@bluefly/openstandardagents 0.3.1 → 0.3.3

package/dist/spec/v0.3.2/examples/access-tiers/compliance-governor.ossa.yaml

@@ -0,0 +1,216 @@
+apiVersion: ossa/v0.3.3
+kind: Agent
+metadata:
+  name: compliance-governor
+  version: 1.0.0
+  description: Compliance policy governor - defines policies, cannot execute
+  labels:
+    team: security
+    access_tier: tier_4_policy
+    domain: security
+  annotations:
+    ossa.io/migration: v0.3.3-to-v0.3.3
+    ossa.io/migrated-date: 2026-01-07
+spec:
+  type: governor
+  role: |
+    You are a compliance governance agent responsible for defining and
+    publishing security and compliance policies. You monitor policy adherence
+    and report violations.
+
+    CRITICAL ISOLATION RULES:
+    - You CANNOT execute remediation actions directly
+    - You CANNOT modify code or infrastructure
+    - You MUST delegate execution to tier_3_write_elevated operators
+    - You define WHAT should happen, not HOW to do it
+
+    Your role is legislative, not executive. You define the rules;
+    operators enforce them.
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0
+    profile: safe
+  taxonomy:
+    domain: security
+    subdomain: compliance
+    capability: define_policies
+    concerns:
+      - governance
+      - quality
+      - reliability
+  access:
+    tier: tier_4_policy
+    permissions:
+      - read_code
+      - read_configs
+      - read_metrics
+      - read_logs
+      - read_issues
+      - read_mrs
+      - define_policies
+      - publish_policies
+      - audit_compliance
+      - report_violations
+    prohibited:
+      - execute_*
+      - write_code
+      - modify_infrastructure
+      - remediate_direct
+      - deploy
+      - merge_mrs
+    audit_level: comprehensive
+    requires_approval: false
+    isolation: strict
+  separation:
+    role: governor
+    conflicts_with:
+      - operator
+      - executor
+      - deployer
+      - remediator
+      - enforcer
+    can_delegate_to:
+      - operator
+    prohibited_actions:
+      - execute
+      - deploy
+      - merge
+      - modify_production
+  delegation:
+    enabled: true
+    allowed_tiers:
+      - tier_3_write_elevated
+    allowed_operations:
+      - remediate_violations
+      - apply_policies
+      - execute_fixes
+    requires:
+      - delegation_token
+      - audit_trail
+      - violation_report
+      - approval
+  tools:
+    - name: policy-reader
+      type: mcp
+      config:
+        server: policy-mcp-server
+        read_only: true
+    - name: compliance-api
+      type: api
+      config:
+        endpoint: https://api.compliance.local
+        methods:
+          - GET
+          - POST
+    - name: audit-logger
+      type: mcp
+      config:
+        server: audit-mcp-server
+  autonomy:
+    level: autonomous
+    allowed_actions:
+      - define_policy
+      - publish_policy
+      - audit_compliance
+      - generate_violation_report
+      - delegate_remediation
+    blocked_actions:
+      - execute_any_modification
+      - deploy
+      - merge
+      - modify_infrastructure
+      - remediate_directly
+  compliance:
+    frameworks:
+      - SOC2
+      - ISO27001
+      - GDPR
+    audit_logging: required
+    pii_handling: redact
+  safety:
+    guardrails:
+      enabled: true
+      max_tool_calls: 20
+      max_execution_time_seconds: 600
+      policies:
+        - no_execution
+        - delegation_only
+        - audit_all_actions
+  observability:
+    tracing:
+      enabled: true
+      exporter: otlp
+    metrics:
+      enabled: true
+      customMetrics:
+        - name: policies_defined
+          type: counter
+          description: Total policies defined
+        - name: violations_detected
+          type: counter
+          description: Compliance violations detected
+        - name: delegations_issued
+          type: counter
+          description: Remediation delegations to operators
+    logging:
+      level: info
+      format: json
+  messaging:
+    publishes:
+      - channel: governance.policies
+        description: Published compliance policies
+        schema:
+          type: object
+          properties:
+            policy_id:
+              type: string
+            version:
+              type: string
+            effective_date:
+              type: string
+              format: date
+      - channel: governance.violations
+        description: Detected policy violations for remediation
+        schema:
+          type: object
+          properties:
+            violation_id:
+              type: string
+            policy_id:
+              type: string
+            severity:
+              type: string
+              enum:
+                - critical
+                - high
+                - medium
+                - low
+            remediation_required:
+              type: boolean
+            delegate_to:
+              type: string
+              description: Target operator agent for remediation
+    commands:
+      - name: audit_project
+        description: Run compliance audit on a project
+        inputSchema:
+          type: object
+          properties:
+            project_id:
+              type: string
+            frameworks:
+              type: array
+              items:
+                type: string
+          required:
+            - project_id
+        outputSchema:
+          type: object
+          properties:
+            compliant:
+              type: boolean
+            violations:
+              type: array
+            recommendations:
+              type: array

package/dist/spec/v0.3.2/examples/access-tiers/deployment-operator.ossa.yaml

@@ -0,0 +1,183 @@
+apiVersion: ossa/v0.3.3
+kind: Agent
+metadata:
+  name: deployment-operator
+  version: 1.0.0
+  description: Deployment operator agent with elevated write access
+  labels:
+    team: platform
+    access_tier: tier_3_write_elevated
+    domain: infrastructure
+  annotations:
+    ossa.io/migration: v0.3.3-to-v0.3.3
+    ossa.io/migrated-date: 2026-01-07
+spec:
+  type: operator
+  role: |
+    You are a deployment operator that manages CI/CD pipelines, deployments,
+    and infrastructure changes. You have elevated access to production systems
+    but all changes require approval through the defined approval chain.
+
+    CRITICAL: Never bypass approval processes. Never delete production data.
+    Always ensure rollback plans exist before deployment.
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0.1
+    profile: safe
+  taxonomy:
+    domain: infrastructure
+    subdomain: deployment
+    capability: execute_deployments
+    concerns:
+      - reliability
+      - observability
+      - performance
+  access:
+    tier: tier_3_write_elevated
+    permissions:
+      - read_code
+      - read_configs
+      - read_metrics
+      - read_logs
+      - execute_deployments
+      - modify_pipelines
+      - merge_mrs
+      - modify_configs
+      - execute_commands
+    prohibited:
+      - delete_production
+      - modify_secrets_direct
+      - bypass_approvals
+      - force_push
+    audit_level: detailed
+    requires_approval: true
+    approval_chain: elevated
+  separation:
+    role: deployer
+    conflicts_with:
+      - governor
+      - policy_definer
+      - critic
+    can_delegate_to:
+      - worker
+      - analyzer
+  delegation:
+    enabled: true
+    allowed_tiers:
+      - tier_1_read
+      - tier_2_write_limited
+    allowed_operations:
+      - gather_information
+      - run_analysis
+      - generate_reports
+      - write_docs
+    requires:
+      - task_specification
+      - audit_trail
+  tools:
+    - name: kubernetes
+      type: kubernetes
+      config:
+        namespace: production
+        rbac_required: true
+    - name: gitlab-ci
+      type: api
+      config:
+        endpoint: https://gitlab.com/api/v4
+        scopes:
+          - api
+          - write_repository
+    - name: deployment-monitor
+      type: mcp
+      config:
+        server: monitoring-mcp-server
+  autonomy:
+    level: supervised
+    approval_required:
+      - deploy_to_production
+      - modify_infrastructure
+      - delete_resources
+    allowed_actions:
+      - deploy_to_staging
+      - run_tests
+      - view_metrics
+    escalation_policy:
+      triggers:
+        - deployment_failure
+        - rollback_required
+        - security_alert
+      notify:
+        - slack:#platform-alerts
+        - gitlab:@platform-team
+  safety:
+    guardrails:
+      enabled: true
+      max_tool_calls: 50
+      max_execution_time_seconds: 1800
+      policies:
+        - require_rollback_plan
+        - no_production_deletes
+        - approval_chain_required
+    human_in_loop:
+      enabled: true
+      triggers:
+        - production_deployment
+        - infrastructure_change
+        - security_modification
+  identity:
+    provider: gitlab
+    service_account:
+      username: bot-deployer
+      email: bot-deployer@bluefly.io
+    token_source:
+      env_var: GITLAB_BOT_DEPLOYER_TOKEN
+      file_path: ~/.tokens/bot-deployer
+    authentication:
+      method: project_access_token
+      scopes:
+        - api
+        - write_repository
+        - read_registry
+  observability:
+    tracing:
+      enabled: true
+      exporter: otlp
+    metrics:
+      enabled: true
+      customMetrics:
+        - name: deployments_total
+          type: counter
+          description: Total deployments executed
+        - name: deployment_duration_seconds
+          type: histogram
+          description: Time to complete deployment
+        - name: rollbacks_total
+          type: counter
+          description: Total rollbacks performed
+    slo:
+      availability: 99.9
+      latency_p95_ms: 30000
+      error_budget: 0.1
+  messaging:
+    subscribes:
+      - channel: ci.pipeline_complete
+        description: Listen for pipeline completion to trigger deployments
+        handler: onPipelineComplete
+    publishes:
+      - channel: deployments.status
+        description: Deployment status updates
+        schema:
+          type: object
+          properties:
+            environment:
+              type: string
+            status:
+              type: string
+              enum:
+                - started
+                - success
+                - failed
+                - rolled_back
+            version:
+              type: string

package/dist/spec/v0.3.2/examples/access-tiers/doc-generator.ossa.yaml

@@ -0,0 +1,98 @@
+apiVersion: ossa/v0.3.3
+kind: Agent
+metadata:
+  name: doc-generator
+  version: 1.0.0
+  description: Documentation generator agent with sandboxed write access
+  labels:
+    team: platform
+    access_tier: tier_2_write_limited
+    domain: documentation
+  annotations:
+    ossa.io/migration: v0.3.3-to-v0.3.3
+    ossa.io/migrated-date: 2026-01-07
+spec:
+  type: worker
+  role: |
+    You are a documentation generator that creates and updates documentation
+    based on code analysis. You can write to documentation files, create
+    test files, and scaffold new structures.
+
+    IMPORTANT: You cannot modify production code or merge changes. All changes
+    must go through review by a human or supervisor agent.
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0.3
+  taxonomy:
+    domain: documentation
+    subdomain: api-docs
+    capability: generate_documentation
+    concerns:
+      - quality
+      - architecture
+  access:
+    tier: tier_2_write_limited
+    permissions:
+      - read_code
+      - read_configs
+      - write_docs
+      - write_tests
+      - create_issues
+      - create_mrs_draft
+      - execute_sandboxed
+    prohibited:
+      - write_production_code
+      - merge_mrs
+      - delete_branches
+      - modify_infrastructure
+    audit_level: standard
+    requires_approval: false
+  separation:
+    role: documenter
+    conflicts_with:
+      - executor
+      - deployer
+    can_delegate_to:
+      - analyzer
+  delegation:
+    enabled: true
+    allowed_tiers:
+      - tier_1_read
+    allowed_operations:
+      - analyze_code
+      - scan_dependencies
+    requires:
+      - task_specification
+  tools:
+    - name: filesystem
+      type: mcp
+      config:
+        server: filesystem-mcp-server
+        paths:
+          - docs/**
+          - tests/**
+          - README.md
+    - name: code-reader
+      type: mcp
+      config:
+        server: filesystem-mcp-server
+        read_only: true
+  autonomy:
+    level: assisted
+    allowed_actions:
+      - read_code
+      - write_documentation
+      - create_draft_mr
+    blocked_actions:
+      - modify_production_code
+      - merge_changes
+      - deploy
+  identity:
+    provider: gitlab
+    service_account:
+      username: bot-docs
+      email: bot-docs@bluefly.io
+    token_source:
+      env_var: GITLAB_BOT_DOCS_TOKEN
+      file_path: ~/.tokens/bot-docs

package/dist/spec/v0.3.2/examples/access-tiers/security-scanner.ossa.yaml

@@ -0,0 +1,118 @@
+apiVersion: ossa/v0.3.3
+kind: Agent
+metadata:
+  name: security-scanner
+  version: 1.0.0
+  description: Security vulnerability scanner - read-only analysis agent
+  labels:
+    team: security
+    access_tier: tier_1_read
+    domain: security
+  annotations:
+    ossa.io/migration: v0.3.3-to-v0.3.3
+    ossa.io/migrated-date: 2026-01-07
+spec:
+  type: analyzer
+  role: |
+    You are a security vulnerability scanner that analyzes code for potential
+    security issues. You can read code, scan dependencies, and report findings.
+
+    IMPORTANT: You cannot modify code, approve changes, or execute remediations.
+    You must report findings to a tier_3 remediator agent for action.
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0.1
+  taxonomy:
+    domain: security
+    subdomain: vulnerability
+    capability: scan_vulnerabilities
+    concerns:
+      - quality
+      - governance
+    recommended_tier: tier_1_read
+  access:
+    tier: tier_1_read
+    permissions:
+      - read_code
+      - read_configs
+      - read_logs
+      - execute_queries
+    prohibited:
+      - write_*
+      - delete_*
+      - execute_commands
+      - modify_infrastructure
+    audit_level: standard
+    requires_approval: false
+  separation:
+    role: scanner
+    conflicts_with:
+      - remediator
+      - executor
+      - approver
+    prohibited_actions:
+      - execute
+      - merge
+      - approve
+  tools:
+    - name: code-reader
+      type: mcp
+      config:
+        server: filesystem-mcp-server
+        read_only: true
+    - name: dependency-scanner
+      type: api
+      config:
+        endpoint: https://api.security.local/scan
+        method: GET
+  autonomy:
+    level: semi_autonomous
+    allowed_actions:
+      - scan_code
+      - generate_report
+      - create_issue
+    blocked_actions:
+      - modify_code
+      - execute_fix
+      - approve_mr
+  safety:
+    content_filtering:
+      enabled: true
+      categories:
+        - credentials
+        - pii
+      action: redact
+    rate_limiting:
+      enabled: true
+      requests_per_minute: 60
+  observability:
+    metrics:
+      enabled: true
+      customMetrics:
+        - name: vulnerabilities_found
+          type: counter
+          description: Total vulnerabilities detected
+        - name: scan_duration_seconds
+          type: histogram
+          description: Time to complete security scan
+  messaging:
+    publishes:
+      - channel: security.vulnerabilities
+        description: Vulnerability findings for remediation
+        schema:
+          type: object
+          properties:
+            severity:
+              type: string
+              enum:
+                - critical
+                - high
+                - medium
+                - low
+            cve:
+              type: string
+            affected_file:
+              type: string
+            remediation_required:
+              type: boolean

package/dist/spec/v0.3.2/examples/agent-with-identity.ossa.yaml

@@ -0,0 +1,63 @@
+apiVersion: ossa/v0.3.3
+kind: Agent
+metadata:
+  name: typescript-worker
+  version: 1.0.0
+  description: TypeScript development agent with GitLab service account identity
+  labels:
+    team: platform
+    tier: development
+  annotations:
+    ossa.io/migration: v0.3.3-to-v0.3.3
+    ossa.io/migrated-date: 2026-01-07
+spec:
+  role: |
+    You are a TypeScript development assistant that manages code changes
+    for the agent-buildkit and related TypeScript projects.
+  llm:
+    provider: anthropic
+    model: claude-sonnet-4-20250514
+    temperature: 0.2
+  identity:
+    provider: gitlab
+    service_account:
+      id: 31840529
+      username: bot-ts-local
+      email: bot-ts-local@bluefly.io
+    token_source:
+      env_var: GITLAB_BOT_TS_TOKEN
+      file_path: ~/.tokens/bot-ts-local
+    patterns:
+      - "*/common_npm/*"
+      - "*/agent-buildkit"
+      - "*/agent-studio"
+    dora_tracking:
+      enabled: true
+      metrics:
+        - deployment_frequency
+        - lead_time
+        - change_failure_rate
+        - mttr
+    observability:
+      service_name: typescript-worker
+      service_namespace: development
+      service_version: 1.0.0
+  tools:
+    - name: git
+      type: mcp
+      config:
+        server: git-mcp-server
+    - name: file-operations
+      type: mcp
+      config:
+        server: filesystem-mcp-server
+  autonomy:
+    level: supervised
+    require_approval:
+      - push_to_protected_branch
+      - delete_branch
+      - force_push
+  safety:
+    max_tokens_per_turn: 8000
+    rate_limits:
+      requests_per_minute: 30