# SPDX-License-Identifier: Apache-2.0
# yaml-language-server: $schema=https://nika.sh/spec/v1/workflow.schema.json
#
# 08 · The deployment's knobs — one authority, two roles.
#
# THREE authorities can put a value in a workflow: `inputs:` (declared once,
# supplied by the caller OR by its own `default:`) · `const:` (the author,
# fixed in the file) · `secrets:` (a governed store reference, masked, and it
# lives with the jobs · CONVENTIONS §3).
#
# A deployment knob — a region label, a verbosity switch — is an `inputs:`
# entry with `required: false` and a `default:`. It used to have a block of
# its own, `config:`, and that block is dead: it had zero usage in real work,
# its `default:` was its only possible source, and under the taint lattice
# `config.p` and `inputs.p` produced the SAME refusal by the same path. Two
# authorities the checker cannot tell apart are one authority.
#
# Demonstrates ·
#   - a knob · typed, `required: false`, `default:`-carrying
#   - declared-only resolution · an undeclared `${{ inputs.x }}` is
#     `NIKA-VAR-001` — the engine NEVER falls back to the OS environment
#     (spec/01-envelope.md §inputs)
#   - `when:` on a knob · a quiet run and a verbose run, one file
#   - who supplies what · `--var` reaches every `inputs:` entry, knob or not
#
# Run · nika run examples/08-config-values.nika.yaml
#   The verbose twin · flip `verbose.default` to true and run again.

nika: config-values

permits:
  tools: ["nika:jq", "nika:log"]

inputs:
  team:
    type: string
    default: "atelier"
    required: true
    description: "Whose report this is — the CALLER's value · --var team=…"
  # The deployment's knobs — `required: false` + a `default:` is what makes
  # this file runnable everywhere with nobody supplying anything. Never a
  # credential here: an input's value appears in logs and traces
  # (spec/01-envelope.md §secrets) — a value that must stay masked belongs
  # to `secrets:`.
  region:
    required: false
    type: string
    default: "eu"
    description: "Which region label the report carries"
  verbose:
    required: false
    type: bool
    default: false
    description: "Emit the debug dump task when true"

const:
  # The author's number — fixed in the file, never supplied by anyone.
  window_days: 7

tasks:
  report:
    invoke:
      tool: "nika:jq"
      args:
        input:
          team: "${{ inputs.team }}"
          region: "${{ inputs.region }}"
          window_days: "${{ const.window_days }}"
        expression: '. + {title: "\(.team) · \(.region) · last \(.window_days) days"}'

  debug_dump:
    with:
      report: ${{ tasks.report.output }}
    # A knob routes WORK — it never stands in for a human decision
    # (spec/10-authority.md · "a `when:` on an input flag is not a gate").
    # False by default: this task settles `skipped`, and nothing downstream
    # reads it, so the quiet run stays quiet. The shape rule (cel-subset)
    # wants an explicit relation — `== true`, never the bare flag.
    when: ${{ inputs.verbose == true }}
    invoke:
      tool: "nika:log"
      args:
        level: debug
        message: "full report object"
        data: "${{ with.report }}"

outputs:
  report:
    value: ${{ tasks.report.output }}
    description: "The shaped report · title carries team + region + window"

the path · 08

The deployment's knobs — one authority, two roles.

run itnika try 08-config-values

08-config-values.nika.yamlsource

1# SPDX-License-Identifier: Apache-2.02# yaml-language-server: $schema=https://nika.sh/spec/v1/workflow.schema.json3#4# 08 · The deployment's knobs — one authority, two roles.5#6# THREE authorities can put a value in a workflow: `inputs:` (declared once,7# supplied by the caller OR by its own `default:`) · `const:` (the author,8# fixed in the file) · `secrets:` (a governed store reference, masked, and it9# lives with the jobs · CONVENTIONS §3).10#11# A deployment knob — a region label, a verbosity switch — is an `inputs:`12# entry with `required: false` and a `default:`. It used to have a block of13# its own, `config:`, and that block is dead: it had zero usage in real work,14# its `default:` was its only possible source, and under the taint lattice15# `config.p` and `inputs.p` produced the SAME refusal by the same path. Two16# authorities the checker cannot tell apart are one authority.17#18# Demonstrates ·19#   - a knob · typed, `required: false`, `default:`-carrying20#   - declared-only resolution · an undeclared `${{ inputs.x }}` is21#     `NIKA-VAR-001` — the engine NEVER falls back to the OS environment22#     (spec/01-envelope.md §inputs)23#   - `when:` on a knob · a quiet run and a verbose run, one file24#   - who supplies what · `--var` reaches every `inputs:` entry, knob or not25#26# Run · nika run examples/08-config-values.nika.yaml27#   The verbose twin · flip `verbose.default` to true and run again.2829nika: config-values3031⛨permits:32  ⛨tools: ["nika:jq", "nika:log"]3334inputs:35  team:36    type: string37    default: "atelier"38    required: true39    description: "Whose report this is — the CALLER's value · --var team=…"40  # The deployment's knobs — `required: false` + a `default:` is what makes41  # this file runnable everywhere with nobody supplying anything. Never a42  # credential here: an input's value appears in logs and traces43  # (spec/01-envelope.md §secrets) — a value that must stay masked belongs44  # to `secrets:`.45  region:46    required: false47    type: string48    default: "eu"49    description: "Which region label the report carries"50  verbose:51    required: false52    type: bool53    default: false54    description: "Emit the debug dump task when true"5556const:57  # The author's number — fixed in the file, never supplied by anyone.58  window_days: 75960tasks:61  report:62    ◆invoke:63      tool: "nika:jq"64      args:65        input:66          team: "${{ inputs.team }}"67          region: "${{ inputs.region }}"68          window_days: "${{ const.window_days }}"69        expression: '. + {title: "\(.team) · \(.region) · last \(.window_days) days"}'7071  debug_dump:72    with:73      report: ${{ tasks.report.output }}74    # A knob routes WORK — it never stands in for a human decision75    # (spec/10-authority.md · "a `when:` on an input flag is not a gate").76    # False by default: this task settles `skipped`, and nothing downstream77    # reads it, so the quiet run stays quiet. The shape rule (cel-subset)78    # wants an explicit relation — `== true`, never the bare flag.79    when: ${{ inputs.verbose == true }}80    ◆invoke:81      tool: "nika:log"82      args:83        level: debug84        message: "full report object"85        data: "${{ with.report }}"8687outputs:88  report:89    value: ${{ tasks.report.output }}90    description: "The shaped report · title carries team + region + window"91

nika-spec@2b3d6ac3e · sha256 63c926dbbf788e7f…