@a5c-ai/krate 5.0.1-staging.f672fe79b

package/tests/agent-mux-client.test.js

@@ -0,0 +1,204 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { createAgentMuxClient, parseSseLines, AGENT_MUX_CLIENT_BOUNDARY } from '../src/agent-mux-client.js';
+
+describe('AGENT_MUX_CLIENT_BOUNDARY', () => {
+  it('declares the expected role and scope', () => {
+    assert.equal(AGENT_MUX_CLIENT_BOUNDARY.role, 'agent-mux-client');
+    assert.ok(AGENT_MUX_CLIENT_BOUNDARY.scope.includes('HTTP/SSE'));
+    assert.ok(AGENT_MUX_CLIENT_BOUNDARY.owns.includes('gateway HTTP calls'));
+    assert.ok(AGENT_MUX_CLIENT_BOUNDARY.delegatesTo.includes('resource-model'));
+  });
+});
+
+describe('createAgentMuxClient — isAvailable', () => {
+  it('returns false when enabled is false', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: false });
+    assert.equal(client.isAvailable(), false);
+  });
+
+  it('returns false when gateway is empty', () => {
+    const client = createAgentMuxClient({ gateway: '', enabled: true });
+    assert.equal(client.isAvailable(), false);
+  });
+
+  it('returns false when no options are provided', () => {
+    const client = createAgentMuxClient();
+    assert.equal(client.isAvailable(), false);
+  });
+
+  it('returns true when enabled is true and gateway is set', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    assert.equal(client.isAvailable(), true);
+  });
+});
+
+describe('createAgentMuxClient — queryCapabilities', () => {
+  it('returns null when client is unavailable', async () => {
+    const client = createAgentMuxClient({ enabled: false });
+    const result = await client.queryCapabilities('claude-code');
+    assert.equal(result, null);
+  });
+});
+
+describe('createAgentMuxClient — launchSession', () => {
+  it('returns null when client is unavailable', async () => {
+    const client = createAgentMuxClient({ enabled: false });
+    const result = await client.launchSession({
+      stack: { baseAgent: 'claude-code' },
+      contextBundle: {},
+      permissionSnapshot: {},
+      workspace: {}
+    });
+    assert.equal(result, null);
+  });
+});
+
+describe('parseSseLines', () => {
+  it('parses valid SSE data lines', () => {
+    const text = [
+      'data: {"role":"assistant","content":"hello"}',
+      '',
+      'data: {"role":"user","content":"world"}',
+      '',
+    ].join('\n');
+    const events = parseSseLines(text);
+    assert.equal(events.length, 2);
+    assert.equal(events[0].role, 'assistant');
+    assert.equal(events[0].content, 'hello');
+    assert.equal(events[1].role, 'user');
+    assert.equal(events[1].content, 'world');
+  });
+
+  it('handles multiple data lines in a single block', () => {
+    const text = [
+      'data: {"seq":1}',
+      'data: {"seq":2}',
+      '',
+    ].join('\n');
+    const events = parseSseLines(text);
+    assert.equal(events.length, 2);
+    assert.equal(events[0].seq, 1);
+    assert.equal(events[1].seq, 2);
+  });
+
+  it('skips malformed JSON gracefully', () => {
+    const text = [
+      'data: {"valid":true}',
+      'data: not-json',
+      'data: {"also":"valid"}',
+      '',
+    ].join('\n');
+    const events = parseSseLines(text);
+    assert.equal(events.length, 2);
+    assert.equal(events[0].valid, true);
+    assert.equal(events[1].also, 'valid');
+  });
+
+  it('ignores non-data SSE lines', () => {
+    const text = [
+      'event: message',
+      'id: 42',
+      'data: {"role":"assistant","content":"test"}',
+      'retry: 3000',
+      '',
+    ].join('\n');
+    const events = parseSseLines(text);
+    assert.equal(events.length, 1);
+    assert.equal(events[0].role, 'assistant');
+  });
+
+  it('returns empty array for empty text', () => {
+    assert.deepEqual(parseSseLines(''), []);
+  });
+
+  it('returns empty array for text with no data lines', () => {
+    assert.deepEqual(parseSseLines('event: ping\nid: 1\n\n'), []);
+  });
+});
+
+describe('createAgentMuxClient — reconcileTranscript', () => {
+  it('creates a valid AgentSessionTranscript resource from events', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    const events = [
+      { role: 'user', content: 'Fix the bug', timestamp: '2026-01-01T00:00:00Z' },
+      { role: 'assistant', content: 'Looking at the code...', timestamp: '2026-01-01T00:00:01Z', usage: { inputTokens: 100, outputTokens: 50 } },
+      { role: 'assistant', content: 'Fixed it.', timestamp: '2026-01-01T00:00:02Z', usage: { inputTokens: 200, outputTokens: 80 } },
+    ];
+
+    const transcript = client.reconcileTranscript('sess-123', events, { namespace: 'krate-org-acme', organizationRef: 'acme' });
+
+    assert.equal(transcript.kind, 'AgentSessionTranscript');
+    assert.equal(transcript.apiVersion, 'krate.a5c.ai/v1alpha1');
+    assert.equal(transcript.metadata.name, 'transcript-sess-123');
+    assert.equal(transcript.metadata.namespace, 'krate-org-acme');
+    assert.equal(transcript.spec.organizationRef, 'acme');
+    assert.equal(transcript.spec.sessionRef, 'sess-123');
+    assert.equal(transcript.spec.messages.length, 3);
+    assert.equal(transcript.spec.messages[0].role, 'user');
+    assert.equal(transcript.spec.messages[0].content, 'Fix the bug');
+    assert.equal(transcript.spec.messages[1].role, 'assistant');
+    assert.equal(transcript.spec.cost.inputTokens, 300);
+    assert.equal(transcript.spec.cost.outputTokens, 130);
+    assert.equal(transcript.spec.cost.totalTokens, 430);
+    assert.equal(transcript.status.phase, 'Reconciled');
+  });
+
+  it('handles empty events array', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    const transcript = client.reconcileTranscript('sess-empty', [], { namespace: 'default', organizationRef: 'default' });
+
+    assert.equal(transcript.kind, 'AgentSessionTranscript');
+    assert.equal(transcript.spec.sessionRef, 'sess-empty');
+    assert.equal(transcript.spec.messages.length, 0);
+    assert.equal(transcript.spec.cost.inputTokens, 0);
+    assert.equal(transcript.spec.cost.outputTokens, 0);
+    assert.equal(transcript.spec.cost.totalTokens, 0);
+  });
+
+  it('handles events with toolUse and toolResult', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    const events = [
+      { role: 'assistant', content: 'Using tool...', toolUse: { name: 'read_file', input: { path: '/tmp/f' } }, timestamp: '2026-01-01T00:00:00Z' },
+      { role: 'tool', content: 'file contents', toolResult: { output: 'ok' }, timestamp: '2026-01-01T00:00:01Z' },
+    ];
+    const transcript = client.reconcileTranscript('sess-tools', events, { namespace: 'default', organizationRef: 'default' });
+
+    assert.equal(transcript.spec.messages.length, 2);
+    assert.deepEqual(transcript.spec.messages[0].toolUse, { name: 'read_file', input: { path: '/tmp/f' } });
+    assert.deepEqual(transcript.spec.messages[1].toolResult, { output: 'ok' });
+  });
+
+  it('handles events with non-string content', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    const events = [
+      { role: 'assistant', content: { type: 'structured', data: [1, 2, 3] }, timestamp: '2026-01-01T00:00:00Z' },
+    ];
+    const transcript = client.reconcileTranscript('sess-obj', events, { namespace: 'default', organizationRef: 'default' });
+
+    assert.equal(typeof transcript.spec.messages[0].content, 'string');
+    assert.ok(transcript.spec.messages[0].content.includes('"type":"structured"'));
+  });
+
+  it('skips null/non-object events gracefully', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    const events = [
+      null,
+      'not-an-object',
+      42,
+      { role: 'user', content: 'valid', timestamp: '2026-01-01T00:00:00Z' },
+    ];
+    const transcript = client.reconcileTranscript('sess-mixed', events, { namespace: 'default', organizationRef: 'default' });
+
+    assert.equal(transcript.spec.messages.length, 1);
+    assert.equal(transcript.spec.messages[0].role, 'user');
+  });
+
+  it('uses default namespace and organizationRef when not specified', () => {
+    const client = createAgentMuxClient({ gateway: 'http://localhost:8080', enabled: true });
+    const transcript = client.reconcileTranscript('sess-defaults', []);
+
+    assert.equal(transcript.metadata.namespace, 'default');
+    assert.equal(transcript.spec.organizationRef, 'default');
+  });
+});

package/tests/agent-permission-review.test.js

@@ -0,0 +1,209 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { createPermissionReviewer } from '../src/agent-permission-review.js';
+import { createResource } from '../src/resource-model.js';
+
+function makeStack(name, overrides = {}) {
+  return createResource('AgentStack', { name }, {
+    organizationRef: 'default',
+    baseAgent: 'claude-code',
+    adapter: 'babysitter',
+    runtimeIdentity: { serviceAccountRef: overrides.serviceAccountRef || 'sa-agent' },
+    ...(overrides.spec || {})
+  });
+}
+
+function makeServiceAccount(name) {
+  return createResource('AgentServiceAccount', { name }, {
+    organizationRef: 'default',
+    namespace: 'krate-agents',
+    serviceAccountName: name
+  });
+}
+
+function makeRoleBinding(name, subject) {
+  return createResource('AgentRoleBinding', { name }, {
+    organizationRef: 'default',
+    subject,
+    roleRef: 'agent-role',
+    scope: 'namespace'
+  });
+}
+
+function makeSecretGrant(name, subject, purpose, overrides = {}) {
+  return createResource('AgentSecretGrant', { name }, {
+    organizationRef: 'default',
+    subject,
+    secretRef: 'api-keys',
+    purpose,
+    ...overrides
+  });
+}
+
+function makeMcpServer(name, overrides = {}) {
+  return createResource('AgentMcpServer', { name }, {
+    organizationRef: 'default',
+    transport: 'stdio',
+    scope: 'workspace',
+    ...overrides
+  });
+}
+
+function makeModelProviderGrant(subject) {
+  return makeSecretGrant('sg-model', subject, 'model-provider');
+}
+
+const baseInput = {
+  repository: 'my-repo',
+  ref: 'refs/heads/main',
+  actor: 'user-1',
+  agentStack: 'test-stack',
+  triggerSource: 'manual',
+  taskKind: 'fix'
+};
+
+describe('agent permission review', () => {
+  it('fully granted stack returns allowed', () => {
+    const reviewer = createPermissionReviewer();
+    const resources = {
+      AgentStack: [makeStack('test-stack')],
+      AgentServiceAccount: [makeServiceAccount('sa-agent')],
+      AgentRoleBinding: [makeRoleBinding('rb-1', 'sa-agent')],
+      AgentSecretGrant: [makeModelProviderGrant('sa-agent')],
+      AgentConfigGrant: [],
+      AgentMcpServer: []
+    };
+    const result = reviewer.reviewPermissions({ ...baseInput, resources });
+    assert.equal(result.decision, 'allowed');
+    assert.ok(result.grants.length > 0, 'should have at least one grant');
+    assert.ok(result.grants.some((g) => g.kind === 'AgentServiceAccount' && g.status === 'bound'));
+    assert.ok(result.grants.some((g) => g.kind === 'AgentRoleBinding' && g.status === 'bound'));
+    assert.ok(typeof result.digest === 'string' && result.digest.length > 0);
+  });
+
+  it('missing service account returns denied with missing-runtime-identity reason', () => {
+    const reviewer = createPermissionReviewer();
+    const resources = {
+      AgentStack: [makeStack('test-stack', { serviceAccountRef: 'nonexistent-sa' })],
+      AgentServiceAccount: [],
+      AgentRoleBinding: [],
+      AgentSecretGrant: [],
+      AgentConfigGrant: [],
+      AgentMcpServer: []
+    };
+    const result = reviewer.reviewPermissions({ ...baseInput, resources });
+    assert.equal(result.decision, 'denied');
+    assert.ok(result.reasons.some((r) => r.severity === 'error' && r.message.includes('Missing AgentServiceAccount')));
+  });
+
+  it('missing secret grant returns denied with missingGrants information', () => {
+    const reviewer = createPermissionReviewer();
+    const mcpServer = makeMcpServer('mcp-github', { secretRef: 'github-token' });
+    const stack = makeStack('test-stack', {
+      spec: {
+        organizationRef: 'default',
+        baseAgent: 'claude-code',
+        adapter: 'babysitter',
+        runtimeIdentity: { serviceAccountRef: 'sa-agent' },
+        mcpServerRefs: ['mcp-github']
+      }
+    });
+    const resources = {
+      AgentStack: [stack],
+      AgentServiceAccount: [makeServiceAccount('sa-agent')],
+      AgentRoleBinding: [makeRoleBinding('rb-1', 'sa-agent')],
+      AgentSecretGrant: [],
+      AgentConfigGrant: [],
+      AgentMcpServer: [mcpServer]
+    };
+    const result = reviewer.reviewPermissions({ ...baseInput, resources });
+    assert.equal(result.decision, 'denied');
+    assert.ok(result.reasons.some((r) => r.severity === 'error' && r.message.includes('Missing AgentSecretGrant')));
+  });
+
+  it('grant requiring approval returns requires-approval', () => {
+    const reviewer = createPermissionReviewer();
+    const mcpServer = makeMcpServer('mcp-prod', { secretRef: 'prod-secret' });
+    const stack = makeStack('test-stack', {
+      spec: {
+        organizationRef: 'default',
+        baseAgent: 'claude-code',
+        adapter: 'babysitter',
+        runtimeIdentity: { serviceAccountRef: 'sa-agent' },
+        mcpServerRefs: ['mcp-prod']
+      }
+    });
+    const mcpGrant = makeSecretGrant('sg-prod', 'sa-agent', 'mcp-server:mcp-prod', {
+      requiredApproval: 'always'
+    });
+    const resources = {
+      AgentStack: [stack],
+      AgentServiceAccount: [makeServiceAccount('sa-agent')],
+      AgentRoleBinding: [makeRoleBinding('rb-1', 'sa-agent')],
+      AgentSecretGrant: [mcpGrant, makeModelProviderGrant('sa-agent')],
+      AgentConfigGrant: [],
+      AgentMcpServer: [mcpServer]
+    };
+    const result = reviewer.reviewPermissions({ ...baseInput, resources });
+    assert.equal(result.decision, 'requires-approval');
+    assert.ok(result.grants.some((g) => g.status === 'requires-approval' && g.requiredApproval === 'always'));
+  });
+
+  it('empty capabilities stack returns allowed', () => {
+    const reviewer = createPermissionReviewer();
+    const stack = makeStack('test-stack');
+    const resources = {
+      AgentStack: [stack],
+      AgentServiceAccount: [makeServiceAccount('sa-agent')],
+      AgentRoleBinding: [makeRoleBinding('rb-1', 'sa-agent')],
+      AgentSecretGrant: [makeModelProviderGrant('sa-agent')],
+      AgentConfigGrant: [],
+      AgentMcpServer: []
+    };
+    const result = reviewer.reviewPermissions({
+      ...baseInput,
+      toolRefs: [],
+      skillRefs: [],
+      mcpServerRefs: [],
+      contextLabelRefs: [],
+      resources
+    });
+    assert.equal(result.decision, 'allowed');
+  });
+
+  it('same input produces deterministic digest', () => {
+    const reviewer = createPermissionReviewer();
+    const resources = {
+      AgentStack: [makeStack('test-stack')],
+      AgentServiceAccount: [makeServiceAccount('sa-agent')],
+      AgentRoleBinding: [makeRoleBinding('rb-1', 'sa-agent')],
+      AgentSecretGrant: [makeModelProviderGrant('sa-agent')],
+      AgentConfigGrant: [],
+      AgentMcpServer: []
+    };
+    const result1 = reviewer.reviewPermissions({ ...baseInput, resources });
+    const result2 = reviewer.reviewPermissions({ ...baseInput, resources });
+    assert.equal(result1.digest, result2.digest);
+    assert.ok(typeof result1.digest === 'string' && result1.digest.length === 64, 'digest should be a 64-char hex SHA-256');
+  });
+
+  it('createPermissionSnapshot returns frozen object with timestamp', () => {
+    const reviewer = createPermissionReviewer();
+    const resources = {
+      AgentStack: [makeStack('test-stack')],
+      AgentServiceAccount: [makeServiceAccount('sa-agent')],
+      AgentRoleBinding: [makeRoleBinding('rb-1', 'sa-agent')],
+      AgentSecretGrant: [makeModelProviderGrant('sa-agent')],
+      AgentConfigGrant: [],
+      AgentMcpServer: []
+    };
+    const review = reviewer.reviewPermissions({ ...baseInput, resources });
+    const snapshot = reviewer.createPermissionSnapshot(review);
+    assert.ok(Object.isFrozen(snapshot), 'snapshot should be frozen');
+    assert.ok(typeof snapshot.snapshotAt === 'string' && snapshot.snapshotAt.length > 0, 'snapshot should have a timestamp');
+    assert.equal(snapshot.frozen, true);
+    assert.equal(snapshot.digest, review.digest);
+    assert.equal(snapshot.decision, review.decision);
+    assert.throws(() => { snapshot.decision = 'denied'; }, TypeError);
+  });
+});

package/tests/agent-resources.test.js

@@ -0,0 +1,212 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  CONFIG_KINDS,
+  AGGREGATED_KINDS,
+  ALL_KINDS,
+  RESOURCE_DEFINITIONS,
+  createResource,
+  validateResource,
+  resourceSchemaForKind,
+  storageClassForKind,
+  listResourceDefinitions
+} from '../src/resource-model.js';
+
+const AGENT_CONFIG_KINDS = [
+  'AgentStack',
+  'AgentSubagent',
+  'AgentToolProfile',
+  'AgentMcpServer',
+  'AgentSkill',
+  'AgentTriggerRule',
+  'AgentContextLabel',
+  'AgentWorkspacePolicy',
+  'AgentServiceAccount',
+  'AgentRoleBinding',
+  'AgentSecretGrant',
+  'AgentConfigGrant',
+  'AgentAdapter',
+  'AgentTransportBinding',
+  'AgentProviderConfig',
+  'AgentProject',
+  'AgentGatewayConfig'
+];
+
+const AGENT_AGGREGATED_KINDS = [
+  'AgentDispatchRun',
+  'AgentDispatchAttempt',
+  'AgentSession',
+  'AgentContextBundle',
+  'AgentArtifact',
+  'AgentApproval',
+  'AgentWorkspace',
+  'AgentTriggerExecution',
+  'AgentCapabilityRequirement',
+  'WorkItemSessionLink',
+  'WorkItemWorkspaceLink',
+  'AgentSessionTranscript',
+  'AgentSessionAttachment',
+  'AgentWorkspaceRuntime'
+];
+
+const ALL_AGENT_KINDS = [...AGENT_CONFIG_KINDS, ...AGENT_AGGREGATED_KINDS];
+
+/** Minimal valid spec for each agent kind, satisfying requiredSpec. */
+function minimalSpecForKind(kind) {
+  const specs = {
+    AgentStack: { organizationRef: 'default', baseAgent: 'claude-code', adapter: 'babysitter', runtimeIdentity: 'sa-agent' },
+    AgentSubagent: { organizationRef: 'default', rolePrompt: 'Code reviewer', taskKinds: ['review'] },
+    AgentToolProfile: { organizationRef: 'default', filesystemPolicy: 'read-write', approvalPolicyByTool: { shell: 'auto' } },
+    AgentMcpServer: { organizationRef: 'default', transport: 'stdio', scope: 'workspace' },
+    AgentSkill: { organizationRef: 'default', format: 'markdown', sourceRef: 'skills/debug.md' },
+    AgentTriggerRule: { organizationRef: 'default', sources: ['ci-failure'], agentStack: 'default-stack', taskKind: 'fix' },
+    AgentContextLabel: { organizationRef: 'default', promptFragment: 'Always run tests before committing', allowedSources: ['admin'] },
+    AgentWorkspacePolicy: { organizationRef: 'default', mode: 'worktree', retentionPolicy: '7d' },
+    AgentServiceAccount: { organizationRef: 'default', namespace: 'krate-agents', serviceAccountName: 'agent-runner' },
+    AgentRoleBinding: { organizationRef: 'default', subject: 'agent-runner', roleRef: 'agent-role', scope: 'namespace' },
+    AgentSecretGrant: { organizationRef: 'default', subject: 'agent-runner', secretRef: 'api-keys', purpose: 'API access' },
+    AgentConfigGrant: { organizationRef: 'default', subject: 'agent-runner', configMapRef: 'agent-config', purpose: 'Configuration' },
+    AgentDispatchRun: { organizationRef: 'default', repository: 'app', sourceRefs: ['refs/heads/main'], agentStack: 'default-stack', taskKind: 'fix' },
+    AgentDispatchAttempt: { organizationRef: 'default', agentDispatchRun: 'run-1', attemptReason: 'initial', agentStackSnapshot: { baseAgent: 'claude-code' } },
+    AgentSession: { organizationRef: 'default', agentMuxSessionId: 'sess-123', dispatchRun: 'run-1' },
+    AgentContextBundle: { organizationRef: 'default', dispatchRun: 'run-1', digest: 'sha256:abc', sources: ['repo-context'] },
+    AgentArtifact: { organizationRef: 'default', dispatchRun: 'run-1', kind: 'patch', digest: 'sha256:def' },
+    AgentApproval: { organizationRef: 'default', dispatchRun: 'run-1', action: 'write-back', requestedBy: 'agent-runner' },
+    AgentWorkspace: { organizationRef: 'default', repository: 'app', workspacePath: '/workspaces/app-1', ownership: 'agent-runner' },
+    AgentTriggerExecution: { organizationRef: 'default', triggerRule: 'on-ci-fail', sourceEvent: 'pipeline-failed', decision: 'dispatch' },
+    AgentCapabilityRequirement: { organizationRef: 'default', ownerRef: 'stack-1', requiredRoles: ['shell', 'git'] },
+    WorkItemSessionLink: { organizationRef: 'default', workItemRef: 'issue-1', agentSession: 'sess-123' },
+    WorkItemWorkspaceLink: { organizationRef: 'default', workItemRef: 'issue-1', workspace: 'ws-1' },
+    AgentAdapter: { organizationRef: 'default', adapterType: 'claude-code', transport: 'stdio' },
+    AgentTransportBinding: { organizationRef: 'default', adapterRef: 'claude-code', endpoint: 'https://agent.example.test', protocol: 'https' },
+    AgentProviderConfig: { organizationRef: 'default', provider: 'anthropic', authType: 'api-key' },
+    AgentProject: { organizationRef: 'default', displayName: 'Platform' },
+    AgentGatewayConfig: { organizationRef: 'default', gatewayUrl: 'https://mux.example.test' },
+    AgentSessionTranscript: { organizationRef: 'default', sessionRef: 'sess-123', messages: [{ role: 'user', content: 'hello' }] },
+    AgentSessionAttachment: { organizationRef: 'default', sessionRef: 'sess-123', sourceType: 'upload', digest: 'sha256:abc' },
+    AgentWorkspaceRuntime: { organizationRef: 'default', workspaceRef: 'ws-1', status: 'running' }
+  };
+  return specs[kind];
+}
+
+describe('agent resource set membership', () => {
+  for (const kind of AGENT_CONFIG_KINDS) {
+    it(`${kind} is in CONFIG_KINDS`, () => {
+      assert.ok(CONFIG_KINDS.has(kind), `${kind} should be in CONFIG_KINDS`);
+    });
+  }
+
+  for (const kind of AGENT_AGGREGATED_KINDS) {
+    it(`${kind} is in AGGREGATED_KINDS`, () => {
+      assert.ok(AGGREGATED_KINDS.has(kind), `${kind} should be in AGGREGATED_KINDS`);
+    });
+  }
+
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`${kind} is in ALL_KINDS`, () => {
+      assert.ok(ALL_KINDS.has(kind), `${kind} should be in ALL_KINDS`);
+    });
+  }
+});
+
+describe('RESOURCE_DEFINITIONS for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`${kind} has valid definition with storage, context, plural, purpose, requiredSpec`, () => {
+      const def = RESOURCE_DEFINITIONS[kind];
+      assert.ok(def, `${kind} should exist in RESOURCE_DEFINITIONS`);
+      assert.ok(['etcd', 'postgres'].includes(def.storage), `${kind} storage should be etcd or postgres`);
+      assert.ok(typeof def.context === 'string' && def.context.length > 0, `${kind} context should be a non-empty string`);
+      assert.ok(typeof def.plural === 'string' && def.plural.length > 0, `${kind} plural should be a non-empty string`);
+      assert.ok(typeof def.purpose === 'string' && def.purpose.length > 0, `${kind} purpose should be a non-empty string`);
+      assert.ok(Array.isArray(def.requiredSpec) && def.requiredSpec.length > 0, `${kind} requiredSpec should be a non-empty array`);
+    });
+  }
+});
+
+describe('createResource for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`creates a valid ${kind} resource`, () => {
+      const spec = minimalSpecForKind(kind);
+      const resource = createResource(kind, { name: `test-${kind.toLowerCase()}` }, spec);
+      assert.equal(resource.apiVersion, 'krate.a5c.ai/v1alpha1');
+      assert.equal(resource.kind, kind);
+      assert.equal(resource.metadata.name, `test-${kind.toLowerCase()}`);
+      assert.equal(resource.metadata.namespace, 'default');
+      assert.ok(resource.metadata.labels !== undefined);
+      assert.ok(resource.metadata.annotations !== undefined);
+      assert.ok(typeof resource.spec === 'object');
+      assert.ok(typeof resource.status === 'object');
+    });
+  }
+});
+
+describe('validateResource rejects missing required spec fields for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`throws on empty spec for ${kind}`, () => {
+      const resource = {
+        apiVersion: 'krate.a5c.ai/v1alpha1',
+        kind,
+        metadata: { name: `invalid-${kind.toLowerCase()}` },
+        spec: {},
+        status: {}
+      };
+      const def = RESOURCE_DEFINITIONS[kind];
+      assert.throws(
+        () => validateResource(resource),
+        (err) => {
+          assert.ok(err.message.includes(`${kind} spec.${def.requiredSpec[0]} is required`));
+          return true;
+        }
+      );
+    });
+  }
+});
+
+describe('resourceSchemaForKind for agent kinds', () => {
+  for (const kind of ALL_AGENT_KINDS) {
+    it(`returns correct schema for ${kind}`, () => {
+      const schema = resourceSchemaForKind(kind);
+      assert.equal(schema.apiVersion, 'krate.a5c.ai/v1alpha1');
+      assert.equal(schema.kind, kind);
+      assert.ok(typeof schema.plural === 'string');
+      assert.ok(['etcd', 'postgres'].includes(schema.storage));
+      assert.ok(Array.isArray(schema.required.metadata));
+      assert.ok(schema.required.metadata.includes('name'));
+      assert.ok(Array.isArray(schema.required.spec));
+      assert.ok(schema.required.spec.length > 0);
+      assert.deepEqual(schema.status, ['storage', 'phase', 'conditions']);
+    });
+  }
+});
+
+describe('storageClassForKind for agent kinds', () => {
+  for (const kind of AGENT_CONFIG_KINDS) {
+    it(`${kind} returns etcd`, () => {
+      assert.equal(storageClassForKind(kind), 'etcd');
+    });
+  }
+
+  for (const kind of AGENT_AGGREGATED_KINDS) {
+    it(`${kind} returns postgres`, () => {
+      assert.equal(storageClassForKind(kind), 'postgres');
+    });
+  }
+});
+
+describe('kind set counts', () => {
+  it('CONFIG_KINDS has 37 members', () => {
+    assert.equal(CONFIG_KINDS.size, 37);
+  });
+
+  it('AGGREGATED_KINDS has 20 members', () => {
+    assert.equal(AGGREGATED_KINDS.size, 20);
+  });
+
+  it('ALL_KINDS has 57 members', () => {
+    assert.equal(ALL_KINDS.size, 57);
+  });
+
+  it('listResourceDefinitions returns 57 definitions', () => {
+    assert.equal(listResourceDefinitions().length, 57);
+  });
+});