@bluefly/openstandardagents 0.3.2 → 0.3.3

package/examples/kagent/k8s-troubleshooter.ossa.yaml

@@ -1,257 +1,102 @@
-# ============================================================================
-# OSSA kAgent Reference Implementation: Kubernetes Troubleshooter Agent
-# ============================================================================
-#
-# This manifest demonstrates OSSA compliance for Kubernetes-native agent
-# deployments with comprehensive diagnostic and troubleshooting capabilities.
-#
-# Key Features:
-#   - K8s runtime integration with pod/node discovery
-#   - RBAC-based permission model for safe cluster operations
-#   - MCP server integration for kubectl command execution
-#   - Supervised autonomy with approval gates
-#   - Service mesh integration (Istio/Ambient)
-#   - Agent-to-Agent (A2A) communication patterns
-#   - Audit logging for compliance and observability
-#
-# Domain: infrastructure.kubernetes.troubleshooting
-# ============================================================================
-
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.3
 kind: Agent
 metadata:
-  # Basic agent identification metadata
   name: k8s-troubleshooter
   version: 1.0.0
-  description: "Autonomous Kubernetes cluster troubleshooting agent with diagnostic capabilities"
-
+  description: Autonomous Kubernetes cluster troubleshooting agent with diagnostic
+    capabilities
 spec:
-  # =========================================================================
-  # TAXONOMY: Agent Classification & Capabilities
-  # =========================================================================
-  # Defines the functional domain and specialization of this agent within
-  # the infrastructure ecosystem. Used for discovery, routing, and validation.
   taxonomy:
-    domain: infrastructure           # Primary domain: infrastructure/devops
-    subdomain: kubernetes           # K8s-specific agent
-    capability: troubleshooting     # Core capability: diagnostics & remediation
+    domain: infrastructure
+    subdomain: kubernetes
+    capability: troubleshooting
+  role: 'You are an expert Kubernetes troubleshooter. You diagnose pod failures, network
+    issues,
+
+    resource constraints, and configuration problems. You use kubectl and monitoring
+    tools
 
-  # =========================================================================
-  # ROLE: Agent Behavior & Expertise Profile
-  # =========================================================================
-  # Instructs the LLM on this agent's purpose, expertise areas, and approach.
-  # Guides decision-making for K8s diagnosis and troubleshooting workflows.
-  role: |
-    You are an expert Kubernetes troubleshooter. You diagnose pod failures, network issues,
-    resource constraints, and configuration problems. You use kubectl and monitoring tools
     to identify root causes and suggest remediation steps.
 
-  # =========================================================================
-  # LLM CONFIGURATION: Model Selection & Behavior
-  # =========================================================================
-  # Configures the Large Language Model backend used for reasoning and
-  # diagnostic recommendations. Temperature kept low (0.2) for consistency.
+    '
   llm:
-    provider: openai                # LLM provider for inference
-    model: gpt-4                    # Model with strong K8s/YAML reasoning
-    temperature: 0.2                # Low temperature: consistent diagnostics
-    maxTokens: 4000                 # Token budget for diagnostic analysis
-
-  # =========================================================================
-  # TOOLS: MCP Server Integration & Capabilities
-  # =========================================================================
-  # Declares MCP (Model Context Protocol) servers that provide K8s API access
-  # and kubectl execution capabilities. MCP enables structured interaction
-  # with Kubernetes cluster resources and diagnostic tools.
+    provider: openai
+    model: gpt-4
+    temperature: 0.2
+    maxTokens: 4000
   tools:
-    # ===== Kubernetes MCP Server =====
-    # Provides direct access to Kubernetes API resources and kubectl execution
-    # for pod inspection, log retrieval, and event analysis
-    - type: mcp
-      server: kubernetes-mcp
-      namespace: default            # Default K8s namespace for queries
-      capabilities:
-        - get_pods                  # Query pod status and configuration
-        - get_logs                  # Stream pod container logs
-        - get_events                # Retrieve K8s cluster events
-        - describe_resource         # Get detailed resource descriptions
-        - get_metrics               # Access Prometheus/kubelet metrics
-
-    # ===== BuildKit Agent Protocol Server =====
-    # Provides documentation search and log analysis capabilities
-    # for correlating K8s issues with known patterns and solutions
-    - type: mcp
-      server: buildkit-agent-protocol
-      namespace: default
-      capabilities:
-        - search_documentation      # Search troubleshooting KB/runbooks
-        - analyze_logs              # Pattern matching in aggregated logs
-
-  # =========================================================================
-  # AUTONOMY: Permission Model & Action Gates
-  # =========================================================================
-  # Defines the supervision level, approval requirements, and permitted actions.
-  # Follows principle of least privilege for cluster safety.
+  - type: mcp
+    server: kubernetes-mcp
+    namespace: default
+    capabilities:
+    - get_pods
+    - get_logs
+    - get_events
+    - describe_resource
+    - get_metrics
+  - type: mcp
+    server: buildkit-agent-protocol
+    namespace: default
+    capabilities:
+    - search_documentation
+    - analyze_logs
   autonomy:
-    level: supervised               # Requires human approval for actions
-    approval_required: true         # All actions need explicit approval
-
-    # ===== ALLOWED READ-ONLY ACTIONS =====
-    # Safe diagnostic operations that don't modify cluster state
+    level: supervised
+    approval_required: true
     allowed_actions:
-      - read_pods                   # Query pod metadata/status
-      - read_logs                   # Access application logs
-      - read_events                 # View cluster events
-      - read_metrics                # Access performance metrics
-
-    # ===== BLOCKED DESTRUCTIVE ACTIONS =====
-    # Dangerous operations explicitly forbidden to prevent cluster damage
+    - read_pods
+    - read_logs
+    - read_events
+    - read_metrics
     blocked_actions:
-      - delete_pods                 # Prevent accidental pod termination
-      - scale_deployments           # Prevent replica count changes
-      - modify_configs              # Prevent ConfigMap/Secret changes
-
-  # =========================================================================
-  # CONSTRAINTS: Cost & Performance Limits
-  # =========================================================================
-  # Enforces resource limits to prevent excessive API/LLM usage and costs.
-  # Token limits control diagnostic depth; latency limits ensure responsiveness.
+    - delete_pods
+    - scale_deployments
+    - modify_configs
   constraints:
     cost:
-      maxTokensPerDay: 50000        # Daily token budget for all operations
-      maxTokensPerRequest: 4000     # Per-request token limit
-      maxCostPerDay: 10.0           # USD cost ceiling per day
+      maxTokensPerDay: 50000
+      maxTokensPerRequest: 4000
+      maxCostPerDay: 10.0
       currency: USD
-
     performance:
-      maxLatencySeconds: 30         # Max response time for diagnostics
-      maxConcurrentRequests: 5      # Concurrent diagnostic requests
-
-  # =========================================================================
-  # EXTENSIONS: kAgent-Specific Kubernetes Integration
-  # =========================================================================
-  # kAgent extensions provide Kubernetes-native deployment configuration,
-  # RBAC integration, service mesh support, and compliance frameworks.
+      maxLatencySeconds: 30
+      maxConcurrentRequests: 5
   extensions:
     kagent:
-      # =====================================================================
-      # KUBERNETES RUNTIME CONFIGURATION
-      # =====================================================================
-      # Configures how the agent pod itself runs within the cluster,
-      # including namespace, resource limits, and identification labels.
       kubernetes:
-        namespace: production        # Production namespace for agent pod
-
-        # ===== POD LABELS =====
-        # Standard Kubernetes labels for discovery, monitoring, and routing
+        namespace: production
         labels:
-          app: k8s-troubleshooter   # App identifier for selectors
-          team: platform            # Team ownership
-          environment: production   # Environment classification
-
-        # ===== POD ANNOTATIONS =====
-        # Metadata annotations for observability and contact information
+          app: k8s-troubleshooter
+          team: platform
+          environment: production
         annotations:
-          description: "Kubernetes troubleshooting agent"
-          contact: "platform-team@company.com"  # Escalation contact
-
-        # ===== RESOURCE LIMITS =====
-        # Container resource requests/limits to prevent resource starvation
-        # or runaway consumption on cluster nodes
+          description: Kubernetes troubleshooting agent
+          contact: platform-team@company.com
         resourceLimits:
-          cpu: "500m"               # CPU allocation for agent execution
-          memory: "512Mi"           # Memory allocation for LLM context
-
-      # =====================================================================
-      # GUARDRAILS: RBAC & Approval Framework
-      # =====================================================================
-      # Enforces mandatory approvals, resource consumption limits, and
-      # specific K8s API action permissions through RBAC-style rules.
+          cpu: 500m
+          memory: 512Mi
       guardrails:
-        requireApproval: true       # Mandatory approval gate before actions
-
+        requireApproval: true
         costLimits:
-          maxTokensPerDay: 50000    # Daily LLM token consumption limit
-          maxCostPerDay: 10.0       # Financial ceiling (USD)
+          maxTokensPerDay: 50000
+          maxCostPerDay: 10.0
           currency: USD
-
-        # ===== K8S API PERMISSION MODEL =====
-        # RBAC-style permissions for specific Kubernetes API resources
-        # Format: kubernetes:<verb>:<resource>
         allowedActions:
-          - kubernetes:get:pods     # Read pod objects (GET /pods)
-          - kubernetes:get:logs     # Stream logs (GET /pods/logs)
-          - kubernetes:get:events   # List events (GET /events)
-
-        # ===== AUDIT LOGGING =====
-        # Records all agent actions for compliance, debugging, and security
+        - kubernetes:get:pods
+        - kubernetes:get:logs
+        - kubernetes:get:events
         auditLog:
-          destination: compliance-engine  # Audit destination service
-          retention: 7years               # Compliance data retention
-
-      # =====================================================================
-      # AGENT-TO-AGENT (A2A) COMMUNICATION CONFIG
-      # =====================================================================
-      # Enables this agent to communicate with other agents (security-scanner,
-      # cost-optimizer) for collaborative diagnostics using JSON-RPC protocol.
-      # Supports multi-agent troubleshooting workflows.
+          destination: compliance-engine
+          retention: 7years
       a2aConfig:
-        enabled: true               # Enable inter-agent communication
-        protocol: json-rpc          # JSON-RPC 2.0 for agent calls
-
-        # ===== A2A ENDPOINT REGISTRY =====
-        # Other agents this troubleshooter can invoke for specialized analysis
+        enabled: true
+        protocol: json-rpc
         endpoints:
-          - http://security-scanner:8080/a2a    # Security audit queries
-          - http://cost-optimizer:8080/a2a      # Cost analysis queries
-
-        # ===== AUTHENTICATION =====
-        # mTLS (mutual TLS) ensures encrypted, authenticated agent-to-agent
-        # communication within the service mesh
+        - http://security-scanner:8080/a2a
+        - http://cost-optimizer:8080/a2a
         authentication:
-          type: mtls               # Mutual TLS certificates required
-
-      # =====================================================================
-      # SERVICE MESH INTEGRATION
-      # =====================================================================
-      # Integrates with Kubernetes service mesh technologies for:
-      #   - Encrypted inter-pod communication
-      #   - Observability (traces, metrics)
-      #   - Traffic policy enforcement
-      #   - mTLS authentication between agents
+          type: mtls
       meshIntegration:
-        enabled: true               # Enable service mesh features
-        istioIntegration: true      # Istio sidecar injection
-        ambientMesh: true           # Ambient mode support (Istio 1.14+)
-
-# ============================================================================
-# OPERATIONAL NOTES
-# ============================================================================
-#
-# DEPLOYMENT:
-#   This manifest deploys an agent pod to the production namespace with
-#   K8s cluster discovery enabled. The agent pod receives an Istio sidecar
-#   for encrypted inter-agent communication and observability.
-#
-# RBAC REQUIREMENTS:
-#   Requires ClusterRole with permissions for:
-#     - pods (get, list, watch)
-#     - pods/logs (get)
-#     - events (get, list, watch)
-#     - nodes (get, list)
-#     - deployments (get, list)
-#
-# SECURITY CONSIDERATIONS:
-#   - All actions require explicit approval via guardrails
-#   - No destructive actions permitted (no delete/modify)
-#   - mTLS required for agent-to-agent communication
-#   - Audit logging for compliance and troubleshooting
-#   - Resource limits prevent denial-of-service
-#
-# MONITORING & OBSERVABILITY:
-#   - Metrics exported to Prometheus via agent instrumentation
-#   - Traces propagated to Jaeger via Istio sidecars
-#   - Pod logs aggregated via standard K8s logging
-#   - Audit events recorded in compliance-engine
-#
-# ============================================================================
+        enabled: true
+        istioIntegration: true
+        ambientMesh: true

package/examples/kagent/security-scanner.ossa.yaml

@@ -1,140 +1,84 @@
-# ============================================================================
-# OSSA kAgent Reference Implementation #2
-# Security Scanner Agent - Comprehensive Annotation
-# Domain: security.vulnerability.scanning
-# Purpose: Continuous vulnerability scanning, CVE detection, compliance validation
-# Last Updated: 2025-11-10
-# ============================================================================
-
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.3
 kind: Agent
 metadata:
-  # Core identity metadata for the security scanning agent
   name: security-scanner
   version: 1.0.0
-  description: "Continuous security vulnerability scanning and compliance validation agent"
-
+  description: Continuous security vulnerability scanning and compliance validation
+    agent
 spec:
-  # Taxonomy defines the agent's operational domain and classification
-  # Used for service discovery, capability matching, and policy routing
   taxonomy:
-    domain: security          # Primary domain for security operations
-    subdomain: vulnerability  # Specialization: vulnerability management
-    capability: scanning      # Core capability: security scanning
+    domain: security
+    subdomain: vulnerability
+    capability: scanning
+  role: 'You are a security scanning agent that continuously monitors Kubernetes clusters
 
-  # Role definition: Defines agent's purpose, boundaries, and security responsibilities
-  # This instructs the LLM on its operational context within the security ecosystem
-  role: |
-    You are a security scanning agent that continuously monitors Kubernetes clusters
     for vulnerabilities, misconfigurations, and compliance violations. You integrate
+
     with CVE databases, security benchmarks (CIS, NIST), and provide actionable remediation.
 
-  # LLM Configuration: Controls AI model behavior for security scanning operations
-  # Low temperature (0.1) ensures deterministic, consistent security analysis
+    '
   llm:
     provider: anthropic
     model: claude-3-sonnet-20240229
-    temperature: 0.1           # Low temperature for consistent vulnerability assessment
-    maxTokens: 8000            # Token limit for detailed security reports
-
-  # Tools: Defines integrations with security scanning and compliance validation systems
-  # Each tool maps to specific security capabilities: image scanning, RBAC validation, config auditing
+    temperature: 0.1
+    maxTokens: 8000
   tools:
-    # Kubernetes-based security operations via MCP server
-    # Provides cluster-level visibility into security posture
-    - type: mcp
-      server: kubernetes-mcp
-      capabilities:
-        - scan_images          # CVE scanning for container images (registry vulnerability detection)
-        - check_rbac           # Role-based access control validation (IAM security)
-        - audit_configs        # Configuration audit against security benchmarks (CIS, NIST)
-
-    # Compliance validation and security policy enforcement via buildkit engine
-    # Enables continuous compliance checking against organizational policies
-    - type: mcp
-      server: buildkit-compliance-engine
-      capabilities:
-        - validate_compliance  # Verify compliance against frameworks (SOC2, FedRAMP, etc.)
-        - check_policies       # Enforce organization-specific security policies
-        - generate_reports     # Create compliance and vulnerability reports
-
-    # Trivy vulnerability scanner: External HTTP service for container/image scanning
-    # Integrates with CVE databases for real-time vulnerability detection
-    - type: http
-      name: trivy-scanner
-      endpoint: http://trivy:8080
-      auth:
-        type: bearer           # Bearer token authentication for API access
-
-  # Autonomy Level: Determines agent decision-making authority and approval workflows
-  # Security agents typically operate autonomously for scanning but require approval for remediation
+  - type: mcp
+    server: kubernetes-mcp
+    capabilities:
+    - scan_images
+    - check_rbac
+    - audit_configs
+  - type: mcp
+    server: buildkit-compliance-engine
+    capabilities:
+    - validate_compliance
+    - check_policies
+    - generate_reports
+  - type: http
+    name: trivy-scanner
+    endpoint: http://trivy:8080
+    auth:
+      type: bearer
   autonomy:
-    level: autonomous          # Can execute scan operations without human intervention
-    approval_required: false   # Scans execute automatically per schedule
+    level: autonomous
+    approval_required: false
     allowed_actions:
-      - scan_all_namespaces    # Permission: scan all Kubernetes namespaces for vulnerabilities
-      - generate_reports       # Permission: create vulnerability and compliance reports
-      - send_alerts            # Permission: notify security teams of findings
+    - scan_all_namespaces
+    - generate_reports
+    - send_alerts
     blocked_actions:
-      - remediate_automatically  # BLOCKED: Prevent autonomous remediation (human oversight required)
-      - modify_resources         # BLOCKED: Prevent direct cluster modifications
-
-  # Constraints: Operational boundaries for cost, performance, and scanning frequency
-  # Prevents resource exhaustion and maintains predictable operational costs
+    - remediate_automatically
+    - modify_resources
   constraints:
     cost:
-      maxTokensPerDay: 100000   # Daily LLM token budget for security analysis
-      maxCostPerDay: 25.0       # Daily cost cap in USD for AI operations
+      maxTokensPerDay: 100000
+      maxCostPerDay: 25.0
     performance:
-      maxLatencySeconds: 60     # Maximum acceptable latency for vulnerability scan results
-      scanInterval: 3600        # Scan frequency: 1 hour (3600 seconds) between full scans
-
-  # Extensions: Kubernetes-specific configurations for agent deployment and runtime governance
-  # Contains kAgent-specific settings for the Kubernetes environment
+      maxLatencySeconds: 60
+      scanInterval: 3600
   extensions:
     kagent:
-      # Kubernetes deployment configuration: Where and how agent runs in cluster
       kubernetes:
-        namespace: security     # Dedicated security namespace for agent isolation
+        namespace: security
         labels:
-          app: security-scanner        # Application identifier
-          team: security               # Team ownership
-          environment: production      # Environment classification
-          compliance: soc2-fedramp     # Compliance frameworks: SOC2, FedRAMP
-
-        # Resource limits: Prevents runaway resource consumption during intensive scans
+          app: security-scanner
+          team: security
+          environment: production
+          compliance: soc2-fedramp
         resourceLimits:
-          cpu: "1000m"                 # 1 CPU core limit
-          memory: "1Gi"                # 1GB memory limit for scan operations
-
-      # Guardrails: Security controls and oversight mechanisms for agent operations
-      # Ensures compliance, auditability, and cost control
+          cpu: 1000m
+          memory: 1Gi
       guardrails:
-        requireApproval: false         # Scans don't require approval (scheduled automation)
+        requireApproval: false
         costLimits:
-          maxTokensPerDay: 100000      # Daily token budget enforcement
+          maxTokensPerDay: 100000
         auditLog:
-          destination: compliance-engine  # Send all operations to compliance system
-          retention: 10years              # 10-year retention for regulatory compliance
-
-      # Agent-to-Agent (A2A) Configuration: Inter-agent communication and coordination
-      # Enables security agent to collaborate with other agents (troubleshooter, validator)
+          destination: compliance-engine
+          retention: 10years
       a2aConfig:
-        enabled: true                  # Enable inter-agent communication
-        protocol: json-rpc             # Communication protocol: JSON-RPC over HTTP
+        enabled: true
+        protocol: json-rpc
         endpoints:
-          - http://k8s-troubleshooter:8080/a2a      # Endpoint: Kubernetes troubleshooting agent
-          - http://compliance-validator:8080/a2a    # Endpoint: Compliance validation agent
-
-# ============================================================================
-# SECURITY FEATURES SUMMARY:
-# - CVE Detection: Trivy integration for container image vulnerability scanning
-# - Compliance Checking: Validates against SOC2, FedRAMP, CIS, NIST standards
-# - RBAC Validation: Ensures Kubernetes access controls are properly configured
-# - Config Auditing: Scans cluster configurations against security baselines
-# - Vulnerability Reporting: Generates detailed security and compliance reports
-# - Alert Management: Autonomous notification of security findings
-# - Audit Trail: 10-year retention of all operations via compliance engine
-# - Cost Controls: Daily token and monetary budgets prevent resource exhaustion
-# - Approval Workflows: Blocks autonomous remediation; requires human oversight
-# ============================================================================
+        - http://k8s-troubleshooter:8080/a2a
+        - http://compliance-validator:8080/a2a

package/examples/langchain/chain-agent.ossa.json

@@ -1,5 +1,5 @@
 {
-  "apiVersion": "ossa/v0.3.2",
+  "apiVersion": "ossa/v0.3.3",
   "kind": "Agent",
   "metadata": {
     "name": "langchain-agent",

package/examples/langflow/workflow-agent.ossa.json

@@ -1,5 +1,5 @@
 {
-  "apiVersion": "ossa/v0.3.2",
+  "apiVersion": "ossa/v0.3.3",
   "kind": "Agent",
   "metadata": {
     "name": "workflow-orchestrator",

package/examples/langgraph/state-machine-agent.ossa.json

@@ -1,5 +1,5 @@
 {
-  "apiVersion": "ossa/v0.3.2",
+  "apiVersion": "ossa/v0.3.3",
   "kind": "Agent",
   "metadata": {
     "name": "state-machine-agent",

package/examples/llamaindex/rag-agent.ossa.json

@@ -1,5 +1,5 @@
 {
-  "apiVersion": "ossa/v0.3.2",
+  "apiVersion": "ossa/v0.3.3",
   "kind": "Agent",
   "metadata": {
     "name": "rag-query-agent",

package/examples/messaging/dependency-healer.ossa.yaml

@@ -3,7 +3,7 @@
 # This agent monitors dependencies, detects outdated packages, and coordinates
 # updates while communicating with security scanners via OSSA messaging.
 
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.3
 kind: Agent
 metadata:
   name: dependency-healer
@@ -311,7 +311,7 @@ spec:
         channel: dependency.dlq
         retentionDays: 14
       ordering:
-        guarantee: per-channel
+        guarantee: per-source
         timeoutSeconds: 600
 
   autonomy:

package/examples/messaging/incident-responder.ossa.yaml

@@ -3,7 +3,7 @@
 # This agent receives security incidents from multiple sources and coordinates
 # response activities across teams via OSSA messaging.
 
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.3
 kind: Agent
 metadata:
   name: incident-responder
@@ -15,7 +15,7 @@ metadata:
     criticality: high
   annotations:
     ossa.openstandardagents.org/category: incident-response
-    ossa.openstandardagents.org/on-call: true
+    ossa.openstandardagents.org/on-call: "true"
     ossa.openstandardagents.org/sla: 15m
 
 spec: