{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {"name": "040 OpenCode Governed Jobs", "slug": "040-opencode-governed-jobs"},
  "spec": {
    "priority": 40,
    "description": "Allow managed Gitea workspace snapshots, preview-gated OpenCode jobs, and bounded delivery execution only for the separately bound openchamber-agent production client. Final acceptance remains external to OpenChamber.",
    "match": {
      "project": "openchamber-agent",
      "environmentClassifications": ["production"],
      "connectors": ["opencode"],
      "riskClasses": ["R2", "R3"],
      "toolPatterns": ["opencode.workspace.ensure", "opencode.job.start", "opencode.job.cancel", "opencode.delivery.control.start", "opencode.delivery.control.retry", "opencode.delivery.control.cancel"]
    },
    "conditions": {"requireEnabledClient": true, "requireBinding": true, "maxArgumentBytes": 65536},
    "decision": "allow_if_conditions",
    "terminal": true
  }
}