{
  "adr_refs": [
    "adr-037",
    "adr-038"
  ],
  "description": "Revokes NATS JWT credential, proposes delegation removal patch on policy-<workspace> repo signed by remaining quorum. After completion the operator cannot sign ops commands.",
  "emit_audit": true,
  "id": "offboard_operator",
  "name": "Offboard Operator",
  "params": [
    {
      "default_val": "",
      "description": "Target workspace",
      "name": "workspace",
      "required": true
    },
    {
      "default_val": "",
      "description": "Name matching onboard record",
      "name": "operator_name",
      "required": true
    },
    {
      "default_val": "",
      "description": "Radicle DID of the operator to remove",
      "name": "operator_did",
      "required": true
    },
    {
      "default_val": "voluntary",
      "description": "Offboarding reason (recorded in audit)",
      "name": "reason",
      "required": false
    }
  ],
  "preconditions": [
    "Identify operator by name and Radicle DID",
    "Remaining quorum (after removal) still meets the threshold for the workspace",
    "Any pending ops signed by this operator should be reviewed before offboarding"
  ],
  "rollback_strategy": "manual",
  "steps": [
    {
      "depends_on": [],
      "dry_run_arg": "--dry-run",
      "id": "revoke_nats_credential",
      "name": "Revoke operator NATS JWT credential",
      "on_error": "Stop",
      "params": {},
      "script": "steps/revoke_nats_credential.nu"
    },
    {
      "depends_on": [
        "revoke_nats_credential"
      ],
      "dry_run_arg": "--dry-run",
      "id": "propose_delegation_removal",
      "name": "Propose delegation removal from policy-<workspace> repo",
      "on_error": "Stop",
      "params": {},
      "script": "steps/propose_delegation_removal.nu"
    },
    {
      "depends_on": [
        "propose_delegation_removal"
      ],
      "dry_run_arg": "--dry-run",
      "id": "sign_removal_patch",
      "name": "Await remaining quorum signatures on removal patch",
      "on_error": "Stop",
      "params": {},
      "script": "steps/sign_removal_patch.nu"
    },
    {
      "depends_on": [
        "sign_removal_patch"
      ],
      "dry_run_arg": "--dry-run",
      "id": "verify_operator_cannot_sign",
      "name": "Verify revoked operator credential is rejected",
      "on_error": "Continue",
      "params": {},
      "script": "steps/verify_operator_blocked.nu"
    },
    {
      "depends_on": [
        "sign_removal_patch"
      ],
      "dry_run_arg": "--dry-run",
      "id": "emit_audit",
      "name": "Emit operator-offboard audit event",
      "on_error": "Continue",
      "params": {
        "event_type": "operator_offboard"
      },
      "script": "steps/emit_audit.nu"
    }
  ],
  "success_criteria": [
    "Operator NATS JWT credential is revoked (NATS rejects connection attempts)",
    "Operator DID removed from policy-<workspace> delegation set",
    "Test sign attempt with revoked credential returns 403",
    "ops history shows operator-offboard audit event"
  ],
  "version": 1
}