{
  "mode": "governed_write",
  "write_default": "disabled",
  "principle": "Luc governs, the agent prepares and executes only one approved change at a time.",
  "runtime_artifacts": {
    "snapshot_dir": "runtime/pingfederate/snapshots",
    "request_dir": "runtime/pingfederate/requests",
    "report_dir": "runtime/pingfederate/reports",
    "git_policy": "runtime/ is ignored and must not be committed"
  },
  "flow": [
    {
      "step": "intake",
      "purpose": "Capture Luc's exact request and target"
    },
    {
      "step": "classify",
      "purpose": "Classify operation, risk and blast radius"
    },
    {
      "step": "inventory",
      "purpose": "Read current PingFederate state"
    },
    {
      "step": "snapshot",
      "purpose": "Save pre-change state outside Git"
    },
    {
      "step": "schema_validation",
      "purpose": "Validate endpoint and payload shape"
    },
    {
      "step": "diff",
      "purpose": "Show expected before/after change"
    },
    {
      "step": "approval",
      "purpose": "Require explicit approval phrase"
    },
    {
      "step": "execute",
      "purpose": "Run a single write operation"
    },
    {
      "step": "verify",
      "purpose": "Read back PingFederate state and test behavior"
    },
    {
      "step": "report",
      "purpose": "Write an EngineeringReport with evidence"
    }
  ],
  "risk_policy": {
    "low": [
      "read inventory",
      "render plan"
    ],
    "medium": [
      "create disabled object",
      "update lab-owned object"
    ],
    "high": [
      "enable object",
      "modify federation link",
      "modify auth policy"
    ],
    "critical": [
      "delete object",
      "replace certificate",
      "global policy change"
    ]
  },
  "hard_blocks": [
    "missing_admin_credentials",
    "missing_pre_change_snapshot",
    "missing_schema_validation",
    "missing_diff",
    "missing_explicit_approval",
    "non_lab_owned_delete"
  ]
}