the language

permits

The declared capability boundary · once present every category is default-deny unless listed (spec/01-envelope.md §permits · NIKA-SEC-004). One of 59 words the served contract declares, projected from workflow.schema.json, the same file your editor validates against.

1surfaceenvelope
optionaleverywherea choice, never a miss
objecttypethe declared shape
2skeletonscarry this key

the contract

1 declaration

Descriptions are the schema's own; the deeper invariants (value languages and regexes) ride the same projection. A miss is a nika check finding before anything runs.

envelope: objectThe declared capability boundary · once present every category is default-deny unless listed (spec/01-envelope.md §permits · NIKA-SEC-004).the file itself

in a real file

from the human-gated-ship skeleton

human-gated-ship.nika.yaml

14permits:                            # SLOT: the blast radius · default-deny once present15  ▷exec: ["echo"]                    # SLOT: ONLY the programs the gates + act run (argv form)16  tools: ["nika:assert", "nika:prompt", "nika:notify"]17  net: { http: ["hooks.slack.com"] }   # SLOT: the webhook host · nothing else may leave

a verbatim slice, real line numbers from human-gated-ship.nika.yaml, conformance-gated upstream on every spec push. open the full skeleton →

cross-references

skeletons that carry it

the check gates that name it

where it lives

[{"slug":"the-pipeline-is-a-file","title":"The pipeline is a file","date":"2026-07-11"},{"slug":"written-by-agents","title":"Written by agents, reviewed by you","date":"2026-07-11"},{"slug":"the-run-that-waits","title":"The run that waits for you","date":"2026-07-10"}]

from the blog

defined by

01-envelope

the block it lives in

envelope: the file itself

The whole grammar in one place: the four verbs · the standard library · the spec. Try it in the playground. Read the reference →