{
  "version": "0.2",
  "identity_profiles": [
    {
      "id": "project-agent",
      "provider": "none",
      "subject": {
        "kind": "service",
        "principal": "agent://ops/stripe-project",
        "display_name": "Stripe Projects Agent",
        "delegation_mode": "none"
      },
      "trust": {
        "level": "supervised",
        "constraints": {
          "max_autonomy": "supervised",
          "escalation": "fail"
        }
      }
    },
    {
      "id": "deploy-credentials",
      "provider": "env-bearer",
      "subject": {
        "kind": "service",
        "principal": "agent://ops/deploy",
        "display_name": "Deploy Agent"
      },
      "auth": {
        "mode": "service",
        "required": true,
        "provider_config": {
          "token_env": "VERCEL_TOKEN"
        }
      },
      "trust": {
        "level": "supervised",
        "constraints": {
          "max_autonomy": "supervised",
          "escalation": "fail"
        }
      },
      "presentation": {
        "bindings": [
          {
            "source": "credentials.access_token.value",
            "target": { "kind": "env", "name": "VERCEL_TOKEN" },
            "required": true,
            "redact": true
          }
        ],
        "handoff": "none",
        "cleanup": "always"
      }
    },
    {
      "id": "database-credentials",
      "provider": "env-bearer",
      "subject": {
        "kind": "service",
        "principal": "agent://ops/project-db",
        "display_name": "Project Database Agent"
      },
      "auth": {
        "mode": "service",
        "required": true,
        "provider_config": {
          "token_env": "DATABASE_URL"
        }
      },
      "trust": {
        "level": "supervised",
        "constraints": {
          "max_autonomy": "supervised",
          "escalation": "fail"
        }
      },
      "presentation": {
        "bindings": [
          {
            "source": "credentials.access_token.value",
            "target": { "kind": "env", "name": "DATABASE_URL" },
            "required": true,
            "redact": true
          }
        ],
        "cleanup": "always"
      }
    }
  ],
  "evidence_profiles": [
    {
      "id": "ssh-evidence",
      "provider": "ssh",
      "payload": {
        "bind": ["execution_id", "declared_identity", "command", "result"],
        "format": "canonical-json"
      },
      "verify": { "required": false }
    }
  ],
  "workflows": [
    {
      "id": "provision",
      "name": "Provision Stripe Project",
      "identity": { "ref": "project-agent" },
      "contract": {
        "sandbox": "permissive",
        "network": "unrestricted",
        "audit": "always",
        "required_trust_level": "restricted",
        "trust_enforcement": "advisory"
      },
      "tasks": [
        {
          "id": "init-project",
          "name": "Initialize Stripe Project",
          "shell": {
            "program": "stripe",
            "args": ["projects", "init", "my-app", "--yes", "--accept-tos"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "schedule": { "cron": "0 0 1 1 *" }
        },
        {
          "id": "add-database",
          "name": "Add Neon Postgres",
          "shell": {
            "program": "stripe",
            "args": ["projects", "add", "neon/postgres", "--accept-tos", "--yes"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "trigger": { "parent": "init-project", "on": "success" }
        },
        {
          "id": "add-hosting",
          "name": "Add Vercel Hosting",
          "shell": {
            "program": "stripe",
            "args": ["projects", "add", "vercel/project", "--accept-tos", "--yes", "--config", "{\"name\":\"my-app\"}"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "trigger": { "parent": "add-database", "on": "success" }
        },
        {
          "id": "pull-credentials",
          "name": "Pull All Credentials",
          "shell": {
            "program": "stripe",
            "args": ["projects", "env", "--pull"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "trigger": { "parent": "add-hosting", "on": "success" }
        }
      ]
    },
    {
      "id": "project-ops",
      "name": "Stripe Project Operations",
      "identity": { "ref": "project-agent" },
      "contract": {
        "sandbox": "permissive",
        "network": "unrestricted",
        "audit": "always",
        "required_trust_level": "restricted",
        "trust_enforcement": "advisory"
      },
      "tasks": [
        {
          "id": "sync-credentials",
          "name": "Sync Project Credentials",
          "shell": {
            "program": "stripe",
            "args": ["projects", "env", "--pull"]
          },
          "target": { "session_target": "shell" },
          "output": { "format": "text" },
          "schedule": { "cron": "0 */2 * * *" }
        },
        {
          "id": "check-project-status",
          "name": "Check Project Status",
          "shell": {
            "program": "stripe",
            "args": ["projects", "status"]
          },
          "target": { "session_target": "shell" },
          "output": { "format": "text" },
          "schedule": { "cron": "0 8 * * *" }
        },
        {
          "id": "run-migrations",
          "name": "Run Database Migrations",
          "shell": {
            "program": "npx",
            "args": ["prisma", "migrate", "deploy"]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "database-credentials" },
          "evidence": { "ref": "ssh-evidence" },
          "contract": {
            "required_trust_level": "supervised",
            "trust_enforcement": "strict"
          },
          "schedule": { "cron": "0 3 * * 1" },
          "on_failure": {
            "id": "triage-migration-failure",
            "name": "Triage Migration Failure",
            "prompt": "A database migration failed. Review the error output, determine whether it is a connection issue, schema conflict, or permission error, and recommend the safest recovery step without making changes.",
            "target": {
              "session_target": "isolated",
              "agent_id": "main"
            },
            "intent": { "mode": "plan", "read_only": true },
            "context": { "retrieval": "recent", "limit": 3 },
            "delivery": { "mode": "announce", "to": "@owner_dm" }
          }
        }
      ]
    },
    {
      "id": "cleanup",
      "name": "Teardown Stripe Project",
      "identity": { "ref": "project-agent" },
      "contract": {
        "sandbox": "permissive",
        "network": "unrestricted",
        "audit": "always",
        "required_trust_level": "supervised",
        "trust_enforcement": "strict"
      },
      "tasks": [
        {
          "id": "remove-hosting",
          "name": "Remove Vercel Service",
          "shell": {
            "program": "stripe",
            "args": ["projects", "remove", "my-app", "--yes"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "schedule": { "cron": "0 0 1 1 *" }
        },
        {
          "id": "remove-database",
          "name": "Remove Neon Service",
          "shell": {
            "program": "stripe",
            "args": ["projects", "remove", "neon-postgres", "--yes"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "trigger": { "parent": "remove-hosting", "on": "success" }
        },
        {
          "id": "teardown-vercel",
          "name": "Remove Vercel Project",
          "shell": {
            "program": "sh",
            "args": ["-c", "echo y | vercel project rm my-app"]
          },
          "target": { "session_target": "shell" },
          "identity": { "ref": "deploy-credentials" },
          "evidence": { "ref": "ssh-evidence" },
          "trigger": { "parent": "remove-hosting", "on": "success" }
        },
        {
          "id": "unlink-providers",
          "name": "Unlink Providers",
          "shell": {
            "program": "sh",
            "args": ["-c", "stripe projects unlink vercel --yes && stripe projects unlink neon --yes"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "trigger": { "parent": "remove-database", "on": "success" }
        }
      ]
    }
  ]
}