106 lines
3 KiB
JSON
106 lines
3 KiB
JSON
{
|
|
"adr_refs": [
|
|
"adr-037"
|
|
],
|
|
"description": "Ensures keeper policy is current in policy-<workspace> Radicle repo, starts keeper-daemon on ops-vm, and verifies it picks up the pending ops backlog.",
|
|
"emit_audit": true,
|
|
"id": "switch_to_vm_ops",
|
|
"name": "Switch to VM-Ops (Auto-Sign) Mode",
|
|
"params": [
|
|
{
|
|
"default_val": "",
|
|
"description": "Target workspace name (e.g. libre-wuji)",
|
|
"name": "workspace",
|
|
"required": true
|
|
},
|
|
{
|
|
"default_val": "",
|
|
"description": "ops-vm SSH hostname or IP",
|
|
"name": "ops_vm_host",
|
|
"required": true
|
|
}
|
|
],
|
|
"preconditions": [
|
|
"policy-<workspace> Radicle repo has been updated and propagated to ops-vm seed",
|
|
"ops-vm is accessible via SSH",
|
|
"KEEPER_PRIVATE_KEY_PATH is set on ops-vm",
|
|
"NATS JetStream OPS_PENDING_<WORKSPACE> stream exists in libre-wuji"
|
|
],
|
|
"rollback_strategy": "manual",
|
|
"steps": [
|
|
{
|
|
"depends_on": [],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "validate_policy",
|
|
"name": "Validate keeper policy against keeper_policy.ncl schema",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/validate_policy.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"validate_policy"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "sync_policy_repo",
|
|
"name": "Sync policy-<workspace> Radicle repo to ops-vm",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/sync_policy_repo.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"sync_policy_repo"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "start_keeper_daemon",
|
|
"name": "Start keeper-daemon on ops-vm via SSH",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/start_keeper.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"start_keeper_daemon"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "verify_daemon_running",
|
|
"name": "Verify keeper-daemon health endpoint responds",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/verify_keeper_health.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"verify_daemon_running"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "verify_backlog_processing",
|
|
"name": "Verify keeper-daemon picks up pending ops backlog",
|
|
"on_error": "Continue",
|
|
"params": {},
|
|
"script": "steps/verify_backlog.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"verify_daemon_running"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "emit_mode_change",
|
|
"name": "Emit audit event: mode switched to vm-ops",
|
|
"on_error": "Continue",
|
|
"params": {
|
|
"event_type": "mode_switch",
|
|
"new_mode": "vm-ops"
|
|
},
|
|
"script": "steps/emit_audit.nu"
|
|
}
|
|
],
|
|
"success_criteria": [
|
|
"keeper-daemon active on ops-vm (systemctl is-active keeper-daemon = active)",
|
|
"keeper-daemon /health endpoint responds 200",
|
|
"OPS_PENDING queue depth decreasing as backlog is processed",
|
|
"ops history shows mode-switch audit event"
|
|
],
|
|
"version": 1
|
|
}
|