106 lines
3 KiB
JSON
106 lines
3 KiB
JSON
{
|
|
"adr_refs": [
|
|
"adr-037",
|
|
"adr-038"
|
|
],
|
|
"description": "Revokes NATS JWT credential, proposes delegation removal patch on policy-<workspace> repo signed by remaining quorum. After completion the operator cannot sign ops commands.",
|
|
"emit_audit": true,
|
|
"id": "offboard_operator",
|
|
"name": "Offboard Operator",
|
|
"params": [
|
|
{
|
|
"default_val": "",
|
|
"description": "Target workspace",
|
|
"name": "workspace",
|
|
"required": true
|
|
},
|
|
{
|
|
"default_val": "",
|
|
"description": "Name matching onboard record",
|
|
"name": "operator_name",
|
|
"required": true
|
|
},
|
|
{
|
|
"default_val": "",
|
|
"description": "Radicle DID of the operator to remove",
|
|
"name": "operator_did",
|
|
"required": true
|
|
},
|
|
{
|
|
"default_val": "voluntary",
|
|
"description": "Offboarding reason (recorded in audit)",
|
|
"name": "reason",
|
|
"required": false
|
|
}
|
|
],
|
|
"preconditions": [
|
|
"Identify operator by name and Radicle DID",
|
|
"Remaining quorum (after removal) still meets the threshold for the workspace",
|
|
"Any pending ops signed by this operator should be reviewed before offboarding"
|
|
],
|
|
"rollback_strategy": "manual",
|
|
"steps": [
|
|
{
|
|
"depends_on": [],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "revoke_nats_credential",
|
|
"name": "Revoke operator NATS JWT credential",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/revoke_nats_credential.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"revoke_nats_credential"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "propose_delegation_removal",
|
|
"name": "Propose delegation removal from policy-<workspace> repo",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/propose_delegation_removal.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"propose_delegation_removal"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "sign_removal_patch",
|
|
"name": "Await remaining quorum signatures on removal patch",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/sign_removal_patch.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"sign_removal_patch"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "verify_operator_cannot_sign",
|
|
"name": "Verify revoked operator credential is rejected",
|
|
"on_error": "Continue",
|
|
"params": {},
|
|
"script": "steps/verify_operator_blocked.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"sign_removal_patch"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "emit_audit",
|
|
"name": "Emit operator-offboard audit event",
|
|
"on_error": "Continue",
|
|
"params": {
|
|
"event_type": "operator_offboard"
|
|
},
|
|
"script": "steps/emit_audit.nu"
|
|
}
|
|
],
|
|
"success_criteria": [
|
|
"Operator NATS JWT credential is revoked (NATS rejects connection attempts)",
|
|
"Operator DID removed from policy-<workspace> delegation set",
|
|
"Test sign attempt with revoked credential returns 403",
|
|
"ops history shows operator-offboard audit event"
|
|
],
|
|
"version": 1
|
|
}
|