Contract guard

1nika: v12workflow:3  id: contract-guard4  description: "Local-model clause extraction → schema gate → risk memo"5​6# Local · the whole review runs offline, zero cloud. Also a NON-thinking7# model on purpose: a thinking model can spend the whole `max_tokens` budget8# in its think block and return before the JSON (engine#428).9model: ollama/llama3.2:3b10​11inputs:12  contract_path:13    type: string14    default: "examples/fixtures/contract.md"15    description: "Path to the contract (markdown or plain text)"16⛨permits:17  ⛨tools: ["nika:assert", "nika:read", "nika:validate", "nika:write"]18  ⛨fs:19    # `permits:` cannot interpolate (NIKA-AUTH-007), so this literal does not20    # follow `inputs.contract_path` around: passing --var without editing this21    # line is refused at run with NIKA-SEC-004. Deliberate — a reviewer can22    # see every file this workflow may open by reading four words.23    ⛨read: ["examples/fixtures/contract.md"]24    ⛨write: ["out/risk-memo.md"]25​26tasks:27  contract:28    ◆invoke:29      tool: "nika:read"30      args: { path: "${{ inputs.contract_path }}" }31​32  clauses:33    with:34      contract: ${{ tasks.contract.output }}35    ◇infer:36      max_tokens: 160037      prompt: |38        Extract every risk-bearing clause from this contract ·39        ${{ with.contract }}40        Quote each clause verbatim · classify its risk.41      schema:42        type: object43        additionalProperties: false44        required: [clauses]45        properties:46          clauses:47            type: array48            items:49              type: object50              additionalProperties: false51              required: [quote, type, risk]52              properties:53                quote: { type: string }54                type: { type: string, enum: [liability, termination, ip, payment, data, other] }55                risk: { type: string, enum: [low, medium, high] }56​57  check:58    with:59      clauses: ${{ tasks.clauses.output }}60    ◆invoke:61      tool: "nika:validate"62      args:63        data: "${{ with.clauses }}"64        format: json65        schema:66          type: object67          required: [clauses]68          properties:69            clauses:70              type: array71              minItems: 1        # an empty extraction is a FAILED extraction72​73  gate:74    with:75      extraction_ok: ${{ tasks.check.output.valid == true }}   # the whole condition crosses as ONE boundary expression76    ◆invoke:77      tool: "nika:assert"78      args:79        condition: "${{ with.extraction_ok }}"80        message: "Clause extraction failed the schema gate: refusing to write the memo"81​82  memo:83    with:84      clauses: ${{ tasks.clauses.output.clauses }}85    after:86      gate: success              # state, no data · the assert passed or the memo is cancelled87    ◇infer:88      max_tokens: 120089      prompt: |90        Write a one-page risk memo from these clauses ·91        ${{ with.clauses }}92        Order by risk · high first · cite the quoted text.93​94  save:95    with:96      memo: ${{ tasks.memo.output }}97    ◆invoke:98      tool: "nika:write"99      args:100        path: out/risk-memo.md101        content: "${{ with.memo }}"102        create_dirs: true103​104outputs:105  clauses:106    value: ${{ tasks.clauses.output.clauses }}107    description: "Typed risk-bearing clauses, verbatim quotes"108  memo: ${{ tasks.memo.output }}109​