150 lines
4.9 KiB
JSON
150 lines
4.9 KiB
JSON
{
|
|
"guards": [],
|
|
"id": "provisioning-audit",
|
|
"postconditions": [
|
|
"Workspace config validates against Nickel schemas without errors",
|
|
"All declared taskservs exist and have metadata.ncl",
|
|
"Provider capabilities match workspace requirements",
|
|
"No provisioning axiom violations detected",
|
|
"Audit report generated with pass/fail per check"
|
|
],
|
|
"preconditions": [
|
|
"{workspace_dir} exists and is a directory",
|
|
"nickel is available in PATH",
|
|
"{workspace_dir}/config/ contains at least one .ncl file",
|
|
"./scripts/ontoref is executable"
|
|
],
|
|
"steps": [
|
|
{
|
|
"action": "nickel_typecheck_workspace",
|
|
"actor": "Agent",
|
|
"cmd": "find {workspace_dir}/config -name '*.ncl' | xargs -I{} nickel typecheck {}",
|
|
"depends_on": [],
|
|
"id": "validate_workspace_config",
|
|
"note": "Validate all workspace Nickel configs parse and typecheck. Hard failure — a workspace with invalid config cannot be certified.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Stop"
|
|
}
|
|
},
|
|
{
|
|
"action": "extract_taskservs_from_config",
|
|
"actor": "Agent",
|
|
"cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.taskservs // [] | .[]'",
|
|
"depends_on": [
|
|
{
|
|
"kind": "OnSuccess",
|
|
"step": "validate_workspace_config"
|
|
}
|
|
],
|
|
"id": "list_declared_taskservs",
|
|
"note": "Extract the list of taskservs declared in the workspace config.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Stop"
|
|
}
|
|
},
|
|
{
|
|
"action": "check_taskserv_presence",
|
|
"actor": "Agent",
|
|
"cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.taskservs // [] | .[]' | while read ts; do test -d catalog/taskservs/$ts || echo \"MISSING taskserv: $ts\"; done",
|
|
"depends_on": [
|
|
{
|
|
"kind": "OnSuccess",
|
|
"step": "list_declared_taskservs"
|
|
}
|
|
],
|
|
"id": "verify_taskservs_exist",
|
|
"note": "Verify each declared taskserv has a corresponding directory in catalog/taskservs/.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Continue"
|
|
}
|
|
},
|
|
{
|
|
"action": "verify_taskserv_metadata",
|
|
"actor": "Agent",
|
|
"cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.taskservs // [] | .[]' | while read ts; do test -f catalog/taskservs/$ts/metadata.ncl || echo \"MISSING metadata.ncl: $ts\"; done",
|
|
"depends_on": [
|
|
{
|
|
"kind": "Always",
|
|
"step": "verify_taskservs_exist"
|
|
}
|
|
],
|
|
"id": "check_taskserv_contracts",
|
|
"note": "Verify each taskserv has metadata.ncl declaring its capabilities and contracts.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Continue"
|
|
}
|
|
},
|
|
{
|
|
"action": "check_provider_capability_match",
|
|
"actor": "Agent",
|
|
"cmd": "nickel export {workspace_dir}/config/workspace.ncl | jq -r '.provider // empty' | xargs -I{} test -d catalog/providers/{} || echo 'MISSING or mismatched provider'",
|
|
"depends_on": [
|
|
{
|
|
"kind": "OnSuccess",
|
|
"step": "validate_workspace_config"
|
|
}
|
|
],
|
|
"id": "verify_provider_capabilities",
|
|
"note": "Verify the declared provider exists in catalog/providers/ and supports the workspace's required capabilities.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Continue"
|
|
}
|
|
},
|
|
{
|
|
"action": "verify_provisioning_axioms",
|
|
"actor": "Agent",
|
|
"cmd": "./scripts/ontoref describe {workspace_name} --check-axioms provisioning:config-driven-always,provisioning:type-safety-nickel",
|
|
"depends_on": [
|
|
{
|
|
"kind": "OnSuccess",
|
|
"step": "validate_workspace_config"
|
|
},
|
|
{
|
|
"kind": "Always",
|
|
"step": "check_taskserv_contracts"
|
|
},
|
|
{
|
|
"kind": "Always",
|
|
"step": "verify_provider_capabilities"
|
|
}
|
|
],
|
|
"id": "check_axiom_coherence",
|
|
"note": "Verify the workspace config does not violate provisioning axioms — no hardcoded values, all config via typed Nickel.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Continue"
|
|
}
|
|
},
|
|
{
|
|
"action": "write_audit_output",
|
|
"actor": "Agent",
|
|
"cmd": "./scripts/ontoref describe {workspace_name} --format audit",
|
|
"depends_on": [
|
|
{
|
|
"kind": "Always",
|
|
"step": "check_axiom_coherence"
|
|
}
|
|
],
|
|
"id": "generate_audit_report",
|
|
"note": "Generate the compliance report: pass/fail per check, missing extensions, axiom violations.",
|
|
"on_error": {
|
|
"backoff_s": 5,
|
|
"max": 3,
|
|
"strategy": "Stop"
|
|
}
|
|
}
|
|
],
|
|
"strategy": "Override",
|
|
"trigger": "Audit an existing workspace for config validity, extension completeness, and axiom coherence"
|
|
}
|