@bluefly/openstandardagents 0.3.2 → 0.3.5

package/examples/ossa-templates/14-security-hardening-agent.ossa.yaml

@@ -0,0 +1,267 @@
+apiVersion: ossa/v0.3
+kind: Agent
+metadata:
+  name: security-hardening-agent
+  version: 1.0.0
+  description: Security Hardening Agent - OWASP Top 10 prevention, vulnerability scanning, secure coding practices
+  labels:
+    ossa-version: v0.3.5
+    domain: security
+    category: hardening
+    tier: worker
+    priority: P0
+    skill.priority: '95'
+    skill.contexts: development,review
+spec:
+  taxonomy:
+    domain: security
+    subdomain: hardening
+    capability: security_enforcement
+  role: 'You are the Security Hardening Agent, preventing OWASP Top 10 vulnerabilities and enforcing secure coding.
+
+
+    Your mission:
+
+    1. Prevent injection attacks (SQL, XSS, command injection)
+
+    2. Enforce authentication and session management
+
+    3. Prevent sensitive data exposure
+
+    4. Validate and sanitize all inputs
+
+    5. Enforce HTTPS and secure headers
+
+    6. Prevent security misconfigurations
+
+
+    Priority Rules:
+
+    - CRITICAL: Input validation and sanitization
+
+    - CRITICAL: No hardcoded secrets or credentials
+
+    - HIGH: SQL injection prevention (parameterized queries)
+
+    - HIGH: XSS prevention (output encoding)
+
+    - MEDIUM: CSRF protection
+
+    - LOW: Security headers (CSP, HSTS)'
+  llm:
+    provider: ${LLM_PROVIDER:-anthropic}
+    model: ${LLM_MODEL:-claude-sonnet-4-20250514}
+    temperature: 0.1
+    maxTokens: 16384
+  runtime:
+    triggers:
+      keywords:
+      - security
+      - vulnerability
+      - owasp
+      - injection
+      - xss
+      - sql
+      - auth
+      - secret
+      file_patterns:
+      - '**/*.{ts,js,tsx,jsx}'
+      - '**/api/**'
+      - '**/routes/**'
+      frameworks:
+      - express
+      - next.js
+      - react
+      - node
+    activation:
+      automatic: true
+      confidence_threshold: 0.8
+extensions:
+  experts:
+    registry:
+    - id: deep-analysis-expert
+      name: Deep Performance Analysis Expert
+      model:
+        provider: anthropic
+        model: claude-opus-4-5-20251101
+      specializations:
+      - owasp_prevention
+      - vulnerability_scanning
+      - secure_coding
+      cost_tier: premium
+      capabilities:
+        extended_thinking: true
+        max_tokens: 200000
+        reasoning_depth: deep
+    - id: standard-analysis-expert
+      name: Standard Performance Expert
+      model:
+        provider: anthropic
+        model: claude-sonnet-4-20250514
+      specializations:
+      - owasp_prevention
+      - vulnerability_scanning
+      - secure_coding
+      cost_tier: standard
+      capabilities:
+        max_tokens: 16384
+        reasoning_depth: balanced
+    - id: quick-scan-expert
+      name: Quick Performance Scan Expert
+      model:
+        provider: google
+        model: gemini-2.0-flash
+      specializations:
+      - owasp_prevention
+      - vulnerability_scanning
+      - secure_coding
+      cost_tier: economy
+      capabilities:
+        max_tokens: 8192
+        reasoning_depth: fast
+    selection_strategy: agent_controlled
+  bat:
+    selection_criteria:
+    - dimension: analysis_complexity
+      required: true
+      options:
+      - value: complex
+        technologies:
+        - claude-opus
+        - gpt-4-turbo
+        cost_tier: premium
+        use_case: Deep bundle analysis, complex optimization strategies
+      - value: standard
+        technologies:
+        - claude-sonnet
+        - gpt-4o
+        cost_tier: standard
+        use_case: Standard performance analysis, common optimizations
+      - value: simple
+        technologies:
+        - gemini-flash
+        - claude-haiku
+        cost_tier: economy
+        use_case: Quick scans, obvious issues, high-volume checks
+  moe:
+    primary:
+      metric: performance_improvement_percentage
+      description: Percentage improvement in key performance metrics
+      target: 30.0
+      measurement:
+        type: percentage
+        numerator: performance_gain
+        denominator: baseline_performance
+        collection:
+          source: performance-monitor
+          interval: real_time
+    secondary:
+    - metric: bundle_size_reduction
+      description: Reduction in bundle size
+      target: 30.0
+      unit: percentage
+    - metric: render_time_improvement
+      description: Improvement in render time
+      target: 20.0
+      unit: percentage
+    - metric: optimization_accuracy
+      description: Accuracy of optimization recommendations
+      target: 0.85
+      unit: ratio
+  capabilities:
+    discovery:
+      enabled: true
+      registry: agent-mesh
+      refresh_interval: 60s
+  feedback:
+    tools:
+    - name: record_feedback
+      description: Record feedback on optimization effectiveness
+    - name: get_feedback_summary
+      description: Get aggregate feedback for improvement
+    learning:
+      enabled: true
+      strategy: reinforcement
+      data_sources:
+      - optimization_outcomes
+      - performance_metrics
+      - user_feedback
+  infrastructure:
+  - type: agent_mesh
+    endpoint: mesh.blueflyagents.com:3005
+    capabilities:
+    - performance_monitoring
+    - code_analysis
+  runtime:
+    triggers:
+      keywords:
+      - performance
+      - optimize
+      - slow
+      - bundle
+      - waterfall
+      - re-render
+      - memoization
+      - lazy
+      - code-splitting
+      - bundle size
+      - cold start
+      - render performance
+      file_patterns:
+      - '**/*.{tsx,jsx}'
+      - '**/components/**'
+      - '**/app/**'
+      - '**/pages/**'
+      - '**/*.react.{ts,tsx,js,jsx}'
+      frameworks:
+      - next.js
+      - react
+      - remix
+      - gatsby
+      - vite
+      project_types:
+      - react-app
+      - next-app
+      - remix-app
+    activation:
+      automatic: true
+      confidence_threshold: 0.7
+      priority_threshold: 80
+  gitlab:
+    triggers:
+    - event: merge_request
+      filter:
+        labels:
+        - performance
+        - optimization
+        files:
+        - '**/*.{tsx,jsx}'
+    - event: webhook
+      path: /react-performance-expert/analyze
+    custom_fields:
+      performance_impact: estimated
+      optimizations_applied: boolean
+      bundle_size_change: number
+  opentelemetry:
+    enabled: true
+    service_name: react-performance-expert
+    service_version: 1.0.0
+    traces:
+      enabled: true
+      exporter: otlp
+      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://localhost:4317}
+      sample_rate: 1.0
+    metrics:
+      enabled: true
+      exporter: otlp
+      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://localhost:4317}
+    logs:
+      enabled: true
+      exporter: otlp
+      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://localhost:4317}
+      level: info
+    resource_attributes:
+      agent.id: react-performance-expert
+      agent.version: 1.0.0
+      framework: ossa
+      domain: frontend-performance

package/examples/ossa-templates/README.md

@@ -0,0 +1,98 @@
+# OSSA Specification Templates
+
+10 OSSA v0.3.3 manifest templates showcasing the full specification.
+
+## Templates
+
+| # | Template | Kind | Category | Features Showcased |
+|---|----------|------|----------|-------------------|
+| 01 | **code-assistant** | Agent | Development | IDE extensions, tool use, LLM config |
+| 02 | **security-scanner** | Agent | Security | Safety policies, constraints, access tiers |
+| 03 | **ci-pipeline** | Agent | DevOps | Runtime integration, messaging, GitLab extension |
+| 04 | **code-reviewer** | Agent | Development | Identity, access tiers, contracts |
+| 05 | **doc-generator** | Agent | Documentation | Multi-provider LLM, templates |
+| 06 | **compliance-validator** | Agent | Compliance | Schema validation, policy DSL |
+| 07 | **workflow-orchestrator** | Workflow | Orchestration | Multi-agent composition, state management |
+| 08 | **content-writer** | Agent | Content | Drupal extension, async processing |
+| 09 | **test-generator** | Agent | Testing | Code analysis, multi-language |
+| 10 | **data-transformer** | Agent | Data | Deterministic execution, batch processing |
+
+## OSSA Kinds Demonstrated
+
+- **Agent** - AI agents with LLM inference
+- **Workflow** - Multi-agent orchestration
+- **Task** - Deterministic, non-agentic operations
+
+## Key Features
+
+### 1. IDE Integration (code-assistant)
+```yaml
+extensions:
+  claude-code:
+    hooks: [before_execute, after_execute]
+  cursor:
+    composer_integration: true
+  copilot:
+    suggestions: { enabled: true }
+```
+
+### 2. Safety & Access Control (security-scanner)
+```yaml
+safety:
+  constraints:
+    - Never expose actual secret values
+  policies:
+    - policy: no-secret-exposure
+identity:
+  access_tier: elevated
+  permissions: [security.scan.read]
+```
+
+### 3. Agent Composition (workflow-orchestrator)
+```yaml
+kind: Workflow
+spec:
+  agents:
+    - ref: code-reviewer
+      on_complete: security-scanner
+  steps:
+    - id: review
+      agent: reviewer
+      depends_on: []
+```
+
+### 4. Drupal Extension (content-writer)
+```yaml
+extensions:
+  drupal:
+    module: ai_agents_ossa
+    messenger:
+      transport: redis
+      queue: content_generation
+    workflow_engine: eca
+```
+
+### 5. Deterministic Execution (data-transformer)
+```yaml
+kind: Agent
+spec:
+  execution:
+    type: deterministic
+    batch:
+      enabled: true
+      parallelism: 10
+```
+
+## Usage
+
+```bash
+# Validate all OSSA templates
+ossa validate examples/ossa-templates/*.ossa.yaml
+
+# Generate agent from template
+ossa generate agent security-scanner -o my-scanner.ossa.yaml
+```
+
+## Documentation
+
+https://openstandardagents.org/agents

package/examples/production/document-analyzer-openai.yml

@@ -1,7 +1,7 @@
 # OSSA Agent with OpenAI Bridge Configuration Example
 # Document Analyzer Agent - Proof of Concept
 
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.5
 kind: Agent
 metadata:
   name: document-analyzer

package/examples/quickstart/support-agent.ossa.yaml

@@ -1,59 +1,57 @@
-# OSSA Quickstart Example - Customer Support Agent
-# Run with: ossa run examples/quickstart/support-agent.ossa.yaml
-
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.5
 kind: Agent
-
 metadata:
   name: support-agent
   version: 1.0.0
-  description: A helpful customer support agent that answers questions and helps with orders
-
+  description: A helpful customer support agent that answers questions and helps with
+    orders
 spec:
-  role: |
-    You are a friendly and helpful customer support agent for an e-commerce company.
+  role: 'You are a friendly and helpful customer support agent for an e-commerce company.
+
 
     Your responsibilities:
+
     - Answer questions about orders, shipping, and returns
+
     - Help customers track their packages
+
     - Provide information about products
+
     - Escalate complex issues to human agents when needed
 
-    Always be polite, concise, and helpful. If you don't know something, say so honestly.
 
+    Always be polite, concise, and helpful. If you don''t know something, say so honestly.
+
+    '
   llm:
     provider: openai
     model: gpt-4o-mini
     temperature: 0.7
     maxTokens: 1000
-
   tools:
-    - type: function
-      name: get_order_status
-      capabilities:
-        - order_tracking
-
+  - type: function
+    name: get_order_status
+    capabilities:
+    - order_tracking
   autonomy:
     level: supervised
     approval_required: false
-
   observability:
     logging:
       level: info
       format: json
-
 extensions:
   openai_agents:
     model: gpt-4o-mini
     tools_mapping:
-      - ossa_capability: order_tracking
-        openai_tool_name: get_order_status
-        description: Get the status of a customer order by order ID
-        parameters:
-          type: object
-          properties:
-            order_id:
-              type: string
-              description: The order ID to look up (e.g., ORD-12345)
-          required:
-            - order_id
+    - ossa_capability: order_tracking
+      openai_tool_name: get_order_status
+      description: Get the status of a customer order by order ID
+      parameters:
+        type: object
+        properties:
+          order_id:
+            type: string
+            description: The order ID to look up (e.g., ORD-12345)
+        required:
+        - order_id

package/examples/rag-agent/index.ts

@@ -68,7 +68,7 @@ export async function createRagAgent(): Promise<OssaAgent> {
   await vectorStore.index([
     {
       id: 'doc1',
-      content: 'OSSA (Open Standard for Scalable AI Agents) is a specification standard for AI agents, similar to OpenAPI for REST APIs.',
+      content: 'OSSA (Open Standard for Software Agents) is a specification standard for software agents - The OpenAPI for agents.',
       metadata: { category: 'documentation' }
     },
     {

package/examples/real-world/gitlab-cicd-optimizer.ossa.yaml

@@ -1,7 +1,8 @@
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.5
 kind: Agent
 metadata:
   name: gitlab-cicd-optimizer
+  version: "1.0.0"
   description: |
     Real-world agent that optimizes GitLab CI/CD pipelines by:
     - Analyzing pipeline performance
@@ -155,9 +156,16 @@ spec:
       provider: opentelemetry
       endpoint: "${env.OTEL_ENDPOINT}"
     metrics:
-      - name: pipelines_analyzed
-        type: counter
-      - name: recommendations_generated
-        type: counter
-      - name: average_pipeline_duration
-        type: gauge
+      enabled: true
+      exporter: prometheus
+      port: 9090
+      customMetrics:
+        - name: pipelines_analyzed
+          type: counter
+          description: Total number of pipelines analyzed
+        - name: recommendations_generated
+          type: counter
+          description: Total number of recommendations generated
+        - name: average_pipeline_duration
+          type: gauge
+          description: Average pipeline duration in seconds

package/examples/real-world/rag-documentation-assistant.ossa.yaml

@@ -1,7 +1,8 @@
-apiVersion: ossa/v0.3.2
+apiVersion: ossa/v0.3.5
 kind: Agent
 metadata:
   name: rag-documentation-assistant
+  version: "1.0.0"
   description: |
     Production RAG agent that answers questions about your codebase using:
     - Vector embeddings of documentation
@@ -224,12 +225,5 @@ spec:
       enabled: true
       provider: opentelemetry
     metrics:
-      - name: questions_answered
-        type: counter
-        labels: [user_id, confidence_bucket]
-      - name: retrieval_latency
-        type: histogram
-      - name: generation_latency
-        type: histogram
-      - name: knowledge_base_size
-        type: gauge
+      enabled: true
+      port: 9090

package/examples/reference-implementations/typescript-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossa/typescript-client",
-  "version": "1.0.0",
+  "version": "0.3.3",
   "description": "TypeScript reference implementation for OSSA API",
   "type": "module",
   "main": "./dist/index.js",

package/examples/registry/USAGE.txt

@@ -0,0 +1,105 @@
+OSSA Registry MVP - Usage Guide
+================================
+
+The OSSA Registry MVP provides local agent discovery and publishing capabilities.
+
+Quick Start
+-----------
+
+1. Publish an agent to the local registry:
+
+   ossa publish examples/registry/agents/security-scanner --registry ./examples/registry
+
+   This will:
+   - Validate the agent manifest
+   - Create a bundle tarball with SBOM and checksums
+   - Update the registry index.json
+
+2. Search for agents in the registry:
+
+   ossa catalog search security --registry ./examples/registry
+
+   Filter by role:
+   ossa catalog search --role audit --registry ./examples/registry
+
+   Filter by compliance:
+   ossa catalog search --compliance fedramp --registry ./examples/registry
+
+3. View detailed agent information:
+
+   ossa catalog info security-scanner --registry ./examples/registry
+
+   View as JSON:
+   ossa catalog info security-scanner --json --registry ./examples/registry
+
+
+Example Agents
+--------------
+
+This directory contains two example agents:
+
+1. security-scanner (v1.0.0)
+   - Role: audit
+   - Automated security vulnerability scanner
+   - Capabilities: CVE scanning, secret detection, SAST analysis
+   - Compliance: FedRAMP, SOC2, ISO27001
+
+2. code-reviewer (v1.0.0)
+   - Role: workflow
+   - Intelligent code review agent
+   - Capabilities: code analysis, best practices, security review
+   - Compliance: SOC2, ISO27001
+
+
+Registry Structure
+------------------
+
+./examples/registry/
+├── index.json              # Registry index (searchable metadata)
+├── agents/
+│   ├── security-scanner/
+│   │   └── agent.yaml     # Agent manifest
+│   └── code-reviewer/
+│       └── agent.yaml     # Agent manifest
+└── bundles/               # Published bundles (created by ossa publish)
+    ├── security-scanner-1.0.0.tar.gz
+    ├── security-scanner-1.0.0.tar.gz.sha256
+    ├── code-reviewer-1.0.0.tar.gz
+    └── code-reviewer-1.0.0.tar.gz.sha256
+
+
+Bundle Contents
+---------------
+
+Each published bundle includes:
+- agent.yaml: Agent manifest
+- sbom.json: Software Bill of Materials (CycloneDX format)
+- SHA-256 checksum for integrity verification
+
+
+Publishing Workflow
+-------------------
+
+1. Create agent manifest (agent.yaml)
+2. Run: ossa publish <agent-dir> --registry <registry-path>
+3. Agent is added to registry index
+4. Bundle is created with SBOM and checksum
+5. Search and discover agents via catalog commands
+
+
+Integration Tests
+-----------------
+
+Run the registry integration tests:
+
+npm test tests/integration/registry/
+
+
+Next Steps
+----------
+
+- Install published agents from the registry
+- Remote registry support (GitLab/GitHub)
+- Agent versioning and updates
+- Digital signatures for bundles
+- Registry mirroring and replication