{
  "version": "0.2",
  "identity_profiles": [
    {
      "id": "docker-monitor",
      "provider": "none",
      "subject": {
        "kind": "service",
        "principal": "agent://ops/docker-monitor",
        "display_name": "Docker Monitor Agent"
      },
      "trust": {
        "level": "restricted",
        "constraints": {
          "max_autonomy": "restricted",
          "escalation": "fail"
        }
      }
    },
    {
      "id": "docker-build",
      "provider": "none",
      "subject": {
        "kind": "service",
        "principal": "agent://ops/docker-build",
        "display_name": "Docker Build Agent"
      },
      "trust": {
        "level": "supervised",
        "constraints": {
          "max_autonomy": "supervised",
          "escalation": "human-approval"
        }
      }
    }
  ],
  "evidence_profiles": [
    {
      "id": "docker-evidence",
      "provider": "ssh",
      "payload": {
        "bind": ["execution_id", "declared_identity", "command", "result"],
        "format": "canonical-json"
      },
      "verify": { "required": false }
    }
  ],
  "workflows": [
    {
      "id": "docker-ops",
      "name": "Docker Operations",
      "contract": {
        "sandbox": "permissive",
        "network": "unrestricted",
        "audit": "always"
      },
      "tasks": [
        {
          "id": "list-containers",
          "name": "List Running Containers",
          "shell": {
            "program": "docker",
            "args": ["ps", "--format", "json"]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "docker-monitor" },
          "output": {
            "format": "ndjson",
            "preview_bytes": 4000,
            "offload": "auto"
          },
          "schedule": { "cron": "*/5 * * * *" }
        },
        {
          "id": "check-images",
          "name": "Check Docker Images",
          "shell": {
            "program": "docker",
            "args": ["images", "--format", "json"]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "docker-monitor" },
          "output": {
            "format": "ndjson",
            "preview_bytes": 4000,
            "offload": "auto"
          },
          "schedule": { "cron": "0 */6 * * *" }
        },
        {
          "id": "system-df",
          "name": "Docker Disk Usage",
          "shell": {
            "program": "docker",
            "args": ["system", "df", "--format", "json"]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "docker-monitor" },
          "output": {
            "format": "json",
            "preview_bytes": 2000
          },
          "schedule": { "cron": "0 8 * * *" }
        },
        {
          "id": "build-image",
          "name": "Build Application Image",
          "shell": {
            "program": "docker",
            "args": ["build", "-t", "myapp:latest", "."]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "docker-build" },
          "evidence": { "ref": "docker-evidence" },
          "output": { "format": "text" },
          "schedule": { "cron": "0 2 * * *" },
          "on_failure": {
            "id": "triage-build-failure",
            "name": "Triage Build Failure",
            "prompt": "The Docker image build failed. Analyze the build output to determine whether this is a Dockerfile syntax issue, dependency resolution failure, or base image problem, and recommend the next step.",
            "target": {
              "session_target": "isolated",
              "agent_id": "main"
            },
            "intent": {
              "mode": "plan",
              "read_only": true
            },
            "context": {
              "retrieval": "recent",
              "limit": 5
            },
            "delivery": {
              "mode": "announce",
              "to": "@owner_dm"
            }
          }
        },
        {
          "id": "prune-unused",
          "name": "Prune Unused Docker Resources",
          "shell": {
            "program": "docker",
            "args": ["system", "prune", "-f"]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "docker-build" },
          "evidence": { "ref": "docker-evidence" },
          "output": { "format": "text" },
          "contract": {
            "network": "none",
            "required_trust_level": "supervised",
            "trust_enforcement": "strict"
          },
          "approval": {
            "required": true,
            "policy": "manual",
            "risk_level": "high"
          },
          "schedule": { "cron": "0 3 * * 0" }
        }
      ]
    }
  ]
}