@bluefly/openstandardagents 0.2.8 → 0.3.0

package/examples/messaging/routing-rules.ossa.yaml

@@ -0,0 +1,307 @@
+# OSSA v0.3.0 Example: Message Routing Configuration
+#
+# This MessageRouting resource defines how messages flow between agents
+# in a multi-agent security system. It implements the routing rules
+# for the security-scanner, dependency-healer, and incident-responder agents.
+
+apiVersion: ossa/v0.3.0
+kind: MessageRouting
+metadata:
+  name: security-workflow-routing
+  version: 1.0.0
+  description: Message routing rules for the security agent workflow
+  labels:
+    domain: security
+    workflow: vulnerability-management
+  annotations:
+    ossa.openstandardagents.org/category: routing
+    ossa.openstandardagents.org/environment: production
+
+spec:
+  # Routing rules define message flow between agents
+  rules:
+    # Rule 1: Route vulnerability findings to incident responder (critical only)
+    - id: vuln-to-incident-critical
+      source: security-scanner
+      channel: security.vulnerabilities
+      targets:
+        - incident-responder
+      filter:
+        fields:
+          severity: [critical]
+        expression: "${{ message.exploit_available == true }}"
+      priority: critical
+      enabled: true
+
+    # Rule 2: Route all high/critical vulnerabilities to monitoring
+    - id: vuln-to-monitoring
+      source: security-scanner
+      channel: security.vulnerabilities
+      targets:
+        - monitoring-agent
+        - compliance-auditor
+      filter:
+        fields:
+          severity: [high, critical]
+      priority: high
+      enabled: true
+
+    # Rule 3: Route dependency updates to security scanner for scanning
+    - id: deps-to-scanner
+      source: dependency-healer
+      channel: dependency.updates
+      targets:
+        - security-scanner
+      filter:
+        fields:
+          security_related: [true]
+          severity: [high, critical]
+      transform: extract_package_info
+      priority: high
+      enabled: true
+
+    # Rule 4: Route all dependency updates to changelog analyzer
+    - id: deps-to-analyzer
+      source: dependency-healer
+      channel: dependency.updates
+      targets:
+        - changelog-analyzer
+      filter:
+        fields:
+          update_type: [major]
+      priority: normal
+      enabled: true
+
+    # Rule 5: Route incident notifications to notification service
+    - id: incident-to-notifications
+      source: incident-responder
+      channel: incident.response.triggered
+      targets:
+        - notification-service
+        - audit-logger
+      priority: critical
+      enabled: true
+
+    # Rule 6: Route incident resolutions for reporting
+    - id: incident-resolved-to-reports
+      source: incident-responder
+      channel: incident.resolved
+      targets:
+        - report-generator
+        - metrics-collector
+      priority: normal
+      enabled: true
+
+    # Rule 7: Wildcard route - all security.* to audit logger
+    - id: security-audit-all
+      source: "*"
+      channel: "security.*"
+      targets:
+        - audit-logger
+      priority: low
+      enabled: true
+
+    # Rule 8: Route scan completions back to dependency healer
+    - id: scan-complete-to-healer
+      source: security-scanner
+      channel: security.scan.completed
+      targets:
+        - dependency-healer
+      filter:
+        expression: "${{ message.summary.vulnerabilities_found > 0 }}"
+      priority: normal
+      enabled: true
+
+    # Rule 9: Route compliance violations to incident responder
+    - id: compliance-to-incident
+      source: compliance-auditor
+      channel: compliance.violation
+      targets:
+        - incident-responder
+      filter:
+        fields:
+          severity: [high, critical]
+      priority: high
+      enabled: true
+
+    # Rule 10: Dead letter handling - route DLQ to alert system
+    - id: dlq-to-alerts
+      source: "*"
+      channel: "*.dlq"
+      targets:
+        - alert-manager
+      priority: high
+      enabled: true
+
+  # Default routing when no rules match
+  defaultRoute:
+    action: dlq
+    targets: []
+
+  # Named message transformations
+  transforms:
+    # Extract minimal package info for security scanning
+    extract_package_info:
+      type: jmespath
+      expression: |
+        {
+          package: package,
+          version: available_version,
+          ecosystem: ecosystem,
+          security_related: security_related,
+          priority: severity
+        }
+      outputSchema:
+        type: object
+        properties:
+          package:
+            type: string
+          version:
+            type: string
+          ecosystem:
+            type: string
+          security_related:
+            type: boolean
+          priority:
+            type: string
+
+    # Extract critical fields for incident creation
+    extract_critical_fields:
+      type: jmespath
+      expression: |
+        {
+          id: vulnerability_id,
+          severity: severity,
+          cve: cve_id,
+          package: affected_package,
+          exploit: exploit_available,
+          remediation: remediation
+        }
+
+    # Anonymize sensitive data for logging
+    anonymize_for_audit:
+      type: jsonata
+      expression: |
+        $merge([
+          $,
+          {"payload": $sift(payload, function($v, $k) { $k != "credentials" and $k != "tokens" })}
+        ])
+
+    # Enrich with metadata for reporting
+    enrich_for_report:
+      type: template
+      expression: |
+        {
+          "original": {{ . | toJson }},
+          "enriched_at": "{{ now | date \"2006-01-02T15:04:05Z07:00\" }}",
+          "routing_rule": "{{ .routing_rule_id }}",
+          "source_agent": "{{ .source }}",
+          "target_agents": {{ .targets | toJson }}
+        }
+
+---
+# Additional MessageRouting for development/staging environment
+apiVersion: ossa/v0.3.0
+kind: MessageRouting
+metadata:
+  name: security-workflow-routing-dev
+  version: 1.0.0
+  description: Development environment routing with relaxed filters
+  labels:
+    domain: security
+    workflow: vulnerability-management
+    environment: development
+
+spec:
+  rules:
+    # In dev, route ALL vulnerabilities to incident responder for testing
+    - id: vuln-to-incident-all-dev
+      source: security-scanner
+      channel: security.vulnerabilities
+      targets:
+        - incident-responder
+      # No filter - all severities in dev
+      priority: normal
+      enabled: true
+
+    # Route to local monitoring instead of production
+    - id: vuln-to-local-monitor
+      source: security-scanner
+      channel: security.vulnerabilities
+      targets:
+        - local-monitoring
+      priority: low
+      enabled: true
+
+    # Disable audit logging in dev
+    - id: security-audit-all-dev
+      source: "*"
+      channel: "security.*"
+      targets:
+        - dev-logger
+      priority: low
+      enabled: false  # Disabled in dev
+
+  defaultRoute:
+    action: drop  # Drop unmatched in dev instead of DLQ
+
+  transforms:
+    # Add dev environment marker
+    mark_dev_environment:
+      type: jmespath
+      expression: |
+        merge(@, {environment: 'development', is_test: true})
+
+---
+# MessageRouting for high-availability setup with multiple targets
+apiVersion: ossa/v0.3.0
+kind: MessageRouting
+metadata:
+  name: security-workflow-routing-ha
+  version: 1.0.0
+  description: High-availability routing with failover targets
+  labels:
+    domain: security
+    workflow: vulnerability-management
+    availability: high
+
+spec:
+  rules:
+    # Primary route with failover
+    - id: vuln-to-incident-ha
+      source: security-scanner
+      channel: security.vulnerabilities
+      targets:
+        - incident-responder-primary
+        - incident-responder-secondary  # Failover
+      filter:
+        fields:
+          severity: [critical]
+      priority: critical
+      enabled: true
+
+    # Geographic routing based on source
+    - id: vuln-to-regional-scanner-us
+      source: "dependency-healer-us-*"
+      channel: dependency.updates
+      targets:
+        - security-scanner-us-east
+        - security-scanner-us-west
+      priority: high
+      enabled: true
+
+    - id: vuln-to-regional-scanner-eu
+      source: "dependency-healer-eu-*"
+      channel: dependency.updates
+      targets:
+        - security-scanner-eu-west
+        - security-scanner-eu-central
+      priority: high
+      enabled: true
+
+  defaultRoute:
+    action: broadcast
+    targets:
+      - global-fallback-handler
+
+  transforms: {}

package/examples/messaging/security-scanner.ossa.yaml

@@ -0,0 +1,328 @@
+# OSSA v0.3.0 Example: Security Scanner Agent with Messaging
+#
+# This agent scans dependencies for vulnerabilities and publishes findings
+# to OSSA messaging channels. It also accepts commands for on-demand scans.
+
+apiVersion: ossa/v0.3.0
+kind: Agent
+metadata:
+  name: security-scanner
+  version: 1.0.0
+  description: Scans dependencies for security vulnerabilities and publishes findings
+  labels:
+    domain: security
+    tier: core
+  annotations:
+    ossa.openstandardagents.org/category: security
+    ossa.openstandardagents.org/compliance: SOC2,HIPAA
+
+spec:
+  role: |
+    You are a security vulnerability scanner. Your responsibilities:
+    1. Analyze software dependencies for known vulnerabilities (CVEs)
+    2. Assess severity and exploitability of findings
+    3. Provide actionable remediation guidance
+    4. Publish findings to security channels for downstream processing
+
+    When scanning packages:
+    - Check against NVD, OSV, and GitHub Advisory databases
+    - Consider CVSS scores for severity classification
+    - Identify if exploits are publicly available
+    - Suggest specific version upgrades when available
+
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0
+    maxTokens: 4096
+
+  tools:
+    - type: mcp
+      name: nvd-database
+      capabilities:
+        - name: search_cve
+          description: Search NVD for CVE information
+          input_schema:
+            type: object
+            properties:
+              cve_id:
+                type: string
+                description: CVE identifier (e.g., CVE-2024-1234)
+        - name: check_package
+          description: Check package for known vulnerabilities
+          input_schema:
+            type: object
+            properties:
+              package:
+                type: string
+              version:
+                type: string
+              ecosystem:
+                type: string
+                enum: [npm, pypi, maven, go, rubygems]
+
+  messaging:
+    # Channels this agent publishes to
+    publishes:
+      - channel: security.vulnerabilities
+        description: Vulnerability findings from security scans
+        schema:
+          type: object
+          required:
+            - vulnerability_id
+            - severity
+            - affected_package
+          properties:
+            vulnerability_id:
+              type: string
+              description: Unique vulnerability identifier
+            severity:
+              type: string
+              enum: [low, medium, high, critical]
+              description: Severity rating based on CVSS
+            cve_id:
+              type: string
+              pattern: ^CVE-\d{4}-\d+$
+              description: CVE identifier if available
+            cvss_score:
+              type: number
+              minimum: 0
+              maximum: 10
+              description: CVSS v3.1 score
+            affected_package:
+              type: string
+              description: Package name and version affected
+            vulnerable_versions:
+              type: string
+              description: Version range affected (semver)
+            fixed_version:
+              type: string
+              description: Minimum version that fixes the vulnerability
+            remediation:
+              type: string
+              description: Recommended remediation steps
+            exploit_available:
+              type: boolean
+              description: Whether public exploits exist
+            references:
+              type: array
+              items:
+                type: string
+                format: uri
+              description: Reference URLs for more information
+        examples:
+          - vulnerability_id: "vuln-2024-001"
+            severity: "critical"
+            cve_id: "CVE-2024-1234"
+            cvss_score: 9.8
+            affected_package: "lodash@4.17.20"
+            vulnerable_versions: "<4.17.21"
+            fixed_version: "4.17.21"
+            remediation: "Update lodash to version 4.17.21 or later"
+            exploit_available: true
+            references:
+              - "https://nvd.nist.gov/vuln/detail/CVE-2024-1234"
+              - "https://github.com/advisories/GHSA-xxxx-xxxx-xxxx"
+
+      - channel: security.scan.completed
+        description: Notification when a security scan completes
+        schema:
+          type: object
+          required:
+            - scan_id
+            - status
+            - summary
+          properties:
+            scan_id:
+              type: string
+            status:
+              type: string
+              enum: [success, failed, partial]
+            target:
+              type: string
+              description: What was scanned (repo, package, etc.)
+            summary:
+              type: object
+              properties:
+                total_packages:
+                  type: integer
+                vulnerabilities_found:
+                  type: integer
+                critical:
+                  type: integer
+                high:
+                  type: integer
+                medium:
+                  type: integer
+                low:
+                  type: integer
+            duration_ms:
+              type: integer
+        examples:
+          - scan_id: "scan-abc123"
+            status: "success"
+            target: "lodash@4.17.20"
+            summary:
+              total_packages: 1
+              vulnerabilities_found: 3
+              critical: 1
+              high: 1
+              medium: 1
+              low: 0
+            duration_ms: 2500
+
+    # Channels this agent subscribes to
+    subscribes:
+      - channel: dependency.updates
+        description: Notifications about dependency changes that need scanning
+        handler: process_dependency_update
+        filter:
+          expression: "${{ message.change_type in ['added', 'updated'] }}"
+        priority: high
+        maxConcurrency: 10
+
+      - channel: security.scan.requested
+        description: Manual scan requests from other agents or users
+        handler: process_scan_request
+        priority: normal
+        maxConcurrency: 5
+
+    # Commands this agent accepts (RPC-style)
+    commands:
+      - name: scan_package
+        description: Scan a specific package for vulnerabilities
+        inputSchema:
+          type: object
+          required:
+            - package_name
+          properties:
+            package_name:
+              type: string
+              description: Package name to scan
+            version:
+              type: string
+              description: Specific version (latest if not specified)
+            ecosystem:
+              type: string
+              enum: [npm, pypi, maven, go, rubygems]
+              default: npm
+            include_transitive:
+              type: boolean
+              default: true
+              description: Include transitive dependencies
+        outputSchema:
+          type: object
+          properties:
+            scan_id:
+              type: string
+            vulnerabilities:
+              type: array
+              items:
+                $ref: "#/spec/messaging/publishes/0/schema"
+            scan_status:
+              type: string
+              enum: [success, failed, partial]
+            scanned_at:
+              type: string
+              format: date-time
+        timeoutSeconds: 120
+        idempotent: true
+
+      - name: get_cve_details
+        description: Get detailed information about a specific CVE
+        inputSchema:
+          type: object
+          required:
+            - cve_id
+          properties:
+            cve_id:
+              type: string
+              pattern: ^CVE-\d{4}-\d+$
+        outputSchema:
+          type: object
+          properties:
+            cve_id:
+              type: string
+            description:
+              type: string
+            cvss:
+              type: object
+              properties:
+                version:
+                  type: string
+                score:
+                  type: number
+                vector:
+                  type: string
+            affected_products:
+              type: array
+              items:
+                type: object
+            references:
+              type: array
+              items:
+                type: string
+        timeoutSeconds: 30
+        idempotent: true
+
+    # Reliability configuration
+    reliability:
+      deliveryGuarantee: at-least-once
+      retry:
+        maxAttempts: 3
+        backoff:
+          strategy: exponential
+          initialDelayMs: 1000
+          maxDelayMs: 30000
+          multiplier: 2
+      dlq:
+        enabled: true
+        channel: security.dlq
+        retentionDays: 30
+      ordering:
+        guarantee: per-source
+        timeoutSeconds: 300
+      acknowledgment:
+        mode: manual
+        timeoutSeconds: 60
+
+  autonomy:
+    level: autonomous
+    approval_required: false
+    allowed_actions:
+      - scan_dependencies
+      - query_vulnerability_databases
+      - publish_findings
+    blocked_actions:
+      - modify_code
+      - deploy_patches
+
+  constraints:
+    cost:
+      maxTokensPerDay: 100000
+      maxTokensPerRequest: 8000
+    performance:
+      maxLatencySeconds: 30
+      maxConcurrentRequests: 20
+      timeoutSeconds: 120
+
+  observability:
+    tracing:
+      enabled: true
+      exporter: otlp
+    metrics:
+      enabled: true
+      exporter: prometheus
+    logging:
+      level: info
+      format: json
+
+  safety:
+    content_filtering:
+      enabled: true
+      categories:
+        - malicious_code
+        - sensitive_data
+    guardrails:
+      enabled: true
+      max_tool_calls: 50

package/examples/migration-guides/from-langchain-to-ossa.yaml

@@ -50,7 +50,7 @@
 # OSSA MANIFEST (After):
 # ----------------------------------------------------------------------------
 
-apiVersion: ossa/v0.2.8
+apiVersion: ossa/v0.3.0
 kind: Agent
 
 metadata:
@@ -117,7 +117,7 @@ spec:
 # ----------------------------------------------------------------------------
 
 ---
-apiVersion: ossa/v0.2.8
+apiVersion: ossa/v0.3.0
 kind: Agent
 
 metadata:
@@ -185,7 +185,7 @@ spec:
 # ----------------------------------------------------------------------------
 
 ---
-apiVersion: ossa/v0.2.8
+apiVersion: ossa/v0.3.0
 kind: Agent
 
 metadata:
@@ -215,7 +215,7 @@ spec:
       endpoint: https://api.academic.com/search
 
 ---
-apiVersion: ossa/v0.2.8
+apiVersion: ossa/v0.3.0
 kind: Agent
 
 metadata: