// Workflow runs are governed: who may start or cancel a run, on which trigger, with which network egress and bounds.
CONTRACT ForgeWorkflowRun {
  ENFORCEMENT_MODE: enforced
  CONTEXT {
    ENTITIES WorkflowRunRequest {
      operation: string
      trigger: string
      repository_matches_main: bool
      requester_is_human: bool
      requester_is_owner: bool
      requester_can_run: bool
      requester_is_trigger_runtime: bool
      requester_started_run: bool
      trigger_declared: bool
      workflow_valid: bool
      workflow_from_main: bool
      target_exists: bool
      network_hosts_requested: int
      network_hosts_unapproved: int
      timeout_minutes: int
      timeout_limit: int
      step_count: int
      step_limit: int
      active_runs: int
      concurrency_limit: int
      spend_microusd: int
    }
  }
  TRIGGER { run_workflow() }
  GUARANTEE {
    ENSURE run_workflow() WHEN WorkflowRunRequest.repository_matches_main == true [SOURCE:workflow_repository]
  }
  PROHIBITION {
    FORBID run_workflow WHEN WorkflowRunRequest.operation != "start" AND WorkflowRunRequest.operation != "cancel" [SOURCE:workflow_operation]
    FORBID run_workflow WHEN WorkflowRunRequest.repository_matches_main == false [SOURCE:workflow_repository_scope]
    FORBID run_workflow WHEN WorkflowRunRequest.requester_can_run == false AND WorkflowRunRequest.requester_is_trigger_runtime == false [SOURCE:workflow_authority]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.trigger == "manual" AND WorkflowRunRequest.requester_is_human == false [SOURCE:workflow_manual_human]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.trigger != "manual" AND WorkflowRunRequest.requester_is_trigger_runtime == false [SOURCE:workflow_event_runtime]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.trigger_declared == false [SOURCE:workflow_trigger_declared]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.workflow_valid == false [SOURCE:workflow_valid]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.workflow_from_main == false [SOURCE:workflow_source]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.network_hosts_unapproved > 0 [SOURCE:workflow_network_allowlist]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.timeout_minutes > WorkflowRunRequest.timeout_limit [SOURCE:workflow_timeout]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.step_count > WorkflowRunRequest.step_limit [SOURCE:workflow_steps]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.active_runs >= WorkflowRunRequest.concurrency_limit [SOURCE:workflow_concurrency]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "start" AND WorkflowRunRequest.target_exists == true [SOURCE:workflow_duplicate]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "cancel" AND WorkflowRunRequest.target_exists == false [SOURCE:workflow_cancel_target]
    FORBID run_workflow WHEN WorkflowRunRequest.operation == "cancel" AND WorkflowRunRequest.requester_started_run == false AND WorkflowRunRequest.requester_is_owner == false AND WorkflowRunRequest.requester_is_trigger_runtime == false [SOURCE:workflow_cancel_authority]
    FORBID run_workflow WHEN WorkflowRunRequest.spend_microusd > 0 [SOURCE:workflow_spending]
  }
  OBSERVABILITY { LOG "ForgeWorkflowRun evaluated" ON decision }
}