{
  "description": "Verify each workspace has the three required Radicle repos (policy, desired, state) with correct delegation profiles and M-of-N quorum (ADR-038).",
  "id": "validate-radicle-governance",
  "params": {
    "expected_quorum": 2,
    "ops_controller_key": "",
    "radicle_home": "~/.radicle",
    "workspace": "libre-wuji"
  },
  "steps": [
    {
      "actor": "Agent",
      "cmd": "rad self --json | jq -e '.node.status == \"running\"'",
      "depends_on": [],
      "id": "check_radicle_node_running",
      "name": "Radicle node (radicled) is running",
      "on_error": "abort"
    },
    {
      "actor": "Agent",
      "cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"policy-{workspace}\") | .rid') | jq -e '.rid'",
      "depends_on": [
        "check_radicle_node_running"
      ],
      "id": "check_policy_repo_exists",
      "name": "policy-{workspace} Radicle repo exists locally",
      "on_error": "abort"
    },
    {
      "actor": "Agent",
      "cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-desired\") | .rid') | jq -e '.rid'",
      "depends_on": [
        "check_radicle_node_running"
      ],
      "id": "check_desired_repo_exists",
      "name": "{workspace}-desired Radicle repo exists locally",
      "on_error": "abort"
    },
    {
      "actor": "Agent",
      "cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-state\") | .rid') | jq -e '.rid'",
      "depends_on": [
        "check_radicle_node_running"
      ],
      "id": "check_state_repo_exists",
      "name": "{workspace}-state Radicle repo exists locally",
      "on_error": "abort"
    },
    {
      "actor": "Agent",
      "cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"policy-{workspace}\") | .rid') | jq -e '.delegates | length >= {expected_quorum}'",
      "depends_on": [
        "check_policy_repo_exists"
      ],
      "id": "check_policy_repo_quorum",
      "name": "policy-{workspace} delegation threshold meets expected quorum",
      "on_error": "abort"
    },
    {
      "actor": "Agent",
      "cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-state\") | .rid') | jq -e '.delegates | length == 1 and .[0].key == \"{ops_controller_key}\"'",
      "depends_on": [
        "check_state_repo_exists"
      ],
      "id": "check_state_repo_sole_delegate",
      "name": "{workspace}-state repo has exactly one delegate (ops-controller key)",
      "on_error": "abort"
    },
    {
      "actor": "Agent",
      "cmd": "git -C {radicle_home}/storage/$(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-state\") | .rid') log --show-signature -5 | grep -c 'Good signature'",
      "depends_on": [
        "check_state_repo_sole_delegate"
      ],
      "id": "check_audit_commits_signed",
      "name": "Recent commits on {workspace}-state are GPG/SSH-signed by ops-controller",
      "on_error": "warn"
    },
    {
      "actor": "Agent",
      "cmd": "echo 'radicle-governance validation complete: policy/desired/state repos confirmed, quorum={expected_quorum}, sole-delegate verified'",
      "depends_on": [
        "check_policy_repo_quorum",
        "check_state_repo_sole_delegate",
        "check_audit_commits_signed"
      ],
      "id": "summary_report",
      "name": "Emit governance validation summary for workspace={workspace}",
      "on_error": "warn"
    }
  ],
  "strategy": "Override",
  "version": "1.0"
}