Boundary.

Two laws, the whole model: absent, the engine floor applies · present, the boundary is default-deny and the body must fit it. nika check --infer-permits writes the tightest boundary the file can prove.

• execwhich commands may run · false kills the family
• fsread and write globs · the walk root is gated
• nethttp allowlist · the SSRF floor stays on regardless
• toolswhich nika tools the file may invoke

1permits:2  ▷exec: ["echo"]3  tools: ["nika:assert", "nika:prompt", "nika:notify"]4  net: { http: ["hooks.slack.com"] }

A secret is a masked reference, never a literal: it resolves from vault, env or file at run time and stays masked in every log and every trace the run leaves behind.

• vaultthe OS keychain backend · the default posture
• envread from the environment at run time
• fileread from a path the boundary allows

1secrets:2  webhook:3    source: env4    key: TEAM_WEBHOOK_URL5    egress:6      - to: "nika:notify"7        host_from_self: true

Some refusals never negotiate: link-local and metadata endpoints are refused even when net.http allows a host pattern · secret values stay masked in every log and trace a run leaves · an exec allowlist matches argv soundly, never a substring. The floor is the part of the boundary you cannot turn off.

Every rule of the boundary is a numbered proposal (NEP) in the spec’s public governance: written, reviewable, versioned before it binds the engine. The register below states each law’s substance; the number links its full text.

• NEP-0002private data + untrusted input + egress: a human gate
• NEP-0003an absent permits: block declares zero authority
• NEP-0004untrusted values re-gate under permits, at the effect
• NEP-0005a child’s environment is composed, never inherited
• NEP-0006a fetch of a code-bearing artifact is never innocent
• NEP-0007the trace carries a permit witness · check and run agree
• NEP-0008the egress proxy is the permit’s exact projection
• NEP-0009a path grant names a path identity, re-judged at dispatch