{"capture":["Which stream becomes the task's output · `stdout` (default) · `stderr` · `combined` · `structured` = `{ stdout, stderr, exit_code }`. This is the SOURCE; `decode:` is how that string becomes a value."],"command":["argv — the program and its arguments, execve, NO shell. Each element substituted independently (the injection-safe form). Shell features (pipes · redirects · globs) live in `shell:`."],"cwd":["Working directory for the subprocess · default = the engine's own cwd."],"decode":["How the captured string becomes a value · `text` (default) · `json` · `jsonl` · `bytes`. Illegal with `capture: structured`, which already IS an object (NIKA-PARSE-025) · a non-parsing stream settles the task `failure` inside `on_error:` scope (spec 09 §decode)."],"env":["OS environment variables for THIS subprocess · a key→value map applied over the composed environment. Nothing is inherited — the ambient environment reaches a task only through `permits.env` (spec/01-envelope.md §permits)."],"shell":["One shell line, run via /bin/sh -c — the EXPLICIT dangerous door (pipes · redirects · globs). The blocklist applies here; interpolating untrusted values here is on the author. Exactly one of command|shell."],"stdin":["Data written to the command's standard input · may interpolate `${{ }}`."]}

the language

exec

Run. A shell command, captured and typed. One of the four verbs. A verb is a distinct native execution model, and every task speaks exactly one.

its lanestring form rides /bin/sh · array form is execve, no shell: the injection-safe lane

7block keysthe contract
0requiredall optional
2check gatestyped findings
2skeletonsspeak this verb

the shape

a complete workflow

Schema-valid whole: this exact text passes nika check (the on-page YAML gate re-validates it on every test run).

run.nika.yaml

1nika: v12workflow:3  id: run4tasks:5  build:6    ▷exec:7      command: ["cargo", "build", "--release"]

inside exec:

7 keys · 0 required

The block's vocabulary comes from the served contract itself (workflow.schema.json). Each key opens its register row.

capture: stringWhich stream becomes the task's output · `stdout` (default) · `stderr` · `combined` · `structured` = `{ stdout, stderr, exit_code }`. This is the SOURCE; `decode:` is how that string becomes a value.
command: arrayargv — the program and its arguments, execve, NO shell. Each element substituted independently (the injection-safe form). Shell features (pipes · redirects · globs) live in `shell:`.
cwd: stringWorking directory for the subprocess · default = the engine's own cwd.
decode: stringHow the captured string becomes a value · `text` (default) · `json` · `jsonl` · `bytes`. Illegal with `capture: structured`, which already IS an object (NIKA-PARSE-025) · a non-parsing stream settles the task `failure` inside `on_error:` scope (spec 09 §decode).
env: objectOS environment variables for THIS subprocess · a key→value map applied over the composed environment. Nothing is inherited — the ambient environment reaches a task only through `permits.env` (spec/01-envelope.md §permits).
shell: stringOne shell line, run via /bin/sh -c — the EXPLICIT dangerous door (pipes · redirects · globs). The blocklist applies here; interpolating untrusted values here is on the author. Exactly one of command|shell.
stdin: stringData written to the command's standard input · may interpolate `${{ }}`.

cross-references

skeletons that speak it

the check gates

where it lives

accepts

errors of this verb

NIKA-EXEC

The verbs are locked forever: four, never five (fetch is a builtin, not a verb; ordering is the DAG's job, not a word's). The grammar lives in spec 02 · verbs; every other key is in the keyword register. Read the spec →