{
  "name": "Infra Loop (diagnose -> patch -> verify-on-canary -> approve -> ship -> watchdog -> re-grade)",
  "description": "A self-supervising infra-change loop: diagnoses and patches freely against a canary, then stops at a human approval gate before anything reaches a production system. Draft template - wire tool_slug values to your own tools.",
  "min_tier": "holdings",
  "steps": [
    {
      "stage": "diagnose",
      "tool_slug": "issue-diagnoser",
      "params": {"target": "<the failing system>"},
      "hil": false,
      "note": "Read-only investigation. No side effects."
    },
    {
      "stage": "patch",
      "tool_slug": "patch-drafter",
      "params": {"backup_suffix": ".pre_change"},
      "hil": false,
      "note": "Draft the fix locally; always back up what it replaces before touching it."
    },
    {
      "stage": "verify-on-canary",
      "tool_slug": "canary-verifier",
      "params": {"require_planted_negative_case": true},
      "hil": false,
      "note": "Prove the fix on one non-production instance first, including a planted case that MUST fail on bad input - a check that can't fail isn't a check."
    },
    {
      "stage": "approve",
      "tool_slug": "approval-gate",
      "params": {
        "surface": "git.push",
        "scope": "<name the exact repo/production target>",
        "ttl_minutes": 30,
        "reason_required": true
      },
      "hil": true,
      "note": "APPROVAL GATE. Reaching a production system is exactly the class of action this template refuses to do unattended - a scoped, short-TTL, human-granted permission is required, named to the exact target, before shipping."
    },
    {
      "stage": "ship",
      "tool_slug": "deploy-change",
      "params": {"verify_remote_ref_changed": true},
      "hil": false,
      "note": "Only reachable once approval is live. Verify the change actually landed against the remote/target state itself - a success-looking message is not proof it took effect."
    },
    {
      "stage": "watchdog",
      "tool_slug": "post-ship-watchdog",
      "params": {"check_process_not_just_file": true, "alert_on_silence_minutes": 30},
      "hil": false,
      "note": "Check the running process, not just the file on disk - a patched file with a still-running old process is not a shipped fix."
    },
    {
      "stage": "re-grade",
      "tool_slug": "verdict-regrader",
      "params": {"reapply_current_logic_to_history": true},
      "hil": false,
      "note": "Revisit whether the fix actually held, under current measurement, not just at ship time."
    }
  ]
}