@bluefly/openstandardagents 0.3.0 → 0.3.2

package/spec/v0.3.2/examples/drupal-moderation-assistant.ossa.yaml

@@ -0,0 +1,96 @@
+apiVersion: ossa/v0.3.2
+kind: Agent
+metadata:
+  name: drupal-moderation-assistant
+  version: 1.0.0
+  description: Content moderation assistant that helps users review and publish content
+
+spec:
+  capabilities:
+    - name: content.review
+      description: "Review content for quality, SEO, and compliance"
+    - name: moderation.suggest
+      description: "Suggest moderation workflow transitions"
+    - name: quality.score
+      description: "Score content quality based on criteria"
+
+  role: |
+    You are a content moderation assistant helping editors review and publish content.
+    You work within the user's permission context and respect Drupal's editorial workflow.
+
+    Responsibilities:
+    1. Review content for quality, readability, and SEO
+    2. Check content against style guide and compliance rules
+    3. Suggest appropriate moderation state transitions
+    4. Provide actionable feedback for improvement
+
+    You can only suggest transitions the user is authorized to perform.
+
+  llm:
+    provider: ${OSSA_LLM_PROVIDER:-anthropic}
+    model: ${OSSA_LLM_MODEL:-claude-sonnet-4}
+    temperature: ${OSSA_LLM_TEMPERATURE:-0.3}
+    maxTokens: ${OSSA_LLM_MAX_TOKENS:-4096}
+
+  tools:
+    - name: drupal.node.load
+      description: "Load a Drupal node for review"
+      handler:
+        runtime: drupal
+        capability: node.load
+
+    - name: drupal.moderation.transitions
+      description: "Get available moderation transitions for user"
+      handler:
+        runtime: drupal
+        capability: moderation.get_transitions
+
+    - name: drupal.moderation.apply
+      description: "Apply moderation state transition"
+      handler:
+        runtime: drupal
+        capability: moderation.apply_transition
+
+extensions:
+  drupal:
+    # Module providing this agent
+    module: ai_agents_ossa
+
+    # Store as config entity for export
+    config_entity: true
+
+    # Permissions for user-context execution
+    permissions:
+      # Required entity permissions
+      entity_permissions:
+        - "view any article content"
+        - "edit any article content"
+        - "use editorial transition review"
+        - "use editorial transition publish"
+
+      # Custom agent permission
+      custom_permissions:
+        - "use moderation assistant"
+
+      # Run in user context (no service account)
+      # execution_user not specified - uses current user
+
+      # User must have ALL required permissions (intersection)
+      permission_mode: least_permissive
+
+    # Synchronous execution (no queue)
+    messenger:
+      transport: sync
+
+    # Integrated with ECA workflow builder
+    workflow_engine: eca
+
+    # Discovery from module
+    discovery_paths:
+      - "modules/custom/ai_agents_ossa/agents/*.ossa.yaml"
+
+    # Hooks for tracking and logging
+    hooks:
+      before_execute: ai_agents_ossa_log_execution
+      after_execute: ai_agents_ossa_track_moderation
+      on_error: ai_agents_ossa_alert_admin

package/spec/v0.3.2/examples/multi-provider-identity.ossa.yaml

@@ -0,0 +1,236 @@
+# OSSA v0.3.1 Multi-Provider Identity Configuration
+# Enterprise-grade agent with fallback identity chain and compliance
+apiVersion: ossa/v0.3.2
+kind: Agent
+metadata:
+  name: enterprise-deployer
+  version: 2.0.0
+  description: Enterprise deployment agent with multi-provider identity and compliance
+  labels:
+    team: platform
+    tier: production
+    compliance: soc2
+  annotations:
+    security.ossa.io/audit-level: high
+    security.ossa.io/mfa-required: "true"
+spec:
+  role: |
+    You are an enterprise deployment orchestrator responsible for managing
+    production deployments across multiple cloud providers and git platforms.
+    You must ensure all operations are auditable, compliant, and follow
+    the principle of least privilege.
+
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0.1
+    max_tokens: 16000
+
+  # Comprehensive Identity Configuration
+  identity:
+    # Primary: GitLab self-hosted
+    provider: gitlab
+    service_account:
+      id: 31840535
+      username: bot-ci-local
+      email: bot-ci-local@bluefly.io
+      display_name: CI/CD Bot
+      roles:
+        - maintainer
+
+    # Authentication with rotation policy
+    authentication:
+      method: project_access_token
+      scopes:
+        - api
+        - read_repository
+        - write_repository
+        - read_registry
+        - write_registry
+      auto_refresh: true
+      expiry_warning_days: 14
+      rotation_policy:
+        enabled: true
+        interval_days: 90
+        notify_on_rotation: true
+
+    # Multi-source token configuration
+    token_source:
+      env_var: GITLAB_BOT_CI_TOKEN
+      file_path: ~/.tokens/bot-ci-local
+      vault:
+        path: secret/data/ci/gitlab-token
+        key: token
+        role: ci-agent
+      kubernetes_secret:
+        name: gitlab-ci-token
+        namespace: ci-cd
+        key: token
+
+    # Auto-detection patterns
+    patterns:
+      - "*/gitlab_components"
+      - "*/infrastructure/*"
+      - "**/deploy/**"
+      - "**/ci-cd/**"
+
+    # Fallback identity chain for high availability
+    fallback:
+      - provider: github
+        service_account:
+          username: enterprise-ci-bot
+          email: ci-bot@enterprise.com
+        token_source:
+          env_var: GITHUB_CI_TOKEN
+          vault:
+            path: secret/data/ci/github-token
+        condition:
+          platform_unavailable: true
+
+      - provider: azure-devops
+        service_account:
+          username: ado-ci-service
+          email: ci-service@enterprise.onmicrosoft.com
+        token_source:
+          azure_key_vault:
+            vault_url: https://enterprise-vault.vault.azure.net
+            secret_name: ado-ci-token
+        condition:
+          pattern_match:
+            - "**/azure/**"
+
+    # Full DORA metrics tracking
+    dora_tracking:
+      enabled: true
+      metrics:
+        - deployment_frequency
+        - lead_time
+        - change_failure_rate
+        - mttr
+      labels:
+        environment: production
+        team: platform
+        cost_center: engineering
+      prometheus:
+        push_gateway: http://prometheus-pushgateway:9091
+        job_name: enterprise-deployer
+      classifications:
+        deployment_frequency:
+          elite: multiple_per_day
+          high: daily
+          medium: weekly
+          low: monthly
+        lead_time:
+          elite: "1"
+          high: "24"
+          medium: "168"
+          low: "720"
+
+    # Claude Code session integration
+    session:
+      init_on_start: true
+      propagate_to_subprocesses: true
+      git_attribution: true
+      heartbeat_interval: 60
+      timeout: 7200
+      hooks:
+        pre_prompt_submit: true
+        post_session: true
+
+    # OpenTelemetry observability
+    observability:
+      service_name: enterprise-deployer
+      service_namespace: production
+      service_version: "2.0.0"
+      service_instance_id: ${HOSTNAME}
+      resource_attributes:
+        deployment.environment: production
+        cloud.provider: multi
+
+    # Enterprise compliance
+    compliance:
+      require_mfa: true
+      ip_allowlist:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+      audit_logging: required
+      data_residency: us-east-1
+      frameworks:
+        - SOC2
+        - ISO27001
+
+    # Security policies
+    security:
+      token_encryption: both
+      minimum_token_length: 40
+      prohibited_actions:
+        - delete_production_branch
+        - disable_branch_protection
+        - modify_security_policies
+      required_approvals:
+        force_push: true
+        delete_protected_branch: true
+        modify_ci_config: true
+      rate_limits:
+        requests_per_minute: 100
+        requests_per_hour: 2000
+        git_operations_per_hour: 200
+
+  # Tool configuration
+  tools:
+    - name: kubernetes
+      type: mcp
+      config:
+        server: kubernetes-mcp-server
+        allowed_namespaces:
+          - production
+          - staging
+    - name: terraform
+      type: mcp
+      config:
+        server: terraform-mcp-server
+        workspace: production
+    - name: git
+      type: mcp
+      config:
+        server: git-mcp-server
+
+  # Strict autonomy controls
+  autonomy:
+    level: semi-autonomous
+    require_approval:
+      - deploy_to_production
+      - rollback_deployment
+      - scale_down_replicas
+      - modify_secrets
+    approval_timeout: 3600
+    escalation:
+      enabled: true
+      timeout: 1800
+      channels:
+        - slack://platform-oncall
+        - pagerduty://platform-critical
+
+  # Comprehensive safety configuration
+  safety:
+    max_tokens_per_turn: 16000
+    rate_limits:
+      requests_per_minute: 30
+      max_concurrent_requests: 5
+    circuit_breaker:
+      enabled: true
+      failure_threshold: 5
+      recovery_timeout: 300
+    kill_switch:
+      enabled: true
+      trigger_conditions:
+        - error_rate > 0.5
+        - latency_p99 > 30000
+      recovery_requires_approval: true
+
+  # State management
+  state:
+    storage: redis
+    ttl: 86400
+    encryption: aes-256-gcm

package/spec/v0.3.2/examples/quick-wins/complete-agent-with-quick-wins.ossa.yaml

@@ -0,0 +1,144 @@
+apiVersion: ossa/v0.3.2
+kind: Agent
+metadata:
+  name: example-agent-quick-wins
+  namespace: production
+  labels:
+    app: example
+    version: v1.0.0
+spec:
+  role: "Example agent demonstrating all quick-win capabilities"
+  
+  # 1. Health Monitoring Configuration
+  health:
+    enabled: true
+    endpoints:
+      health: /health
+      ready: /ready
+      live: /live
+    interval_seconds: 30
+    timeout_seconds: 5
+    restart_policy:
+      enabled: true
+      max_restarts: 3
+      restart_delay_seconds: 10
+  
+  # 2. Secrets Management
+  secrets:
+    provider: gitlab_vault
+    injection:
+      method: env_vars
+      prefix: AGENT_SECRET_
+    rotation:
+      enabled: true
+      interval_days: 90
+      auto_rotate: false
+    encryption:
+      enabled: true
+      algorithm: aes-256-gcm
+    audit:
+      enabled: true
+      log_access: true
+  
+  # 3. LLM Configuration with Circuit Breaker (via retry)
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4
+    profile: balanced
+    retry:
+      max_attempts: 3
+      backoff:
+        strategy: exponential
+        initial_delay_ms: 1000
+        max_delay_ms: 30000
+      circuit_breaker:
+        enabled: true
+        failure_threshold: 5
+        timeout_ms: 60000
+        half_open_max_calls: 3
+        success_threshold: 2
+  
+  # 4. Error Handling with Aggregation
+  error_handling:
+    strategy: fail_fast
+    aggregation:
+      enabled: true
+      window_seconds: 300
+      threshold: 10
+      alert_channels:
+        - slack
+        - pagerduty
+      categorization:
+        enabled: true
+        categories:
+          - timeout
+          - rate_limit
+          - validation
+  
+  # 5. State Management with Versioning & Conflict Resolution
+  state:
+    mode: long_running
+    storage:
+      type: kv
+      config:
+        provider: redis
+        endpoint: redis://localhost:6379
+    versioning:
+      enabled: true
+      strategy: optimistic_locking
+    conflict_resolution:
+      strategy: merge_on_conflict
+      merge_on_conflict: true
+    persistence:
+      enabled: true
+      backup_interval_seconds: 300
+      restore_on_startup: true
+  
+  # 6. Security Boundaries
+  safety:
+    content_filtering:
+      enabled: true
+    security_boundaries:
+      network_policies:
+        enabled: true
+        allowed_agents:
+          - agent-a
+          - agent-b
+      rbac:
+        enabled: true
+        roles:
+          - reader
+          - writer
+      mtls:
+        enabled: true
+        ca_cert: env:CA_CERT
+      audit_logging:
+        enabled: true
+        retention_days: 90
+  
+  # 7. Rollback Configuration
+  rollback:
+    triggers:
+      - health_check_failure
+      - error_rate_threshold
+      - cost_exceeded
+    automation:
+      enabled: true
+      approval_required: false
+      notification_channels:
+        - slack
+        - email
+  
+  # 8. Testing Configuration (Optional)
+  testing:
+    framework: jest
+    mock_llm:
+      enabled: true
+      provider: local_mock
+      responses_file: tests/fixtures/mock-llm-responses.json
+    coverage:
+      threshold: 80
+      enforce: true
+    test_data:
+      management: fixtures
+      fixtures_path: tests/fixtures/

package/spec/v0.3.2/examples/tasks/data-transform.ossa.yaml

@@ -0,0 +1,147 @@
+# ============================================================================
+# OSSA Task: Data Transformation
+# ============================================================================
+# Idempotent data transformation task - safe to retry, deterministic output
+# Demonstrates batch processing and multiple runtime bindings
+#
+# @see https://openstandardagents.org/spec/v0.3.2/task
+# ============================================================================
+
+apiVersion: ossa/v0.3.2
+kind: Task
+metadata:
+  name: transform-csv-to-json
+  version: 1.0.0
+  labels:
+    domain: data-engineering
+    tier: tier_1_read
+  annotations:
+    ossa.io/description: "Transform CSV data to structured JSON"
+    ossa.io/category: "data-transformation"
+    ossa.io/idempotent: "true"
+
+spec:
+  execution:
+    type: idempotent     # safe to retry without side effects
+    runtime: any         # works on any runtime
+    entrypoint: "transform"
+    timeout_seconds: 300
+
+  capabilities:
+    - read_file
+    - parse_csv
+    - write_json
+    - validate_schema
+
+  input:
+    type: object
+    required:
+      - source_path
+      - target_path
+      - schema
+    properties:
+      source_path:
+        type: string
+        description: "Path to source CSV file"
+      target_path:
+        type: string
+        description: "Path to output JSON file"
+      schema:
+        type: object
+        description: "JSON Schema for validation"
+        properties:
+          columns:
+            type: array
+            items:
+              type: object
+              properties:
+                name:
+                  type: string
+                type:
+                  type: string
+                  enum: [string, integer, number, boolean, date]
+                required:
+                  type: boolean
+      options:
+        type: object
+        properties:
+          delimiter:
+            type: string
+            default: ","
+          skip_header:
+            type: boolean
+            default: true
+          null_value:
+            type: string
+            default: ""
+          batch_size:
+            type: integer
+            default: 1000
+
+  output:
+    type: object
+    required:
+      - success
+      - records_processed
+    properties:
+      success:
+        type: boolean
+      records_processed:
+        type: integer
+        minimum: 0
+      records_failed:
+        type: integer
+        minimum: 0
+      output_path:
+        type: string
+      checksum:
+        type: string
+        description: "SHA256 of output file"
+      processing_time_ms:
+        type: integer
+
+  batch:
+    enabled: true
+    parallelism: 10
+    retry: 3
+    backoff_seconds: 5
+
+  error_handling:
+    on_failure: continue  # process remaining rows even if some fail
+    retryable_errors:
+      - IO_ERROR
+      - MEMORY_LIMIT
+    fatal_errors:
+      - SCHEMA_MISMATCH
+      - INVALID_FORMAT
+
+runtime:
+  python:
+    read_file:
+      module: "pathlib"
+      class: "Path"
+      method: "read_text"
+    parse_csv:
+      module: "csv"
+      function: "DictReader"
+    write_json:
+      module: "json"
+      function: "dump"
+    validate_schema:
+      module: "jsonschema"
+      function: "validate"
+
+  node:
+    read_file:
+      module: "fs/promises"
+      function: "readFile"
+    parse_csv:
+      module: "csv-parse"
+      function: "parse"
+    write_json:
+      module: "fs/promises"
+      function: "writeFile"
+    validate_schema:
+      module: "ajv"
+      class: "Ajv"
+      method: "validate"