@bluefly/openstandardagents 0.4.4 → 0.4.5

package/dist/spec/v0.3.6/taxonomy.yaml

@@ -1,506 +0,0 @@
-# =============================================================================
-# OSSA v0.3.3 - Agent Taxonomy Specification
-# =============================================================================
-# Hierarchical classification system for agents with cross-cutting concerns
-# Now includes access tier integration for separation of duties
-# Issues:
-#   - https://gitlab.com/blueflyio/openstandardagents/-/issues/194 (taxonomy)
-#   - https://gitlab.com/blueflyio/openstandardagents/-/issues/363 (separation of duties)
-# =============================================================================
-
-apiVersion: ossa/v0.3.6
-kind: TaxonomySpec
-version: "3.0.0"
-
-# =============================================================================
-# ACCESS TIER INTEGRATION
-# Links taxonomy to access_tiers.yaml for separation of duties
-# =============================================================================
-access_tier_reference: "./access_tiers.yaml"
-
-# =============================================================================
-# PRIMARY DOMAINS
-# Top-level classification - every agent belongs to exactly one domain
-# =============================================================================
-domains:
-  security:
-    description: "Authentication, authorization, encryption, compliance, vulnerability management"
-    subdomains:
-      - auth                 # Authentication & authorization
-      - encryption          # Encryption & key management
-      - compliance          # Regulatory compliance (SOC2, ISO, GDPR)
-      - vulnerability       # Vulnerability scanning & remediation
-      - secrets             # Secrets management & rotation
-      - threat-detection    # Threat detection & response
-    examples:
-      - security-scanner
-      - compliance-checker
-      - secret-detector
-      - threat-modeler
-
-  infrastructure:
-    description: "DevOps, CI/CD, deployment, configuration, cloud resources"
-    subdomains:
-      - ci-cd               # CI/CD pipeline management
-      - gitops              # GitOps workflows
-      - deployment          # Deployment automation
-      - configuration       # Configuration management
-      - networking          # Network configuration
-      - storage             # Storage management
-      - kubernetes          # Kubernetes orchestration
-      - cloud               # Cloud provider management
-    examples:
-      - deployment-manager
-      - pipeline-fixer
-      - infrastructure-provisioner
-      - incident-responder
-
-  documentation:
-    description: "Documentation, wiki, guides, knowledge management"
-    subdomains:
-      - api-docs            # API documentation
-      - user-guides         # User guides & tutorials
-      - wiki                # Wiki management
-      - knowledge-base      # Knowledge base management
-      - changelog           # Changelog & release notes
-    examples:
-      - documentation-generator
-      - wiki-manager
-      - api-docs-generator
-
-  backend:
-    description: "API, database, services, business logic"
-    subdomains:
-      - api                 # API design & implementation
-      - database            # Database management
-      - services            # Microservices
-      - messaging           # Message queues & events
-      - caching             # Caching strategies
-      - integration         # System integration
-    examples:
-      - api-builder
-      - database-migrator
-      - service-orchestrator
-
-  frontend:
-    description: "UI/UX, web, mobile interfaces"
-    subdomains:
-      - web                 # Web applications
-      - mobile              # Mobile applications
-      - design-system       # Design system components
-      - accessibility       # Accessibility (a11y)
-      - performance         # Frontend performance
-    examples:
-      - ui-reviewer
-      - accessibility-checker
-      - design-system-manager
-
-  data:
-    description: "Data engineering, analytics, ML/AI operations"
-    subdomains:
-      - analytics           # Business analytics
-      - ml-ops              # ML operations
-      - etl                 # Extract, transform, load
-      - data-quality        # Data quality & validation
-      - data-governance     # Data governance
-      - streaming           # Real-time data streaming
-    examples:
-      - analytics-collector
-      - ml-model-manager
-      - data-quality-checker
-
-  agents:
-    description: "OSSA agents, automation, orchestration, meta-operations"
-    subdomains:
-      - orchestration       # Multi-agent orchestration
-      - workers             # Worker agents
-      - supervisors         # Supervisor agents
-      - mesh                # Agent mesh networking
-      - training            # Agent training & improvement
-      - registry            # Agent registry management
-    examples:
-      - master-orchestrator
-      - agent-trainer
-      - workflow-builder
-
-  development:
-    description: "Software development, code quality, testing"
-    subdomains:
-      - code-review         # Code review automation
-      - testing             # Test generation & execution
-      - refactoring         # Code refactoring
-      - debugging           # Debugging assistance
-      - ide                 # IDE integration
-    examples:
-      - code-reviewer
-      - test-generator
-      - refactoring-assistant
-
-  content:
-    description: "Content management, editing, publishing"
-    subdomains:
-      - authoring           # Content authoring
-      - editing             # Content editing
-      - publishing          # Content publishing
-      - research            # Research & knowledge gathering
-      - localization        # Internationalization & localization
-    examples:
-      - content-orchestrator
-      - editor
-      - researcher
-      - publisher
-
-# =============================================================================
-# CROSS-CUTTING CONCERNS
-# Tags that can apply to any agent regardless of domain
-# An agent can have multiple concerns
-# =============================================================================
-concerns:
-  quality:
-    description: "Testing, code quality, standards enforcement"
-    applies_to: ["development", "backend", "frontend", "infrastructure"]
-
-  observability:
-    description: "Metrics, logging, tracing, monitoring"
-    applies_to: ["*"]  # All domains
-
-  governance:
-    description: "Policies, compliance, audit trails"
-    applies_to: ["*"]
-
-  performance:
-    description: "Optimization, caching, scaling"
-    applies_to: ["*"]
-
-  architecture:
-    description: "Design patterns, system structure"
-    applies_to: ["development", "backend", "infrastructure", "agents"]
-
-  cost:
-    description: "FinOps, resource optimization, budget management"
-    applies_to: ["infrastructure", "data", "agents"]
-
-  reliability:
-    description: "SRE, uptime, resilience, disaster recovery"
-    applies_to: ["infrastructure", "backend", "agents"]
-
-# =============================================================================
-# AGENT TYPE CLASSIFICATION
-# Based on OSSA spec.type field - now with access tier recommendations
-# =============================================================================
-agent_types:
-  analyzer:
-    description: "Read-only analysis, scanning, auditing - no modifications"
-    typical_domains: ["security", "development", "data"]
-    recommended_tier: tier_1_read
-    can_delegate_to: []
-
-  worker:
-    description: "Executes specific tasks, limited write access"
-    typical_domains: ["development", "documentation", "content"]
-    recommended_tier: tier_2_write_limited
-    can_delegate_to: ["analyzer"]
-
-  operator:
-    description: "Modifies production systems, requires approval"
-    typical_domains: ["infrastructure", "agents"]
-    recommended_tier: tier_3_write_elevated
-    can_delegate_to: ["worker", "analyzer"]
-
-  supervisor:
-    description: "Coordinates other agents, can delegate"
-    typical_domains: ["agents", "infrastructure"]
-    recommended_tier: tier_3_write_elevated
-    can_delegate_to: ["worker", "analyzer"]
-
-  orchestrator:
-    description: "High-level coordination, workflow management"
-    typical_domains: ["agents"]
-    recommended_tier: tier_3_write_elevated
-    can_delegate_to: ["supervisor", "worker", "analyzer"]
-
-  governor:
-    description: "Defines policies, cannot execute - ISOLATED"
-    typical_domains: ["security", "agents"]
-    recommended_tier: tier_4_policy
-    can_delegate_to: ["operator"]  # Delegation only, not execution
-    isolation: strict
-
-  specialist:
-    description: "Deep expertise in narrow domain"
-    typical_domains: ["security", "data", "backend"]
-    recommended_tier: tier_1_read  # Most specialists are analyzers
-    can_delegate_to: []
-
-  critic:
-    description: "Reviews and provides feedback, cannot approve"
-    typical_domains: ["development", "security"]
-    recommended_tier: tier_1_read
-    prohibited_actions: ["approve", "merge", "execute"]
-    can_delegate_to: []
-
-# =============================================================================
-# DOMAIN-TIER MAPPINGS
-# Recommended access tiers by domain for separation of duties
-# =============================================================================
-domain_tier_recommendations:
-  security:
-    default_tier: tier_1_read
-    rationale: "Security agents should analyze, not modify"
-    exceptions:
-      - role: remediator
-        tier: tier_3_write_elevated
-        requires: governor_approval
-      - role: policy_definer
-        tier: tier_4_policy
-
-  infrastructure:
-    default_tier: tier_3_write_elevated
-    rationale: "Infrastructure requires elevated access"
-    separation_required:
-      - readers: ["monitor", "cost_reporter"]
-        tier: tier_1_read
-      - operators: ["deployer", "provisioner"]
-        tier: tier_3_write_elevated
-
-  documentation:
-    default_tier: tier_2_write_limited
-    rationale: "Doc changes are low-risk"
-
-  development:
-    default_tier: tier_2_write_limited
-    rationale: "Code generation is sandboxed"
-    separation_required:
-      - critics: ["reviewer", "analyzer"]
-        tier: tier_1_read
-        prohibited: ["approve", "merge"]
-      - generators: ["scaffolder", "test_writer"]
-        tier: tier_2_write_limited
-
-  agents:
-    default_tier: tier_3_write_elevated
-    rationale: "Agent orchestration needs elevated access"
-    separation_required:
-      - governors: ["policy_definer", "compliance_enforcer"]
-        tier: tier_4_policy
-        isolation: strict
-      - orchestrators: ["coordinator", "scheduler"]
-        tier: tier_3_write_elevated
-
-  backend:
-    default_tier: tier_2_write_limited
-    separation_required:
-      - analyzers: ["db_analyzer", "api_auditor"]
-        tier: tier_1_read
-      - operators: ["db_migrator", "service_deployer"]
-        tier: tier_3_write_elevated
-
-  data:
-    default_tier: tier_1_read
-    rationale: "Data access is sensitive - read-only by default"
-    exceptions:
-      - role: etl_operator
-        tier: tier_3_write_elevated
-        requires: data_governance_approval
-
-# =============================================================================
-# USAGE IN AGENT MANIFESTS
-# =============================================================================
-# Example usage in OSSA agent manifest:
-#
-# metadata:
-#   name: security-scanner
-#   labels:
-#     domain: security
-#     subdomain: vulnerability
-#     concerns: quality,compliance
-#
-# spec:
-#   type: worker
-#   taxonomy:
-#     domain: security
-#     subdomain: vulnerability
-#     capability: scan_vulnerabilities
-#     concerns:
-#       - quality
-#       - compliance
-
-# =============================================================================
-# VALIDATION RULES
-# =============================================================================
-validation:
-  rules:
-    - name: valid-domain
-      description: "Domain must be from approved list"
-      severity: error
-
-    - name: valid-subdomain
-      description: "Subdomain must belong to specified domain"
-      severity: error
-
-    - name: concerns-applicable
-      description: "Concerns must be applicable to domain"
-      severity: warning
-
-    - name: type-domain-match
-      description: "Agent type should match typical domains"
-      severity: info
-
-# =============================================================================
-# MIGRATION FROM LEGACY
-# =============================================================================
-migration:
-  deprecated_domains:
-    ci-cd: { domain: infrastructure, subdomain: ci-cd }
-    gitops: { domain: infrastructure, subdomain: gitops }
-    deployment: { domain: infrastructure, subdomain: deployment }
-    configuration: { domain: infrastructure, subdomain: configuration }
-    cost-management: { domain: infrastructure, concerns: [cost] }
-    database: { domain: backend, subdomain: database }
-    performance: { concerns: [performance] }
-    observability: { concerns: [observability] }
-    governance: { concerns: [governance] }
-    architecture: { concerns: [architecture] }
-
-# =============================================================================
-# AGENT MATURITY LEVELS
-# Classification of agent readiness and stability
-# =============================================================================
-maturity_levels:
-  prototype:
-    description: "Early development, experimental, not production-ready"
-    stability: low
-    testing_required: minimal
-    documentation_required: basic
-    use_cases: ["proof-of-concept", "experimentation", "learning"]
-
-  beta:
-    description: "Feature-complete, undergoing testing, near production-ready"
-    stability: medium
-    testing_required: comprehensive
-    documentation_required: complete
-    use_cases: ["early-adopter testing", "staging environments"]
-
-  stable:
-    description: "Production-ready, well-tested, documented, maintained"
-    stability: high
-    testing_required: extensive
-    documentation_required: comprehensive
-    use_cases: ["production workloads", "enterprise adoption"]
-
-  production:
-    description: "Enterprise-grade, fully tested, documented, supported, SLA-backed"
-    stability: very_high
-    testing_required: exhaustive
-    documentation_required: enterprise-grade
-    use_cases: ["mission-critical systems", "enterprise production"]
-
-# =============================================================================
-# DEPLOYMENT PATTERNS
-# How agents are deployed and executed
-# =============================================================================
-deployment_patterns:
-  serverless:
-    description: "Function-as-a-Service, event-driven, auto-scaling"
-    examples: ["AWS Lambda", "Google Cloud Functions", "Azure Functions"]
-    characteristics: ["stateless", "ephemeral", "cost-efficient"]
-    use_cases: ["event processing", "API endpoints", "scheduled tasks"]
-
-  container:
-    description: "Containerized deployment, long-running processes"
-    examples: ["Docker", "Podman", "containerd"]
-    characteristics: ["stateful", "persistent", "resource-controlled"]
-    use_cases: ["microservices", "background workers", "API servers"]
-
-  edge:
-    description: "Edge computing, low latency, distributed"
-    examples: ["Cloudflare Workers", "AWS Lambda@Edge", "Akamai Edge"]
-    characteristics: ["low-latency", "distributed", "lightweight"]
-    use_cases: ["real-time processing", "CDN integration", "IoT"]
-
-  hybrid:
-    description: "Combination of multiple deployment patterns"
-    examples: ["serverless + container", "edge + cloud"]
-    characteristics: ["flexible", "optimized", "complex"]
-    use_cases: ["multi-tier architectures", "optimized cost/performance"]
-
-# =============================================================================
-# INTEGRATION PATTERNS
-# How agents integrate with external systems
-# =============================================================================
-integration_patterns:
-  api-first:
-    description: "REST/GraphQL APIs, HTTP-based communication"
-    protocols: ["REST", "GraphQL", "gRPC"]
-    characteristics: ["synchronous", "request-response", "stateless"]
-    use_cases: ["web services", "microservices", "API integration"]
-
-  event-driven:
-    description: "Event streams, message queues, pub/sub"
-    protocols: ["CloudEvents", "NATS", "Kafka", "RabbitMQ"]
-    characteristics: ["asynchronous", "decoupled", "scalable"]
-    use_cases: ["event processing", "workflow orchestration", "real-time systems"]
-
-  batch:
-    description: "Scheduled jobs, bulk processing, ETL"
-    protocols: ["Cron", "Scheduled Tasks", "ETL Pipelines"]
-    characteristics: ["scheduled", "bulk", "resource-intensive"]
-    use_cases: ["data processing", "reporting", "migration"]
-
-  streaming:
-    description: "Real-time data streams, continuous processing"
-    protocols: ["WebSocket", "Server-Sent Events", "gRPC Streaming"]
-    characteristics: ["real-time", "continuous", "low-latency"]
-    use_cases: ["live updates", "real-time analytics", "chat systems"]
-
-# =============================================================================
-# COST PROFILES
-# Expected cost characteristics of agent execution
-# =============================================================================
-cost_profiles:
-  low:
-    description: "Minimal cost, infrequent execution, simple operations"
-    estimated_monthly_cost: "< $10"
-    characteristics: ["infrequent", "simple", "low-resource"]
-    use_cases: ["personal projects", "prototypes", "low-volume"]
-
-  medium:
-    description: "Moderate cost, regular execution, standard operations"
-    estimated_monthly_cost: "$10 - $100"
-    characteristics: ["regular", "standard", "moderate-resource"]
-    use_cases: ["small teams", "development", "moderate-volume"]
-
-  high:
-    description: "Significant cost, frequent execution, complex operations"
-    estimated_monthly_cost: "$100 - $1000"
-    characteristics: ["frequent", "complex", "high-resource"]
-    use_cases: ["production systems", "enterprise", "high-volume"]
-
-  enterprise:
-    description: "Enterprise-scale cost, continuous execution, mission-critical"
-    estimated_monthly_cost: "> $1000"
-    characteristics: ["continuous", "mission-critical", "enterprise-resource"]
-    use_cases: ["large enterprises", "mission-critical", "high-scale"]
-
-# =============================================================================
-# PERFORMANCE TIERS
-# Expected performance characteristics
-# =============================================================================
-performance_tiers:
-  real-time:
-    description: "Sub-second response, immediate processing"
-    latency_requirement: "< 1 second"
-    throughput: "high"
-    use_cases: ["user interactions", "live systems", "interactive agents"]
-
-  near-real-time:
-    description: "Fast response, seconds to minutes"
-    latency_requirement: "1 second - 5 minutes"
-    throughput: "medium-high"
-    use_cases: ["background processing", "notifications", "updates"]
-
-  batch:
-    description: "Scheduled processing, minutes to hours"
-    latency_requirement: "5 minutes - 24 hours"
-    throughput: "medium"
-    use_cases: ["reporting", "analytics", "ETL", "scheduled tasks"]