@bluefly/openstandardagents 0.3.2 → 0.3.3

package/spec/{v0.3.0 → v0.3.3}/schemas/agent-unified.yaml

@@ -1,8 +1,8 @@
-# OSSA v0.3.0 - Unified Agent Schema
+# OSSA v0.3.3 - Unified Agent Schema
 # Universal agent platform: OSSA + GitLab Duo + Google A2A + MCP
 # Zero hardcoded models, runtime-agnostic, infrastructure-driven
 
-apiVersion: ossa/v0.3.0
+apiVersion: ossa/v0.3.3
 kind: Agent
 
 metadata:

package/spec/{v0.3.0 → v0.3.3}/schemas/capabilities.yaml

@@ -1,8 +1,8 @@
-# OSSA v0.3.0 - Capabilities Schema
+# OSSA v0.3.3 - Capabilities Schema
 # Google A2A and GitLab Duo compatible capability declarations
 
 $schema: http://json-schema.org/draft-07/schema#
-$id: https://openstandardagents.org/schemas/v0.3.0/capabilities.yaml
+$id: https://openstandardagents.org/schemas/v0.3.3/capabilities.yaml
 
 title: Agent Capabilities
 description: |

package/spec/{v0.3.0 → v0.3.3}/schemas/functions.yaml

@@ -1,8 +1,8 @@
-# OSSA v0.3.0 - Functions Schema
+# OSSA v0.3.3 - Functions Schema
 # Google A2A compatible function declarations (OpenAI function calling format)
 
 $schema: http://json-schema.org/draft-07/schema#
-$id: https://openstandardagents.org/schemas/v0.3.0/functions.yaml
+$id: https://openstandardagents.org/schemas/v0.3.3/functions.yaml
 
 title: Agent Functions
 description: |

package/spec/{v0.3.0 → v0.3.3}/schemas/messaging/channel.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://openstandardagents.org/schemas/v0.3.1/messaging/channel.json",
+  "$id": "https://openstandardagents.org/schemas/v0.3.3/messaging/channel.json",
   "title": "OSSA Channel Schema",
-  "description": "Schema for message channel configuration in OSSA v0.3.1",
+  "description": "Schema for message channel configuration in OSSA v0.3.3",
   "type": "object",
   "required": [
     "name",

package/spec/{v0.3.0 → v0.3.3}/schemas/messaging/delivery-receipt.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://openstandardagents.org/schemas/v0.3.1/messaging/delivery-receipt.json",
+  "$id": "https://openstandardagents.org/schemas/v0.3.3/messaging/delivery-receipt.json",
   "title": "OSSA Delivery Receipt Schema",
-  "description": "Schema for message delivery receipts in OSSA v0.3.1",
+  "description": "Schema for message delivery receipts in OSSA v0.3.3",
   "type": "object",
   "required": [
     "messageId",

package/{dist/spec/v0.3.0 → spec/v0.3.3}/schemas/messaging/message.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://openstandardagents.org/schemas/v0.3.1/messaging/message.json",
+  "$id": "https://openstandardagents.org/schemas/v0.3.3/messaging/message.json",
   "title": "OSSA Message Schema",
-  "description": "Schema for Agent-to-Agent messages in OSSA v0.3.1",
+  "description": "Schema for Agent-to-Agent messages in OSSA v0.3.3",
   "type": "object",
   "required": [
     "id",
@@ -141,7 +141,7 @@
           "examples": [
             {
               "traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
-              "user-agent": "OSSA/0.3.1"
+              "user-agent": "OSSA/0.3.3"
             }
           ]
         }

package/spec/{v0.3.0 → v0.3.3}/schemas/messaging/subscription.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://openstandardagents.org/schemas/v0.3.1/messaging/subscription.json",
+  "$id": "https://openstandardagents.org/schemas/v0.3.3/messaging/subscription.json",
   "title": "OSSA Subscription Schema",
-  "description": "Schema for agent message subscriptions in OSSA v0.3.1",
+  "description": "Schema for agent message subscriptions in OSSA v0.3.3",
   "type": "object",
   "required": [
     "channel",

package/{dist/spec/v0.3.0 → spec/v0.3.3}/schemas/runtime.yaml

@@ -1,8 +1,8 @@
-# OSSA v0.3.0 - Runtime Declaration Schema
+# OSSA v0.3.3 - Runtime Declaration Schema
 # Multi-runtime compatibility: Google A2A, GitLab Duo, OSSA Mesh, MCP
 
 $schema: http://json-schema.org/draft-07/schema#
-$id: https://openstandardagents.org/schemas/v0.3.0/runtime.yaml
+$id: https://openstandardagents.org/schemas/v0.3.3/runtime.yaml
 
 title: Agent Runtime Declaration
 description: |

package/spec/{v0.3.0 → v0.3.3}/schemas/taxonomy.yaml

@@ -1,12 +1,12 @@
-# OSSA Agent Taxonomy Schema v0.3.0
+# OSSA Agent Taxonomy Schema v0.3.3
 # Comprehensive hierarchical classification for AI agents
 # Aligned with OSSA spec roles, multi-agent patterns, and industry standards
 
-apiVersion: ossa/v0.3.0
+apiVersion: ossa/v0.3.3
 kind: Taxonomy
 metadata:
   name: agent-taxonomy
-  version: "0.3.0"
+  version: "0.3.3"
   description: |
     Formal agent taxonomy with hierarchical domains, cross-cutting capabilities,
     autonomy levels, and multi-agent orchestration patterns. Designed for

package/{dist/spec/v0.3.0 → spec/v0.3.3}/schemas/unified-llm.yaml

@@ -1,9 +1,9 @@
-# OSSA v0.3.0 - Unified LLM Configuration Schema
+# OSSA v0.3.3 - Unified LLM Configuration Schema
 # Compatible with: OSSA, GitLab Duo, Google A2A, MCP
 # Zero hardcoded models, runtime-configurable, multi-provider
 
 $schema: http://json-schema.org/draft-07/schema#
-$id: https://openstandardagents.org/schemas/v0.3.0/unified-llm.yaml
+$id: https://openstandardagents.org/schemas/v0.3.3/unified-llm.yaml
 
 title: Unified LLM Configuration
 description: |

package/{dist/spec/v0.3.0 → spec/v0.3.3}/taxonomy.yaml

@@ -1,13 +1,22 @@
 # =============================================================================
-# OSSA v0.3.0 - Agent Taxonomy Specification
+# OSSA v0.3.3 - Agent Taxonomy Specification
 # =============================================================================
 # Hierarchical classification system for agents with cross-cutting concerns
-# Issue: https://gitlab.com/blueflyio/openstandardagents/-/issues/194
+# Now includes access tier integration for separation of duties
+# Issues:
+#   - https://gitlab.com/blueflyio/openstandardagents/-/issues/194 (taxonomy)
+#   - https://gitlab.com/blueflyio/openstandardagents/-/issues/363 (separation of duties)
 # =============================================================================
 
-apiVersion: ossa/v0.3.0
+apiVersion: ossa/v0.3.3
 kind: TaxonomySpec
-version: "1.0.0"
+version: "2.0.0"
+
+# =============================================================================
+# ACCESS TIER INTEGRATION
+# Links taxonomy to access_tiers.yaml for separation of duties
+# =============================================================================
+access_tier_reference: "./access_tiers.yaml"
 
 # =============================================================================
 # PRIMARY DOMAINS
@@ -177,24 +186,122 @@ concerns:
 
 # =============================================================================
 # AGENT TYPE CLASSIFICATION
-# Based on OSSA spec.type field
+# Based on OSSA spec.type field - now with access tier recommendations
 # =============================================================================
 agent_types:
+  analyzer:
+    description: "Read-only analysis, scanning, auditing - no modifications"
+    typical_domains: ["security", "development", "data"]
+    recommended_tier: tier_1_read
+    can_delegate_to: []
+
   worker:
-    description: "Executes specific tasks, no delegation"
-    typical_domains: ["development", "security", "documentation"]
+    description: "Executes specific tasks, limited write access"
+    typical_domains: ["development", "documentation", "content"]
+    recommended_tier: tier_2_write_limited
+    can_delegate_to: ["analyzer"]
+
+  operator:
+    description: "Modifies production systems, requires approval"
+    typical_domains: ["infrastructure", "agents"]
+    recommended_tier: tier_3_write_elevated
+    can_delegate_to: ["worker", "analyzer"]
 
   supervisor:
     description: "Coordinates other agents, can delegate"
     typical_domains: ["agents", "infrastructure"]
+    recommended_tier: tier_3_write_elevated
+    can_delegate_to: ["worker", "analyzer"]
 
   orchestrator:
     description: "High-level coordination, workflow management"
     typical_domains: ["agents"]
+    recommended_tier: tier_3_write_elevated
+    can_delegate_to: ["supervisor", "worker", "analyzer"]
+
+  governor:
+    description: "Defines policies, cannot execute - ISOLATED"
+    typical_domains: ["security", "agents"]
+    recommended_tier: tier_4_policy
+    can_delegate_to: ["operator"]  # Delegation only, not execution
+    isolation: strict
 
   specialist:
     description: "Deep expertise in narrow domain"
     typical_domains: ["security", "data", "backend"]
+    recommended_tier: tier_1_read  # Most specialists are analyzers
+    can_delegate_to: []
+
+  critic:
+    description: "Reviews and provides feedback, cannot approve"
+    typical_domains: ["development", "security"]
+    recommended_tier: tier_1_read
+    prohibited_actions: ["approve", "merge", "execute"]
+    can_delegate_to: []
+
+# =============================================================================
+# DOMAIN-TIER MAPPINGS
+# Recommended access tiers by domain for separation of duties
+# =============================================================================
+domain_tier_recommendations:
+  security:
+    default_tier: tier_1_read
+    rationale: "Security agents should analyze, not modify"
+    exceptions:
+      - role: remediator
+        tier: tier_3_write_elevated
+        requires: governor_approval
+      - role: policy_definer
+        tier: tier_4_policy
+
+  infrastructure:
+    default_tier: tier_3_write_elevated
+    rationale: "Infrastructure requires elevated access"
+    separation_required:
+      - readers: ["monitor", "cost_reporter"]
+        tier: tier_1_read
+      - operators: ["deployer", "provisioner"]
+        tier: tier_3_write_elevated
+
+  documentation:
+    default_tier: tier_2_write_limited
+    rationale: "Doc changes are low-risk"
+
+  development:
+    default_tier: tier_2_write_limited
+    rationale: "Code generation is sandboxed"
+    separation_required:
+      - critics: ["reviewer", "analyzer"]
+        tier: tier_1_read
+        prohibited: ["approve", "merge"]
+      - generators: ["scaffolder", "test_writer"]
+        tier: tier_2_write_limited
+
+  agents:
+    default_tier: tier_3_write_elevated
+    rationale: "Agent orchestration needs elevated access"
+    separation_required:
+      - governors: ["policy_definer", "compliance_enforcer"]
+        tier: tier_4_policy
+        isolation: strict
+      - orchestrators: ["coordinator", "scheduler"]
+        tier: tier_3_write_elevated
+
+  backend:
+    default_tier: tier_2_write_limited
+    separation_required:
+      - analyzers: ["db_analyzer", "api_auditor"]
+        tier: tier_1_read
+      - operators: ["db_migrator", "service_deployer"]
+        tier: tier_3_write_elevated
+
+  data:
+    default_tier: tier_1_read
+    rationale: "Data access is sensitive - read-only by default"
+    exceptions:
+      - role: etl_operator
+        tier: tier_3_write_elevated
+        requires: data_governance_approval
 
 # =============================================================================
 # USAGE IN AGENT MANIFESTS

package/.devfile.yaml

@@ -1,87 +0,0 @@
-schemaVersion: 2.2.0
-metadata:
-  name: ossa-development
-  # Version is managed by package.json - run `npm run version:sync` to update
-  description: OSSA development environment with GitLab agent access
-components:
-  - name: dev-tools
-    container:
-      image: node:22-alpine
-      memoryLimit: 4Gi
-      cpuLimit: 2000m
-      mountSources: true
-      env:
-        - name: NODE_ENV
-          value: development
-        - name: KUBECONFIG
-          value: /workspace/.kube/config
-      volumeMounts:
-        - name: kube-config
-          path: /workspace/.kube
-  
-  - name: kubectl
-    container:
-      image: bitnami/kubectl:latest
-      memoryLimit: 512Mi
-      cpuLimit: 500m
-      env:
-        - name: KUBECONFIG
-          value: /workspace/.kube/config
-      volumeMounts:
-        - name: kube-config
-          path: /workspace/.kube
-
-volumes:
-  - name: kube-config
-    ephemeral: true
-
-commands:
-  - id: install
-    exec:
-      component: dev-tools
-      commandLine: npm ci --legacy-peer-deps
-      workingDir: ${PROJECT_SOURCE}
-  
-  - id: build
-    exec:
-      component: dev-tools
-      commandLine: npm run build
-      workingDir: ${PROJECT_SOURCE}
-  
-  - id: test
-    exec:
-      component: dev-tools
-      commandLine: npm test
-      workingDir: ${PROJECT_SOURCE}
-  
-  - id: lint
-    exec:
-      component: dev-tools
-      commandLine: npm run lint
-      workingDir: ${PROJECT_SOURCE}
-  
-  - id: version-sync
-    exec:
-      component: dev-tools
-      commandLine: npm run version:sync
-      workingDir: ${PROJECT_SOURCE}
-  
-  - id: deploy-agents
-    exec:
-      component: kubectl
-      commandLine: kubectl apply -f .gitlab/agents/
-      workingDir: ${PROJECT_SOURCE}
-  
-  - id: get-pods
-    exec:
-      component: kubectl
-      commandLine: kubectl get pods -n ossa-agents
-  
-  - id: agent-logs
-    exec:
-      component: kubectl
-      commandLine: kubectl logs -n ossa-agents -l app=version-manager --tail=100 -f
-
-events:
-  postStart:
-    - install

package/.gitlab-ci-trigger

@@ -1 +0,0 @@
-# CI trigger - 1766005216

package/bin/ossa-dev

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-
-import { spawn } from 'child_process';
-import { watch } from 'fs';
-import { resolve } from 'path';
-
-const args = process.argv.slice(2);
-const agentPath = args[0] || './agent.yaml';
-const port = args[1] || '3000';
-
-let server;
-
-function startServer() {
-  if (server) server.kill();
-  
-  console.log(`\n🚀 Starting OSSA agent: ${agentPath}`);
-  server = spawn('node', ['--loader', 'tsx', '-e', `
-    import { readFileSync } from 'fs';
-    import { createServer } from 'http';
-    
-    const agent = readFileSync('${agentPath}', 'utf-8');
-    
-    createServer((req, res) => {
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ status: 'ok', agent: '${agentPath}' }));
-    }).listen(${port}, () => {
-      console.log('✓ Agent running on http://localhost:${port}');
-    });
-  `], { stdio: 'inherit' });
-}
-
-watch(resolve(agentPath), () => {
-  console.log('📝 Agent config changed, reloading...');
-  startServer();
-});
-
-startServer();
-
-process.on('SIGINT', () => {
-  if (server) server.kill();
-  process.exit(0);
-});

package/bin/ossa-export

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * OSSA Export Utility
- * Quick export of OSSA manifests to various formats
- */
-
-const { execSync } = require('child_process');
-const path = require('path');
-
-const args = process.argv.slice(2);
-const format = args[0];
-const file = args[1];
-
-if (!format || !file) {
-  console.log('Usage: ossa-export <format> <file>');
-  console.log('');
-  console.log('Formats:');
-  console.log('  cursor      - Export to Cursor AI format');
-  console.log('  langchain   - Export to LangChain format');
-  console.log('  openai      - Export to OpenAI Assistants format');
-  console.log('  anthropic   - Export to Anthropic Claude format');
-  console.log('');
-  console.log('Example: ossa-export cursor my-agent.ossa.yaml');
-  process.exit(1);
-}
-
-try {
-  execSync(`ossa export --to ${format} ${file}`, { stdio: 'inherit' });
-} catch (error) {
-  process.exit(1);
-}

package/bin/ossa-generate

@@ -1,53 +0,0 @@
-#!/usr/bin/env node
-
-import { writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
-
-const [type, name] = process.argv.slice(2);
-
-if (!type || !name) {
-  console.log('Usage: ossa-generate <agent|adapter> <name>');
-  process.exit(1);
-}
-
-const templates = {
-  agent: `apiVersion: ossa/v0.3.0
-kind: Agent
-metadata:
-  name: ${name}
-  version: "1.0.0"
-  description: ${name} agent
-spec:
-  role: |
-    You are a helpful assistant.
-  llm:
-    provider: openai
-    model: gpt-4o-mini
-  tools: []
-`,
-  adapter: `import { Adapter } from '@ossa/core';
-
-export class ${name.charAt(0).toUpperCase() + name.slice(1)}Adapter implements Adapter {
-  async execute(input: any): Promise<any> {
-    // Implementation
-    return { result: 'success' };
-  }
-}
-`
-};
-
-if (!templates[type]) {
-  console.log('❌ Unknown type. Use: agent or adapter');
-  process.exit(1);
-}
-
-const ext = type === 'agent' ? 'yaml' : 'ts';
-const filename = `${name}.${ext}`;
-
-try {
-  writeFileSync(filename, templates[type]);
-  console.log(`✓ Created ${type}: ${filename}`);
-} catch (err) {
-  console.error('❌ Error:', err.message);
-  process.exit(1);
-}

package/bin/ossa-health

@@ -1,40 +0,0 @@
-#!/usr/bin/env node
-
-import { readFileSync, existsSync } from 'fs';
-import { parse } from 'yaml';
-
-const agentPath = process.argv[2] || './agent.yaml';
-
-if (!existsSync(agentPath)) {
-  console.log('❌ Agent file not found:', agentPath);
-  process.exit(1);
-}
-
-try {
-  const content = readFileSync(agentPath, 'utf-8');
-  const agent = parse(content);
-  
-  const checks = {
-    'Valid YAML': !!agent,
-    'Has apiVersion': !!agent.apiVersion,
-    'Has kind': agent.kind === 'Agent',
-    'Has metadata': !!agent.metadata?.name,
-    'Has spec': !!agent.spec
-  };
-  
-  console.log('\n🏥 OSSA Agent Health Check\n');
-  console.log(`Agent: ${agentPath}\n`);
-  
-  let passed = 0;
-  for (const [check, result] of Object.entries(checks)) {
-    console.log(`${result ? '✓' : '✗'} ${check}`);
-    if (result) passed++;
-  }
-  
-  console.log(`\n${passed}/${Object.keys(checks).length} checks passed\n`);
-  
-  process.exit(passed === Object.keys(checks).length ? 0 : 1);
-} catch (err) {
-  console.log('❌ Error:', err.message);
-  process.exit(1);
-}

package/bin/ossa-init

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * OSSA Init Utility
- * Quick project initialization
- */
-
-const { execSync } = require('child_process');
-
-const args = process.argv.slice(2);
-const name = args[0] || 'my-agent';
-
-console.log(`🚀 Initializing OSSA agent: ${name}`);
-
-try {
-  execSync(`ossa init ${name}`, { stdio: 'inherit' });
-  console.log('');
-  console.log('✅ Agent initialized!');
-  console.log('');
-  console.log('Next steps:');
-  console.log(`  cd ${name}`);
-  console.log('  ossa validate agent.ossa.yaml');
-  console.log('  ossa export --to cursor agent.ossa.yaml');
-} catch (error) {
-  process.exit(1);
-}