nika: v1
workflow:
  id: config-drift-sentinel
  description: "live config vs sanctioned baseline → typed drift → explained alert"

model: ollama/qwen3.5:4b   # local · zero key · swap for anthropic/claude-haiku-4-5 (explain is cheap)

vars:
  config_url: "https://api.internal.example.com/v1/config"
  baseline_path: "./ops/config-baseline.json"
  approved_overrides:
    type: object
    default: {}                      # zero approved drifts until you say otherwise
    description: "Sanctioned config overrides (RFC 7396 merge-patch shape)"

secrets:
  oncall_webhook:
    source: env
    key: ONCALL_WEBHOOK_URL
    egress:                       # sanction the one send · the secret IS the URL
      - to: "nika:notify"
        host_from_self: true

tasks:
  live:
    invoke:
      tool: "nika:fetch"
      args:
        url: "${{ vars.config_url }}"
        mode: jq
        jq: "."
    retry:
      max_attempts: 3
      backoff_strategy: exponential

  baseline:
    invoke:
      tool: "nika:read"
      args: { path: "${{ vars.baseline_path }}" }

  expected:
    with:
      baseline: ${{ tasks.baseline.output }}
    invoke:
      tool: "nika:json_merge_patch"
      args:
        target: "${{ with.baseline }}"
        patch: "${{ vars.approved_overrides }}"

  drift:
    with:
      expected: ${{ tasks.expected.output }}
      live: ${{ tasks.live.output }}
    invoke:
      tool: "nika:json_diff"
      args:
        before: "${{ with.expected }}"
        after: "${{ with.live }}"

  fingerprint:
    with:
      live: ${{ tasks.live.output }}
    invoke:
      tool: "nika:hash"
      args:
        algo: blake3
        content: "${{ with.live }}"
        encoding: hex

  explain:
    with:
      patch: ${{ tasks.drift.output }}
    when: ${{ size(with.patch) > 0 }}
    on_error:
      recover: "(explanation unavailable · model call failed · the raw patch is attached)"
    infer:
      prompt: |
        This RFC 6902 patch is UNSANCTIONED config drift in production ·
        ${{ with.patch }}
        Explain in 3 bullets · what changed · likely blast radius · first check.

  alert:
    with:
      patch: ${{ tasks.drift.output }}
      explanation: ${{ tasks.explain.output }}
      live_hash: ${{ tasks.fingerprint.output }}
    when: ${{ size(with.patch) > 0 }}
    invoke:
      tool: "nika:notify"
      args:
        channel: webhook
        target: "${{ secrets.oncall_webhook }}"
        message: "Config drift detected · ${{ with.explanation }} · live config blake3 ${{ with.live_hash }}"
        severity: critical

  record:
    with:
      patch: ${{ tasks.drift.output }}
      live_hash: ${{ tasks.fingerprint.output }}
    invoke:
      tool: "nika:emit"
      args:
        event_type: "config.drift.scan"
        payload:
          patch: "${{ with.patch }}"
          live_hash: "${{ with.live_hash }}"

outputs:
  drift:
    value: ${{ tasks.drift.output }}
    description: "RFC 6902 operations · empty when prod matches the sanctioned state"

{"a":{"graph_format":2,"workflow":"config-drift-sentinel","nodes":[{"id":"live","verb":"invoke","tool":"nika:fetch","permits":["tool: nika:fetch"]},{"id":"baseline","verb":"invoke","tool":"nika:read","permits":["tool: nika:read"]},{"id":"fingerprint","verb":"invoke","tool":"nika:hash","permits":["tool: nika:hash"]},{"id":"expected","verb":"invoke","tool":"nika:json_merge_patch","permits":["tool: nika:json_merge_patch"]},{"id":"drift","verb":"invoke","tool":"nika:json_diff","permits":["tool: nika:json_diff"]},{"id":"explain","verb":"infer","model":"ollama/qwen3.5:4b","when":"${{ size(with.patch) > 0 }}","permits":[]},{"id":"record","verb":"invoke","tool":"nika:emit","permits":["tool: nika:emit"]},{"id":"alert","verb":"invoke","tool":"nika:notify","when":"${{ size(with.patch) > 0 }}","permits":["tool: nika:notify"]}],"edges":[{"from":"baseline","to":"expected","kind":"value"},{"from":"drift","to":"alert","kind":"value"},{"from":"drift","to":"explain","kind":"value"},{"from":"drift","to":"record","kind":"value"},{"from":"expected","to":"drift","kind":"value"},{"from":"explain","to":"alert","kind":"value"},{"from":"fingerprint","to":"alert","kind":"value"},{"from":"fingerprint","to":"record","kind":"value"},{"from":"live","to":"drift","kind":"value"},{"from":"live","to":"fingerprint","kind":"value"}]},"engine":"0.105.0"}

showcase · tier 3 · ops & support

Config drift sentinel

Builds the sanctioned baseline (RFC 7396 merge), diffs it against live prod (RFC 6902), and pages on-call only for the drift nobody approved, with a model explaining what changed.

Silence means prod matches exactly what was signed off. That is the whole alert policy. · conformance-gated in nika-spec ↗ · re-proven at every push

The whole file

8 tasks · 5 waves · the plan falls out of the bindings, nothing is scheduled by hand.

t3-config-drift-sentinel.nika.yamlsource

1nika: v12workflow:3  id: config-drift-sentinel4  description: "live config vs sanctioned baseline → typed drift → explained alert"56model: ollama/qwen3.5:4b   # local · zero key · swap for anthropic/claude-haiku-4-5 (explain is cheap)78vars:9  config_url: "https://api.internal.example.com/v1/config"10  baseline_path: "./ops/config-baseline.json"11  approved_overrides:12    type: object13    default: {}                      # zero approved drifts until you say otherwise14    description: "Sanctioned config overrides (RFC 7396 merge-patch shape)"1516secrets:17  oncall_webhook:18    source: env19    key: ONCALL_WEBHOOK_URL20    egress:                       # sanction the one send · the secret IS the URL21      - to: "nika:notify"22        host_from_self: true2324tasks:25  live:26    ◆invoke:27      tool: "nika:fetch"28      args:29        url: "${{ vars.config_url }}"30        mode: jq31        jq: "."32    retry:33      max_attempts: 334      backoff_strategy: exponential3536  baseline:37    ◆invoke:38      tool: "nika:read"39      args: { path: "${{ vars.baseline_path }}" }4041  expected:42    with:43      baseline: ${{ tasks.baseline.output }}44    ◆invoke:45      tool: "nika:json_merge_patch"46      args:47        target: "${{ with.baseline }}"48        patch: "${{ vars.approved_overrides }}"4950  drift:51    with:52      expected: ${{ tasks.expected.output }}53      live: ${{ tasks.live.output }}54    ◆invoke:55      tool: "nika:json_diff"56      args:57        before: "${{ with.expected }}"58        after: "${{ with.live }}"5960  fingerprint:61    with:62      live: ${{ tasks.live.output }}63    ◆invoke:64      tool: "nika:hash"65      args:66        algo: blake367        content: "${{ with.live }}"68        encoding: hex6970  explain:71    with:72      patch: ${{ tasks.drift.output }}73    when: ${{ size(with.patch) > 0 }}74    on_error:75      recover: "(explanation unavailable · model call failed · the raw patch is attached)"76    ◇infer:77      prompt: |78        This RFC 6902 patch is UNSANCTIONED config drift in production ·79        ${{ with.patch }}80        Explain in 3 bullets · what changed · likely blast radius · first check.8182  alert:83    with:84      patch: ${{ tasks.drift.output }}85      explanation: ${{ tasks.explain.output }}86      live_hash: ${{ tasks.fingerprint.output }}87    when: ${{ size(with.patch) > 0 }}88    ◆invoke:89      tool: "nika:notify"90      args:91        channel: webhook92        target: "${{ secrets.oncall_webhook }}"93        message: "Config drift detected · ${{ with.explanation }} · live config blake3 ${{ with.live_hash }}"94        severity: critical9596  record:97    with:98      patch: ${{ tasks.drift.output }}99      live_hash: ${{ tasks.fingerprint.output }}100    ◆invoke:101      tool: "nika:emit"102      args:103        event_type: "config.drift.scan"104        payload:105          patch: "${{ with.patch }}"106          live_hash: "${{ with.live_hash }}"107108outputs:109  drift:110    value: ${{ tasks.drift.output }}111    description: "RFC 6902 operations · empty when prod matches the sanctioned state"112

nika inspect · engine 0.105.0 · vendored graph, never re-derived

10 declared edges · 5 waves · the plan falls out of the bindings

try itopen in the playground guidethe walkthrough · docs verbinvoke verbinfer toolnika:fetch toolnika:read toolnika:json_merge_patch toolnika:json_diff toolnika:hash toolnika:notify toolnika:emit