chio-workflow-preflight

Read-only verifier for workflow preflight plans. Given a parent task's scope, its child tasks, and plan-wide gates (route support, approvals, schema registry, budget pool, revocation freshness), it checks whether the child tasks stay inside the parent's authority and returns a report recording the verdict. The report is planning evidence only: it never executes a workflow, mints a capability, dispatches a tool, or mutates a runtime store, and it can never claim live runtime authority.

Distinct from chio-workflow: that crate owns workflow execution (SkillGrant, SkillManifest, WorkflowReceipt, WorkflowAuthority) and re-exports this crate's public API under its preflight module. This crate has no chio-* dependencies of its own.

Responsibilities

• Validate plan shape: schema tag, required non-empty fields, non-empty parent/child scopes, and a 64-character lowercase hex SHA-256 revocation root. A shape failure returns Err(WorkflowPreflightError) before any policy check runs.
• Check that every child task's requested scope (actions, resources, route refs, approval refs, required schemas, currency, budget) is contained in the parent task's scope, including the aggregate child budget against the parent budget.
• Check plan-wide gates: route support, approval status, schema-registry coverage, budget-pool currency and totals, revocation freshness, and that no planning artifact claims to satisfy a live-authority claim.
• Return a WorkflowPreflightReport with an Accepted or Rejected verdict and the list of rejected checks. A structurally valid plan always returns Ok, even when the verdict is Rejected.

Public API

• evaluate_workflow_preflight(&WorkflowPreflightPlan) -> Result<WorkflowPreflightReport, WorkflowPreflightError>
  • the entry point.
• WorkflowPreflightPlan, WorkflowPreflightParentTask, WorkflowPreflightChildTask, WorkflowPreflightScope - the input plan and its scopes.
• WorkflowRoutePlanPreflight, WorkflowApprovalPreflight, WorkflowRegistrySupport, WorkflowBudgetPool, WorkflowRevocationPreflight, WorkflowPlanningArtifact - plan-wide gate inputs.
• WorkflowPreflightReport, WorkflowPreflightVerdict, WorkflowPreflightCheck - the output report and its rejection entries.
• WorkflowPreflightError - UnsupportedSchema and InvalidPlan.
• WORKFLOW_PREFLIGHT_PLAN_SCHEMA, WORKFLOW_PREFLIGHT_REPORT_SCHEMA - "chio.workflow.preflight-plan.v1" and "chio.workflow.preflight-report.v1".

Usage

use chio_workflow_preflight::{evaluate_workflow_preflight, WorkflowPreflightPlan};

let plan: WorkflowPreflightPlan = serde_json::from_slice(&plan_bytes)?;
let report = evaluate_workflow_preflight(&plan)?;

Testing

cargo test -p chio-workflow-preflight

Integration tests read fixtures from fixtures/proof-room/workflow-preflight/<case>/preflight-plan.json at the workspace root.

See also

• chio-workflow - re-exports this crate's public API under its preflight module; owns workflow execution, which this crate does not touch.
• chio-proof-room - depends on this crate directly to render workflow-preflight proof-room fixtures.
• chio-cli - runs the workflow preflight command through chio-workflow's re-export.