82 lines
2.3 KiB
JSON
82 lines
2.3 KiB
JSON
{
|
|
"adr_refs": [
|
|
"adr-037"
|
|
],
|
|
"description": "Stops keeper-daemon on ops-vm. All ops commands require operator manual signature until switch_to_vm_ops reverses this.",
|
|
"emit_audit": true,
|
|
"id": "switch_to_operator_only",
|
|
"name": "Switch to Operator-Only Mode",
|
|
"params": [
|
|
{
|
|
"default_val": "",
|
|
"description": "Target workspace name (e.g. libre-wuji)",
|
|
"name": "workspace",
|
|
"required": true
|
|
},
|
|
{
|
|
"default_val": "",
|
|
"description": "ops-vm SSH hostname or IP",
|
|
"name": "ops_vm_host",
|
|
"required": true
|
|
}
|
|
],
|
|
"preconditions": [
|
|
"Operator has a valid keeper-cli credential for the target workspace",
|
|
"ops-vm is accessible via SSH",
|
|
"No critical ops pending that would miss auto-sign SLA"
|
|
],
|
|
"rollback_strategy": "manual",
|
|
"steps": [
|
|
{
|
|
"depends_on": [],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "check_pending_queue",
|
|
"name": "Check pending queue depth before switching",
|
|
"on_error": "Continue",
|
|
"params": {},
|
|
"script": "steps/check_queue.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"check_pending_queue"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "stop_keeper_daemon",
|
|
"name": "Stop keeper-daemon on ops-vm via SSH",
|
|
"on_error": "Stop",
|
|
"params": {},
|
|
"script": "steps/stop_keeper.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"stop_keeper_daemon"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "verify_queue_accumulating",
|
|
"name": "Verify OPS_PENDING stream accumulates without auto-sign",
|
|
"on_error": "Continue",
|
|
"params": {},
|
|
"script": "steps/verify_queue_accumulating.nu"
|
|
},
|
|
{
|
|
"depends_on": [
|
|
"stop_keeper_daemon"
|
|
],
|
|
"dry_run_arg": "--dry-run",
|
|
"id": "emit_mode_change",
|
|
"name": "Emit audit event: mode switched to operator-only",
|
|
"on_error": "Continue",
|
|
"params": {
|
|
"event_type": "mode_switch",
|
|
"new_mode": "operator-only"
|
|
},
|
|
"script": "steps/emit_audit.nu"
|
|
}
|
|
],
|
|
"success_criteria": [
|
|
"keeper-daemon inactive on ops-vm (systemctl is-active keeper-daemon = inactive)",
|
|
"OPS_PENDING queue depth increasing without auto-sign clearing it",
|
|
"ops history shows mode-switch audit event"
|
|
],
|
|
"version": 1
|
|
}
|