capture

    # A COMMAND gate · a test suite, a CLI probe · argv form, never a shell.
    exec:
      command: ["echo", "ok"]        # SLOT: gate 2 · the program must be in permits.exec
      capture: structured
    on_error:
      # Golden rehearsal · `nika test` refuses exec (NIKA-SEC-001 · the mock
      # plane simulates the model, not effects). Catch-all ON PURPOSE — never
      # `on_codes: [NIKA-SEC-001]`: that code is also a real blocklist stop,
      # and a narrow forgiveness would swallow a security refusal. The shape
      # matches `capture: structured` so the gates expression reads it.