Onboard a team with one workflow.

# Onboard a team: invite their lead, then create their workspace.
#
# Shipped as a catalogue entry, so this is the shape a published workflow takes.
# It uses only `wf/...` tasks, which means it depends on no integration, agent or
# MCP and installs cleanly into any tenant.
#
# Every value it needs is answered when somebody runs it.
apiVersion: orchestration/v3
kind: Workflow
metadata:
  name: onboard-team
spec:
  description: Invites a team lead and creates their workspace, tolerating a failed invite.
  suggestedRoles:
    - tenant.manager
  triggers:
    - name: run
      manual:
        inputs:
          - name: workspace
            description: Name of the workspace to create for the team.
          - name: email
            description: Email address of the team lead to invite.
          - name: role
            description: Tenant role a team lead is invited with.
            defaultValue: tenant.member
  tasks:
    # Best-effort. An address can be wrong, or the person may already be a member,
    # and neither is a reason to leave the team without a workspace.
    invite_lead:
      action: wf/invite/user
      continueOnFailure: true
      with:
        name: '${{ .Inputs.email }}'
        role: '${{ .Inputs.role }}'
    # The point of the whole thing, and it runs either way.
    provision:
      dependsOn: [invite_lead]
      action: wf/create/workspace
      with:
        name: '${{ .Inputs.workspace }}'
        description: 'Onboarded by the onboard-team workflow'