[{"k":"h","depth":1,"text":"12 · Gateway","id":"12--gateway"},{"k":"quote","inline":[{"k":"text","text":"Nika is the semantic execution kernel that "},{"k":"strong","text":"connects"},{"k":"text","text":" agentic\nstandards without reinventing them: a skill, an agent profile, or a\nworkflow from any ecosystem enters Nika, is understood, typed,\nsecured, locked, executed and attested — without losing its\nsemantics and "},{"k":"strong","text":"without gaining invisible authority"},{"k":"text","text":"."},{"k":"text","text":"The contracts in this chapter are "},{"k":"strong","text":"backend-neutral by law"},{"k":"text","text":": no\nenforcement backend, agent runtime, or vendor is named anywhere in\nthis spec, and the entry fixture for any conforming abstraction is\n"},{"k":"em","text":"« the same plan, two backends, comparable reports »"},{"k":"text","text":". Nika stays\nthe semantic truth; a backend enforces, it never redefines."}]},{"k":"hr"},{"k":"h","depth":2,"text":"Five categories, never confused (normative)","id":"five-categories-never-confused-normative"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Category · Is · Is NOT"}],[{"k":"text","text":"**Tool** · one atomic capability (builtin · MCP · API) · a place to hide a workflow"}],[{"k":"text","text":"**Workflow** · a typed, composable computation (the callable contract) · a tool with steps"}],[{"k":"text","text":"**Skill** · procedural KNOWLEDGE — explains *how* · an authority grant of any kind"}],[{"k":"text","text":"**Agent profile** · portable agentic configuration · a permission, a budget, or a memory"}],[{"k":"text","text":"**Pack** · a signed distributable unit {workflows · skills · agents · schemas · assets · manifest · lock · attestations · fixtures} · a running thing"}]]},{"k":"p","inline":[{"k":"text","text":"A skill "},{"k":"strong","text":"never"},{"k":"text","text":" grants authority. Disclosure of a tool changes the\nmodel's "},{"k":"em","text":"context"},{"k":"text","text":", never its "},{"k":"em","text":"authority"},{"k":"text","text":" — the four sets are ordered\nand the order is the law ("},{"k":"code","text":"NIKA-PORT"},{"k":"text","text":" class when violated):"}]},{"k":"code","lang":"text","text":"T_presented ⊆ T_discoverable ⊆ T_authorized ⊆ T_installed"},{"k":"h","depth":2,"text":"The Deployment Bundle · *`deployment_bundle_format: 1`*","id":"the-deployment-bundle--deployment_bundle_format-1"},{"k":"p","inline":[{"k":"text","text":"A "},{"k":"strong","text":"compiled, portable artifact"},{"k":"text","text":" (a projection of a Pack — never\nauthored by hand): everything a host needs to run a workflow the way\nits author proved it."}]},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Region · Carries"}],[{"k":"text","text":"`manifest` · id · version · owner · the semantic hashes of every workflow it ships"}],[{"k":"text","text":"`lock` · every dependency **pinned by digest** (spec pin · tool versions · provider catalog snapshot · schemas) — nothing resolves at run time"}],[{"k":"text","text":"`authority` · the DECLARED boundary: the `permits:`/`policy:` blocks verbatim + the inferred needed-effects projection (10 §certificate)"}],[{"k":"text","text":"`contracts` · the callable contracts (types · returns · inputs/outputs) of every entry workflow"}],[{"k":"text","text":"`backend_requirements` · the MINIMUM capability set a backend must attest before this bundle runs (see below) — with per-requirement `on_absent: refuse | degrade_declared`"}],[{"k":"text","text":"`attestations` · reserved (W6 — signatures · provenance · SBOM refs)"}],[{"k":"text","text":"`lifecycle` · reserved (W5 — DeploymentLifecycleIR)"}]]},{"k":"p","inline":[{"k":"text","text":"The bundle is DATA. Signing it proves "},{"k":"em","text":"origin"},{"k":"text","text":", never "},{"k":"em","text":"safety"},{"k":"text","text":"\n("},{"k":"code","text":"signature ≠ safety"},{"k":"text","text":" — the separation laws below)."}]},{"k":"h","depth":2,"text":"ExecutionBackend · the enforcement contract (normative)","id":"executionbackend--the-enforcement-contract-normative"},{"k":"p","inline":[{"k":"text","text":"An execution backend is anything that can "},{"k":"em","text":"enforce"},{"k":"text","text":" a compiled\nauthority boundary around a run (a sandbox · a container profile · an\nOS policy layer). The contract has four verbs, and every one of them\nreturns "},{"k":"strong","text":"evidence"},{"k":"text","text":", not vibes:"}]},{"k":"code","lang":"text","text":"capabilities()  → BackendCapabilities\nlower(plan)     → EnforcementPlan + PolicyLoweringReport\nload(plan)      → EffectivePolicySnapshot        (the READBACK)\nobserve(run)    → BackendReceiptFragment          (reserved W6)"},{"k":"p","inline":[{"k":"strong","text":"BackendCapabilities"},{"k":"text","text":" — for every capability the kernel may ask\n(fs-path confinement · network host allowlists · exec program\nallowlists · process isolation · secret masking), the backend answers:"}]},{"k":"code","lang":"text","text":"support ∈ { exact · partial · absent · unknown }\n× guarantee (the G27 strength enum — unchanged, never extended here)\n× scope (what exactly is covered)\n× assumptions (kernel versions · privileges · platform)\n× evidence (how the claim was verified — a doc pin · a probe result)"},{"k":"p","inline":[{"k":"code","text":"unknown"},{"k":"text","text":" is an honest answer and is "},{"k":"strong","text":"never promoted"},{"k":"text","text":" to anything\nelse. A backend that cannot attest a "},{"k":"code","text":"backend_requirements"},{"k":"text","text":" entry\nrefuses the bundle (or degrades "},{"k":"strong","text":"declaredly"},{"k":"text","text":" when the bundle allows\nit) — a silent downgrade is the one forbidden move."}]},{"k":"p","inline":[{"k":"strong","text":"The five policy states"},{"k":"text","text":" (never conflated · the readback is\nmandatory):"}]},{"k":"code","lang":"text","text":"Requested → Compiled → Loaded → Effective → Observed"},{"k":"p","inline":[{"k":"text","text":"What the author wrote (Requested) is compiled to a backend plan\n(Compiled), loaded into the mechanism (Loaded), read "},{"k":"strong","text":"back"},{"k":"text","text":" from the\nmechanism as ground truth (Effective), and finally compared against\nwhat actually happened (Observed · W6). A divergence between any two\nadjacent states is a "},{"k":"strong","text":"typed diff with a witness"},{"k":"text","text":" — decision and\nreceipt, never a shrug."}]},{"k":"p","inline":[{"k":"strong","text":"PolicyLoweringReport"},{"k":"text","text":" — lowering a Nika policy onto a backend\nmechanism is classified per rule:"}]},{"k":"code","lang":"text","text":"exact · restrictive_safe · permissive_unsafe · unsupported · unknown"},{"k":"p","inline":[{"k":"text","text":"The soundness law is the enforcement twin of the type-side lowering\nlaw: "},{"k":"code","text":"Behaviors(BackendPolicy) ⊆ Behaviors(NikaPolicy)"},{"k":"text","text":". A\n"},{"k":"code","text":"restrictive_safe"},{"k":"text","text":" lowering (the backend blocks MORE than asked) is\nsound and reported; "},{"k":"strong","text":"`permissive_unsafe` is a REFUSAL"},{"k":"text","text":" (the backend\nwould allow what the policy forbids — running anyway would make the\nfile lie); "},{"k":"code","text":"unknown"},{"k":"text","text":" is never promoted to safe. Every non-"},{"k":"code","text":"exact"},{"k":"text","text":" row\ncarries the divergence witness."}]},{"k":"h","depth":2,"text":"AgentRuntimeAdapter · the import/export contract (normative)","id":"agentruntimeadapter--the-importexport-contract-normative"},{"k":"p","inline":[{"k":"text","text":"An agent runtime adapter connects a foreign agentic ecosystem\n(profiles · skills · sub-agent conventions) to Nika. Two artifacts are\nmandatory on every import, and they are the whole honesty of the\ngateway:"}]},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"FidelityReport"},{"k":"text","text":" — per imported element, the 6-value fidelity enum\n("},{"k":"code","text":"exact · adapted · lossy · unsupported · ambiguous · security_restricted"},{"k":"text","text":"): what survived translation, what didn't, and\nwhat was "},{"k":"em","text":"deliberately"},{"k":"text","text":" restricted. "},{"k":"code","text":"lossy"},{"k":"text","text":" names what was lost;\n"},{"k":"code","text":"ambiguous"},{"k":"text","text":" names both readings and refuses to guess."}],[{"k":"strong","text":"AuthorityDelta"},{"k":"text","text":" — the authority the element would have had in its\nhome runtime vs the authority it has under Nika: ambient credentials\nit can no longer reach · prompt-only conventions that became\nenforced boundaries · default-on capabilities that became\ndefault-deny. "},{"k":"strong","text":"Import must never *gain* authority"},{"k":"text","text":"; every loss and\nevery hardening is listed, none is silent."}]]},{"k":"p","inline":[{"k":"text","text":"The five delegation notions stay separated (reserved to composition —\nthe vocabulary is normative now, the mechanics land with workflow\ncomposition): "},{"k":"code","text":"DelegationPreference"},{"k":"text","text":" (a prompt hint) ≠\n"},{"k":"code","text":"DelegationAuthority"},{"k":"text","text":" (an enforced grant) ≠ "},{"k":"code","text":"DelegationContract"},{"k":"text","text":" ≠\n"},{"k":"code","text":"DelegationBudget"},{"k":"text","text":" ≠ "},{"k":"code","text":"DelegationReceipt"},{"k":"text","text":". A runtime whose delegation\ncontrol is prompt-guidance-only imports as "},{"k":"em","text":"preference"},{"k":"text","text":", never as\n"},{"k":"em","text":"authority"},{"k":"text","text":" — the AuthorityDelta says so."}]},{"k":"h","depth":2,"text":"The separation laws (normative · one voice with 10/11)","id":"the-separation-laws-normative--one-voice-with-1011"},{"k":"code","lang":"text","text":"disclosure        ≠ authorization\ndelegation pref.  ≠ delegation authority\ncompaction        ≠ canonical memory\nrequested policy  ≠ effective policy\nlogs              ≠ attestation\nsignature         ≠ safety\nbackend           ≠ semantic truth"},{"k":"p","inline":[{"k":"text","text":"And the containment laws every gateway judgment enforces:"}]},{"k":"code","lang":"text","text":"EffectiveAuthority ⊆ PermittedAuthority\nAuthority(child)   ⊆ Authority(parent)\nStrength(Claim)    ≤ Strength(Evidence)"},{"k":"p","inline":[{"k":"text","text":"No ambient credentials. No ambient memory. No silent permissive\nlowering. No best-effort presented as hard enforcement."}]},{"k":"h","depth":2,"text":"Errors (the `NIKA-PORT` namespace · new in this chapter)","id":"errors-the-nika-port-namespace--new-in-this-chapter"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Code · Category · Meaning"}],[{"k":"text","text":"`NIKA-PORT-001` · `validation_error` · a gateway artifact (bundle · capabilities report · lowering report · fidelity report · authority delta) is malformed or violates its laws (an unknown promoted · a permissive_unsafe row without refusal · a disclosure set violating the ⊆ chain · a child authority exceeding its parent)"}],[{"k":"text","text":"`NIKA-PORT-002` · `security_error` · a lowering is `permissive_unsafe` — the backend would allow what the policy forbids; the run is refused with the divergence witness"}]]},{"k":"h","depth":2,"text":"What v1 deliberately does not do","id":"what-v1-deliberately-does-not-do"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"No backend is named."},{"k":"text","text":" Reference adapters live in engine/ecosystem\nspace, pinned by digest at build; the spec never depends on one."}],[{"k":"strong","text":"No runtime adapter mechanics."},{"k":"text","text":" This chapter is the CONTRACT layer;\nsandbox lifecycle, event ingestion, and live adapters are engine\nwork gated on their own waves."}],[{"k":"strong","text":"No delegation mechanics."},{"k":"text","text":" The five notions are vocabulary here;\ncontracts and budgets land with workflow composition."}],[{"k":"strong","text":"No attestation."},{"k":"text","text":" "},{"k":"code","text":"attestations"},{"k":"text","text":" and "},{"k":"code","text":"observe()"},{"k":"text","text":" are reserved (the\nproof wave) — a log is not an attestation, and this chapter refuses\nto pretend otherwise."}]]},{"k":"h","depth":2,"text":"Related","id":"related"},{"k":"list","ordered":false,"items":[[{"k":"link","text":"10 · Authority","href":"./10-authority.md"},{"k":"text","text":" — the boundary this chapter\ncompiles and lowers"}],[{"k":"link","text":"11 · Decision","href":"./11-decision.md"},{"k":"text","text":" — the receipt discipline the\nlowering/fidelity reports follow"}],[{"k":"link","text":"09 · Types","href":"./09-types.md"},{"k":"text","text":" — the callable contracts a bundle ships"}],[{"k":"link","text":"06 · Stdlib contract","href":"./06-stdlib-contract.md"},{"k":"text","text":" — the tool surface\nthe disclosure sets order"}]]}]

the spec · 12

Gateway

Nika is the semantic execution kernel that **connects** agentic standards without reinventing them: a skill, an agent profile, or a workflow from any ecosystem enters Nika, is understood, typed, secured, locked, executed and attested — without losing its semantics and **without gaining invisible authority**.

12 · Gateway #

Nika is the semantic execution kernel that connects agentic standards without reinventing them: a skill, an agent profile, or a workflow from any ecosystem enters Nika, is understood, typed, secured, locked, executed and attested — without losing its semantics and without gaining invisible authority.The contracts in this chapter are backend-neutral by law: no enforcement backend, agent runtime, or vendor is named anywhere in this spec, and the entry fixture for any conforming abstraction is « the same plan, two backends, comparable reports ». Nika stays the semantic truth; a backend enforces, it never redefines.

Five categories, never confused (normative) #

Category · Is · Is NOT
**Tool** · one atomic capability (builtin · MCP · API) · a place to hide a workflow
**Workflow** · a typed, composable computation (the callable contract) · a tool with steps
**Skill** · procedural KNOWLEDGE — explains *how* · an authority grant of any kind
**Agent profile** · portable agentic configuration · a permission, a budget, or a memory
**Pack** · a signed distributable unit {workflows · skills · agents · schemas · assets · manifest · lock · attestations · fixtures} · a running thing

A skill never grants authority. Disclosure of a tool changes the model's context, never its authority — the four sets are ordered and the order is the law (NIKA-PORT class when violated):

text

1T_presented ⊆ T_discoverable ⊆ T_authorized ⊆ T_installed

The Deployment Bundle · `deployment_bundle_format: 1` #

A compiled, portable artifact (a projection of a Pack — never authored by hand): everything a host needs to run a workflow the way its author proved it.

Region · Carries
`manifest` · id · version · owner · the semantic hashes of every workflow it ships
`lock` · every dependency **pinned by digest** (spec pin · tool versions · provider catalog snapshot · schemas) — nothing resolves at run time
`authority` · the DECLARED boundary: the `permits:`/`policy:` blocks verbatim + the inferred needed-effects projection (10 §certificate)
`contracts` · the callable contracts (types · returns · inputs/outputs) of every entry workflow
`backend_requirements` · the MINIMUM capability set a backend must attest before this bundle runs (see below) — with per-requirement `on_absent: refuse | degrade_declared`
`attestations` · reserved (W6 — signatures · provenance · SBOM refs)
`lifecycle` · reserved (W5 — DeploymentLifecycleIR)

The bundle is DATA. Signing it proves origin, never safety (signature ≠ safety — the separation laws below).

ExecutionBackend · the enforcement contract (normative) #

An execution backend is anything that can enforce a compiled authority boundary around a run (a sandbox · a container profile · an OS policy layer). The contract has four verbs, and every one of them returns evidence, not vibes:

text

1capabilities()  → BackendCapabilities2lower(plan)     → EnforcementPlan + PolicyLoweringReport3load(plan)      → EffectivePolicySnapshot        (the READBACK)4observe(run)    → BackendReceiptFragment          (reserved W6)

BackendCapabilities — for every capability the kernel may ask (fs-path confinement · network host allowlists · exec program allowlists · process isolation · secret masking), the backend answers:

text

1support ∈ { exact · partial · absent · unknown }2× guarantee (the G27 strength enum — unchanged, never extended here)3× scope (what exactly is covered)4× assumptions (kernel versions · privileges · platform)5× evidence (how the claim was verified — a doc pin · a probe result)

unknown is an honest answer and is never promoted to anything else. A backend that cannot attest a backend_requirements entry refuses the bundle (or degrades declaredly when the bundle allows it) — a silent downgrade is the one forbidden move.

The five policy states (never conflated · the readback is mandatory):

text

1Requested → Compiled → Loaded → Effective → Observed

What the author wrote (Requested) is compiled to a backend plan (Compiled), loaded into the mechanism (Loaded), read back from the mechanism as ground truth (Effective), and finally compared against what actually happened (Observed · W6). A divergence between any two adjacent states is a typed diff with a witness — decision and receipt, never a shrug.

PolicyLoweringReport — lowering a Nika policy onto a backend mechanism is classified per rule:

text

1exact · restrictive_safe · permissive_unsafe · unsupported · unknown

The soundness law is the enforcement twin of the type-side lowering law: Behaviors(BackendPolicy) ⊆ Behaviors(NikaPolicy). A restrictive_safe lowering (the backend blocks MORE than asked) is sound and reported; `permissive_unsafe` is a REFUSAL (the backend would allow what the policy forbids — running anyway would make the file lie); unknown is never promoted to safe. Every non-exact row carries the divergence witness.

AgentRuntimeAdapter · the import/export contract (normative) #

An agent runtime adapter connects a foreign agentic ecosystem (profiles · skills · sub-agent conventions) to Nika. Two artifacts are mandatory on every import, and they are the whole honesty of the gateway:

FidelityReport — per imported element, the 6-value fidelity enum (exact · adapted · lossy · unsupported · ambiguous · security_restricted): what survived translation, what didn't, and what was deliberately restricted. lossy names what was lost; ambiguous names both readings and refuses to guess.
AuthorityDelta — the authority the element would have had in its home runtime vs the authority it has under Nika: ambient credentials it can no longer reach · prompt-only conventions that became enforced boundaries · default-on capabilities that became default-deny. Import must never *gain* authority; every loss and every hardening is listed, none is silent.

The five delegation notions stay separated (reserved to composition — the vocabulary is normative now, the mechanics land with workflow composition): DelegationPreference (a prompt hint) ≠ DelegationAuthority (an enforced grant) ≠ DelegationContract ≠ DelegationBudget ≠ DelegationReceipt. A runtime whose delegation control is prompt-guidance-only imports as preference, never as authority — the AuthorityDelta says so.

The separation laws (normative · one voice with 10/11) #

text

1disclosure        ≠ authorization2delegation pref.  ≠ delegation authority3compaction        ≠ canonical memory4requested policy  ≠ effective policy5logs              ≠ attestation6signature         ≠ safety7backend           ≠ semantic truth

And the containment laws every gateway judgment enforces:

text

1EffectiveAuthority ⊆ PermittedAuthority2Authority(child)   ⊆ Authority(parent)3Strength(Claim)    ≤ Strength(Evidence)

No ambient credentials. No ambient memory. No silent permissive lowering. No best-effort presented as hard enforcement.

Errors (the `NIKA-PORT` namespace · new in this chapter) #

Code · Category · Meaning
`NIKA-PORT-001` · `validation_error` · a gateway artifact (bundle · capabilities report · lowering report · fidelity report · authority delta) is malformed or violates its laws (an unknown promoted · a permissive_unsafe row without refusal · a disclosure set violating the ⊆ chain · a child authority exceeding its parent)
`NIKA-PORT-002` · `security_error` · a lowering is `permissive_unsafe` — the backend would allow what the policy forbids; the run is refused with the divergence witness

What v1 deliberately does not do #

No backend is named. Reference adapters live in engine/ecosystem space, pinned by digest at build; the spec never depends on one.
No runtime adapter mechanics. This chapter is the CONTRACT layer; sandbox lifecycle, event ingestion, and live adapters are engine work gated on their own waves.
No delegation mechanics. The five notions are vocabulary here; contracts and budgets land with workflow composition.
No attestation. attestations and observe() are reserved (the proof wave) — a log is not an attestation, and this chapter refuses to pretend otherwise.

10 · Authority — the boundary this chapter compiles and lowers
11 · Decision — the receipt discipline the lowering/fidelity reports follow
09 · Types — the callable contracts a bundle ships
06 · Stdlib contract — the tool surface the disclosure sets order

nika-spec@6ac29351a · 12-gateway.md · sha256 65ad1708e850ceee… · the pack upstream

Gateway

12 · Gateway #

Five categories, never confused (normative) #

The Deployment Bundle · *`deployment_bundle_format: 1`* #

ExecutionBackend · the enforcement contract (normative) #

AgentRuntimeAdapter · the import/export contract (normative) #

The separation laws (normative · one voice with 10/11) #

Errors (the `NIKA-PORT` namespace · new in this chapter) #

What v1 deliberately does not do #

Related #

The Deployment Bundle · `deployment_bundle_format: 1` #