{
  "adr_refs": [
    "adr-037"
  ],
  "description": "Ensures keeper policy is current in policy-<workspace> Radicle repo, starts keeper-daemon on ops-vm, and verifies it picks up the pending ops backlog.",
  "emit_audit": true,
  "id": "switch_to_vm_ops",
  "name": "Switch to VM-Ops (Auto-Sign) Mode",
  "params": [
    {
      "default_val": "",
      "description": "Target workspace name (e.g. libre-wuji)",
      "name": "workspace",
      "required": true
    },
    {
      "default_val": "",
      "description": "ops-vm SSH hostname or IP",
      "name": "ops_vm_host",
      "required": true
    }
  ],
  "preconditions": [
    "policy-<workspace> Radicle repo has been updated and propagated to ops-vm seed",
    "ops-vm is accessible via SSH",
    "KEEPER_PRIVATE_KEY_PATH is set on ops-vm",
    "NATS JetStream OPS_PENDING_<WORKSPACE> stream exists in libre-wuji"
  ],
  "rollback_strategy": "manual",
  "steps": [
    {
      "depends_on": [],
      "dry_run_arg": "--dry-run",
      "id": "validate_policy",
      "name": "Validate keeper policy against keeper_policy.ncl schema",
      "on_error": "Stop",
      "params": {},
      "script": "steps/validate_policy.nu"
    },
    {
      "depends_on": [
        "validate_policy"
      ],
      "dry_run_arg": "--dry-run",
      "id": "sync_policy_repo",
      "name": "Sync policy-<workspace> Radicle repo to ops-vm",
      "on_error": "Stop",
      "params": {},
      "script": "steps/sync_policy_repo.nu"
    },
    {
      "depends_on": [
        "sync_policy_repo"
      ],
      "dry_run_arg": "--dry-run",
      "id": "start_keeper_daemon",
      "name": "Start keeper-daemon on ops-vm via SSH",
      "on_error": "Stop",
      "params": {},
      "script": "steps/start_keeper.nu"
    },
    {
      "depends_on": [
        "start_keeper_daemon"
      ],
      "dry_run_arg": "--dry-run",
      "id": "verify_daemon_running",
      "name": "Verify keeper-daemon health endpoint responds",
      "on_error": "Stop",
      "params": {},
      "script": "steps/verify_keeper_health.nu"
    },
    {
      "depends_on": [
        "verify_daemon_running"
      ],
      "dry_run_arg": "--dry-run",
      "id": "verify_backlog_processing",
      "name": "Verify keeper-daemon picks up pending ops backlog",
      "on_error": "Continue",
      "params": {},
      "script": "steps/verify_backlog.nu"
    },
    {
      "depends_on": [
        "verify_daemon_running"
      ],
      "dry_run_arg": "--dry-run",
      "id": "emit_mode_change",
      "name": "Emit audit event: mode switched to vm-ops",
      "on_error": "Continue",
      "params": {
        "event_type": "mode_switch",
        "new_mode": "vm-ops"
      },
      "script": "steps/emit_audit.nu"
    }
  ],
  "success_criteria": [
    "keeper-daemon active on ops-vm (systemctl is-active keeper-daemon = active)",
    "keeper-daemon /health endpoint responds 200",
    "OPS_PENDING queue depth decreasing as backlog is processed",
    "ops history shows mode-switch audit event"
  ],
  "version": 1
}