94 lines
3.4 KiB
JSON
94 lines
3.4 KiB
JSON
{
|
|
"description": "Verify each workspace has the three required Radicle repos (policy, desired, state) with correct delegation profiles and M-of-N quorum (ADR-038).",
|
|
"id": "validate-radicle-governance",
|
|
"params": {
|
|
"expected_quorum": 2,
|
|
"ops_controller_key": "",
|
|
"radicle_home": "~/.radicle",
|
|
"workspace": "libre-wuji"
|
|
},
|
|
"steps": [
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "rad self --json | jq -e '.node.status == \"running\"'",
|
|
"depends_on": [],
|
|
"id": "check_radicle_node_running",
|
|
"name": "Radicle node (radicled) is running",
|
|
"on_error": "abort"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"policy-{workspace}\") | .rid') | jq -e '.rid'",
|
|
"depends_on": [
|
|
"check_radicle_node_running"
|
|
],
|
|
"id": "check_policy_repo_exists",
|
|
"name": "policy-{workspace} Radicle repo exists locally",
|
|
"on_error": "abort"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-desired\") | .rid') | jq -e '.rid'",
|
|
"depends_on": [
|
|
"check_radicle_node_running"
|
|
],
|
|
"id": "check_desired_repo_exists",
|
|
"name": "{workspace}-desired Radicle repo exists locally",
|
|
"on_error": "abort"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-state\") | .rid') | jq -e '.rid'",
|
|
"depends_on": [
|
|
"check_radicle_node_running"
|
|
],
|
|
"id": "check_state_repo_exists",
|
|
"name": "{workspace}-state Radicle repo exists locally",
|
|
"on_error": "abort"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"policy-{workspace}\") | .rid') | jq -e '.delegates | length >= {expected_quorum}'",
|
|
"depends_on": [
|
|
"check_policy_repo_exists"
|
|
],
|
|
"id": "check_policy_repo_quorum",
|
|
"name": "policy-{workspace} delegation threshold meets expected quorum",
|
|
"on_error": "abort"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "rad inspect --json $(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-state\") | .rid') | jq -e '.delegates | length == 1 and .[0].key == \"{ops_controller_key}\"'",
|
|
"depends_on": [
|
|
"check_state_repo_exists"
|
|
],
|
|
"id": "check_state_repo_sole_delegate",
|
|
"name": "{workspace}-state repo has exactly one delegate (ops-controller key)",
|
|
"on_error": "abort"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "git -C {radicle_home}/storage/$(rad ls --json | jq -r '.[] | select(.name == \"{workspace}-state\") | .rid') log --show-signature -5 | grep -c 'Good signature'",
|
|
"depends_on": [
|
|
"check_state_repo_sole_delegate"
|
|
],
|
|
"id": "check_audit_commits_signed",
|
|
"name": "Recent commits on {workspace}-state are GPG/SSH-signed by ops-controller",
|
|
"on_error": "warn"
|
|
},
|
|
{
|
|
"actor": "Agent",
|
|
"cmd": "echo 'radicle-governance validation complete: policy/desired/state repos confirmed, quorum={expected_quorum}, sole-delegate verified'",
|
|
"depends_on": [
|
|
"check_policy_repo_quorum",
|
|
"check_state_repo_sole_delegate",
|
|
"check_audit_commits_signed"
|
|
],
|
|
"id": "summary_report",
|
|
"name": "Emit governance validation summary for workspace={workspace}",
|
|
"on_error": "warn"
|
|
}
|
|
],
|
|
"strategy": "Override",
|
|
"version": "1.0"
|
|
}
|