@bluefly/openstandardagents 0.3.2 → 0.3.5

package/dist/spec/reference/reference-agents/pipeline-fixer/manifest.ossa.yaml

@@ -0,0 +1,336 @@
+# ============================================================================
+# OSSA Pipeline Fixer Agent
+# ============================================================================
+#
+# PURPOSE:
+#   Automatically detect and fix common CI/CD pipeline failures. Analyzes
+#   job logs, identifies root causes, and applies fixes or suggests
+#   remediation steps.
+#
+# ============================================================================
+
+apiVersion: ossa/v0.3.5
+kind: Agent
+
+metadata:
+  name: pipeline-fixer
+  version: 1.0.0
+  description: |
+    Automated CI/CD pipeline failure detection and remediation agent.
+    Analyzes failing jobs, identifies root causes, and applies fixes
+    for common issues like dependency conflicts, test flakes, and
+    configuration errors.
+  labels:
+    environment: production
+    team: devops
+    domain: ci-cd
+    capability: pipeline-automation
+    integration: gitlab
+    ossa-version: v0.3.0
+  annotations:
+    documentation: https://openstandardagents.org/docs/agents/pipeline-fixer
+    support: ops@openstandardagents.org
+
+spec:
+  lifecycle:
+    phases:
+      - name: message_normalization
+        description: "Normalize incoming messages to canonical format"
+        timeout: 5s
+        retry: 2
+      - name: tool_resolution
+        description: "Resolve available tools and capabilities"
+        timeout: 10s
+        retry: 1
+      - name: llm_inference
+        description: "Execute LLM reasoning with context"
+        timeout: 60s
+        retry: 3
+      - name: tool_execution
+        description: "Execute resolved tools and actions"
+        timeout: 120s
+        retry: 2
+      - name: response_assembly
+        description: "Assemble final response"
+        timeout: 5s
+        retry: 1
+      - name: state_persistence
+        description: "Persist state and memory updates"
+        timeout: 10s
+        retry: 3
+      - name: observability_emission
+        description: "Emit telemetry, traces, and metrics"
+        timeout: 5s
+        retry: 1
+
+  taxonomy:
+    domain: ci-cd
+    subdomain: pipeline-automation
+    capability: failure-remediation
+
+  role: |
+    You are an expert CI/CD engineer specializing in GitLab pipeline
+    troubleshooting and automated remediation.
+
+    Your responsibilities:
+    1. Analyze failing pipeline job logs
+    2. Identify root causes of failures
+    3. Apply automated fixes for common issues
+    4. Create merge requests with fixes
+    5. Retry pipelines after fixes
+    6. Escalate complex issues to humans
+
+    Common failure patterns you can fix:
+    - Dependency version conflicts (npm, composer, pip)
+    - Flaky tests (add retry, increase timeout)
+    - Missing environment variables
+    - Docker build failures (cache, layer issues)
+    - Resource limits (memory, disk)
+    - Network timeouts (retry logic)
+    - Linting/formatting issues (auto-fix)
+
+  llm:
+    provider: anthropic
+    model: claude-3-5-sonnet-20241022
+    temperature: 0.1
+    maxTokens: 8000
+
+  tools:
+    - type: mcp
+      name: gitlab-api
+      description: Access GitLab CI/CD API for pipelines, jobs, and logs.
+      config:
+        server: gitlab-mcp
+        scope: ci-cd
+      auth:
+        type: bearer
+        tokenPath: /var/secrets/gitlab-token
+
+    - type: mcp
+      name: filesystem
+      description: Read and modify CI configuration files.
+      config:
+        server: filesystem-mcp
+        allowed_paths:
+          - '.gitlab-ci.yml'
+          - '.gitlab/**'
+          - 'package*.json'
+          - 'composer*.json'
+
+    - type: a2a
+      name: agent-mesh
+      description: Communicate with gitops-deployer and mr-reviewer agents.
+      endpoint: http://agent-mesh:9090/a2a
+      config:
+        protocol: json-rpc
+        version: "2.0"
+
+  capabilities:
+    policy: deny_by_default
+    grants:
+      - capability: file_read
+        scope: [".gitlab-ci.yml", ".gitlab/**/*.yml", "package*.json", "composer*.json", "requirements*.txt", "Dockerfile*", "docker-compose*.yml"]
+        rationale: "Read CI configuration and dependency files for failure analysis"
+      - capability: file_write
+        scope: [".gitlab-ci.yml", ".gitlab/**/*.yml", "package*.json", "composer*.json", "requirements*.txt"]
+        rationale: "Write fixes to CI configuration and dependency files"
+      - capability: api_call
+        scope: ["gitlab.com/api/v4/projects/*/pipelines/*", "gitlab.com/api/v4/projects/*/jobs/*"]
+        rate_limit: "100/minute"
+        rationale: "GitLab API access for pipeline and job operations"
+      - capability: api_call
+        scope: ["gitlab.com/api/v4/projects/*/merge_requests"]
+        rate_limit: "20/minute"
+        rationale: "Create merge requests with pipeline fixes"
+      - capability: pipeline_retry
+        scope: ["gitlab.com/api/v4/projects/*/pipelines/*/retry"]
+        rate_limit: "10/minute"
+        rationale: "Retry failed pipelines after applying fixes"
+      - capability: llm_inference
+        providers: ["anthropic"]
+        models: ["claude-3-5-sonnet-20241022"]
+        rationale: "AI reasoning for failure analysis and fix generation"
+      - capability: agent_communication
+        scope: ["gitops-deployer", "mr-reviewer"]
+        rationale: "Coordinate with deployment and review agents"
+
+    actions:
+      - name: analyze_failure
+        description: Analyze a failing pipeline job
+        input_schema:
+          type: object
+          properties:
+            project_id: { type: string }
+            job_id: { type: integer }
+          required: [project_id, job_id]
+        output_schema:
+          type: object
+          properties:
+            failure_type: { type: string }
+            root_cause: { type: string }
+            suggested_fix: { type: string }
+            auto_fixable: { type: boolean }
+            success: { type: boolean }
+
+      - name: apply_fix
+        description: Apply automated fix for a failure
+        input_schema:
+          type: object
+          properties:
+            project_id: { type: string }
+            failure_type: { type: string }
+            fix_config: { type: object }
+          required: [project_id, failure_type]
+
+      - name: retry_pipeline
+        description: Retry a failed pipeline
+        input_schema:
+          type: object
+          properties:
+            project_id: { type: string }
+            pipeline_id: { type: integer }
+          required: [project_id, pipeline_id]
+
+  triggers:
+    - type: webhook
+      name: on_pipeline_failed
+      event: pipeline
+      filter:
+        status: failed
+
+    - type: webhook
+      name: on_job_failed
+      event: job
+      filter:
+        status: failed
+
+  autonomy:
+    level: autonomous
+    approval_required: false
+    allowed_actions:
+      - analyze_failure
+      - apply_fix
+      - retry_pipeline
+      - create_merge_requests
+    blocked_actions:
+      - delete_pipelines
+      - modify_protected_branches
+
+  constraints:
+    cost:
+      maxTokensPerDay: 200000
+      maxCostPerDay: 20.00
+      currency: USD
+    performance:
+      maxLatencySeconds: 120
+      timeoutSeconds: 300
+    resources:
+      cpu: "1000m"
+      memory: "2Gi"
+
+  observability:
+    telemetry:
+      enabled: true
+      exporter: otlp
+      endpoint: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
+      service_name: "${AGENT_NAME}"
+      service_version: "${AGENT_VERSION}"
+    tracing:
+      enabled: true
+      sampler: parentbased_traceidratio
+      sample_rate: 0.1
+      propagation: ["tracecontext", "baggage"]
+    metrics:
+      enabled: true
+      interval: 30s
+      histogram_buckets: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
+      labels:
+        - agent_name
+        - agent_version
+        - phase
+        - capability
+        - status
+    logging:
+      level: info
+      format: json
+      redact_pii: true
+      structured: true
+      fields:
+        - execution_id
+        - agent_id
+        - phase
+        - duration_ms
+
+  safety:
+    guardrails:
+      pii_detection:
+        enabled: true
+        action: redact
+        categories: ["email", "phone", "ssn", "credit_card"]
+      secrets_detection:
+        enabled: true
+        action: block
+        patterns:
+          - "glpat-*"
+          - "ghp_*"
+          - "sk-*"
+          - "bearer *"
+          - "password=*"
+          - "api_key=*"
+      prompt_injection:
+        enabled: true
+        action: warn
+        detection: ["ignore previous", "system prompt", "jailbreak"]
+      content_policy:
+        enabled: true
+        categories:
+          violence: block
+          hate: block
+          sexual: block
+          self_harm: block
+    kill_switch:
+      enabled: true
+      trigger: manual
+      webhook: "${KILL_SWITCH_WEBHOOK}"
+      grace_period: 30s
+    compliance:
+      profiles:
+        - fedramp_moderate
+        - hipaa
+        - gdpr
+        - soc2_type2
+
+extensions:
+  kagent:
+    api_version: kagent.dev/v1alpha2
+    kubernetes:
+      namespace: agent-system
+      labels:
+        app.kubernetes.io/name: pipeline-fixer
+        app.kubernetes.io/part-of: ossa-showcase
+        openstandardagents.org/version: v0.3.0
+      resourceLimits:
+        cpu: "1"
+        memory: 2Gi
+    deployment:
+      replicas: { min: 1, max: 3 }
+      strategy: rolling-update
+    a2aConfig:
+      enabled: true
+      protocol: json-rpc
+    meshIntegration:
+      enabled: true
+      istioIntegration: true
+
+  gitlab_duo:
+    enabled: true
+    flow_execution: true
+    model: ${GITLAB_DUO_MODEL:-claude-sonnet-4.5-20250929}
+    knowledge_graph:
+      enabled: true
+      index_on_push: true
+
+  mcp:
+    enabled: true
+    server_type: stdio
+    server_name: pipeline-fixer-mcp

package/dist/spec/reference/reference-agents/release-orchestrator/README.md

@@ -0,0 +1,35 @@
+# Release Orchestrator Agent
+
+**Version**: 1.0.0  
+**Type**: Orchestrator  
+**Domain**: Release Automation
+
+## Overview
+
+Autonomous AI agent powered by GitLab Duo that executes production releases with zero human intervention.
+
+## Activation
+
+Close a milestone matching pattern `vX.Y.Z` with all issues closed.
+
+## Workflow
+
+1. Validate milestone (all issues closed)
+2. Generate release notes
+3. Update CHANGELOG.md
+4. Create release MR with auto-merge
+5. Publish to npm
+6. Create GitLab Release
+7. Tag issues/MRs
+8. Close milestone
+9. Create next milestone
+10. Sync branches
+
+## Usage
+
+```bash
+# Close milestone - agent handles the rest
+glab milestone close "v0.3.0 - Release & Polish"
+```
+
+See full documentation in this directory.

package/dist/spec/reference/reference-agents/release-orchestrator/manifest.ossa.yaml

@@ -0,0 +1,233 @@
+apiVersion: ossa/v0.3.5
+kind: Agent
+metadata:
+  name: release-orchestrator
+  version: 1.0.0
+  labels:
+    domain: release-automation
+    priority: critical
+    team: platform
+    ossa-version: v0.3.0
+spec:
+  lifecycle:
+    phases:
+      - name: message_normalization
+        description: "Normalize incoming messages to canonical format"
+        timeout: 5s
+        retry: 2
+      - name: tool_resolution
+        description: "Resolve available tools and capabilities"
+        timeout: 10s
+        retry: 1
+      - name: llm_inference
+        description: "Execute LLM reasoning with context"
+        timeout: 60s
+        retry: 3
+      - name: tool_execution
+        description: "Execute resolved tools and actions"
+        timeout: 120s
+        retry: 2
+      - name: response_assembly
+        description: "Assemble final response"
+        timeout: 5s
+        retry: 1
+      - name: state_persistence
+        description: "Persist state and memory updates"
+        timeout: 10s
+        retry: 3
+      - name: observability_emission
+        description: "Emit telemetry, traces, and metrics"
+        timeout: 5s
+        retry: 1
+
+  type: orchestrator
+  identity:
+    instance_id:
+      generation: uuid_v4
+      scope: pod
+    session_id:
+      generation: uuid_v4
+      scope: workflow
+    interaction_id:
+      generation: uuid_v4
+      scope: turn
+  reasoning:
+    strategy: react
+    max_steps: 25
+    max_depth: 5
+    trace_enabled: true
+    export_format: otel
+    self_reflection:
+      enabled: true
+      trigger: on_failure
+      threshold: 0.95
+  prompts:
+    system:
+      template: |
+        You are the OSSA Release Orchestrator - autonomous AI for production releases.
+        Execute flawless releases when milestones close with zero human intervention.
+      version: 1.0.0
+  capabilities:
+    policy: deny_by_default
+    grants:
+      - capability: file_read
+        scope: ["CHANGELOG.md", "package.json", "VERSION", "*.version", ".releaserc*"]
+        rationale: "Read version files and changelog for release preparation"
+      - capability: file_write
+        scope: ["CHANGELOG.md", "package.json", "VERSION", "*.version"]
+        rationale: "Update version files and changelog during release"
+      - capability: api_call
+        scope: ["gitlab.com/api/v4/projects/*/milestones/*"]
+        rate_limit: "50/minute"
+        rationale: "GitLab API access for milestone validation and management"
+      - capability: api_call
+        scope: ["gitlab.com/api/v4/projects/*/issues*", "gitlab.com/api/v4/projects/*/labels*"]
+        rate_limit: "100/minute"
+        rationale: "GitLab API access for issue queries and label management"
+      - capability: api_call
+        scope: ["gitlab.com/api/v4/projects/*/releases*"]
+        rate_limit: "20/minute"
+        rationale: "GitLab API access for release creation"
+      - capability: api_call
+        scope: ["gitlab.com/api/v4/projects/*/merge_requests"]
+        rate_limit: "30/minute"
+        rationale: "GitLab API access for merge request creation"
+      - capability: npm_publish
+        scope: ["@bluefly/*", "@openstandardagents/*"]
+        rate_limit: "10/hour"
+        rationale: "Publish packages to npm registry"
+      - capability: changelog_generate
+        scope: ["conventional-commits"]
+        rationale: "Generate changelog from conventional commits"
+      - capability: llm_inference
+        providers: ["anthropic", "openai"]
+        models: ["claude-sonnet", "gpt-4o"]
+        rationale: "AI reasoning for release notes and decision making"
+      - capability: git_operations
+        scope: ["tag", "push"]
+        rationale: "Create and push git tags for releases"
+
+    actions:
+      - ossa:gitlab/milestone_validate@1.0
+      - ossa:gitlab/issue_query@1.0
+      - ossa:gitlab/changelog_generate@1.0
+      - ossa:gitlab/mr_create@1.0
+      - ossa:gitlab/release_create@1.0
+      - ossa:gitlab/label_apply@1.0
+      - ossa:gitlab/milestone_manage@1.0
+      - ossa:npm/publish@1.0
+  tools:
+    - name: gitlab-api
+      type: http
+      config:
+        base_url: ${CI_API_V4_URL}
+        auth:
+          type: bearer
+          token_ref: GITLAB_PUSH_TOKEN
+  triggers:
+    - type: webhook
+      event: milestone
+      conditions:
+        - object_attributes.action == "close"
+        - object_attributes.title matches "^v\\d+\\.\\d+\\.\\d+"
+  observability:
+    telemetry:
+      enabled: true
+      exporter: otlp
+      endpoint: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
+      service_name: "${AGENT_NAME}"
+      service_version: "${AGENT_VERSION}"
+    tracing:
+      enabled: true
+      sampler: parentbased_traceidratio
+      sample_rate: 0.1
+      propagation: ["tracecontext", "baggage"]
+    metrics:
+      enabled: true
+      interval: 30s
+      histogram_buckets: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10]
+      labels:
+        - agent_name
+        - agent_version
+        - phase
+        - capability
+        - status
+    logging:
+      level: info
+      format: json
+      redact_pii: true
+      structured: true
+      fields:
+        - execution_id
+        - agent_id
+        - phase
+        - duration_ms
+  safety:
+    guardrails:
+      pii_detection:
+        enabled: true
+        action: redact
+        categories: ["email", "phone", "ssn", "credit_card"]
+      secrets_detection:
+        enabled: true
+        action: block
+        patterns:
+          - "glpat-*"
+          - "ghp_*"
+          - "sk-*"
+          - "bearer *"
+          - "password=*"
+          - "api_key=*"
+      prompt_injection:
+        enabled: true
+        action: warn
+        detection: ["ignore previous", "system prompt", "jailbreak"]
+      content_policy:
+        enabled: true
+        categories:
+          violence: block
+          hate: block
+          sexual: block
+          self_harm: block
+    kill_switch:
+      enabled: true
+      trigger: manual
+      webhook: "${KILL_SWITCH_WEBHOOK}"
+      grace_period: 30s
+    compliance:
+      profiles:
+        - fedramp_moderate
+        - hipaa
+        - gdpr
+        - soc2_type2
+extensions:
+  gitlab_duo:
+    enabled: true
+    flow_execution: true
+    model: ${GITLAB_DUO_MODEL:-claude-sonnet}
+  kagent:
+    api_version: kagent.dev/v1alpha2
+    kubernetes:
+      namespace: agent-system
+      labels:
+        app.kubernetes.io/name: release-orchestrator
+        app.kubernetes.io/part-of: ossa-showcase
+        openstandardagents.org/version: v0.3.0
+      resourceLimits:
+        cpu: "1"
+        memory: 2Gi
+    deployment:
+      replicas:
+        min: 1
+        max: 3
+      strategy: rolling-update
+    a2aConfig:
+      enabled: true
+      protocol: json-rpc
+    meshIntegration:
+      enabled: true
+      istioIntegration: true
+  mcp:
+    enabled: true
+    server_type: stdio
+    server_name: release-orchestrator-mcp

package/dist/spec/registry/README.md

@@ -291,7 +291,7 @@ $ ossa install blueflyio/k8s-security-scanner
 ⬇️  Downloading k8s-security-scanner@1.2.0...
 ✓ Checksum verified
 📦 Resolving dependencies...
-✓ @ossa/runtime@0.3.2
+✓ @ossa/runtime@0.3.3
 ✓ kubernetes-tools@1.28.4
 ✅ Installed k8s-security-scanner@1.2.0
 

package/dist/spec/registry/registry-spec.md

@@ -686,7 +686,7 @@ Retrieve agent dependencies with version resolution.
     "runtime": {
       "@ossa/runtime": {
         "required": "^0.3.0",
-        "resolved": "0.3.2",
+        "resolved": "0.3.3",
         "type": "runtime"
       }
     },
@@ -707,9 +707,9 @@ Retrieve agent dependencies with version resolution.
   },
   "dependency_tree": {
     "blueflyio/security-scanner@1.2.0": {
-      "@ossa/runtime@0.3.2": {},
+      "@ossa/runtime@0.3.3": {},
       "blueflyio/vuln-db-agent@2.1.5": {
-        "@ossa/runtime@0.3.2": {}
+        "@ossa/runtime@0.3.3": {}
       },
       "kubernetes-api@1.28.4": {}
     }
@@ -1163,9 +1163,9 @@ OSSA CLI resolves dependencies using semver:
 ```bash
 # Example dependency tree
 security-scanner@1.2.0
-├── @ossa/runtime@0.3.2
+├── @ossa/runtime@0.3.3
 ├── vuln-db-agent@2.1.5
-│   └── @ossa/runtime@0.3.2 (deduped)
+│   └── @ossa/runtime@0.3.3 (deduped)
 └── kubernetes-tools@1.28.4
 
 # CLI automatically:
@@ -1332,7 +1332,7 @@ Every published agent undergoes automated security scanning:
 ```yaml
 # Check dependencies for known vulnerabilities
 ✓ No vulnerable dependencies found
-  Scanned: @ossa/runtime@0.3.2, vuln-scanner-lib@2.1.0
+  Scanned: @ossa/runtime@0.3.3, vuln-scanner-lib@2.1.0
 ```
 
 #### 3. Secret Detection