{
  "guards": [],
  "id": "provisioning-audit",
  "postconditions": [
    "Workspace config validates against Nickel schemas without errors",
    "All declared taskservs exist and have metadata.ncl",
    "Provider capabilities match workspace requirements",
    "No provisioning axiom violations detected",
    "Audit report generated with pass/fail per check"
  ],
  "preconditions": [
    "{workspace_dir} exists and is a directory",
    "nickel is available in PATH",
    "{workspace_dir}/config/ contains at least one .ncl file",
    "./scripts/ontoref is executable"
  ],
  "steps": [
    {
      "action": "nickel_typecheck_workspace",
      "actor": "Agent",
      "cmd": "find {workspace_dir}/config -name '*.ncl' | xargs -I{} nickel typecheck {}",
      "depends_on": [],
      "id": "validate_workspace_config",
      "note": "Validate all workspace Nickel configs parse and typecheck. Hard failure — a workspace with invalid config cannot be certified.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Stop"
      }
    },
    {
      "action": "extract_taskservs_from_config",
      "actor": "Agent",
      "cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.taskservs // [] | .[]'",
      "depends_on": [
        {
          "kind": "OnSuccess",
          "step": "validate_workspace_config"
        }
      ],
      "id": "list_declared_taskservs",
      "note": "Extract the list of taskservs declared in the workspace config.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Stop"
      }
    },
    {
      "action": "check_taskserv_presence",
      "actor": "Agent",
      "cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.taskservs // [] | .[]' | while read ts; do test -d extensions/taskservs/$ts || echo \"MISSING taskserv: $ts\"; done",
      "depends_on": [
        {
          "kind": "OnSuccess",
          "step": "list_declared_taskservs"
        }
      ],
      "id": "verify_taskservs_exist",
      "note": "Verify each declared taskserv has a corresponding directory in extensions/taskservs/.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Continue"
      }
    },
    {
      "action": "verify_taskserv_metadata",
      "actor": "Agent",
      "cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.taskservs // [] | .[]' | while read ts; do test -f extensions/taskservs/$ts/metadata.ncl || echo \"MISSING metadata.ncl: $ts\"; done",
      "depends_on": [
        {
          "kind": "Always",
          "step": "verify_taskservs_exist"
        }
      ],
      "id": "check_taskserv_contracts",
      "note": "Verify each taskserv has metadata.ncl declaring its capabilities and contracts.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Continue"
      }
    },
    {
      "action": "check_provider_capability_match",
      "actor": "Agent",
      "cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.provider // empty' | xargs -I{} test -d extensions/providers/{} || echo 'MISSING or mismatched provider'",
      "depends_on": [
        {
          "kind": "OnSuccess",
          "step": "validate_workspace_config"
        }
      ],
      "id": "verify_provider_capabilities",
      "note": "Verify the declared provider exists in extensions/providers/ and supports the workspace's required capabilities.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Continue"
      }
    },
    {
      "action": "verify_provisioning_axioms",
      "actor": "Agent",
      "cmd": "./scripts/ontoref describe {workspace_name} --check-axioms provisioning:config-driven-always,provisioning:type-safety-nickel",
      "depends_on": [
        {
          "kind": "OnSuccess",
          "step": "validate_workspace_config"
        },
        {
          "kind": "Always",
          "step": "check_taskserv_contracts"
        },
        {
          "kind": "Always",
          "step": "verify_provider_capabilities"
        }
      ],
      "id": "check_axiom_coherence",
      "note": "Verify the workspace config does not violate provisioning axioms — no hardcoded values, all config via typed Nickel.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Continue"
      }
    },
    {
      "action": "write_audit_output",
      "actor": "Agent",
      "cmd": "./scripts/ontoref describe {workspace_name} --format audit",
      "depends_on": [
        {
          "kind": "Always",
          "step": "check_axiom_coherence"
        }
      ],
      "id": "generate_audit_report",
      "note": "Generate the compliance report: pass/fail per check, missing extensions, axiom violations.",
      "on_error": {
        "backoff_s": 5,
        "max": 3,
        "strategy": "Stop"
      }
    }
  ],
  "trigger": "Audit an existing workspace for config validity, extension completeness, and axiom coherence"
}