@bluefly/openstandardagents 0.4.3 → 0.4.5

package/dist/sdks/kagent/crd-generator.js

@@ -1,8 +1,31 @@
 /**
  * kagent.dev CRD Generator
  * Converts OSSA manifest to kagent.dev CRD format
+ * Generates production-grade Kubernetes manifests with complete resource specs
  */
+import { getVersion } from '../../utils/version.js';
 export class KAgentCRDGenerator {
+    /**
+     * Generate complete Kubernetes manifest bundle
+     * Includes: CRD, Deployment, Service, ConfigMap, Secret, RBAC, HPA, NetworkPolicy
+     */
+    generateBundle(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            crd: this.generate(manifest, options),
+            deployment: this.generateDeployment(manifest, options),
+            service: this.generateService(manifest, options),
+            configMap: this.generateConfigMap(manifest, options),
+            secret: this.generateSecret(manifest, options),
+            serviceAccount: this.generateServiceAccount(manifest, options),
+            role: this.generateRole(manifest, options),
+            roleBinding: this.generateRoleBinding(manifest, options),
+            horizontalPodAutoscaler: this.generateHPA(manifest, options),
+            networkPolicy: this.generateNetworkPolicy(manifest, options),
+            readme: this.generateReadme(manifest, options),
+        };
+    }
     /**
      * Generate kagent CRD from OSSA manifest
      */
@@ -13,7 +36,13 @@ export class KAgentCRDGenerator {
         const systemMessage = spec.role || manifest.metadata?.description || '';
         // Extract tools
         const tools = this.extractTools(spec.tools, options);
-        // Build CRD
+        // Extract governance configuration (OSSA v0.4.4)
+        const governance = this.extractGovernance(spec.governance);
+        // Extract workflow configuration
+        const workflow = this.extractWorkflow(spec.workflow);
+        // Extract monitoring configuration
+        const monitoring = this.extractMonitoring(spec.monitoring);
+        // Build comprehensive CRD
         const crd = {
             apiVersion: 'kagent.dev/v1alpha1',
             kind: 'Agent',
@@ -21,13 +50,25 @@ export class KAgentCRDGenerator {
                 name: agentName,
                 namespace: options.namespace || 'default',
                 labels: {
-                    'ossa.ai/version': manifest.metadata?.version || '0.3.5',
+                    'ossa.ai/version': manifest.metadata?.version || getVersion(),
                     'ossa.ai/domain': spec.taxonomy?.domain ||
                         'agents',
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/version': manifest.metadata?.version || '1.0.0',
+                    'app.kubernetes.io/managed-by': 'kagent',
+                    'app.kubernetes.io/component': 'agent',
                     ...manifest.metadata?.labels,
                 },
                 annotations: {
                     'ossa.ai/manifest': JSON.stringify(manifest),
+                    'ossa.ai/generated-by': 'kagent-crd-generator',
+                    'ossa.ai/generated-at': new Date().toISOString(),
+                    ...(manifest.metadata?.annotations?.['ossa.org/gaid'] && {
+                        'ossa.ai/gaid': manifest.metadata.annotations['ossa.org/gaid'],
+                    }),
+                    ...(manifest.metadata?.annotations?.['ossa.org/serial-number'] && {
+                        'ossa.ai/serial-number': manifest.metadata.annotations['ossa.org/serial-number'],
+                    }),
                     ...manifest.metadata?.annotations,
                 },
             },
@@ -47,7 +88,14 @@ export class KAgentCRDGenerator {
                 },
                 ...(tools && tools.length > 0 && { tools }),
                 // Skills (from OSSA spec or options)
-                ...(options.skills && options.skills.length > 0 && { skills: options.skills }),
+                ...(options.skills &&
+                    options.skills.length > 0 && { skills: options.skills }),
+                // Governance (OSSA v0.4.4)
+                ...(governance && { governance }),
+                // Workflow
+                ...(workflow && { workflow }),
+                // Monitoring
+                ...(monitoring && { monitoring }),
                 // A2A Protocol
                 enableA2A: this.shouldEnableA2A(manifest),
                 ...(options.a2a && {
@@ -63,28 +111,41 @@ export class KAgentCRDGenerator {
                     codeExecution: {
                         enabled: options.codeExecution.enabled,
                         sandboxed: options.codeExecution.sandboxed !== false,
-                        allowedLanguages: options.codeExecution.allowedLanguages || ['python', 'javascript'],
+                        allowedLanguages: options.codeExecution.allowedLanguages || [
+                            'python',
+                            'javascript',
+                        ],
                     },
                 }),
                 // Resources
-                ...(options.replicas !== undefined && {
-                    resources: {
-                        replicas: options.replicas,
-                        ...options.resources,
+                resources: {
+                    replicas: options.replicas || this.getDefaultReplicas(spec),
+                    limits: {
+                        cpu: options.resources?.limits?.cpu || '1000m',
+                        memory: options.resources?.limits?.memory || '1Gi',
                     },
-                }),
+                    requests: {
+                        cpu: options.resources?.requests?.cpu || '100m',
+                        memory: options.resources?.requests?.memory || '128Mi',
+                    },
+                },
                 // Security
-                ...(options.securityContext && {
-                    securityContext: options.securityContext,
-                }),
-                // RBAC
-                ...(options.rbac && {
-                    serviceAccountName: options.rbac.serviceAccountName || `${agentName}-sa`,
-                    rbac: {
-                        enabled: options.rbac.enabled,
-                        rules: options.rbac.rules || this.getDefaultRBACRules(),
+                securityContext: options.securityContext || {
+                    runAsNonRoot: true,
+                    runAsUser: 1000,
+                    fsGroup: 1000,
+                    readOnlyRootFilesystem: true,
+                    allowPrivilegeEscalation: false,
+                    capabilities: {
+                        drop: ['ALL'],
                     },
-                }),
+                },
+                // RBAC
+                serviceAccountName: options.rbac?.serviceAccountName || `${agentName}-sa`,
+                rbac: {
+                    enabled: options.rbac?.enabled ?? true,
+                    rules: options.rbac?.rules || this.getDefaultRBACRules(),
+                },
                 // BYO Agent
                 ...(options.byoAgent && {
                     byoAgent: {
@@ -98,6 +159,642 @@ export class KAgentCRDGenerator {
         };
         return crd;
     }
+    /**
+     * Generate Kubernetes Deployment
+     */
+    generateDeployment(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        const spec = manifest.spec;
+        const crd = this.generate(manifest, options);
+        return {
+            apiVersion: 'apps/v1',
+            kind: 'Deployment',
+            metadata: {
+                name: `${agentName}-deployment`,
+                namespace,
+                labels: crd.metadata.labels,
+                annotations: crd.metadata.annotations,
+            },
+            spec: {
+                replicas: crd.spec.resources?.replicas || 1,
+                strategy: {
+                    type: 'RollingUpdate',
+                    rollingUpdate: {
+                        maxSurge: 1,
+                        maxUnavailable: 0,
+                    },
+                },
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': agentName,
+                        'app.kubernetes.io/component': 'agent',
+                    },
+                },
+                template: {
+                    metadata: {
+                        labels: crd.metadata.labels,
+                        annotations: {
+                            'prometheus.io/scrape': 'true',
+                            'prometheus.io/port': '9090',
+                            'prometheus.io/path': '/metrics',
+                        },
+                    },
+                    spec: {
+                        serviceAccountName: crd.spec.serviceAccountName,
+                        securityContext: {
+                            runAsNonRoot: true,
+                            runAsUser: 1000,
+                            fsGroup: 1000,
+                            seccompProfile: {
+                                type: 'RuntimeDefault',
+                            },
+                        },
+                        containers: [
+                            {
+                                name: 'agent',
+                                image: options.byoAgent?.image || `${agentName}:latest`,
+                                imagePullPolicy: 'IfNotPresent',
+                                ports: [
+                                    {
+                                        name: 'http',
+                                        containerPort: 3000,
+                                        protocol: 'TCP',
+                                    },
+                                    {
+                                        name: 'metrics',
+                                        containerPort: 9090,
+                                        protocol: 'TCP',
+                                    },
+                                ],
+                                env: [
+                                    {
+                                        name: 'NODE_ENV',
+                                        value: 'production',
+                                    },
+                                    {
+                                        name: 'AGENT_NAME',
+                                        value: agentName,
+                                    },
+                                    {
+                                        name: 'AGENT_VERSION',
+                                        value: manifest.metadata?.version || '1.0.0',
+                                    },
+                                    {
+                                        name: 'OSSA_VERSION',
+                                        value: getVersion(),
+                                    },
+                                ],
+                                envFrom: [
+                                    {
+                                        configMapRef: {
+                                            name: `${agentName}-config`,
+                                        },
+                                    },
+                                    {
+                                        secretRef: {
+                                            name: `${agentName}-secret`,
+                                            optional: true,
+                                        },
+                                    },
+                                ],
+                                resources: crd.spec.resources,
+                                securityContext: crd.spec.securityContext,
+                                livenessProbe: {
+                                    httpGet: {
+                                        path: '/health',
+                                        port: 3000,
+                                        scheme: 'HTTP',
+                                    },
+                                    initialDelaySeconds: 30,
+                                    periodSeconds: 10,
+                                    timeoutSeconds: 5,
+                                    successThreshold: 1,
+                                    failureThreshold: 3,
+                                },
+                                readinessProbe: {
+                                    httpGet: {
+                                        path: '/ready',
+                                        port: 3000,
+                                        scheme: 'HTTP',
+                                    },
+                                    initialDelaySeconds: 10,
+                                    periodSeconds: 5,
+                                    timeoutSeconds: 3,
+                                    successThreshold: 1,
+                                    failureThreshold: 3,
+                                },
+                                volumeMounts: [
+                                    {
+                                        name: 'tmp',
+                                        mountPath: '/tmp',
+                                    },
+                                ],
+                            },
+                        ],
+                        volumes: [
+                            {
+                                name: 'tmp',
+                                emptyDir: {},
+                            },
+                        ],
+                    },
+                },
+            },
+        };
+    }
+    /**
+     * Generate Kubernetes Service
+     */
+    generateService(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            apiVersion: 'v1',
+            kind: 'Service',
+            metadata: {
+                name: `${agentName}-service`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            spec: {
+                type: 'ClusterIP',
+                selector: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+                ports: [
+                    {
+                        name: 'http',
+                        port: 80,
+                        targetPort: 3000,
+                        protocol: 'TCP',
+                    },
+                    {
+                        name: 'metrics',
+                        port: 9090,
+                        targetPort: 9090,
+                        protocol: 'TCP',
+                    },
+                ],
+                sessionAffinity: 'ClientIP',
+            },
+        };
+    }
+    /**
+     * Generate ConfigMap
+     */
+    generateConfigMap(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        const spec = manifest.spec;
+        return {
+            apiVersion: 'v1',
+            kind: 'ConfigMap',
+            metadata: {
+                name: `${agentName}-config`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            data: {
+                'agent-config.json': JSON.stringify({
+                    role: spec.role,
+                    llm: spec.llm,
+                    tools: spec.tools,
+                    workflow: spec.workflow,
+                    monitoring: spec.monitoring,
+                }, null, 2),
+                'ossa-manifest.yaml': JSON.stringify(manifest, null, 2),
+            },
+        };
+    }
+    /**
+     * Generate Secret (placeholder - user must fill in secrets)
+     */
+    generateSecret(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            apiVersion: 'v1',
+            kind: 'Secret',
+            metadata: {
+                name: `${agentName}-secret`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            type: 'Opaque',
+            stringData: {
+                API_KEY: 'REPLACE_WITH_YOUR_API_KEY',
+                ANTHROPIC_API_KEY: 'REPLACE_WITH_ANTHROPIC_KEY',
+                OPENAI_API_KEY: 'REPLACE_WITH_OPENAI_KEY',
+            },
+        };
+    }
+    /**
+     * Generate ServiceAccount
+     */
+    generateServiceAccount(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            apiVersion: 'v1',
+            kind: 'ServiceAccount',
+            metadata: {
+                name: `${agentName}-sa`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            automountServiceAccountToken: true,
+        };
+    }
+    /**
+     * Generate Role
+     */
+    generateRole(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            apiVersion: 'rbac.authorization.k8s.io/v1',
+            kind: 'Role',
+            metadata: {
+                name: `${agentName}-role`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            rules: this.getDefaultRBACRules(),
+        };
+    }
+    /**
+     * Generate RoleBinding
+     */
+    generateRoleBinding(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            apiVersion: 'rbac.authorization.k8s.io/v1',
+            kind: 'RoleBinding',
+            metadata: {
+                name: `${agentName}-rolebinding`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            subjects: [
+                {
+                    kind: 'ServiceAccount',
+                    name: `${agentName}-sa`,
+                    namespace,
+                },
+            ],
+            roleRef: {
+                kind: 'Role',
+                name: `${agentName}-role`,
+                apiGroup: 'rbac.authorization.k8s.io',
+            },
+        };
+    }
+    /**
+     * Generate HorizontalPodAutoscaler
+     */
+    generateHPA(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        const spec = manifest.spec;
+        // Only generate HPA if agent supports horizontal scaling
+        const scalability = spec.agentArchitecture?.runtime?.scalability;
+        if (scalability !== 'horizontal') {
+            return null;
+        }
+        return {
+            apiVersion: 'autoscaling/v2',
+            kind: 'HorizontalPodAutoscaler',
+            metadata: {
+                name: `${agentName}-hpa`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            spec: {
+                scaleTargetRef: {
+                    apiVersion: 'apps/v1',
+                    kind: 'Deployment',
+                    name: `${agentName}-deployment`,
+                },
+                minReplicas: 1,
+                maxReplicas: 10,
+                metrics: [
+                    {
+                        type: 'Resource',
+                        resource: {
+                            name: 'cpu',
+                            target: {
+                                type: 'Utilization',
+                                averageUtilization: 70,
+                            },
+                        },
+                    },
+                    {
+                        type: 'Resource',
+                        resource: {
+                            name: 'memory',
+                            target: {
+                                type: 'Utilization',
+                                averageUtilization: 80,
+                            },
+                        },
+                    },
+                ],
+                behavior: {
+                    scaleDown: {
+                        stabilizationWindowSeconds: 300,
+                        policies: [
+                            {
+                                type: 'Percent',
+                                value: 50,
+                                periodSeconds: 60,
+                            },
+                        ],
+                    },
+                    scaleUp: {
+                        stabilizationWindowSeconds: 60,
+                        policies: [
+                            {
+                                type: 'Percent',
+                                value: 100,
+                                periodSeconds: 30,
+                            },
+                        ],
+                    },
+                },
+            },
+        };
+    }
+    /**
+     * Generate NetworkPolicy
+     */
+    generateNetworkPolicy(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        return {
+            apiVersion: 'networking.k8s.io/v1',
+            kind: 'NetworkPolicy',
+            metadata: {
+                name: `${agentName}-netpol`,
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': agentName,
+                    'app.kubernetes.io/component': 'agent',
+                },
+            },
+            spec: {
+                podSelector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': agentName,
+                        'app.kubernetes.io/component': 'agent',
+                    },
+                },
+                policyTypes: ['Ingress', 'Egress'],
+                ingress: [
+                    {
+                        from: [
+                            {
+                                podSelector: {
+                                    matchLabels: {
+                                        'app.kubernetes.io/component': 'gateway',
+                                    },
+                                },
+                            },
+                        ],
+                        ports: [
+                            {
+                                protocol: 'TCP',
+                                port: 3000,
+                            },
+                        ],
+                    },
+                ],
+                egress: [
+                    {
+                        to: [
+                            {
+                                namespaceSelector: {},
+                            },
+                        ],
+                        ports: [
+                            {
+                                protocol: 'TCP',
+                                port: 443,
+                            },
+                            {
+                                protocol: 'TCP',
+                                port: 80,
+                            },
+                        ],
+                    },
+                    {
+                        to: [
+                            {
+                                podSelector: {},
+                            },
+                        ],
+                        ports: [
+                            {
+                                protocol: 'TCP',
+                                port: 53,
+                            },
+                            {
+                                protocol: 'UDP',
+                                port: 53,
+                            },
+                        ],
+                    },
+                ],
+            },
+        };
+    }
+    /**
+     * Generate comprehensive README documentation
+     */
+    generateReadme(manifest, options = {}) {
+        const agentName = manifest.metadata?.name || 'unknown-agent';
+        const namespace = options.namespace || 'default';
+        const spec = manifest.spec;
+        const llm = spec.llm;
+        let readme = `# ${agentName} - Kubernetes Deployment\n\n`;
+        readme += `**Generated from OSSA v0.4.4 Manifest**\n\n`;
+        readme += `${manifest.metadata?.description || 'AI Agent deployment'}\n\n`;
+        readme += '## Overview\n\n';
+        readme += `- **Agent Name**: ${agentName}\n`;
+        readme += `- **Version**: ${manifest.metadata?.version || '1.0.0'}\n`;
+        readme += `- **Namespace**: ${namespace}\n`;
+        readme += `- **LLM Provider**: ${llm?.provider || 'unknown'}\n`;
+        readme += `- **LLM Model**: ${llm?.model || 'unknown'}\n\n`;
+        readme += '## Prerequisites\n\n';
+        readme += '- Kubernetes cluster (v1.24+)\n';
+        readme += '- kubectl CLI configured\n';
+        readme += '- kagent operator installed (optional for CRD)\n';
+        readme += '- API keys configured in secrets\n\n';
+        readme += '## Quick Start\n\n';
+        readme += '### 1. Configure Secrets\n\n';
+        readme += 'Edit the secret manifest and add your API keys:\n\n';
+        readme += '```bash\n';
+        readme += `kubectl edit secret ${agentName}-secret -n ${namespace}\n`;
+        readme += '```\n\n';
+        readme += '### 2. Deploy Resources\n\n';
+        readme += '```bash\n';
+        readme += '# Create namespace\n';
+        readme += `kubectl create namespace ${namespace}\n\n`;
+        readme += '# Apply all manifests\n';
+        readme += `kubectl apply -f ${agentName}-serviceaccount.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-role.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-rolebinding.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-secret.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-configmap.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-service.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-deployment.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-networkpolicy.yaml\n`;
+        readme += `kubectl apply -f ${agentName}-crd.yaml\n`;
+        readme += '```\n\n';
+        readme += '### 3. Verify Deployment\n\n';
+        readme += '```bash\n';
+        readme += '# Check pod status\n';
+        readme += `kubectl get pods -n ${namespace} -l app.kubernetes.io/name=${agentName}\n\n`;
+        readme += '# Check logs\n';
+        readme += `kubectl logs -n ${namespace} -l app.kubernetes.io/name=${agentName} --tail=100\n\n`;
+        readme += '# Check service\n';
+        readme += `kubectl get svc -n ${namespace} ${agentName}-service\n`;
+        readme += '```\n\n';
+        readme += '## Resource Specifications\n\n';
+        const crd = this.generate(manifest, options);
+        readme += '### Resource Limits\n\n';
+        readme += '```yaml\n';
+        readme += `replicas: ${crd.spec.resources?.replicas || 1}\n`;
+        readme += 'resources:\n';
+        readme += `  requests:\n`;
+        readme += `    cpu: ${crd.spec.resources?.requests?.cpu || '100m'}\n`;
+        readme += `    memory: ${crd.spec.resources?.requests?.memory || '128Mi'}\n`;
+        readme += `  limits:\n`;
+        readme += `    cpu: ${crd.spec.resources?.limits?.cpu || '1000m'}\n`;
+        readme += `    memory: ${crd.spec.resources?.limits?.memory || '1Gi'}\n`;
+        readme += '```\n\n';
+        readme += '## Security\n\n';
+        readme += '### Pod Security Context\n\n';
+        readme += '- **Run as non-root**: Yes\n';
+        readme += '- **User ID**: 1000\n';
+        readme += '- **Read-only root filesystem**: Yes\n';
+        readme += '- **Privilege escalation**: Disabled\n';
+        readme += '- **Capabilities**: All dropped\n\n';
+        readme += '### RBAC Permissions\n\n';
+        readme += 'The agent has minimal permissions:\n\n';
+        readme += '- Read-only access to ConfigMaps\n';
+        readme += '- Read-only access to Secrets\n';
+        readme += '- Manage own agent status\n\n';
+        readme += '### Network Policy\n\n';
+        readme += '- **Ingress**: Only from gateway pods on port 3000\n';
+        readme += '- **Egress**: HTTPS (443) and DNS (53) only\n\n';
+        readme += '## Monitoring\n\n';
+        readme += '### Prometheus Metrics\n\n';
+        readme += '```bash\n';
+        readme += '# Port-forward to metrics endpoint\n';
+        readme += `kubectl port-forward -n ${namespace} svc/${agentName}-service 9090:9090\n\n`;
+        readme += '# Access metrics\n';
+        readme += 'curl http://localhost:9090/metrics\n';
+        readme += '```\n\n';
+        readme += '### Health Checks\n\n';
+        readme += '- **Liveness**: GET /health on port 3000\n';
+        readme += '- **Readiness**: GET /ready on port 3000\n\n';
+        readme += '## Scaling\n\n';
+        const hpa = this.generateHPA(manifest, options);
+        if (hpa) {
+            readme += '### Horizontal Pod Autoscaler\n\n';
+            readme += 'HPA is configured for automatic scaling:\n\n';
+            readme += '```bash\n';
+            readme += `kubectl apply -f ${agentName}-hpa.yaml\n\n`;
+            readme += '# Check HPA status\n';
+            readme += `kubectl get hpa -n ${namespace} ${agentName}-hpa\n`;
+            readme += '```\n\n';
+            readme += '- **Min Replicas**: 1\n';
+            readme += '- **Max Replicas**: 10\n';
+            readme += '- **Target CPU**: 70%\n';
+            readme += '- **Target Memory**: 80%\n\n';
+        }
+        else {
+            readme += '### Manual Scaling\n\n';
+            readme += '```bash\n';
+            readme += `kubectl scale deployment ${agentName}-deployment -n ${namespace} --replicas=3\n`;
+            readme += '```\n\n';
+        }
+        readme += '## Troubleshooting\n\n';
+        readme += '### Pod Fails to Start\n\n';
+        readme += '```bash\n';
+        readme += '# Check pod events\n';
+        readme += `kubectl describe pod -n ${namespace} -l app.kubernetes.io/name=${agentName}\n\n`;
+        readme += '# Check logs\n';
+        readme += `kubectl logs -n ${namespace} -l app.kubernetes.io/name=${agentName} --previous\n`;
+        readme += '```\n\n';
+        readme += '### API Key Issues\n\n';
+        readme += '```bash\n';
+        readme += '# Verify secret exists\n';
+        readme += `kubectl get secret ${agentName}-secret -n ${namespace}\n\n`;
+        readme += '# Update secret\n';
+        readme += `kubectl create secret generic ${agentName}-secret \\\n`;
+        readme += `  --from-literal=API_KEY=your-key \\\n`;
+        readme += `  -n ${namespace} \\\n`;
+        readme += '  --dry-run=client -o yaml | kubectl apply -f -\n';
+        readme += '```\n\n';
+        readme += '### Network Connectivity Issues\n\n';
+        readme += '```bash\n';
+        readme += '# Check network policy\n';
+        readme += `kubectl get networkpolicy -n ${namespace} ${agentName}-netpol\n\n`;
+        readme += '# Test connectivity from pod\n';
+        readme += `kubectl exec -n ${namespace} -it <pod-name> -- curl -v https://api.anthropic.com\n`;
+        readme += '```\n\n';
+        readme += '## Cleanup\n\n';
+        readme += '```bash\n';
+        readme += '# Delete all resources\n';
+        readme += `kubectl delete -f ${agentName}-deployment.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-service.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-configmap.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-secret.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-rolebinding.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-role.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-serviceaccount.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-networkpolicy.yaml\n`;
+        readme += `kubectl delete -f ${agentName}-crd.yaml\n\n`;
+        readme += '# Or delete by label\n';
+        readme += `kubectl delete all,secret,configmap,sa,role,rolebinding,networkpolicy -n ${namespace} -l app.kubernetes.io/name=${agentName}\n`;
+        readme += '```\n\n';
+        readme += '## References\n\n';
+        readme += '- [OSSA Specification](https://openstandardagents.org)\n';
+        readme += '- [kagent.dev Documentation](https://kagent.dev)\n';
+        readme += '- [Kubernetes Documentation](https://kubernetes.io/docs)\n';
+        readme +=
+            '- [kubectl Cheat Sheet](https://kubernetes.io/docs/reference/kubectl/cheatsheet/)\n\n';
+        readme += '---\n\n';
+        readme += `**Generated by**: kagent CRD Generator\n`;
+        readme += `**OSSA Version**: 0.4.4\n`;
+        readme += `**Generated at**: ${new Date().toISOString()}\n`;
+        return readme;
+    }
     /**
      * Extract tools from OSSA spec
      */
@@ -129,6 +826,8 @@ export class KAgentCRDGenerator {
                 return {
                     type: toolObj.type || 'mcp',
                     name: toolObj.name,
+                    description: toolObj.description,
+                    risk_level: toolObj.risk_level,
                     server: toolObj.server,
                     namespace: toolObj.namespace,
                     endpoint: toolObj.endpoint,
@@ -148,13 +847,54 @@ export class KAgentCRDGenerator {
         })
             .filter((tool) => tool !== null);
     }
+    /**
+     * Extract governance configuration from OSSA v0.4.4 spec
+     */
+    extractGovernance(governance) {
+        if (!governance || typeof governance !== 'object') {
+            return undefined;
+        }
+        const gov = governance;
+        return {
+            authorization: gov.authorization,
+            quality_requirements: gov.quality_requirements,
+            compliance: gov.compliance,
+        };
+    }
+    /**
+     * Extract workflow configuration
+     */
+    extractWorkflow(workflow) {
+        if (!workflow || typeof workflow !== 'object') {
+            return undefined;
+        }
+        return workflow;
+    }
+    /**
+     * Extract monitoring configuration
+     */
+    extractMonitoring(monitoring) {
+        if (!monitoring || typeof monitoring !== 'object') {
+            return undefined;
+        }
+        return monitoring;
+    }
+    /**
+     * Get default replicas based on spec
+     */
+    getDefaultReplicas(spec) {
+        const scalability = spec.agentArchitecture?.runtime?.scalability;
+        return scalability === 'horizontal' ? 3 : 1;
+    }
     /**
      * Determine if A2A should be enabled
      */
     shouldEnableA2A(manifest) {
         const spec = manifest.spec;
         const a2a = spec.a2a;
-        return a2a !== undefined && Object.keys(a2a).length > 0;
+        const messaging = spec.messaging;
+        return ((a2a !== undefined && Object.keys(a2a).length > 0) ||
+            (messaging !== undefined && Object.keys(messaging).length > 0));
     }
     /**
      * Get default RBAC rules for agent
@@ -176,6 +916,16 @@ export class KAgentCRDGenerator {
                 resources: ['configmaps'],
                 verbs: ['get', 'list', 'watch'],
             },
+            {
+                apiGroups: [''],
+                resources: ['pods'],
+                verbs: ['get', 'list'],
+            },
+            {
+                apiGroups: [''],
+                resources: ['events'],
+                verbs: ['create', 'patch'],
+            },
         ];
     }
 }