procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/agents/procesio/audit.py

@@ -0,0 +1,226 @@
+"""Static analysis of a PROCESIO process (flow) DTO.
+
+Two kinds of findings:
+  - correctness: the designer-vs-runtime parity bugs that make Validate fail even
+    when the process runs (the hard-won PHASE4-E2E lessons). `verify` gates on these.
+  - practice: best-practice smells (too many actions, slow actions, no error
+    handling, no description, possible inline secret). The `audit` action reports them.
+
+DTO case matters: the LIVE Web-API returns camelCase (`actions`, `parameters`,
+`value`), while the offline .procesio EXPORT bundles use PascalCase (`Actions`,
+`Parameters`, `Value`). Every lookup goes through `ci()` (case-insensitive) so the
+agent works on a live process AND on an export golden. Beyond that the auditor is
+defensive: an unknown shape downgrades a check to "skipped" rather than crashing
+or emitting a false finding. It never invents certainty it does not have.
+"""
+from __future__ import annotations
+
+import json
+import re
+
+_STRUCTURAL = {"start", "stop"}  # no configuration expected (compared lowercased)
+# A node whose human NAME signals a Data Store / cache operation while its action
+# TYPE is 'Call API' is a masquerade: a Call API does NOT touch the Data Store, it
+# just calls an HTTP endpoint (the FX-usecase bug - a Call API node wearing a cache
+# icon). Intent keywords are matched on the action NAME, the type on the template.
+_DATASTORE_INTENT = ("cache", "data store", "datastore")
+_CALLAPI_TEMPLATE = "call api"
+_SLOW_KEYWORDS = ("call api", "sql", "ftp", "decisional",
+                  "data store", "mysql", "redis")  # network/DB-bound: count toward speed
+_GUID_RE = re.compile(
+    r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
+_SECRET_KEYWORDS = ("password", "passwd", "apikey", "api_key", "api-key",
+                    "secret", "client_secret", "bearer ", "authorization")
+_TOKEN_RE = re.compile(r"^[A-Za-z0-9+/_=-]{24,}$")
+
+
+def ci(d, *names):
+    """Case-insensitive dict get: first `names` value whose key matches ignoring
+    case. Handles live camelCase and export PascalCase from one call site."""
+    if not isinstance(d, dict):
+        return None
+    lowered = {k.lower(): k for k in d.keys()}
+    for n in names:
+        k = lowered.get(n.lower())
+        if k is not None:
+            return d[k]
+    return None
+
+
+def _actions(flow: dict) -> list[dict]:
+    a = ci(flow, "actions")
+    return [x for x in a if isinstance(x, dict)] if isinstance(a, list) else []
+
+
+def _template(a: dict) -> str:
+    return str(ci(a, "actionTemplateName") or ci(a, "actionName") or "")
+
+
+def _name(a: dict) -> str:
+    return str(ci(a, "actionName") or _template(a) or "?")
+
+
+def _is_structural(a: dict) -> bool:
+    return _template(a).strip().lower() in _STRUCTURAL
+
+
+def _param_set(p: dict) -> bool:
+    val = ci(p, "value")
+    return (val not in (None, "")) or bool(ci(p, "variable"))
+
+
+def _config_settings(a: dict) -> list[dict]:
+    conf = ci(ci(a, "customData") or {}, "configuration")
+    if not isinstance(conf, list):
+        return []
+    settings: list[dict] = []
+    for tab in conf:
+        if isinstance(tab, dict):
+            for s in ci(tab, "settings") or []:
+                if isinstance(s, dict):
+                    settings.append(s)
+    return settings
+
+
+def _config_set(s: dict) -> bool:
+    return ci(s, "value") not in (None, "", [], {})
+
+
+def _f(kind, severity, code, message, citation, action=None) -> dict:
+    out = {"kind": kind, "severity": severity, "code": code,
+           "message": message, "citation": citation}
+    if action:
+        out["action"] = action
+    return out
+
+
+def _datastore_masquerade(flow: dict) -> list[dict]:
+    """A node named like a Data Store/cache op whose TYPE is 'Call API' does not read
+    or write the Data Store - it just calls an endpoint. Hard-fail: the cache never
+    works, which is invisible because the process still 'runs' green (FX-usecase bug)."""
+    out: list[dict] = []
+    for a in _actions(flow):
+        if _is_structural(a):
+            continue
+        if any(k in _name(a).lower() for k in _DATASTORE_INTENT) \
+                and _CALLAPI_TEMPLATE in _template(a).lower():
+            out.append(_f(
+                "correctness", "fail", "datastore-as-callapi",
+                "action is named like a Data Store / cache operation but its type is "
+                "'Call API' - a Call API node does NOT read or write the Data Store. "
+                "Use a native Data Store action (Select/Insert/Update/Delete), not a "
+                "Call API dressed with a cache icon.",
+                "FX-usecase diagnosis; PROCESIO-DATASTORE", _name(a)))
+    return out
+
+
+def correctness_findings(flow: dict) -> list[dict]:
+    """Designer-vs-runtime parity checks only (what `verify` gates on)."""
+    findings: list[dict] = list(_datastore_masquerade(flow))
+    for a in _actions(flow):
+        if _is_structural(a):
+            continue
+        params = ci(a, "parameters")
+        if not isinstance(params, list):
+            continue
+        set_params = [p for p in params if isinstance(p, dict) and _param_set(p)]
+        settings = _config_settings(a)
+        set_settings = [s for s in settings if _config_set(s)]
+        if set_params and settings and not set_settings:
+            findings.append(_f(
+                "correctness", "warn", "designer-blank",
+                "runtime parameters are set but the designer configuration is empty; "
+                "the designer will show 'not configured' and Validate will fail "
+                "(mirror parameters into customData.configuration)",
+                "PHASE4-E2E process-builder fix", _name(a)))
+        elif params and not set_params and not set_settings:
+            findings.append(_f(
+                "correctness", "info", "unconfigured-action",
+                "action has parameters but none are set; confirm it is meant to be empty",
+                "playbook A", _name(a)))
+    return findings
+
+
+def _practice_findings(flow: dict) -> tuple[list[dict], dict]:
+    findings: list[dict] = []
+    nonstructural = [a for a in _actions(flow) if not _is_structural(a)]
+    n = len(nonstructural)
+
+    if n > 5:
+        findings.append(_f("practice", "warn", "high-action-count",
+                           f"{n} non-structural actions; >5 is 'really bad' for a "
+                           "form-called process - reduce/merge or move to one scripting action",
+                           "best-practices 9-10"))
+    elif n >= 4:
+        findings.append(_f("practice", "info", "action-count",
+                           f"{n} non-structural actions; aim for <=3 if a form calls this",
+                           "best-practices 9-10"))
+
+    slow = sorted({_template(a) for a in nonstructural
+                   if any(k in _template(a).lower() for k in _SLOW_KEYWORDS)})
+    if slow:
+        findings.append(_f("practice", "info" if len(slow) <= 2 else "warn",
+                           "slow-actions",
+                           "latency-adding actions present: " + ", ".join(slow) +
+                           " - use only where needed, minimize for form-called processes",
+                           "best-practices 10"))
+
+    has_desc = bool(str(ci(flow, "description") or "").strip())
+    if not has_desc:
+        findings.append(_f("practice", "info", "missing-description",
+                           "process has no description; document it and the trigger order (SOP)",
+                           "best-practices 7"))
+
+    blob = json.dumps(flow, default=str).lower()
+    error_handling = any(t in blob for t in
+                         ('errorport', '"error"', 'onerror', 'error_port', 'erroraction'))
+    if n >= 2 and not error_handling:
+        findings.append(_f("practice", "info", "no-error-handling",
+                           "no error-port / error handling detected (heuristic); add a "
+                           "global try/catch via Error Port + Decisional",
+                           "best-practices 5"))
+
+    findings.extend(_secret_smells(nonstructural))
+
+    summary = {
+        "action_count": len(_actions(flow)),
+        "nonstructural_action_count": n,
+        "slow_actions": slow,
+        "has_description": has_desc,
+        "error_handling_detected": error_handling,
+    }
+    return findings, summary
+
+
+def _secret_smells(actions: list[dict]) -> list[dict]:
+    out: list[dict] = []
+    for a in actions:
+        params = ci(a, "parameters") or []
+        for p in params:
+            if not isinstance(p, dict) or ci(p, "variable"):
+                continue  # bound to a variable -> not an inline literal
+            val = ci(p, "value")
+            if not isinstance(val, str) or not val or _GUID_RE.match(val):
+                continue  # GUIDs (e.g. a credential id literal) are expected, not secrets
+            low = val.lower()
+            if any(k in low for k in _SECRET_KEYWORDS) or (
+                    len(val) >= 24 and _TOKEN_RE.match(val) and not val.startswith("<%")):
+                out.append(_f("practice", "warn", "possible-inline-secret",
+                              "a parameter holds a literal that looks like a secret; "
+                              "secrets must live in the Credential Manager, not in the process",
+                              "best-practices 2", _name(a)))
+                break
+    return out
+
+
+def audit_process(flow: dict) -> dict:
+    """Full audit: correctness + practice findings + a summary."""
+    correctness = correctness_findings(flow)
+    practice, summary = _practice_findings(flow)
+    findings = correctness + practice
+    counts = {"fail": 0, "warn": 0, "info": 0}
+    for f in findings:
+        counts[f["severity"]] = counts.get(f["severity"], 0) + 1
+    summary["findings_by_severity"] = counts
+    summary["title"] = ci(flow, "title") or ci(flow, "name")
+    return {"findings": findings, "summary": summary}

procesio_cli/agents/procesio/checklist.py

@@ -0,0 +1,135 @@
+"""The build-and-test self-test checklist, as structured data.
+
+Single source of truth for what "tested" means (the playbook's checklist in
+machine-readable form). The `checklist` action emits it; `verify` runs the
+automatable steps; the manual steps are surfaced so a human/LLM cannot quietly
+skip them. Keep this in sync with PROCESIO-BUILD-AND-TEST-PLAYBOOK.md.
+
+Each step:
+  id          stable slug
+  phase       validate | run | forms | webhooks | e2e
+  title       what to check
+  how         concrete mechanic
+  tool        which registered tool/action performs it (or "" for judgment)
+  automatable True  -> `verify` can run it
+              False -> a human/LLM must do it (named in verify's manual_checks)
+  citation    where it comes from
+"""
+from __future__ import annotations
+
+STEPS: list[dict] = [
+    # A. static validation -----------------------------------------------------
+    {"id": "validate-process", "phase": "validate", "automatable": True,
+     "title": "Validate the process with PROCESIO's own validator",
+     "how": "POST /api/Projects/validate; expect no validation errors",
+     "tool": "procesio request", "citation": "playbook A"},
+    {"id": "config-parity-audit", "phase": "validate", "automatable": True,
+     "title": "Designer-vs-runtime parity: every action configured",
+     "how": "runtime Parameters[] must be mirrored into CustomData.configuration "
+            "or the designer shows 'not configured' and Validate fails",
+     "tool": "procesio agent (audit/verify)", "citation": "playbook A; PHASE4-E2E"},
+    {"id": "test-credentials", "phase": "validate", "automatable": True,
+     "title": "Test every credential the process uses",
+     "how": "POST /api/Credentials/test returns a real upstream body when placement is right",
+     "tool": "procesio request", "citation": "playbook A; PHASE4-E2E 3-4"},
+    {"id": "test-actions", "phase": "validate", "automatable": True,
+     "title": "Test individual actions where supported",
+     "how": "POST /api/Actions/test", "tool": "procesio request",
+     "citation": "playbook A"},
+    {"id": "db-credential-engine", "phase": "validate", "automatable": True,
+     "title": "For a DB credential, Test Connection against the chosen engine",
+     "how": "a MySQL DB credential (server-type MySQL) or a Redis credential must pass "
+            "POST /api/Credentials/test — it opens a real connection",
+     "tool": "procesio credential-test", "citation": "datastore/best-practices; PRC-3696"},
+    # B. run + instance --------------------------------------------------------
+    {"id": "run-instance", "phase": "run", "automatable": True,
+     "title": "Run the process and read the real instance status",
+     "how": "run-process --synchronous, then status 50 = finished, 40 = ran-with-errors",
+     "tool": "procesio run-process / get-instance-status",
+     "citation": "playbook B; PHASE4-E2E 6,15"},
+    {"id": "read-action-errors", "phase": "run", "automatable": True,
+     "title": "Read per-action errorMessage, do not assume success",
+     "how": "GET /api/Projects/instances/{id}/status?getActions=true",
+     "tool": "procesio get-instance-status --actions", "citation": "playbook B"},
+    {"id": "download-artifact", "phase": "run", "automatable": False,
+     "title": "Download and open any generated file",
+     "how": "GET /api/File/download with uploadFilePath/variableId/instanceId/flowTemplateId",
+     "tool": "procesio request", "citation": "playbook B"},
+    {"id": "datastore-roundtrip", "phase": "run", "automatable": True,
+     "title": "Data Store: a row round-trips (add -> filtered read -> update -> delete)",
+     "how": "add-rows then get-rows with a filter returns exactly it; update-row by PK and "
+            "delete-rows change affectedRows as expected (rows keyed by display name)",
+     "tool": "procesio datastore-*", "citation": "datastore"},
+    {"id": "schedule-cron", "phase": "run", "automatable": True,
+     "title": "Schedule: preview a cron string, then confirm the stored recurrence",
+     "how": "validate-crontab returns the expected next occurrences; create-schedule "
+            "--cron then get-schedule shows recurrence type 8 (CRON)",
+     "tool": "procesio validate-crontab / create-schedule / get-schedule",
+     "citation": "scheduling; PRC-3282"},
+    # C. forms -----------------------------------------------------------------
+    {"id": "form-render", "phase": "forms", "automatable": False,
+     "title": "Confirm the form renders (layout, theme, controls)",
+     "how": "open forms.procesio.app/... and screenshot",
+     "tool": "web", "citation": "playbook C"},
+    {"id": "form-behavior", "phase": "forms", "automatable": False,
+     "title": "Verify field value-flow in a REAL browser, not headless",
+     "how": "headless fill()/press() do NOT update the Angular form model and "
+            "RUN_JAVASCRIPT events do not fire headlessly -> false negatives",
+     "tool": "web (persistent session)", "citation": "playbook C; PHASE4-E2E 7-11,21"},
+    {"id": "form-triggers", "phase": "forms", "automatable": False,
+     "title": "Confirm RUN_PROCESS triggers ran the process and produced the artifact",
+     "how": "prefer server-side RUN_PROCESS mapping over form JS reading field values",
+     "tool": "web", "citation": "playbook C"},
+    {"id": "form-theme-render", "phase": "forms", "automatable": False,
+     "title": "Confirm the theme renders: dark mode + element alignment",
+     "how": "toggle dark mode and check the 16-var palette applies; container elements "
+            "honor their --fd/--jc/--ai alignment vars — verify in a real browser",
+     "tool": "web", "citation": "playbook C; form-styling"},
+    {"id": "form-datastore-trigger", "phase": "forms", "automatable": False,
+     "title": "Confirm a RUN_DATA_STORE_OPERATION trigger runs and the row round-trips",
+     "how": "fire the element event; the READ/ADD/UPDATE/DELETE op hits the store and the "
+            "result maps back into the form (filters apply to every op except ADD)",
+     "tool": "web + procesio datastore-get-rows", "citation": "datastore"},
+    # D. webhooks --------------------------------------------------------------
+    {"id": "webhook-trigger", "phase": "webhooks", "automatable": True,
+     "title": "Trigger the webhook and confirm an async instance runs to status 50",
+     "how": "POST the webhook endpoint with a real payload, then poll instances",
+     "tool": "procesio request / list-instances", "citation": "playbook D"},
+    {"id": "webhook-body-binding", "phase": "webhooks", "automatable": False,
+     "title": "Webhook body binds WHOLE to a model-typed variable",
+     "how": "bind the body to a primitive and you get raw JSON instead of fields",
+     "tool": "procesio agent (design check)", "citation": "playbook D; PHASE4-E2E 1"},
+    # E. end-to-end ------------------------------------------------------------
+    {"id": "e2e-flow", "phase": "e2e", "automatable": False,
+     "title": "Exercise the whole use case as a user; verify the real artifact",
+     "how": "form -> process(es) -> document/email/SQL -> system of record",
+     "tool": "web + procesio", "citation": "playbook E"},
+    {"id": "idempotency", "phase": "e2e", "automatable": False,
+     "title": "Trigger twice; confirm no duplicate side effects",
+     "how": "external IDs / dedupe keys make a retry or double-trigger safe",
+     "tool": "", "citation": "best-practices 2"},
+    {"id": "ux-timing", "phase": "e2e", "automatable": False,
+     "title": "Check forms UX timing (1s / 3s rules)",
+     "how": ">=90% of clicks under 1s, <=10% in 1-3s, none ever over 3s",
+     "tool": "web", "citation": "best-practices 9"},
+    {"id": "speed", "phase": "e2e", "automatable": True,
+     "title": "Check optimize-for-speed (action count, slow actions)",
+     "how": "~10ms per action; reduce count; minimize Call API/SQL/FTP/Decisional",
+     "tool": "procesio agent (audit)", "citation": "best-practices 10"},
+]
+
+PHASES = ["validate", "run", "forms", "webhooks", "e2e"]
+
+
+def steps(phase: str | None = None, automatable_only: bool = False) -> list[dict]:
+    out = STEPS
+    if phase:
+        out = [s for s in out if s["phase"] == phase]
+    if automatable_only:
+        out = [s for s in out if s["automatable"]]
+    return [dict(s) for s in out]
+
+
+def manual_steps() -> list[dict]:
+    """Steps `verify` cannot run - a human/LLM must do them by hand."""
+    return [dict(s) for s in STEPS if not s["automatable"]]

procesio_cli/agents/procesio/context.py

@@ -0,0 +1,19 @@
+"""Runtime context for the PROCESIO agent.
+
+Unlike the outreach agent there is no state backend - the PROCESIO agent is
+stateless. The only thing context-actions need is a tool invoker (so they can
+drive the `procesio` tool), which tests replace with a fake. No secret of its
+own; readiness comes from the tools it drives.
+"""
+from __future__ import annotations
+
+from agents._lib import toolrunner
+
+
+class ProcesioContext:
+    def __init__(self, invoke=None):
+        self.invoke = invoke or toolrunner.invoke
+
+    @classmethod
+    def create(cls, invoke=None) -> "ProcesioContext":
+        return cls(invoke=invoke)

procesio_cli/agents/procesio/handlers/audit.py

@@ -0,0 +1,39 @@
+"""audit action - static best-practice analysis of a process (no run). Surfaces
+the inefficiency / UX / robustness smells so they get addressed: action count,
+slow actions, missing error handling, missing description, possible inline secret,
+plus the designer-vs-runtime parity correctness findings.
+"""
+from __future__ import annotations
+
+import argparse
+
+from agents._lib.actiondef import ActionDef
+from agents.procesio import audit as auditlib
+from agents.procesio import verifylib
+
+
+def _audit(ctx, args) -> dict:
+    scope = verifylib.scope_args(args.profile, args.workspace_id)
+    flow = verifylib._flow_from(
+        ctx.invoke("procesio", "get-process", "--id", args.process_id, *scope))
+    report = auditlib.audit_process(flow)
+    report["process_id"] = args.process_id
+    return report
+
+
+def _args(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--process-id", dest="process_id", required=True,
+                   help="process (project) id to audit")
+    p.add_argument("--profile", help="procesio credential profile to use")
+    p.add_argument("--workspace-id", dest="workspace_id",
+                   help="workspace GUID the process lives in (required whenever it "
+                        "is not the profile's default workspace)")
+
+
+ACTIONS = {
+    "audit": ActionDef(
+        func=_audit, context=True, add_args=_args,
+        description="Static best-practice + correctness audit of a process "
+                    "(action count, slow actions, error handling, inline secrets, "
+                    "designer-vs-runtime parity)."),
+}

procesio_cli/agents/procesio/handlers/checklist.py

@@ -0,0 +1,34 @@
+"""checklist action - emit the self-test checklist as structured steps. The single
+source `verify` runs and any session follows, so a test layer cannot be skipped
+by forgetting it exists.
+"""
+from __future__ import annotations
+
+import argparse
+
+from agents._lib.actiondef import ActionDef
+from agents.procesio import checklist as cl
+
+
+def _checklist(args) -> dict:
+    steps = cl.steps(phase=args.phase, automatable_only=args.automatable_only)
+    return {
+        "phases": cl.PHASES,
+        "count": len(steps),
+        "steps": steps,
+        "manual_steps": [s["id"] for s in cl.manual_steps()],
+    }
+
+
+def _args(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--phase", help="filter to one phase: " + " | ".join(cl.PHASES))
+    p.add_argument("--automatable-only", dest="automatable_only",
+                   action="store_true", help="only steps `verify` can run")
+
+
+ACTIONS = {
+    "checklist": ActionDef(
+        func=_checklist, add_args=_args,
+        description="Emit the rigorous self-test checklist (structured). "
+                    "--phase to filter, --automatable-only for verify-runnable steps."),
+}

procesio_cli/agents/procesio/handlers/guidance.py

@@ -0,0 +1,36 @@
+"""guidance action - serve the agent's knowledge base (the build-and-test
+playbook, best practices, and the tool-vs-agent boundary) from one
+registry-discoverable place. The methodology is loaded, never re-derived.
+"""
+from __future__ import annotations
+
+import argparse
+
+from agents._lib.actiondef import ActionDef
+from agents._lib.errors import AgentError
+from agents.procesio import knowledge
+
+
+def _guidance(args) -> dict:
+    if args.topic == "all":
+        return {"topics": knowledge.topics(), "sections": knowledge.load_all()}
+    try:
+        return knowledge.load(args.topic)
+    except (KeyError, FileNotFoundError) as e:
+        raise AgentError("unknown_topic", str(e),
+                         {"known": knowledge.topics() + ["all"]})
+
+
+def _args(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--topic", default="all",
+                   help="playbook | best-practices | visual-organization | datastore | "
+                        "scheduling | environments | boundary | all (default all)")
+
+
+ACTIONS = {
+    "guidance": ActionDef(
+        func=_guidance, add_args=_args,
+        description="Serve the build-and-test playbook + best practices (the agent's "
+                    "knowledge base). --topic playbook|best-practices|"
+                    "visual-organization|boundary|all."),
+}

procesio_cli/agents/procesio/handlers/status.py

@@ -0,0 +1,33 @@
+"""status action - report the PROCESIO agent's readiness and that of the tools it
+drives. Pure introspection: reads the registry, no network, no secrets needed.
+"""
+from __future__ import annotations
+
+from agents._lib.actiondef import ActionDef
+
+
+def _status(_args) -> dict:
+    from registry import list_agents
+
+    me = next((a for a in list_agents() if a.get("name") == "procesio"), None)
+    if me is None:
+        return {"agent": "procesio", "found": False,
+                "note": "agent.yaml not discovered by the registry"}
+    tools = me.get("tool_status", {})
+    return {
+        "agent": "procesio",
+        "found": True,
+        "version": me.get("version"),
+        "ready": me.get("ready", False),
+        "missing_secrets": me.get("missing_secrets", []),
+        "tools_ready": sorted(n for n, s in tools.items() if s.get("ready")),
+        "tools_unready": {n: s for n, s in tools.items() if not s.get("ready")},
+    }
+
+
+ACTIONS = {
+    "status": ActionDef(
+        func=_status,
+        description="Report agent + driven-tool readiness (presence + secrets).",
+    ),
+}

procesio_cli/agents/procesio/handlers/verify.py

@@ -0,0 +1,39 @@
+"""verify action - run the automatable self-test steps against a live process and
+return a pass/fail report. The enforcement gate: it validates, audits config
+parity, and (with --run) runs the process and reads the real instance status.
+Manual steps it cannot run are listed so they are not silently skipped.
+"""
+from __future__ import annotations
+
+import argparse
+
+from agents._lib.actiondef import ActionDef
+from agents.procesio import verifylib
+
+
+def _verify(ctx, args) -> dict:
+    return verifylib.verify_process(
+        ctx.invoke, args.process_id, profile=args.profile,
+        workspace_id=args.workspace_id,
+        run=args.run, payload=args.payload, timeout=args.timeout)
+
+
+def _args(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--process-id", dest="process_id", required=True,
+                   help="process (project) id to verify")
+    p.add_argument("--run", action="store_true",
+                   help="actually run the process and read the instance status")
+    p.add_argument("--payload", help="input variables as a JSON object (with --run)")
+    p.add_argument("--timeout", type=int, help="secondsTimeOut for the synchronous run")
+    p.add_argument("--profile", help="procesio credential profile to use")
+    p.add_argument("--workspace-id", dest="workspace_id",
+                   help="workspace GUID the process lives in (required whenever it "
+                        "is not the profile's default workspace)")
+
+
+ACTIONS = {
+    "verify": ActionDef(
+        func=_verify, context=True, add_args=_args,
+        description="Run the automatable self-test gate against a process (validate, "
+                    "config-parity audit, and with --run execute + read instance status)."),
+}