alainlebret Orchestration Policy Enforcer
Goal
Act as the final gatekeeper before a workflow's output is considered validated. Verify that all rules from shared/orchestration-policy/ and shared/reproducibility-policy/ have been applied, and emit a structured compliance report.
When to use
Run as the last step of any non-trivial workflow, after all skills have executed and all artefacts have been produced.
Inputs
workflow-spec.json— the authoritative list of required skills, artefacts, and quality gatesrun-manifest.json— what was actually producedquality-report.json— gate verification resultslanguage-report.json— language compliance resultsexecution-plan.json— planned vs. actual skill execution
Output contract
| File | Description |
|---|---|
orchestration-compliance-report.md |
Structured report: one section per policy rule, with verdict and evidence |
Report structure
# Orchestration Compliance Report — <workflow_id> — <run_id>
## Policy: Required artefacts
- mission.json: present ✓
- execution-plan.json: present ✓
- run-manifest.json: present ✓
- quality-report.json: present ✓
- [other expected artefacts]: present ✓ / MISSING ✗
## Policy: Quality gates
- QG1 mission-present: pass ✓ / fail ✗
- ...
## Policy: Language compliance
- overall_status: pass ✓ / review ✗
## Policy: Reproducibility
- run_id present: yes ✓
- created_at present: yes ✓
- skills_used matches execution_order: yes ✓ / MISMATCH ✗
## Overall verdict
COMPLIANT / NON-COMPLIANT — [summary of blocking issues]
Compliance rules (from shared policies)
| Rule | Source | Check |
|---|---|---|
mission.json must be present |
orchestration-policy.md | run-manifest.json → artifacts_out contains mission.json |
execution-plan.json must be present |
orchestration-policy.md | file exists in run or example directory |
run-manifest.json must be present |
orchestration-policy.md | file exists with valid run_id |
| At least one audit artefact must exist | orchestration-policy.md | quality-report.json or orchestration-compliance-report.md present |
| Launcher must not silently invent inputs | launcher-policy.md | artifacts_in in manifest only lists files that actually existed |
| Quality gates must be stored as JSON | launcher-policy.md | quality-report.json exists and is valid JSON |
run_id must be unique and timestamped |
reproducibility-policy | run_id matches pattern RUN-<WORKFLOW>-<ISO8601> |
| Language report must be emitted | workflow language_constraints | language-report.json exists if must_emit_language_report: true |
Rules
- Report all non-compliances, not just the first one found.
- A workflow with any blocking non-compliance must have
overall_status: fail. - A workflow with only warnings must have
overall_status: review. - A fully compliant workflow must have
overall_status: pass.