{
  "adr_refs": [
    "adr-037"
  ],
  "description": "Stops keeper-daemon on ops-vm. All ops commands require operator manual signature until switch_to_vm_ops reverses this.",
  "emit_audit": true,
  "id": "switch_to_operator_only",
  "name": "Switch to Operator-Only Mode",
  "params": [
    {
      "default_val": "",
      "description": "Target workspace name (e.g. libre-wuji)",
      "name": "workspace",
      "required": true
    },
    {
      "default_val": "",
      "description": "ops-vm SSH hostname or IP",
      "name": "ops_vm_host",
      "required": true
    }
  ],
  "preconditions": [
    "Operator has a valid keeper-cli credential for the target workspace",
    "ops-vm is accessible via SSH",
    "No critical ops pending that would miss auto-sign SLA"
  ],
  "rollback_strategy": "manual",
  "steps": [
    {
      "depends_on": [],
      "dry_run_arg": "--dry-run",
      "id": "check_pending_queue",
      "name": "Check pending queue depth before switching",
      "on_error": "Continue",
      "params": {},
      "script": "steps/check_queue.nu"
    },
    {
      "depends_on": [
        "check_pending_queue"
      ],
      "dry_run_arg": "--dry-run",
      "id": "stop_keeper_daemon",
      "name": "Stop keeper-daemon on ops-vm via SSH",
      "on_error": "Stop",
      "params": {},
      "script": "steps/stop_keeper.nu"
    },
    {
      "depends_on": [
        "stop_keeper_daemon"
      ],
      "dry_run_arg": "--dry-run",
      "id": "verify_queue_accumulating",
      "name": "Verify OPS_PENDING stream accumulates without auto-sign",
      "on_error": "Continue",
      "params": {},
      "script": "steps/verify_queue_accumulating.nu"
    },
    {
      "depends_on": [
        "stop_keeper_daemon"
      ],
      "dry_run_arg": "--dry-run",
      "id": "emit_mode_change",
      "name": "Emit audit event: mode switched to operator-only",
      "on_error": "Continue",
      "params": {
        "event_type": "mode_switch",
        "new_mode": "operator-only"
      },
      "script": "steps/emit_audit.nu"
    }
  ],
  "success_criteria": [
    "keeper-daemon inactive on ops-vm (systemctl is-active keeper-daemon = inactive)",
    "OPS_PENDING queue depth increasing without auto-sign clearing it",
    "ops history shows mode-switch audit event"
  ],
  "version": 1
}