Orchestration policy enforcer

Orchestration Policy Enforcer

Goal

Act as the final gatekeeper before a workflow's output is considered validated. Verify that all rules from shared/orchestration-policy/ and shared/reproducibility-policy/ have been applied, and emit a structured compliance report.

When to use

Run as the last step of any non-trivial workflow, after all skills have executed and all artefacts have been produced.

Inputs

• workflow-spec.json — the authoritative list of required skills, artefacts, and quality gates
• run-manifest.json — what was actually produced
• quality-report.json — gate verification results
• language-report.json — language compliance results
• execution-plan.json — planned vs. actual skill execution

Output contract

File	Description
orchestration-compliance-report.md	Structured report: one section per policy rule, with verdict and evidence

Report structure

# Orchestration Compliance Report — <workflow_id> — <run_id>

## Policy: Required artefacts
- mission.json: present ✓
- execution-plan.json: present ✓
- run-manifest.json: present ✓
- quality-report.json: present ✓
- [other expected artefacts]: present ✓ / MISSING ✗

## Policy: Quality gates
- QG1 mission-present: pass ✓ / fail ✗
- ...

## Policy: Language compliance
- overall_status: pass ✓ / review ✗

## Policy: Reproducibility
- run_id present: yes ✓
- created_at present: yes ✓
- skills_used matches execution_order: yes ✓ / MISMATCH ✗

## Overall verdict
COMPLIANT / NON-COMPLIANT — [summary of blocking issues]

Compliance rules (from shared policies)

Rule	Source	Check
mission.json must be present	orchestration-policy.md	run-manifest.json → artifacts_out contains mission.json
execution-plan.json must be present	orchestration-policy.md	file exists in run or example directory
run-manifest.json must be present	orchestration-policy.md	file exists with valid run_id
At least one audit artefact must exist	orchestration-policy.md	quality-report.json or orchestration-compliance-report.md present
Launcher must not silently invent inputs	launcher-policy.md	artifacts_in in manifest only lists files that actually existed
Quality gates must be stored as JSON	launcher-policy.md	quality-report.json exists and is valid JSON
run_id must be unique and timestamped	reproducibility-policy	run_id matches pattern RUN-<WORKFLOW>-<ISO8601>
Language report must be emitted	workflow language_constraints	language-report.json exists if must_emit_language_report: true

Rules

• Report all non-compliances, not just the first one found.
• A workflow with any blocking non-compliance must have overall_status: fail.
• A workflow with only warnings must have overall_status: review.
• A fully compliant workflow must have overall_status: pass.