> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nika.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Run it with what you already have

> Point an agent task at the harness you already pay for — gemini-cli, qwen-code, codex, claude — under nika's authority, billed honestly.

export const CANON = {
  schemaVersion: 1,
  verbs: 4,
  verbNames: ["infer", "exec", "invoke", "agent"],
  namespaces: 6,
  namespaceNames: ["inputs", "config", "const", "secrets", "with", "tasks"],
  builtins: 28,
  builtinNames: ["assert", "chart", "compose", "convert", "date", "decide", "done", "edit", "emit", "fetch", "glob", "grep", "hash", "image_fx", "image_generate", "inspect", "jq", "json_diff", "json_merge_patch", "log", "notify", "prompt", "read", "tts_generate", "uuid", "validate", "wait", "write"],
  providers: 17,
  providersCloud: 11,
  providersLocal: 5,
  providersTest: 1,
  providerIdsCloud: ["mistral", "anthropic", "openai", "gemini", "deepseek", "xai", "groq", "openrouter", "huggingface", "nvidia", "moonshot"],
  providerIdsLocal: ["ollama", "lmstudio", "llamacpp", "localai", "vllm"],
  providerIdsTest: ["mock"],
  extractModes: 9,
  extractModeNames: ["article", "feed", "jq", "links", "markdown", "metadata", "selector", "sitemap", "text"],
  templates: 10,
  templateNames: ["agent-loop", "api-upload-and-create", "chain", "docker-report", "etl-state", "fanout", "gate-and-act", "human-gated-ship", "media-asset-pack", "website-brief"],
  mcpTools: 9,
  mcpToolNames: ["nika_check", "nika_explain", "nika_schema", "nika_examples", "nika_template", "nika_canon", "nika_catalog", "nika_tools", "nika_inspect"],
  mcpProtocolVersions: ["2026-07-28", "2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"],
  mcpLatestProtocol: "2026-07-28",
  errorNamespaces: 25,
  errorNamespaceNames: ["NIKA-AGENT", "NIKA-ASSERT", "NIKA-AUTH", "NIKA-BUILTIN", "NIKA-CANCEL", "NIKA-COMP", "NIKA-DAG", "NIKA-DEFAULT", "NIKA-EXEC", "NIKA-IMPL", "NIKA-INFER", "NIKA-INVOKE", "NIKA-LOCK", "NIKA-MCP", "NIKA-DECIDE", "NIKA-DRIFT", "NIKA-PARSE", "NIKA-POLICY", "NIKA-PORT", "NIKA-PROVIDER", "NIKA-SEC", "NIKA-TIMEOUT", "NIKA-TYPE", "NIKA-VAR", "NIKA-VALUES"],
  errorCategories: 12,
  errorCodes: 103,
  pillars: 5
};

<Warning>
  Experimental — behind the `access-harness` build feature, OFF by
  default. This page describes a design-partner surface: the wire can
  move before it stabilizes, and every run tells you so.
</Warning>

`model:` picks the intelligence. **Access** picks the path the run
takes to reach it. Today that path is an API key, a local server, or
the mock. The harness class adds the one you already pay for: the
agent harness on your machine, driving its own subscription, with nika
in charge of what it may do.

Your workflow never changes. The same `agent:` task runs on a
provider key or on your harness — the access layer decides, at
admission, with a witness.

## What you need

One of the supported harnesses, signed in the way IT expects (nika
never holds its credential — the harness owns its auth store):

| Harness      | Driven through                              | Serves               |
| ------------ | ------------------------------------------- | -------------------- |
| Gemini CLI   | `gemini --experimental-acp`                 | `gemini/…` models    |
| Qwen Code    | `qwen --acp --experimental-skills`          | `qwen/…` models      |
| Codex        | `@zed-industries/codex-acp` (pinned)        | `openai/…` models    |
| Claude Agent | `@zed-industries/claude-agent-acp` (pinned) | `anthropic/…` models |

`nika doctor` shows what this machine detected — the binary, the
version against its pin, and whether the harness's own status surface
reports a sign-in. Nothing is probed silently, no credential file is
ever opened.

## Run it

Build with the feature, then declare the adapter:

```bash theme={"system"}
cargo build --release --features access-harness
export NIKA_HARNESS_ADAPTER=gemini-cli   # the registry row's id
nika run flow.nika.yaml
```

An agent task whose model the harness can serve is planned onto it.
Pin it explicitly when you mean it:

```bash theme={"system"}
nika run flow.nika.yaml --access gemini-cli
```

A pin is a pin: unsatisfied refuses with the witnesses, never a silent
fallback to a metered key.

## The authority bridge

The harness asks before it acts. Nika answers with your workflow's
`permits:` block, not with the harness's defaults:

* **Inside your grants** — the ask is allowed once (never
  "allow always") and the decision is witnessed in the trace.
* **Outside them** — the run pauses and shows you the harness's
  question, word for word. Answer once with
  `nika run --resume <trace> --answer <task>=true` (or `false`).
  Nothing the harness asked for runs before you answer.

## The honest receipt

A harness run's trace row says `access: harness` and
`billing: unknown` — because your plan's quota is the harness's
business until the harness itself reports it. What you will never see
is a fabricated `$0.00`: the ledger records the lane as
`subscription_quota`, priced when evidence exists, absent when it
doesn't.

## Kill-switch

One adapter refusing to behave? Take it off the machine without
touching the rest:

```bash theme={"system"}
export NIKA_HARNESS_DISABLE=codex-acp
```

A disabled adapter is no candidate at all — a pin naming it refuses in
plain words.