the language
permits
The declared capability boundary · once present every category is default-deny unless listed (spec/01-envelope.md §permits · NIKA-SEC-004). One of 62 words the served contract declares, projected from workflow.schema.json, the same file your editor validates against.
- 1surfaceenvelope
- optionaleverywherea choice, never a miss
- objecttypethe declared shape
- 10skeletonscarry this key
the contract
1 declarationthe boundary · one of the two declarations that fence what a plan may touch · a reader can see the blast radius without reading the tasks
Descriptions are the schema's own; the deeper invariants (value languages and regexes) ride the same projection. A miss is a nika check finding before anything runs.
- envelope
objectThe declared capability boundary · once present every category is default-deny unless listed (spec/01-envelope.md §permits · NIKA-SEC-004).the file itself
in a real file
from the chain skeletonpermits: # the blast radius · default-deny once present tools: ["nika:read", "nika:write"] # Two literal paths, one each way. `check` can read these (they come from # `const:`) and proves them against the boundary before anything runs — keep # them in step with the two `const:` entries above. fs: read: ["./README.md"] write: ["./output.md"]a verbatim slice, real line numbers from chain.nika.yaml, conformance-gated upstream on every spec push. open the full skeleton →
cross-references
skeletons that carry it
the check gates that name it
defined by
the block it lives in
The whole grammar in one place: the four verbs · the standard library · the spec. Try it in the playground. Read the reference →