{
 "$schema": "https://nika.sh/schema/errors-catalog.json",
 "version": 3,
 "description": "Nika error catalog · generated from nika-spec canon.yaml (spec/05-errors.md is the prose home · the registry is the v0.1 normative floor · engines may add codes within a namespace · never repurpose). Code format ^NIKA-[A-Z]{2,9}(-[A-Z][A-Z0-9_]{1,15})?-[0-9]{3}$.",
 "spec": "https://github.com/supernovae-st/nika-spec/blob/main/spec/05-errors.md",
 "namespaces": {
  "NIKA-AGENT": {
   "scope": "agent: verb errors",
   "range": "001-099"
  },
  "NIKA-ASSERT": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-AUTH": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-BUILTIN": {
   "scope": "Builtin tool errors · per-builtin sub-namespace",
   "range": "001-099"
  },
  "NIKA-CANCEL": {
   "scope": "Task or workflow cancellation",
   "range": "001-099"
  },
  "NIKA-COMP": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-DAG": {
   "scope": "DAG topology · cycles · invalid deps",
   "range": "001-099"
  },
  "NIKA-DEFAULT": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-EXEC": {
   "scope": "exec: verb errors",
   "range": "001-099"
  },
  "NIKA-IMPL": {
   "scope": "Engine internal errors",
   "range": "001-099"
  },
  "NIKA-INFER": {
   "scope": "infer: verb errors",
   "range": "001-099"
  },
  "NIKA-INVOKE": {
   "scope": "invoke: verb errors",
   "range": "001-099"
  },
  "NIKA-LOCK": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-MCP": {
   "scope": "MCP client errors",
   "range": "001-099"
  },
  "NIKA-DECIDE": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-DRIFT": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-PARSE": {
   "scope": "YAML parse + envelope validation",
   "range": "001-099"
  },
  "NIKA-PORT": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-PROVIDER": {
   "scope": "Provider adapter errors",
   "range": "001-099"
  },
  "NIKA-SEC": {
   "scope": "Security policy violations (SSRF · blocklist)",
   "range": "001-099"
  },
  "NIKA-TIMEOUT": {
   "scope": "Task or step timeouts",
   "range": "001-099"
  },
  "NIKA-TYPE": {
   "scope": "",
   "range": "001-099"
  },
  "NIKA-VAR": {
   "scope": "Variable resolution failures",
   "range": "001-099"
  },
  "NIKA-VALUES": {
   "scope": "",
   "range": "001-099"
  }
 },
 "categories": [
  "parse_error",
  "validation_error",
  "variable_error",
  "provider_error",
  "network_error",
  "tool_error",
  "process_error",
  "budget_error",
  "security_error",
  "timeout_error",
  "cancelled",
  "internal_error"
 ],
 "codes": [
  {
   "code": "NIKA-PARSE-001",
   "category": "parse_error",
   "transient": "false",
   "failure": "the YAML itself does not parse (syntax error)"
  },
  {
   "code": "NIKA-PARSE-002",
   "category": "validation_error",
   "transient": "false",
   "failure": "missing envelope field (nika: / non-empty tasks:)"
  },
  {
   "code": "NIKA-PARSE-003",
   "category": "parse_error",
   "transient": "false",
   "failure": "nika: is not a kebab-case id (^[a-z][a-z0-9-]*$)"
  },
  {
   "code": "NIKA-PARSE-004",
   "category": "validation_error",
   "transient": "false",
   "failure": "workflow: id violates ^[a-z][a-z0-9-]*$"
  },
  {
   "code": "NIKA-PARSE-005",
   "category": "validation_error",
   "transient": "false",
   "failure": "unknown field — strict mode rejects anything outside the closed v1 set"
  },
  {
   "code": "NIKA-PARSE-006",
   "category": "validation_error",
   "transient": "false",
   "failure": "task id violates ^[a-z][a-z0-9_]*$ (snake_case · CEL-safe · no hyphens)"
  },
  {
   "code": "NIKA-PARSE-007",
   "category": "validation_error",
   "transient": "false",
   "failure": "duplicate task id within the workflow"
  },
  {
   "code": "NIKA-PARSE-008",
   "category": "validation_error",
   "transient": "false",
   "failure": "task declares no verb — exactly one of infer/exec/invoke/agent required"
  },
  {
   "code": "NIKA-PARSE-009",
   "category": "validation_error",
   "transient": "false",
   "failure": "task declares multiple verbs — exactly one required"
  },
  {
   "code": "NIKA-PARSE-010",
   "category": "validation_error",
   "transient": "false",
   "failure": "timeout: violates the quoted Go-duration contract (positive · max 24h · descending units)"
  },
  {
   "code": "NIKA-PARSE-011",
   "category": "validation_error",
   "transient": "false",
   "failure": "retry: block violates the spec shape"
  },
  {
   "code": "NIKA-PARSE-012",
   "category": "validation_error",
   "transient": "false",
   "failure": "on_error: block violates the spec shape (fields mutually exclusive)"
  },
  {
   "code": "NIKA-PARSE-013",
   "category": "validation_error",
   "transient": "false",
   "failure": "with:/extract: binding uses a reserved name (output · status · error · started_at · ended_at · duration_ms)"
  },
  {
   "code": "NIKA-PARSE-014",
   "category": "validation_error",
   "transient": "false",
   "failure": "secrets: entry is not a store reference — inline literals forbidden"
  },
  {
   "code": "NIKA-PARSE-017",
   "category": "validation_error",
   "transient": "false",
   "failure": "duplicate mapping key — no silent last-wins"
  },
  {
   "code": "NIKA-PARSE-018",
   "category": "validation_error",
   "transient": "false",
   "failure": "missing required field in a verb body (infer.prompt · exec.command · invoke.tool)"
  },
  {
   "code": "NIKA-PARSE-019",
   "category": "validation_error",
   "transient": "false",
   "failure": "generic structural validation — wrong YAML shape for a field"
  },
  {
   "code": "NIKA-PARSE-022",
   "category": "validation_error",
   "transient": "false",
   "failure": "tasks: is a sequence — it became a map keyed by task id (drop `- id:`, the key IS the identity)"
  },
  {
   "code": "NIKA-PARSE-023",
   "category": "validation_error",
   "transient": "false",
   "failure": "a task carries an id: field — the map key is the identity, the field is gone"
  },
  {
   "code": "NIKA-PARSE-024",
   "category": "validation_error",
   "transient": "false",
   "failure": "a task carries depends_on: — dead since W2 (data → with: bindings · control → after: predicates · check --fix migrates)"
  },
  {
   "code": "NIKA-PARSE-025",
   "category": "validation_error",
   "transient": "false",
   "failure": "decode: with capture: structured — that capture already IS an object · type it with returns:"
  },
  {
   "code": "NIKA-PARSE-026",
   "category": "validation_error",
   "transient": "false",
   "failure": "a declared entropy x clock contradiction · entropy: ambient paired with clock: virtual — the ambient declaration contradicts the determinism demand (NEP-0010 · F-P3)"
  },
  {
   "code": "NIKA-PARSE-027",
   "category": "validation_error",
   "transient": "false",
   "failure": "a declared entropy x clock contradiction · entropy: none | seeded paired with clock: system — deterministic journals cannot ride the wall clock (NEP-0010 · F-P3)"
  },
  {
   "code": "NIKA-PARSE-028",
   "category": "validation_error",
   "transient": "false",
   "failure": "entropy: none declares strict determinism while a structural randomness source is consumed (a live retry jitter · nika:uuid) — the strict declaration cannot hold (NEP-0010 · F-P3 · judged at check)"
  },
  {
   "code": "NIKA-COMP-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "invoke.workflow: target is not statically resolvable (templated · malformed · unpinned registry ref) — a call graph you cannot draw before the run cannot be bounded (spec 14)"
  },
  {
   "code": "NIKA-COMP-002",
   "category": "security_error",
   "transient": "false",
   "failure": "the child workflow's effect boundary exceeds the parent capped by the call-site declaration (Authority(child) subset of Authority(parent) intersect declared · spec 14 laws 3/4)"
  },
  {
   "code": "NIKA-COMP-003",
   "category": "validation_error",
   "transient": "false",
   "failure": "the static call graph is not acyclic (self-launch · cycle · spec 14 law 7 · NIKA-SEC-003 is the runtime depth backstop)"
  },
  {
   "code": "NIKA-COMP-004",
   "category": "validation_error",
   "transient": "false",
   "failure": "the typed call does not compose — parent args do not fit child inputs, or child outputs do not fit parent returns (spec 14 law 2)"
  },
  {
   "code": "NIKA-DAG-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "cycle in the precedence graph G_p = E_d ∪ E_c (incl. self-dependency · via with:/after:)"
  },
  {
   "code": "NIKA-DAG-002",
   "category": "validation_error",
   "transient": "false",
   "failure": "with:/after: references an undeclared task"
  },
  {
   "code": "NIKA-DAG-004",
   "category": "validation_error",
   "transient": "false",
   "failure": "on_error.recover references a task downstream of the declaring task (await would deadlock)"
  },
  {
   "code": "NIKA-DAG-005",
   "category": "validation_error",
   "transient": "false",
   "failure": "after: predicate outside the closed set (success · failure · skipped · terminal)"
  },
  {
   "code": "NIKA-DAG-006",
   "category": "validation_error",
   "transient": "false",
   "failure": "statically dead task — an incoming edge's pass-set excludes every reachable producer state, or the when: gate is false under every reachable upstream combination (gate algebra v2)"
  },
  {
   "code": "NIKA-DAG-007",
   "category": "validation_error",
   "transient": "false",
   "failure": "status compared against a literal outside the vocabulary (success · failure · skipped · cancelled) — == never matches, != always holds"
  },
  {
   "code": "NIKA-DAG-008",
   "category": "validation_error",
   "transient": "false",
   "failure": "a group.<name> fold names a group no task declares — including a bare group and the group a renamed member left empty"
  },
  {
   "code": "NIKA-DAG-009",
   "category": "validation_error",
   "transient": "false",
   "failure": "an unwind task declares group: — cleanup never enters G_p, so it cannot be a fan-in member"
  },
  {
   "code": "NIKA-TYPE-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "unknown type name (in types: · returns: · an outputs: type) — did-you-mean when close"
  },
  {
   "code": "NIKA-TYPE-003",
   "category": "validation_error",
   "transient": "false",
   "failure": "returns: and schema: on the same task — one contract, one spelling"
  },
  {
   "code": "NIKA-TYPE-004",
   "category": "validation_error",
   "transient": "false",
   "failure": "returns: type unreachable from the declared decode: (an object contract over decode: text · …)"
  },
  {
   "code": "NIKA-TYPE-005",
   "category": "security_error",
   "transient": "false",
   "failure": "a secret-carrying type in a lowered position (reserved with secret<T> · W4)"
  },
  {
   "code": "NIKA-TYPE-006",
   "category": "validation_error",
   "transient": "false",
   "failure": "regex pattern outside the locked dialect (backreference · lookaround · named group · inline flags · lazy/possessive · word-boundary · unicode-class — spec 09 §the regex dialect)"
  },
  {
   "code": "NIKA-TYPE-101",
   "category": "validation_error",
   "transient": "false",
   "failure": "run-time contract violation — the decoded value does not fit returns: (exec:/invoke: lane)"
  },
  {
   "code": "NIKA-VAR-001",
   "category": "variable_error",
   "transient": "false",
   "failure": "unresolved reference (unknown namespace entry · undeclared inputs/const/secrets/with key)"
  },
  {
   "code": "NIKA-VAR-002",
   "category": "variable_error",
   "transient": "false",
   "failure": "binding cardinality — a jq binding emitted zero or multiple values"
  },
  {
   "code": "NIKA-VAR-003",
   "category": "validation_error",
   "transient": "false",
   "failure": "provably-invalid path into a declared schema (static walk)"
  },
  {
   "code": "NIKA-VAR-004",
   "category": "variable_error",
   "transient": "false",
   "failure": "jq runtime error while evaluating a binding"
  },
  {
   "code": "NIKA-VAR-005",
   "category": "validation_error",
   "transient": "false",
   "failure": "static expression violation — outside cel-subset/0.1 · chained relation · unknown function · non-boolean when: root · jq compile error"
  },
  {
   "code": "NIKA-VAR-006",
   "category": "variable_error",
   "transient": "false",
   "failure": "expression type error at evaluation — cross-type compare · non-boolean when: value · for_each over a non-array"
  },
  {
   "code": "NIKA-VAR-007",
   "category": "variable_error",
   "transient": "false",
   "failure": "bytes value substituted into a string position"
  },
  {
   "code": "NIKA-VAR-008",
   "category": "validation_error",
   "transient": "false",
   "failure": "unclosed ${{ opener"
  },
  {
   "code": "NIKA-VAR-020",
   "category": "validation_error",
   "transient": "false",
   "failure": "bare tasks.X is the envelope, not a value — the projection set (.output/.status/.error/.duration_ms) is closed and required (04 §namespaces · 0.103 · #75 D2)"
  },
  {
   "code": "NIKA-VAR-021",
   "category": "validation_error",
   "transient": "false",
   "failure": "a tasks.* reference outside the boundary (with: · after: · on_error.recover · an unwind task reading its producer · workflow outputs) — hoist it into with: (check --fix applies it)"
  },
  {
   "code": "NIKA-VAR-009",
   "category": "validation_error",
   "transient": "false",
   "failure": "typed outputs value did not match its declared type: at run end (the output half of the callable contract)"
  },
  {
   "code": "NIKA-INFER-001",
   "category": "provider_error",
   "transient": "engine-assessed",
   "failure": "provider call failed (HTTP error · provider refusal)"
  },
  {
   "code": "NIKA-INFER-002",
   "category": "validation_error",
   "transient": "false",
   "failure": "structured output failed schema validation (after any engine-internal retries)"
  },
  {
   "code": "NIKA-INFER-003",
   "category": "validation_error",
   "transient": "false",
   "failure": "the provider reported no token usage for a priced model — the ledger cannot bill the call honestly (fail-closed · R3-F1)"
  },
  {
   "code": "NIKA-INFER-004",
   "category": "validation_error",
   "transient": "false",
   "failure": "the provider spent tokens yet the visible answer is empty — a thinking model ate the budget on its reasoning trace (fail-closed · #651 · raise max_tokens or use a no-think variant)"
  },
  {
   "code": "NIKA-EXEC-001",
   "category": "process_error",
   "transient": "false",
   "failure": "non-zero exit code (default capture modes)"
  },
  {
   "code": "NIKA-EXEC-002",
   "category": "process_error",
   "transient": "false",
   "failure": "spawn failure (command not found · permission)"
  },
  {
   "code": "NIKA-INVOKE-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "unknown tool (unresolvable nika:/mcp: id)"
  },
  {
   "code": "NIKA-INVOKE-002",
   "category": "validation_error",
   "transient": "false",
   "failure": "tool args failed the tool's schema"
  },
  {
   "code": "NIKA-AGENT-001",
   "category": "budget_error",
   "transient": "false",
   "failure": "max_turns exhausted before completion"
  },
  {
   "code": "NIKA-AGENT-002",
   "category": "budget_error",
   "transient": "false",
   "failure": "max_tokens_total exhausted before completion"
  },
  {
   "code": "NIKA-AGENT-003",
   "category": "validation_error",
   "transient": "false",
   "failure": "a skills: path does not resolve (file missing/unreadable at compose time)"
  },
  {
   "code": "NIKA-AGENT-004",
   "category": "validation_error",
   "transient": "false",
   "failure": "a skills: file is not a valid Agent Skill (frontmatter shape · missing/empty name/description)"
  },
  {
   "code": "NIKA-AGENT-005",
   "category": "budget_error",
   "transient": "false",
   "failure": "the provider reported no token usage for a priced model — every budget and ledger reads the turn as free, so the loop fails closed (R3-F1 · the usage-absence gate)"
  },
  {
   "code": "NIKA-MCP-001",
   "category": "tool_error",
   "transient": "engine-assessed",
   "failure": "MCP server not configured / not reachable at call time"
  },
  {
   "code": "NIKA-MCP-002",
   "category": "tool_error",
   "transient": "engine-assessed",
   "failure": "MCP tool call failed (transport · tool-side error)"
  },
  {
   "code": "NIKA-DECIDE-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "the decision bundle is malformed or violates its own laws (float weight · undeclared evidence key in rules · identity key feeding a technical dimension · missing contradictory fixture · monotonicity violated by the bundle's own fixtures) (spec 11)"
  },
  {
   "code": "NIKA-DECIDE-002",
   "category": "validation_error",
   "transient": "false",
   "failure": "the evidence snapshot does not satisfy the bundle's evidence schema (type misfit · unauthorized source · integrity below the declared floor · undeclared key) (spec 11)"
  },
  {
   "code": "NIKA-PORT-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "a gateway artifact (deployment bundle · capabilities report · lowering report · fidelity report · authority delta) is malformed or violates its laws (unknown promoted · permissive_unsafe without refusal · disclosure subset-chain violated · child authority exceeding parent) (spec 12)"
  },
  {
   "code": "NIKA-PORT-002",
   "category": "security_error",
   "transient": "false",
   "failure": "policy lowering is permissive_unsafe — the backend would allow what the policy forbids · refused with the divergence witness (spec 12)"
  },
  {
   "code": "NIKA-SEC-001",
   "category": "security_error",
   "transient": "false",
   "failure": "exec refused before the child spawns — either the shell floor (a destructive/privilege pattern · always-on · independent of permits:) or the mock plane under `nika test`, which refuses EVERY command by design (it simulates the model, not effects) · under test the exit is `nika run` for real effects, or an `on_error: recover` rehearsal on the task"
  },
  {
   "code": "NIKA-SEC-002",
   "category": "security_error",
   "transient": "false",
   "failure": "agent tool call outside the tools: whitelist"
  },
  {
   "code": "NIKA-SEC-003",
   "category": "security_error",
   "transient": "false",
   "failure": "run-recursion bound — nested-run depth exceeded OR self-launching workflow"
  },
  {
   "code": "NIKA-SEC-004",
   "category": "security_error",
   "transient": "false",
   "failure": "effect outside the declared permits: capability boundary (fs/net/exec/tool)"
  },
  {
   "code": "NIKA-SEC-005",
   "category": "security_error",
   "transient": "false",
   "failure": "SSRF block — a nika:fetch/nika:notify URL resolves to a loopback/private/link-local/metadata target (always-on engine floor · independent of permits:)"
  },
  {
   "code": "NIKA-SEC-006",
   "category": "security_error",
   "transient": "false",
   "failure": "secret flow — a secrets.<name> value reaches an unsanctioned sink (exec argument · invoke payload · infer/agent prompt) · the diagnostic carries the taint path + the egress clause that would sanction it (spec 10 · flow rules in 01 §egress)"
  },
  {
   "code": "NIKA-SEC-007",
   "category": "security_error",
   "transient": "false",
   "failure": "secret egress — a tainted value reaches the workflow boundary (outputs:) · the diagnostic carries the taint path (spec 10 · the to: outputs sanction in 01 §egress)"
  },
  {
   "code": "NIKA-SEC-008",
   "category": "security_error",
   "transient": "false",
   "failure": "data-as-code sink · a nika:fetch resolved URL path names a code-bearing class (serialized-executable · script/interpreter · executable binary/module · the closed NEP-0006 list) and the task declares no door — no lift: entry naming the data-as-code law · the read hides an execution sink (F-O7 · NEP-0006)"
  },
  {
   "code": "NIKA-SEC-009",
   "category": "security_error",
   "transient": "false",
   "failure": "lethal trifecta complete — the declared boundary grants private read (fs.read non-empty) + untrusted ingress (a nika:fetch builtin invoked · an mcp:* tool invoked · an agent: whose whitelist admits ingress) + external egress (net.http non-empty · an escaping fs.write glob · exec enabled), the untrusted content REACHES an egress-capable task's effect surface (a realized flow), and no blocking invoke: nika:prompt (no default:) dominates it (NEP-0002 v2.0 · the Rule of Two as a static check)"
  },
  {
   "code": "NIKA-SEC-010",
   "category": "security_error",
   "transient": "false",
   "failure": "the approval-capability law is violated · a rate-limited approval burst (the N+1th distinct mint of a run) · an approval whose resolved content hash differs from the shown hash (content_mismatch) · a ticket replayed across runs or steps (scope_mismatch) · or the static heterogeneous-batch refusal (one prompt unleashing two or more effect classes) — the 6th invariant (NEP-0013 · F-P4)"
  },
  {
   "code": "NIKA-SEC-011",
   "category": "security_error",
   "transient": "false",
   "failure": "preview-commit divergence — the commit digest recomputed at the sink over the exact bytes about to fire differs from the preview digest computed at resolution (one bit of rendered argv · a permuted context field · a mutated tool argument) · the step refuses fail-closed and the receipt carries divergence:{preview, commit} — judged = executed at the action scale (NEP-0015 · F-P6)"
  },
  {
   "code": "NIKA-SEC-012",
   "category": "security_error",
   "transient": "false",
   "failure": "unordered shared writes — two tasks incomparable in the DAG closure whose literal nika:write/nika:edit paths collide with no ordering edge (after: · with:) to serialize them, or a for_each fan writing one constant path · parallelism is safe exactly where the writes are provably disjoint (NEP-0014 law 1 · F-P15)"
  },
  {
   "code": "NIKA-SEC-014",
   "category": "security_error",
   "transient": "false",
   "failure": "the affirmative-consent law — a confirm-mode human gate (invoke: nika:prompt · mode absent or confirm) reaches an egress-capable task over a route no affirmative gate closes: a REFUSED confirm settles success with value false, so a bare after: { gate: success } edge, a when: that never reads the answer, and a when: provably true on the refusal all let the effect through · the gate is credited only when every route consumes the answer and proves false on it (the Kleene-falsifiable when: · when: false · a closer confirm gate owns its closure) · an undecidable gate (a nested binding · a non-fragment expression) defers to the advisory hint, never a refusal (NEP-0020 · P0-2 of the 2026-07-30 audit)"
  },
  {
   "code": "NIKA-SEC-015",
   "category": "security_error",
   "transient": "false",
   "failure": "the order law — an exec: task sits transitively downstream of a net-effecting task (nika:fetch · nika:notify) over the derived graph (with: data edges ∪ after: control edges) · content the workflow did not author must not reach a shell · UNCONDITIONAL: no block declares it and none can disable it"
  },
  {
   "code": "NIKA-TIMEOUT-001",
   "category": "timeout_error",
   "transient": "false",
   "failure": "task (or for_each iteration) exceeded timeout:"
  },
  {
   "code": "NIKA-CANCEL-001",
   "category": "cancelled",
   "transient": "false",
   "failure": "task cancelled (workflow failure gate · user cancellation)"
  },
  {
   "code": "NIKA-ASSERT-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "an assert: claims a level the evidence does not support (a StaticProof the IR cannot decide · a mis-leveled obligation · spec 15)"
  },
  {
   "code": "NIKA-LOCK-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "a dependency resolved that nika.lock does not pin, or a hand-edited lock digest does not match (pin-by-default · the lock's own hash catches the edit · spec 15)"
  },
  {
   "code": "NIKA-BUILTIN-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "builtin invoke violates its statically-checkable arg contract (e.g. nika:fetch without url: · nika:jq arg shape)"
  },
  {
   "code": "NIKA-BUILTIN-DONE-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "nika:done invoked outside an agent: loop"
  },
  {
   "code": "NIKA-DRIFT-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "declared-but-unused — a vars:/env:/secrets: name or a permits: entry (exec program · tool glob · net host · fs path) that nothing in the body references (advisory check hint · never fails the audit — the reverse direction, used-but-undeclared, is the hard NIKA-VAR-001/NIKA-DAG-002/NIKA-SEC-004 surface)"
  },
  {
   "code": "NIKA-AUTH-006",
   "category": "security_error",
   "transient": "false",
   "failure": "no permits: block declared and the body has effects — absent = zero authority (F-O8 · NEP-0003)"
  },
  {
   "code": "NIKA-AUTH-007",
   "category": "security_error",
   "transient": "false",
   "failure": "an interpolation reaches a permit bound (host · glob · program · env name) — a bound MUST be a literal, the boundary would be self-serve (F-O1 · NEP-0004 · env per NEP-0005)"
  },
  {
   "code": "NIKA-AUTH-008",
   "category": "security_error",
   "transient": "false",
   "failure": "an untrusted value reaches a permitted verb's argument and its canonical resolved form escapes the step's permit — re-gate refused (F-O1 · NEP-0004)"
  },
  {
   "code": "NIKA-AUTH-009",
   "category": "security_error",
   "transient": "false",
   "failure": "a permits env: entry names a dangerous-floor variable · the engine strips the name unconditionally, the grant can never take effect: an inert dead grant (F-O4 · NEP-0005)"
  },
  {
   "code": "NIKA-AUTH-010",
   "category": "security_error",
   "transient": "false",
   "failure": "a permits net.http: entry carries the *. subdomain wildcard · the grant delegates the boundary to the zone operator (every host under the suffix, present and future) — refused: name exact hosts, or the bare * when allow-all is genuinely intended (F-P5 · NEP-0008)"
  },
  {
   "code": "NIKA-AUTH-011",
   "category": "validation_error",
   "transient": "false",
   "failure": "a lift: entry whose named law would not have fired on this task — a trapdoor that lifts nothing is refused, never a silent no-op (10 §the authored doors rule 6)"
  },
  {
   "code": "NIKA-VALUES-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "vars: is a dead envelope field (R3a · the E-split)"
  },
  {
   "code": "NIKA-VALUES-002",
   "category": "validation_error",
   "transient": "false",
   "failure": "env: is a dead envelope field (R3a · the E-split)"
  },
  {
   "code": "NIKA-VALUES-003",
   "category": "validation_error",
   "transient": "false",
   "failure": "a value-namespace read outside the three-authority family (R3a · LAW-SURFACE-0201)"
  },
  {
   "code": "NIKA-DEFAULT-001",
   "category": "validation_error",
   "transient": "false",
   "failure": "a declared inputs default or typed const value does not conform to its declared type (R3b · LAW-TYPE-0211)"
  }
 ]
}