{"row":{"n":"0006","slug":"nep-0006-data-as-code-sink","file":"nep-0006-data-as-code-sink.md","headline":"The data-as-code sink: a fetch of a code-bearing artifact is never innocent","title":"The contract distinguishes inert reads from code-bearing reads: a fetch whose artifact class can execute is refused, unless the read is declared inert","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 sealed the absent boundary, NEP-0004 the values flowing under\nit, NEP-0005 the environment plane.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Migration plan","anchor":"migration-plan"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1230,"sha256":"465beb460148e07bac89375b0876e98b66a2a791ad60bd1bc0e516fc389c5aa6"},"prev":{"n":"0005","slug":"nep-0005-env-permit-dimension","file":"nep-0005-env-permit-dimension.md","headline":"The environment permit: a child's environment is composed, never inherited","title":"`env:` is a permit category: the child process environment is composed from a published floor plus the declared passthrough, never inherited","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 made the absent boundary fail-closed and NEP-0004 made the\npresent boundary honest against attacker-controlled values.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Migration plan","anchor":"migration-plan"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1491,"sha256":"e5fc719bcec4ed72be32303560b38483b16c076f19ac39a5c7b31f2f001561c3"},"next":{"n":"0007","slug":"nep-0007-trace-format-and-equivalence","file":"nep-0007-trace-format-and-equivalence.md","headline":"The trace leaves the private dialect: a normative journal, a required witness, a differential oracle","title":"The run journal is a versioned chapter of the spec, every permit decision is a required trace frame, and check ⇔ run agreement is proven by a differential oracle","status":"Draft","type":"Standards Track","created":"2026-07-23","author":"Thibaut Melen (SuperNovae Studio)","lede":"NEP-0003 through NEP-0006 hardened WHAT the boundary refuses.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1095,"sha256":"730f680968ff38df66acbeecd1d2647a6528789cd0f9bb2d526f01296c5ec3dc"},"total":18}

[{"k":"h","depth":1,"text":"NEP-0006 · The data-as-code sink: a fetch of a code-bearing artifact is never innocent","id":"nep-0006--the-data-as-code-sink-a-fetch-of-a-code-bearing-artifact-is-never-innocent"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"NEP"},{"k":"text","text":": 0006 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint · 0005 the environment permit)"}],[{"k":"strong","text":"Title"},{"k":"text","text":": The contract distinguishes inert reads from code-bearing reads: a fetch whose artifact class can execute is refused, unless the read is declared inert"}],[{"k":"strong","text":"Author"},{"k":"text","text":": Thibaut Melen (SuperNovae Studio)"}],[{"k":"strong","text":"Status"},{"k":"text","text":": Draft"}],[{"k":"strong","text":"Type"},{"k":"text","text":": Standards Track"}],[{"k":"strong","text":"Created"},{"k":"text","text":": 2026-07-23"}]]},{"k":"h","depth":2,"text":"Abstract","id":"abstract"},{"k":"p","inline":[{"k":"text","text":"NEP-0003 sealed the absent boundary, NEP-0004 the values flowing under\nit, NEP-0005 the environment plane. This NEP closes the verb-choice\nhole: acquiring an artifact whose LOAD executes code · a serialized\nobject whose deserializer runs arbitrary code, a script, an executable\nbinary · through an innocent-looking "},{"k":"code","text":"fetch"},{"k":"text","text":" hides an execution sink\nfrom review. The static judge sees « the workflow fetches a host »; the\nkill chain sees « the workflow imports a loader ». The contract now\ndistinguishes the two reads. A "},{"k":"code","text":"nika:fetch"},{"k":"text","text":" whose RESOLVED URL path\nnames a code-bearing class is refused at check ("},{"k":"code","text":"NIKA-SEC-008"},{"k":"text","text":"); the\nrepair is to model the acquisition as the "},{"k":"code","text":"exec"},{"k":"text","text":" it feeds\n(program-permitted · reviewable) or to declare the read inert\n("},{"k":"code","text":"inert: \"<because>\""},{"k":"text","text":" · the honest door · one greppable line). At run,\nthe same class refuses on the resolved URL in defense in depth\n("},{"k":"code","text":"NIKA-SEC-004"},{"k":"text","text":"), honoring the same declared door."}]},{"k":"h","depth":2,"text":"Motivation","id":"motivation"},{"k":"p","inline":[{"k":"text","text":"HF incident vector n°1: the loader RCE (arXiv:2601.14163 · code\nexecution on ML hosting through artifact loads). The dangerous act is\nnot the network read · it is that some artifact CLASSES execute at\nload: the pickle-format family deserializes by running opcodes\n("},{"k":"code","text":".pkl"},{"k":"text","text":", and the torch checkpoint family that embeds the same\nmechanism), scripts exist to be run, binaries and executable modules\nare code by definition. A workflow that models « load this dataset »\nas a bare "},{"k":"code","text":"fetch"},{"k":"text","text":" under a permitted host carries an execution sink no\nreviewer sees and no permit names. Nothing today forces the author to\nmodel that load as the "},{"k":"code","text":"exec"},{"k":"text","text":" it is · this NEP makes the mismatch a\ncheck-time refusal with a one-line repair in either honest direction."}]},{"k":"h","depth":2,"text":"Specification","id":"specification"},{"k":"p","inline":[{"k":"text","text":"Definitions (normative · closed):"}]},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"CODE-BEARING CLASS (v1)"},{"k":"text","text":" · three classes, each justified by a\nnamed RCE mechanism, matched CASE-INSENSITIVELY on the final\nextension of the resolved URL's PATH:"},{"k":"text","text":"- *serialized-executable* (the deserializer executes at load):\n  `.pkl` `.pickle` `.dill` `.joblib` `.pt` `.pth` `.ckpt`\n- *script/interpreter* (the artifact is a program):\n  `.py` `.sh` `.bash` `.zsh` `.ps1` `.bat` `.cmd` `.rb` `.pl`\n  `.php` `.js` `.mjs` `.ipynb`\n- *executable binary/module*:\n  `.exe` `.dll` `.so` `.dylib` `.wasm` `.jar`\nThe list is CLOSED and normative; only a NEP amends it. Deliberate\nexclusions: `.safetensors` (the safe tensor format · its existence\nis the argument), `.npy`/`.npz` (the loader does not execute by\ndefault since numpy 1.16.3), archives (`.zip`/`.tar.*` · every\ndataset is a tarball; the INNER artifact is judged at its consumer ·\ndeclared residual), templates (the extension signal is too weak ·\ndeclared residual)."}],[{"k":"strong","text":"RESOLVED URL"},{"k":"text","text":" · the "},{"k":"code","text":"nika:fetch"},{"k":"text","text":" "},{"k":"code","text":"url"},{"k":"text","text":" argument, literal, or\nresolved at check through the NEP-0004 rules (a "},{"k":"code","text":"\u0024{{ }}"},{"k":"text","text":" island over\n"},{"k":"code","text":"const.*"},{"k":"text","text":", or over "},{"k":"code","text":"inputs.*"},{"k":"text","text":"/"},{"k":"code","text":"config.*"},{"k":"text","text":" carrying a declared\ndefault). A URL not resolvable at check DEFERS to the run-time\ntwin · never a static refusal."}],[{"k":"strong","text":"THE INERT DOOR"},{"k":"text","text":" · the task-level "},{"k":"code","text":"inert: \"<because>\""},{"k":"text","text":" key\n(non-empty string · the justification). Authored, check-visible,\ngreppable. It lifts THIS law only."}]]},{"k":"p","inline":[{"k":"text","text":"The law (MUST):"}]},{"k":"list","ordered":true,"items":[[{"k":"text","text":"An engine MUST refuse at check a "},{"k":"code","text":"nika:fetch"},{"k":"text","text":" whose resolved URL\npath names a code-bearing class · "},{"k":"code","text":"NIKA-SEC-008"},{"k":"text","text":" (security_error ·\nblocking) · the diagnostic names the class, the extension, and both\nrepairs."}],[{"k":"text","text":"The task-level "},{"k":"code","text":"inert: \"<because>\""},{"k":"text","text":" declaration lifts law 1 for its\ntask. It never lifts the "},{"k":"code","text":"net.http"},{"k":"text","text":" boundary, the SSRF floor, or\nthe NEP-0004 taint re-gate · the door declares the READ inert, it\nwidens nothing."}],[{"k":"text","text":"An engine MUST refuse the same class at run on the RESOLVED URL\n("},{"k":"code","text":"NIKA-SEC-004"},{"k":"text","text":" · defense in depth · the dynamic case the static\njudge defers), honoring the same declared door."}],[{"k":"text","text":"Classification reads the URL PATH only · query and fragment carry\nno verdict (a "},{"k":"code","text":"?file=x.py"},{"k":"text","text":" query is not a "},{"k":"code","text":".py"},{"k":"text","text":" path · declared).\nByte-sniffing and magic-byte classification are out of scope in v1\n(declared residual · a future NEP may harden the run-time twin)."}],[{"k":"text","text":"The grammar gains exactly one optional task-level key ("},{"k":"code","text":"inert:"},{"k":"text","text":") ·\nadditive · no version marker."}]]},{"k":"p","inline":[{"k":"text","text":"Registry and prose touched:"}]},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"LAW-AUTH-0327"},{"k":"text","text":" is added to "},{"k":"code","text":"canon/laws/authority.yaml"},{"k":"text","text":" (status\nactive) · the machine row of this law."}],[{"k":"code","text":"spec/10-authority.md"},{"k":"text","text":" gains « The data-as-code sink (normative) » ·\n"},{"k":"code","text":"stdlib/builtins-v0.1.md"},{"k":"text","text":" §nika:fetch gains the class pointer."}],[{"k":"code","text":"canon/diagnostics/registry.yaml"},{"k":"text","text":" gains "},{"k":"code","text":"NIKA-SEC-008"},{"k":"text","text":" (the slot the\nF-O1 analysis confirmed free · the flow family carries the sink)."}],[{"k":"code","text":"schemas/workflow.schema.json"},{"k":"text","text":" gains the task "},{"k":"code","text":"inert"},{"k":"text","text":" key."}],[{"k":"text","text":"Implementation surfaces: the schema parser (the door key) · the\ncheck (the classifier · the deferral) · the fetch builtin (the\nrun-time twin) · the reference oracle (the same closed list ·\nengine/reference differential per LAW-AUTH-0319)."}]]},{"k":"h","depth":2,"text":"Conformance test","id":"conformance-test"},{"k":"p","inline":[{"k":"text","text":"Five static pairs ship in "},{"k":"code","text":"conformance/tests/core/authority/"},{"k":"text","text":"\n(018-022, continuing the NEP-0005 suite) plus one behavioral contract\n("},{"k":"code","text":"runtime/permits/007"},{"k":"text","text":" · the deferred dynamic case). One fixture per\nclass keeps the two mirrored lists honest."}]},{"k":"h","depth":2,"text":"Compatibility impact","id":"compatibility-impact"},{"k":"p","inline":[{"k":"text","text":"Additive for every file in the reference corpora (census at engine\n7cf8d2ba7 and spec aa96468: zero conformance, example, or template\nworkflow fetches a code-bearing URL). The one flip is deliberate and\ninside the engine's own adversarial suite: the "},{"k":"code","text":"f1-02"},{"k":"text","text":" attack fixture\nfetches "},{"k":"code","text":"install.sh"},{"k":"text","text":" and is exactly what this law now catches at\ncheck · the fixture's expected verdict gains the static finding (the\nattack is refused EARLIER, the same reclassification story as F-O1's\nf3-03)."}]},{"k":"h","depth":2,"text":"Migration plan","id":"migration-plan"},{"k":"p","inline":[{"k":"strong","text":"What changes for you."},{"k":"text","text":" A "},{"k":"code","text":"fetch"},{"k":"text","text":" of a "},{"k":"code","text":".pkl"},{"k":"text","text":", a "},{"k":"code","text":".sh"},{"k":"text","text":", a "},{"k":"code","text":".py"},{"k":"text","text":", an\nexecutable · refused at check with both repairs in the error:"}]},{"k":"code","lang":"text","text":"error[NIKA-SEC-008]: task `grab` fetches a code-bearing artifact (script class · `.sh`)\n  · https://news.example/install.sh is a program, not data · the read hides an execution sink\n  · fix: model the acquisition as the exec it feeds (exec: + a program permit) · reviewable authority\n  · or declare the read inert on the task: inert: \"archived for provenance · never loaded or run\""},{"k":"p","inline":[{"k":"text","text":"When the read genuinely never feeds an interpreter (archival ·\nscanning · provenance), declare it:"}]},{"k":"code","lang":"yaml","text":"tasks:\n  grab:\n    invoke:\n      tool: nika:fetch\n      args: { url: \"https://data.example.com/legacy-model.pkl\" }\n    inert: \"archived for provenance · never loaded by any child of this workflow\""},{"k":"p","inline":[{"k":"text","text":"One greppable line; review sees every declared exception. Nothing else\nchanges: hosts still bind under "},{"k":"code","text":"net.http"},{"k":"text","text":", the SSRF floor still\nrefuses, dynamic URLs still re-gate at run."}]},{"k":"h","depth":2,"text":"Rejected alternatives","id":"rejected-alternatives"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"Classify by Content-Type"},{"k":"text","text":" · rejected: the header is\nserver-controlled · the attacker names their own class."}],[{"k":"strong","text":"Classify at extract-time"},{"k":"text","text":" · rejected: too late, the bytes landed;\ncheck-time is where review happens."}],[{"k":"strong","text":"An allowlist of inert extensions"},{"k":"text","text":" · rejected: the inert world is\nunbounded; the code-bearing set is the small closed one."}],[{"k":"strong","text":"Auto-reclassify the fetch as exec"},{"k":"text","text":" · rejected: a verb that\nsilently changes meaning is magic; the author declares, the engine\nrefuses."}],[{"k":"strong","text":"A per-URL door (`inert_urls:` list)"},{"k":"text","text":" · rejected: the task is the\nreviewable unit; one fetch per task is already the shape the taint\nlaws assume."}],[{"k":"strong","text":"Extending the law to `nika:notify`"},{"k":"text","text":" · rejected: notify is egress\n(it posts OUT); the sink this NEP names is the read."}]]}]

NEP-0006

The data-as-code sink: a fetch of a code-bearing artifact is never innocent

Draft · Standards Track · opened 2026-07-23 · 1230 words

NEP-0006 · The data-as-code sink: a fetch of a code-bearing artifact is never innocent #

NEP: 0006 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint · 0005 the environment permit)
Title: The contract distinguishes inert reads from code-bearing reads: a fetch whose artifact class can execute is refused, unless the read is declared inert
Author: Thibaut Melen (SuperNovae Studio)
Status: Draft
Type: Standards Track
Created: 2026-07-23

Abstract #

NEP-0003 sealed the absent boundary, NEP-0004 the values flowing under it, NEP-0005 the environment plane. This NEP closes the verb-choice hole: acquiring an artifact whose LOAD executes code · a serialized object whose deserializer runs arbitrary code, a script, an executable binary · through an innocent-looking fetch hides an execution sink from review. The static judge sees « the workflow fetches a host »; the kill chain sees « the workflow imports a loader ». The contract now distinguishes the two reads. A nika:fetch whose RESOLVED URL path names a code-bearing class is refused at check (NIKA-SEC-008); the repair is to model the acquisition as the exec it feeds (program-permitted · reviewable) or to declare the read inert (inert: "<because>" · the honest door · one greppable line). At run, the same class refuses on the resolved URL in defense in depth (NIKA-SEC-004), honoring the same declared door.

Motivation #

HF incident vector n°1: the loader RCE (arXiv:2601.14163 · code execution on ML hosting through artifact loads). The dangerous act is not the network read · it is that some artifact CLASSES execute at load: the pickle-format family deserializes by running opcodes (.pkl, and the torch checkpoint family that embeds the same mechanism), scripts exist to be run, binaries and executable modules are code by definition. A workflow that models « load this dataset » as a bare fetch under a permitted host carries an execution sink no reviewer sees and no permit names. Nothing today forces the author to model that load as the exec it is · this NEP makes the mismatch a check-time refusal with a one-line repair in either honest direction.

Specification #

Definitions (normative · closed):

CODE-BEARING CLASS (v1) · three classes, each justified by a named RCE mechanism, matched CASE-INSENSITIVELY on the final extension of the resolved URL's PATH:- *serialized-executable* (the deserializer executes at load): `.pkl` `.pickle` `.dill` `.joblib` `.pt` `.pth` `.ckpt` - *script/interpreter* (the artifact is a program): `.py` `.sh` `.bash` `.zsh` `.ps1` `.bat` `.cmd` `.rb` `.pl` `.php` `.js` `.mjs` `.ipynb` - *executable binary/module*: `.exe` `.dll` `.so` `.dylib` `.wasm` `.jar` The list is CLOSED and normative; only a NEP amends it. Deliberate exclusions: `.safetensors` (the safe tensor format · its existence is the argument), `.npy`/`.npz` (the loader does not execute by default since numpy 1.16.3), archives (`.zip`/`.tar.*` · every dataset is a tarball; the INNER artifact is judged at its consumer · declared residual), templates (the extension signal is too weak · declared residual).
RESOLVED URL · the nika:fetch url argument, literal, or resolved at check through the NEP-0004 rules (a ${{ }} island over const.*, or over inputs.*/config.* carrying a declared default). A URL not resolvable at check DEFERS to the run-time twin · never a static refusal.
THE INERT DOOR · the task-level inert: "<because>" key (non-empty string · the justification). Authored, check-visible, greppable. It lifts THIS law only.

The law (MUST):

An engine MUST refuse at check a nika:fetch whose resolved URL path names a code-bearing class · NIKA-SEC-008 (security_error · blocking) · the diagnostic names the class, the extension, and both repairs.
The task-level inert: "<because>" declaration lifts law 1 for its task. It never lifts the net.http boundary, the SSRF floor, or the NEP-0004 taint re-gate · the door declares the READ inert, it widens nothing.
An engine MUST refuse the same class at run on the RESOLVED URL (NIKA-SEC-004 · defense in depth · the dynamic case the static judge defers), honoring the same declared door.
Classification reads the URL PATH only · query and fragment carry no verdict (a ?file=x.py query is not a .py path · declared). Byte-sniffing and magic-byte classification are out of scope in v1 (declared residual · a future NEP may harden the run-time twin).
The grammar gains exactly one optional task-level key (inert:) · additive · no version marker.

Registry and prose touched:

LAW-AUTH-0327 is added to canon/laws/authority.yaml (status active) · the machine row of this law.
spec/10-authority.md gains « The data-as-code sink (normative) » · stdlib/builtins-v0.1.md §nika:fetch gains the class pointer.
canon/diagnostics/registry.yaml gains NIKA-SEC-008 (the slot the F-O1 analysis confirmed free · the flow family carries the sink).
schemas/workflow.schema.json gains the task inert key.
Implementation surfaces: the schema parser (the door key) · the check (the classifier · the deferral) · the fetch builtin (the run-time twin) · the reference oracle (the same closed list · engine/reference differential per LAW-AUTH-0319).

Conformance test #

Five static pairs ship in conformance/tests/core/authority/ (018-022, continuing the NEP-0005 suite) plus one behavioral contract (runtime/permits/007 · the deferred dynamic case). One fixture per class keeps the two mirrored lists honest.

Compatibility impact #

Additive for every file in the reference corpora (census at engine 7cf8d2ba7 and spec aa96468: zero conformance, example, or template workflow fetches a code-bearing URL). The one flip is deliberate and inside the engine's own adversarial suite: the f1-02 attack fixture fetches install.sh and is exactly what this law now catches at check · the fixture's expected verdict gains the static finding (the attack is refused EARLIER, the same reclassification story as F-O1's f3-03).

Migration plan #

What changes for you. A fetch of a .pkl, a .sh, a .py, an executable · refused at check with both repairs in the error:

text

1error[NIKA-SEC-008]: task `grab` fetches a code-bearing artifact (script class · `.sh`)2  · https://news.example/install.sh is a program, not data · the read hides an execution sink3  · fix: model the acquisition as the exec it feeds (exec: + a program permit) · reviewable authority4  · or declare the read inert on the task: inert: "archived for provenance · never loaded or run"

When the read genuinely never feeds an interpreter (archival · scanning · provenance), declare it:

yaml

1tasks:2  grab:3    ◆invoke:4      tool: nika:fetch5      args: { url: "https://data.example.com/legacy-model.pkl" }6    inert: "archived for provenance · never loaded by any child of this workflow"

One greppable line; review sees every declared exception. Nothing else changes: hosts still bind under net.http, the SSRF floor still refuses, dynamic URLs still re-gate at run.

Rejected alternatives #

Classify by Content-Type · rejected: the header is server-controlled · the attacker names their own class.
Classify at extract-time · rejected: too late, the bytes landed; check-time is where review happens.
An allowlist of inert extensions · rejected: the inert world is unbounded; the code-bearing set is the small closed one.
Auto-reclassify the fetch as exec · rejected: a verb that silently changes meaning is magic; the author declares, the engine refuses.
A per-URL door (`inert_urls:` list) · rejected: the task is the reviewable unit; one fetch per task is already the shape the taint laws assume.
Extending the law to `nika:notify` · rejected: notify is egress (it posts OUT); the sink this NEP names is the read.

This proposal in the spec repo The specification it amends