# SPDX-License-Identifier: Apache-2.0
# yaml-language-server: $schema=https://nika.sh/spec/v1/workflow.schema.json
#
# 11 · Declassify — the one door through the taint.
#
# A permit-relevant argument fed by an UNTRUSTED value (`inputs.*` ·
# `config.*` · anything fetched) is the parameterisation taint. When the
# check can resolve the value and it ESCAPES the bound, it refuses with
# `NIKA-AUTH-008` — and the reflex that refusal provokes (widen the
# boundary until the message stops) is the wrong door. The right one is
# authored: `declassify:` on the task, with a reviewable `because:`
# (spec/10-authority.md · "The only door is the authored one").
#
# Demonstrates · every claim below was run against this exact file
#   - the wall · flip this file's `default:` to "../outside/secrets.csv"
#     and the check refuses ✖ NIKA-AUTH-008; the door below turns that
#     SAME variant check-green — the static question is deferred, not
#     answered
#   - never a bypass · that deferred variant still dies `NIKA-SEC-004` at
#     run, and `--var path=README.md` on THIS file dies the same way — the
#     boundary confines every value, door or no door
#     (spec/10-authority.md · "Declassify is never a permit bypass")
#   - `declassify:` · task-level, `from:` a dotted binding · `to: trusted`
#     (the only value v1 knows) · `because:` non-empty, the review record
#   - what the door yields on an ADMITTED value · the vouching lands in
#     the signed trace — one `Declassify` frame per entry, holding the
#     `because:`
#   - a wall with no door at all · a permit BOUND can never interpolate
#     (`NIKA-AUTH-007` · a bound is a literal you can read)
#
# Run · nika run examples/11-declassify-the-door.nika.yaml
#   another vendor file · --var path=examples/fixtures/inventory-q3.csv

nika: v1
workflow:
  id: declassify-the-door

permits:
  tools: ["nika:jq", "nika:read"]
  fs:
    # The bound is the DOMAIN the operator grants: any fixture csv, one
    # path segment, nothing nested. `*` never crosses `/` — a caller aiming
    # at `fixtures/deep/x.csv` or `../secrets.csv` is refused by the
    # boundary itself, before the taint question even comes up.
    read: ["examples/fixtures/*.csv"]

inputs:
  path:
    type: string
    default: "examples/fixtures/inventory-q3.csv"
    required: true
    description: "WHICH vendor csv to load · must sit inside the fs.read bound"

tasks:
  load:
    invoke:
      tool: "nika:read"
      args:
        path: "${{ inputs.path }}"
    # The door. `from:` names the exact tainted binding; `because:` is the
    # sentence a reviewer holds you to. What it buys, measured: a
    # resolvable ESCAPING value stops refusing at check (the question is
    # handed to the run), and every run writes one `Declassify` frame into
    # the signed trace carrying this exact sentence. What it does not buy,
    # measured: the boundary — an out-of-bound path dies `NIKA-SEC-004` at
    # run with the door in place.
    declassify:
      - from: inputs.path
        to: trusted
        because: "the caller picks WHICH fixture csv, never an arbitrary path — the one-segment *.csv bound confines every value this input can take, and the run refuses anything outside it"

  shape:
    with:
      raw: ${{ tasks.load.output }}
    invoke:
      tool: "nika:jq"
      args:
        input: "${{ with.raw }}"
        expression: '{rows: (split("\n") | map(select(. != "")) | length - 1)}'

outputs:
  summary:
    value: ${{ tasks.shape.output }}
    description: "How many data rows the vendor file carries (header excluded)"

the path · 11

Declassify — the one door through the taint.

run itnika try 11-declassify-the-door

11-declassify-the-door.nika.yaml

1# SPDX-License-Identifier: Apache-2.02# yaml-language-server: $schema=https://nika.sh/spec/v1/workflow.schema.json3#4# 11 · Declassify — the one door through the taint.5#6# A permit-relevant argument fed by an UNTRUSTED value (`inputs.*` ·7# `config.*` · anything fetched) is the parameterisation taint. When the8# check can resolve the value and it ESCAPES the bound, it refuses with9# `NIKA-AUTH-008` — and the reflex that refusal provokes (widen the10# boundary until the message stops) is the wrong door. The right one is11# authored: `declassify:` on the task, with a reviewable `because:`12# (spec/10-authority.md · "The only door is the authored one").13#14# Demonstrates · every claim below was run against this exact file15#   - the wall · flip this file's `default:` to "../outside/secrets.csv"16#     and the check refuses ✖ NIKA-AUTH-008; the door below turns that17#     SAME variant check-green — the static question is deferred, not18#     answered19#   - never a bypass · that deferred variant still dies `NIKA-SEC-004` at20#     run, and `--var path=README.md` on THIS file dies the same way — the21#     boundary confines every value, door or no door22#     (spec/10-authority.md · "Declassify is never a permit bypass")23#   - `declassify:` · task-level, `from:` a dotted binding · `to: trusted`24#     (the only value v1 knows) · `because:` non-empty, the review record25#   - what the door yields on an ADMITTED value · the vouching lands in26#     the signed trace — one `Declassify` frame per entry, holding the27#     `because:`28#   - a wall with no door at all · a permit BOUND can never interpolate29#     (`NIKA-AUTH-007` · a bound is a literal you can read)30#31# Run · nika run examples/11-declassify-the-door.nika.yaml32#   another vendor file · --var path=examples/fixtures/inventory-q3.csv3334nika: v135workflow:36  id: declassify-the-door3738⛨permits:39  ⛨tools: ["nika:jq", "nika:read"]40  ⛨fs:41    # The bound is the DOMAIN the operator grants: any fixture csv, one42    # path segment, nothing nested. `*` never crosses `/` — a caller aiming43    # at `fixtures/deep/x.csv` or `../secrets.csv` is refused by the44    # boundary itself, before the taint question even comes up.45    ⛨read: ["examples/fixtures/*.csv"]4647inputs:48  path:49    type: string50    default: "examples/fixtures/inventory-q3.csv"51    required: true52    description: "WHICH vendor csv to load · must sit inside the fs.read bound"5354tasks:55  load:56    ◆invoke:57      tool: "nika:read"58      args:59        path: "${{ inputs.path }}"60    # The door. `from:` names the exact tainted binding; `because:` is the61    # sentence a reviewer holds you to. What it buys, measured: a62    # resolvable ESCAPING value stops refusing at check (the question is63    # handed to the run), and every run writes one `Declassify` frame into64    # the signed trace carrying this exact sentence. What it does not buy,65    # measured: the boundary — an out-of-bound path dies `NIKA-SEC-004` at66    # run with the door in place.67    declassify:68      - from: inputs.path69        to: trusted70        because: "the caller picks WHICH fixture csv, never an arbitrary path — the one-segment *.csv bound confines every value this input can take, and the run refuses anything outside it"7172  shape:73    with:74      raw: ${{ tasks.load.output }}75    ◆invoke:76      tool: "nika:jq"77      args:78        input: "${{ with.raw }}"79        expression: '{rows: (split("\n") | map(select(. != "")) | length - 1)}'8081outputs:82  summary:83    value: ${{ tasks.shape.output }}84    description: "How many data rows the vendor file carries (header excluded)"85

nika-spec@6ac29351a · sha256 b86292635a80a3cc…