text":"NOT additive at run for a workflow whose subprocess reads an undeclared\nambient variable · additive for every file in the reference corpora\n(census at engine 042aeaf95 and spec 38614d2: zero engine, spec, or\nexample workflow reads ambient env in a command). The break surfaces as\nthe child tool's own missing-variable error, and the repair is one\ndeclared line. The grammar change is additive ("},{"k":"code","text":"env:"},{"k":"text","text":" is a new optional\nkey under "},{"k":"code","text":"permits:"},{"k":"text","text":"; the "},{"k":"code","text":"nika: v1"},{"k":"text","text":" marker is untouched)."}]},{"k":"h","depth":2,"text":"Migration plan","id":"migration-plan"},{"k":"p","inline":[{"k":"strong","text":"What changes for you."},{"k":"text","text":" A subprocess no longer sees the engine's\nenvironment. It sees the runner env floor ("},{"k":"code","text":"PATH"},{"k":"text","text":", "},{"k":"code","text":"HOME"},{"k":"text","text":", "},{"k":"code","text":"TMPDIR"},{"k":"text","text":",\n"},{"k":"code","text":"LANG"},{"k":"text","text":", "},{"k":"code","text":"LC_ALL"},{"k":"text","text":", "},{"k":"code","text":"TZ"},{"k":"text","text":", "},{"k":"code","text":"USER"},{"k":"text","text":", "},{"k":"code","text":"LOGNAME"},{"k":"text","text":"), what your task's "},{"k":"code","text":"env:"},{"k":"text","text":" map\nsets, and the variables your "},{"k":"code","text":"permits.env:"},{"k":"text","text":" names, nothing else:"}]},{"k":"code","lang":"yaml","text":"permits:\n  exec: [\"terraform\"]\n  env: [\"AWS_ACCESS_KEY_ID\", \"AWS_SECRET_ACCESS_KEY\", \"AWS_DEFAULT_REGION\"]"},{"k":"p","inline":[{"k":"text","text":"Each passed credential is one greppable line in the file that IS the\nblast radius. A tool failing with « VARIABLE not set » after this change\nis the law working: add the name to "},{"k":"code","text":"permits.env:"},{"k":"text","text":", or set the value in\nthe task's "},{"k":"code","text":"env:"},{"k":"text","text":" map when it is authored data. Two check errors teach\nthe block's own defects:"}]},{"k":"code","lang":"text","text":"error[NIKA-AUTH-007]: permit bound `env[0]` is interpolated, not literal\n  · a bound is the wall itself: write the exact variable name\nerror[NIKA-AUTH-009]: permit entry `env: [\"LD_PRELOAD\"]` is an inert dead grant\n  · the dangerous-name floor strips this name unconditionally: the grant can never take effect · remove it"},{"k":"p","inline":[{"k":"text","text":"Nothing else changes: the verbs, the other categories, the task "},{"k":"code","text":"env:"},{"k":"text","text":"\nmap, and the "},{"k":"code","text":"nika: v1"},{"k":"text","text":" marker are untouched."}]},{"k":"h","depth":2,"text":"Rejected alternatives","id":"rejected-alternatives"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"Deny-list only (the status quo)"},{"k":"text","text":" · rejected: a denylist kills the\ninjection class and structurally cannot kill the disclosure class; no\nlist enumerates every secret-bearing name."}],[{"k":"strong","text":"Glob passthrough (`AWS_*`)"},{"k":"text","text":" · rejected for v1: the glob that matches\nthe harmless id also matches the secret; exact names keep one line =\none credential at review distance. A glob arm can only enter by NEP."}],[{"k":"strong","text":"Values inside the permit (`env: {KEY: value}`)"},{"k":"text","text":" · rejected: values\nare the task map's job (02-verbs); a permit names REACH, never data."}],[{"k":"strong","text":"Per-task `env:` permits"},{"k":"text","text":" · rejected for v1: the block is the\nworkflow's blast radius (01 §permits posture); task-grain scoping\narrives with the narrowing story, not here."}],[{"k":"strong","text":"Synthesizing empty strings for absent names"},{"k":"text","text":" · rejected: inventing a\nvalue masks a deployment defect; absence propagates honestly."}],[{"k":"strong","text":"Refusing the run when a child reads an undeclared variable"},{"k":"text","text":" ·\nrejected: environment reads happen inside the child, unobservable in\ngeneral; composition is enforceable, interception is not. Composing the\nvariable OUT is the enforceable truth, and the child's own error is the\nhonest signal."}],[{"k":"strong","text":"Exec-only scope (leaving `mcp:*` servers on the curated list)"},{"k":"text","text":" ·\nrejected: one law for every child, or the hole migrates from the verb\nto the tool server."}]]}]

NEP-0005

The environment permit: a child's environment is composed, never inherited

Draft · Standards Track · opened 2026-07-23 · 1491 words

NEP-0005 · The environment permit: a child's environment is composed, never inherited #

NEP: 0005 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint)
Title: env: is a permit category: the child process environment is composed from a published floor plus the declared passthrough, never inherited
Author: Thibaut Melen (SuperNovae Studio)
Status: Draft
Type: Standards Track
Created: 2026-07-23

Abstract #

NEP-0003 made the absent boundary fail-closed and NEP-0004 made the present boundary honest against attacker-controlled values. This NEP closes the one capability plane the permits: block still does not name: the process environment. Cloud and cluster credentials live in environment variables, and today a spawned subprocess inherits the engine's ENTIRE environment minus a dangerous-name denylist, so one allowlisted program can read AWS_SECRET_ACCESS_KEY without a single declared grant. env: becomes a permit category. A child process environment is COMPOSED: the runner env floor (a fixed, spec-published name list) ∪ the declared env: passthrough (exact names, resolved from the engine's environment at spawn) ∪ the task's explicit env: map (authored values) − the dangerous-name floor. Inheritance is dead: a workflow that declares no env: spawns children that see the floor and nothing else.

Motivation #

HF incident stage 3: the pivot from one compromised process to the platform's cloud account rode ambient credentials in the environment. A denylist scrub (the engine's dangerous-name floor) kills the INJECTION class (LD_PRELOAD, BASH_ENV, interpreter hooks) and can never kill the DISCLOSURE class: no list enumerates every secret-bearing name an operator exports. Deny-by-default with a declared passthrough is the only shape that contains the credential plane, and it is the exact posture the engine's MCP stdio spawn already runs as an implementation choice (env_clear plus a curated 8-name passthrough). This NEP promotes that posture from an engine detail to the LAW of every child, governed by the file: the permits: block finally names the reach that credentials ride.

Specification #

Definitions (normative · closed):

CHILD PROCESS · any OS process an engine spawns on behalf of a workflow: the exec verb's subprocess (argv and shell forms) and a stdio tool server (mcp:*). The engine process itself is not a child: infer provider calls, first-party builtins, and the in-engine composition of a child WORKFLOW (14-composition) spawn nothing here.
RUNNER ENV FLOOR · the fixed name list PATH, HOME, TMPDIR, LANG, LC_ALL, TZ, USER, LOGNAME. A loader path, a home for caches, scratch, locale and timezone: what a child needs to RUN, and nothing that names a credential. The list is a normative MAXIMUM: an engine MUST NOT pass any undeclared name beyond it and MAY pass fewer.
DANGEROUS-NAME FLOOR · the injection-vector names an engine strips unconditionally and LAST: dynamic-linker injection, shell startup sourcing, tool command hooks, interpreter pre-exec hooks, and field-splitting (IFS). The engine's canonical list (DANGEROUS_ENV_VARS) is the reference; no grant overrides it.
`env:` CATEGORY · a list of exact environment variable names. A name MUST match the POSIX shape [A-Za-z_][A-Za-z0-9_]*. No globs. A name is a permit BOUND: LAW-AUTH-0325 literality applies, so an interpolation in the list is a hard refusal (NIKA-AUTH-007).
COMPOSED ENVIRONMENT · floor-resolved ∪ passthrough-resolved ∪ the task-level env: map, minus the dangerous-name floor. Resolution reads the ENGINE's environment at spawn time; a declared name absent from the engine environment passes nothing (no error, no empty-string synthesis).

The law (MUST/SHOULD):

A child process environment MUST be composed, never inherited. With no env: category (or no permits: block at all · NEP-0003), the child sees at most the runner env floor plus the task's explicit env: map.
A declared env: list passes exactly the named engine variables to every child process of the workflow. Presence in the list grants REACH; the engine environment supplies the value or nothing.
A name on the dangerous-name floor is never passable: an env: entry naming one is an inert dead grant and MUST be flagged at check (NIKA-AUTH-009 · security_error), and a task-map entry naming one is stripped last (the floor wins, today's behavior kept).
An env: bound MUST be a literal exact POSIX name: interpolation in the list is NIKA-AUTH-007 (LAW-AUTH-0325 covers every bound, this category included); a non-name string is a parse-level refusal.
Under composition (14) the effective category is the meet: child ∩ parent, exact-name intersection. An absent parent block still means zero (NEP-0003): no child obtains a passthrough its parent could not grant.
The task-level env: map (02-verbs §exec) stays authored data: values the file carries, visible at review distance, applied AFTER the passthrough (an authored entry wins over an inherited one on the same name), still under the dangerous-name floor. Nothing about its grammar changes.
env: is not inferable. Permit-inference tooling MUST NOT invent the list: a subprocess's environment reads are opaque to static analysis. The undeclared-read failure mode is the child tool's own missing-variable error; an engine SHOULD document the one-line repair (env: [NAME]) next to that story.

Registry and prose touched:

LAW-AUTH-0326 is added to canon/laws/authority.yaml (status active) · the machine row of this law.
spec/01-envelope.md §permits gains the env category row, the sample line, and « The environment category (normative) » · spec/02-verbs.md §exec env: gains the composed-never-inherited pointer · spec/10-authority.md §the permit-parameterization taint counts env names among the literal bounds.
canon/diagnostics/registry.yaml gains NIKA-AUTH-009 (the AUTH family carries the defects of the boundary block itself: 006 absent · 007 non-literal bound · 008 re-gate escape · 009 dead grant; the SEC family stays the run-time floor and flow classes); the NIKA-AUTH-007 teaching names env alongside host/glob/program.
Implementation surfaces: the schema parser (the strict permits: grammar) · the check (dead-grant flag, bound literality, composition containment) · the spawn sites (the exec runner's clean slate, the MCP stdio scrub's declared allowlist) · the permits algebra (the meet).

Conformance test #

Four static pairs ship in conformance/tests/core/authority/ (014-017, continuing the NEP-0004 suite) plus two behavioral contracts (runtime/permits/005-006 · the reserved tier: the executable proof lands engine-side, one canary flipped by one declared line). Engine/reference differential per LAW-AUTH-0319.

Compatibility impact #

NOT additive at run for a workflow whose subprocess reads an undeclared ambient variable · additive for every file in the reference corpora (census at engine 042aeaf95 and spec 38614d2: zero engine, spec, or example workflow reads ambient env in a command). The break surfaces as the child tool's own missing-variable error, and the repair is one declared line. The grammar change is additive (env: is a new optional key under permits:; the nika: v1 marker is untouched).

Migration plan #

What changes for you. A subprocess no longer sees the engine's environment. It sees the runner env floor (PATH, HOME, TMPDIR, LANG, LC_ALL, TZ, USER, LOGNAME), what your task's env: map sets, and the variables your permits.env: names, nothing else:

yaml

1⛨permits:2  ⛨exec: ["terraform"]3  ⛨env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_DEFAULT_REGION"]

Each passed credential is one greppable line in the file that IS the blast radius. A tool failing with « VARIABLE not set » after this change is the law working: add the name to permits.env:, or set the value in the task's env: map when it is authored data. Two check errors teach the block's own defects:

text

1error[NIKA-AUTH-007]: permit bound `env[0]` is interpolated, not literal2  · a bound is the wall itself: write the exact variable name3error[NIKA-AUTH-009]: permit entry `env: ["LD_PRELOAD"]` is an inert dead grant4  · the dangerous-name floor strips this name unconditionally: the grant can never take effect · remove it

Nothing else changes: the verbs, the other categories, the task env: map, and the nika: v1 marker are untouched.

Rejected alternatives #

Deny-list only (the status quo) · rejected: a denylist kills the injection class and structurally cannot kill the disclosure class; no list enumerates every secret-bearing name.
Glob passthrough (`AWS_*`) · rejected for v1: the glob that matches the harmless id also matches the secret; exact names keep one line = one credential at review distance. A glob arm can only enter by NEP.
Values inside the permit (`env: {KEY: value}`) · rejected: values are the task map's job (02-verbs); a permit names REACH, never data.
Per-task `env:` permits · rejected for v1: the block is the workflow's blast radius (01 §permits posture); task-grain scoping arrives with the narrowing story, not here.
Synthesizing empty strings for absent names · rejected: inventing a value masks a deployment defect; absence propagates honestly.
Refusing the run when a child reads an undeclared variable · rejected: environment reads happen inside the child, unobservable in general; composition is enforceable, interception is not. Composing the variable OUT is the enforceable truth, and the child's own error is the honest signal.
Exec-only scope (leaving `mcp:*` servers on the curated list) · rejected: one law for every child, or the hole migrates from the verb to the tool server.

This proposal in the spec repo The specification it amends