nika:prompt

59  # NEP-0002 · the Rule of Two, as a check. This run holds all three legs at60  # once: it reads a private file, ingests UNTRUSTED network content, and61  # persists that content into the very file the NEXT run reads as trusted62  # state. One human decision has to dominate EVERY path to that write — so the63  # gate sits before the first network touch, not next to the write (a gate the64  # fetch can route around dominates nothing). Blocking on purpose: a `default:`65  # here would disarm it, and the checker knows — measured, adding `default:`66  # flips TRIFECTA to `✖ NIKA-SEC-009 lethal trifecta complete`.67  approve:68    ◆invoke:69      tool: "nika:prompt"70      args:71        message: "Fetch ${{ const.source_url }} and persist it into ${{ const.state_path }}?"