docker-report

1# SPDX-License-Identifier: Apache-2.02# yaml-language-server: $schema=https://nika.sh/spec/v1/workflow.schema.json3#4# TEMPLATE · docker-report · read real state via a pinned CLI → explain it → keep the report.5#6#   [ps]────┐7#   [df]────┴──▶[diagnose]────▶[keep]8#   exec ×2      infer          nika:write9#10# The "ask the machine what is actually true, then explain it" job. Two reads11# run in parallel because nothing connects them, one model pass turns raw CLI12# output into a report a human can act on, and the report is kept on disk. Swap13# `docker` for `kubectl`, `gh`, `systemctl` — the shape does not change.14#15# Demonstrates ·16#   - argv-ARRAY `exec:` · one program, exactly these arguments, no shell to17#     inject into · and `permits.exec` names the single program allowed18#   - implicit parallelism · `ps` and `df` share no edge, so the scheduler runs19#     them together · nobody writes "in parallel" anywhere20#   - `on_error: recover:` on an exec · the skeleton rehearses green on a host21#     with no Docker at all22#23# Needs · nothing to rehearse. For a REAL report: a running Docker daemon —24#   then delete the two `on_error:` blocks so a broken daemon is loud.25#26# Run · nika run <file> --model mock/echo    # offline rehearsal · no daemon27nika: v128workflow:29  id: docker-report-template    # SLOT: kebab-case workflow id30  # SLOT: one honest sentence — `nika new` matches intents against these words31  description: "read the daemon's state · explain it · keep the report"32​33# SLOT: local-first · `--model mock/echo` for the offline rehearsal. Measured34# seat — `ollama/llama3.2:3b` answers this prose prompt in well under a minute.35model: ollama/llama3.2:3b36​37⛨permits:                            # the blast radius · default-deny once present38  ⛨exec:39    - "docker"                      # SLOT: the ONE program the reads may launch40  ⛨tools:41    - "nika:write"42  ⛨fs:43    ⛨write:44      - "./docker-health.md"        # SLOT: where the report lands (must match `keep`)45​46tasks:47  # The reads run IN PARALLEL (no edges between them) — the48  # scheduler proves it from the DAG, nobody orders it.49  ps:50    ▷exec:51      # SLOT: argv ARRAY form — one program, exactly these arguments. The array52      # is why there is no shell here: no word-splitting, no globbing, nothing53      # to quote wrong. `permits.exec` above is the provable allowlist.54      command: ["docker", "ps", "--all", "--format", "{{.Names}}\t{{.Status}}\t{{.Image}}"]55    on_error:56      # Offline rehearsal · a host with no daemon answers with a literal that57      # LOOKS like the real thing, so `diagnose` reads the same shape either58      # way. Delete this once the daemon is really there.59      recover: "REHEARSAL\tno docker daemon on this host\tn/a"60​61  df:62    ▷exec:63      command: ["docker", "system", "df"]   # SLOT: the second read (drop the task if one suffices)64    on_error:65      recover: "REHEARSAL · disk usage unavailable without a daemon"66​67  diagnose:68    with:69      ps: ${{ tasks.ps.output }}70      df: ${{ tasks.df.output }}71    ◇infer:72      max_tokens: 600               # SLOT: the spend ceiling for this call73      # SLOT: what should the model DO with the readings? Keep slot markers out74      # of the block below — everything indented under `prompt: |` is prompt75      # TEXT, and a stray comment line is sent to the model verbatim.76      prompt: |77        You are reading a Docker host's state. Containers (name·status·image):78        ${{ with.ps }}79​80        Disk usage:81        ${{ with.df }}82​83        Write a short health report: what is running, what exited, what84        looks unhealthy (restart loops · old exits), and whether disk85        usage needs attention. Plain prose, no preamble.86​87  keep:88    with:89      diagnose: ${{ tasks.diagnose.output }}90    ◆invoke:91      tool: "nika:write"92      args:93        path: "./docker-health.md"  # SLOT: same path as permits.fs.write94        content: "${{ with.diagnose }}"95​96outputs:97  report:98    value: ${{ tasks.keep.output }}99    description: "Where the report landed — nika:write hands back the path it wrote"100​