# Catalog declaration for the `render_provisioning_report` operation —
# kind = 'Wasm. Phase B per ADR-030: declarable today, executive
# backend trigger-deferred (T3 cross-instance dispatch bottleneck,
# T4 toolchain divergence, T5 untrusted ops authors).
#
# The module is a WASM component implementing the WIT interface in
# render_provisioning_report.wit. Compile with:
#   cargo build --target wasm32-unknown-unknown --release
#   wasm-tools component new ... -o render_provisioning_report.wasm
# Place the artefact at .ontoref/catalog/wasm/render_provisioning_report.wasm.

let s = import "../schema-future.ncl" in

(
  {
    id          = "render_provisioning_report",
    description = "Render a provisioning status report from declared infra cells; runs in a WASM sandbox with read-only fs + no network.",
    kind        = 'Wasm,

    body = {
      module_path  = ".ontoref/catalog/wasm/render_provisioning_report.wasm",
      export_name  = "ontoref:catalog/op#render",
      # Explicit capability grants — the WASM sandbox can ONLY do what
      # this list says. Anything else returns a host trap.
      capabilities = [
        "fs:read:.ontology/provisioning/",
        "fs:read:.ontoref/catalog/",
        "net:none",
      ],
    },

    inputs = {
      instance_id = "String",
      format      = "String",
    },

    constraints = {
      # ondaod-pre MANDATORY for non-Rust kinds. The host can't reach
      # the ondaod context from inside the sandbox — the discipline
      # check runs BEFORE the WASM call.
      pre    = ["evaluate_ondaod", "instance_known", "format_supported"],
      inline = [],
      post   = ["report_well_formed"],
    },

    validation_sla = 'Synchronous,

    effects = [
      {
        kind       = 'Insert,
        entity     = "ProvisioningReport",
        attrs      = ["instance_id", "format", "body", "generated_at"],
        dimensions = [],
      },
    ],

    # Witness honesty: WASM is a black box to the daemon. The signature
    # attests the inputs the daemon passed and the outputs it received,
    # NOT the internal computation. ADR-034 constraint
    # `witness-shape-attests-only-host-observable-state`.
    witness_shape = {
      payload_kind = "wasm_call_envelope",
      proof_paths  = ["provisioning_report/<instance_id>/body"],
      signature    = { actor_id = "developer", algorithm = "Ed25519" },
    },

    actor_policy = { roles = ["developer", "admin", "ci"] },

    render_paths = [],
  } | s.OperationDecl | s.OndaodPreRequired
)
