@bluefly/openstandardagents 0.5.1 → 0.5.4

package/examples/gitlab-duo/generated/webhook-agent.yaml

@@ -1,52 +0,0 @@
-# GitLab Duo External Agent Configuration
-# Agent: mr-reviewer
-# Generated from OSSA manifest v1.0.0
-
-# External agents run in GitLab CI/CD pipelines and use AI Gateway
-# for model access. This YAML defines the agent execution environment.
-
-name: mr-reviewer
-description: Comprehensive MR review agent with AI Gateway integration
-
-# Docker image for agent execution
-image: node:22-slim
-
-# Commands to execute agent
-commands:
-  - npm ci
-  - npm run build
-  - node dist/index.js
-
-# Environment variables required by agent
-variables:
-  - AI_FLOW_CONTEXT
-  - AI_FLOW_EVENT
-  - AI_FLOW_INPUT
-  - GITLAB_HOST
-  - GITLAB_TOKEN
-  - MR_IID
-  - PROJECT_ID
-
-# Inject AI Gateway token for model access
-injectGatewayToken: true
-
-# LLM configuration for AI Gateway
-llm:
-  provider: anthropic
-  model: claude-sonnet-4-20250514
-  temperature: 0.2
-  max_tokens: 16384
-
-# Webhook runtime configuration
-runtime:
-  type: webhook
-  port: 9090
-  path: /webhook/mr-reviewer
-
-# Usage:
-# 1. Register agent: glab duo agent register external-agent.yaml
-# 2. Test agent: glab duo agent test mr-reviewer
-# 3. Deploy agent: Agent runs in GitLab CI/CD when triggered
-
-# Documentation:
-# https://docs.gitlab.com/ee/user/gitlab_duo/external_agents.html

package/examples/hierarchical-agent.ossa.yaml

@@ -1,83 +0,0 @@
-apiVersion: ossa/v0.5
-kind: Agent
-metadata:
-  name: code-review-pipeline
-  version: 1.0.0
-  description: A code review coordinator that spawns specialized subagents to analyze code changes. A researcher explores the codebase for context, a debugger scans for security vulnerabilities, and a generic subagent validates test coverage. The coordinator synthesizes all findings into a review report.
-  agentKind: coordinator
-  agentType: custom
-  agentArchitecture:
-    pattern: hierarchical
-    capabilities:
-      - tools
-      - code
-      - context
-      - function-calling
-    coordination:
-      handoffStrategy: automatic
-      maxDepth: 2
-      teamModel: parent-child
-      communicationPattern: direct
-      taskCoordination: assigned
-  labels:
-    domain: development
-    subdomain: code-review
-    pattern: hierarchical
-spec:
-  role: |-
-    You are a code review coordinator. When given a merge request or set of file changes, you: 1. Spawn the code-explorer subagent to gather codebase context. 2. Spawn the security-scanner subagent to identify vulnerabilities. 3. Spawn the test-validator subagent to check test coverage. 4. Collect all subagent reports and synthesize a comprehensive review
-       with actionable feedback, severity ratings, and suggested fixes.
-  llm:
-    provider: anthropic
-    model: claude-sonnet-4-5-20250929
-    temperature: 0.2
-    maxTokens: 4096
-    profile: deep
-  subagents:
-    - name: code-explorer
-      kind: researcher
-      role: Fast codebase search and structural analysis. Find relevant files, trace dependencies, identify architecture patterns, and summarize the context around changed files. Read-only — never modify anything.
-      model:
-        provider: anthropic
-        name: claude-haiku-4-5-20250514
-      tools:
-        - glob
-        - grep
-        - read_file
-      contextIsolation: true
-      reportTo: parent
-      maxTokenBudget: 50000
-    - name: security-scanner
-      kind: debugger
-      role: Identify security vulnerabilities, code smells, and potential attack vectors in the changed files. Check for injection risks, auth bypass, secrets in code, unsafe deserialization, and OWASP Top 10 issues. Generate a severity-rated findings list.
-      model:
-        provider: anthropic
-        name: claude-sonnet-4-5-20250929
-      tools:
-        - read_file
-        - grep
-        - static_analysis
-      contextIsolation: true
-      reportTo: parent
-      maxTokenBudget: 80000
-    - name: test-validator
-      kind: subagent
-      role: Run the test suite and validate coverage for changed files. Check that new code has corresponding tests, coverage thresholds are met, and no existing tests are broken. Report coverage percentages and any failures.
-      model:
-        provider: anthropic
-        name: claude-sonnet-4-5-20250929
-      tools:
-        - bash
-        - read_file
-        - grep
-      contextIsolation: true
-      reportTo: parent
-      maxTokenBudget: 60000
-  constraints:
-    cost:
-      maxTokensPerRequest: 200000
-      maxCostPerDay: 50
-      currency: USD
-    performance:
-      timeoutSeconds: 120
-      maxConcurrentRequests: 5

package/examples/hierarchical-crewai.ossa.yaml

@@ -1,96 +0,0 @@
-apiVersion: ossa/v0.4
-kind: Agent
-metadata:
-  name: devops-crew
-  version: 1.0.0
-  description: CrewAI manager/worker pattern for DevOps automation
-  agentType: crewai
-  agentKind: orchestrator
-  agentArchitecture:
-    pattern: hierarchical
-    capabilities:
-      - tools
-      - code
-      - context
-      - function-calling
-    coordination:
-      handoffStrategy: supervised
-      leaderAgent: devops-manager
-      teamModel: hierarchical
-      taskCoordination: dependency-wave
-      conflictResolution: leader-decides
-spec:
-  role: >
-    You manage a DevOps automation crew. Coordinate infrastructure,
-    deployment, and monitoring tasks across specialized workers.
-  llm:
-    provider: openai
-    model: gpt-4o
-  team:
-    model: hierarchical
-    lead: devops-manager
-    delegateMode: capability-match
-    members:
-      - name: devops-manager
-        kind: team-lead
-        role: >
-          DevOps team manager. Plan infrastructure changes, coordinate
-          deployments, and ensure system reliability.
-        model: gpt-4o
-        tools:
-          - project-planner
-          - status-dashboard
-      - name: infra-engineer
-        kind: specialist
-        role: >
-          Infrastructure engineer. Manage cloud resources, networking,
-          and compute provisioning using IaC.
-        tools:
-          - terraform-apply
-          - cloud-api
-          - dns-manager
-        maxTokenBudget: 25000
-      - name: deploy-engineer
-        kind: worker
-        role: >
-          Deployment engineer. Handle CI/CD pipelines, container builds,
-          and rollout strategies.
-        tools:
-          - docker-build
-          - kubectl-apply
-          - helm-upgrade
-          - ci-trigger
-      - name: monitor-agent
-        kind: teammate
-        role: >
-          Monitoring specialist. Track system health, alert on anomalies,
-          and provide performance insights.
-        tools:
-          - prometheus-query
-          - grafana-dashboard
-          - alert-manager
-          - log-search
-      - name: security-auditor
-        kind: reviewer
-        role: >
-          Security auditor. Review infrastructure changes for compliance,
-          scan for vulnerabilities, and enforce policies.
-        tools:
-          - vulnerability-scan
-          - compliance-check
-          - secret-scanner
-    taskList:
-      persistence: file-backed
-      format: yaml
-      dependencyTracking: true
-    communication:
-      channel: task-list
-      consensus: leader-decides
-    deployment:
-      backend: distributed
-      maxConcurrency: 5
-  constraints:
-    cost:
-      maxTokensPerDay: 2000000
-    performance:
-      timeoutSeconds: 600

package/examples/infrastructure/token-rotation/README.md

@@ -1,119 +0,0 @@
-# Token Rotation Pattern - Reference Example
-
-> **Minimal reference** showing OSSA token rotation features. For production implementation, see [platform-agents/token-rotation-manager](https://gitlab.com/blueflyio/agent-platform/platform-agents/-/tree/main/packages/@ossa/token-rotation-manager).
-
-## What This Example Shows
-
-This manifest demonstrates **automated token rotation** using OSSA v0.4.4 features:
-
-### Key Features
-
-**1. Self-Rotation (`self_rotate: true`)**
-- Agent can rotate **its own token**
-- Requires `self_rotate` scope on service account
-- Prevents manual token management
-
-**2. Service Account Management (`manage_service_accounts: []`)**
-- Agent rotates **other service account tokens**
-- Manages multiple accounts (CI, security, content, etc.)
-- Central rotation orchestrator
-
-**3. Automated Refresh (`auto_refresh: true`)**
-- Automatically refreshes tokens before expiry
-- No manual intervention needed
-
-## When to Use This Pattern
-
-✅ **Use when:**
-- Managing 5+ service account tokens
-- Need automated rotation (security compliance)
-- Want zero-downtime rotation
-
-❌ **Don't use when:**
-- Single token (just use `auto_refresh`)
-- Manual token management required
-- No vault/secrets manager
-
-## Configuration
-
-### Rotation Policy and Observability
-
-OSSA v0.4 `rotation_policy` supports optional runtime observability: `last_rotated_at` (date-time) and `last_rotated_by` (agent/user id). These are set by runtime or tooling (e.g. buildkit `gitlab token self-rotate`) after successful rotation, not in the manifest; used for audit and expiry warnings.
-
-```yaml
-authentication:
-  rotation_policy:
-    enabled: true                # Enable rotation
-    interval_days: 90            # Rotate every 90 days
-    notify_on_rotation: true     # Send notifications
-    manage_service_accounts:     # Accounts to rotate
-      - gitlab_token_webhook_manager
-      - gitlab_token_ci_orchestrator
-```
-
-### Self-Rotation
-
-```yaml
-authentication:
-  self_rotate: true  # Agent rotates its own token
-  scopes:
-    - api
-    - read_user
-    - self_rotate   # ⚠️ Required scope
-```
-
-## API Endpoints (Reference)
-
-Simple rotation API:
-
-```
-POST   /v1/token-rotation/validate    - Validate token scopes
-POST   /v1/token-rotation/rotate      - Rotate token
-POST   /v1/token-rotation/verify      - Verify new token
-GET    /v1/token-rotation/status      - Rotation status
-```
-
-See [`openapi.yaml`](./openapi.yaml) for full spec (minimal reference).
-
-## How It Works
-
-```
-┌─────────────────────────┐
-│  Scheduled Trigger      │
-│  (cron: "0 2 * * 0")    │
-└───────────┬─────────────┘
-            │
-            ▼
-┌─────────────────────────┐
-│  For Each Account:      │
-│  1. Validate current    │
-│  2. Rotate token        │
-│  3. Verify new token    │
-│  4. Update vault        │
-│  5. Notify if enabled   │
-└─────────────────────────┘
-```
-
-## Production Implementation
-
-For a complete, production-ready implementation with:
-- Full error handling
-- Rollback on failure
-- Comprehensive testing
-- CI/CD pipelines
-- Emergency rotation support
-
-See: [`platform-agents/@ossa/token-rotation-manager`](https://gitlab.com/blueflyio/agent-platform/platform-agents/-/tree/main/packages/@ossa/token-rotation-manager)
-
-## Pattern Documentation
-
-For design rationale and best practices, see:
-- [docs/patterns/token-rotation.md](../../docs/patterns/token-rotation.md)
-- [OSSA Agent Type: KAGENT](../../docs/agent-types/kagent.md)
-
-## Compliance
-
-Meets security standards:
-- **NIST 800-63B**: Token rotation requirements
-- **CIS Benchmarks**: Service account management
-- **OWASP**: Token lifecycle security

package/examples/infrastructure/token-rotation/manifest.ossa.yaml

@@ -1,73 +0,0 @@
-apiVersion: ossa/v0.4.7
-kind: Agent
-metadata:
-  name: token-rotation-manager
-  version: 1.0.0
-  description: Reference example for token rotation pattern
-  agentType: kagent
-  agentKind: executor
-  agentArchitecture:
-    pattern: single
-    capabilities:
-      - tools
-      - code
-      - memory
-    coordination:
-      style: autonomous
-      handoffStrategy: none
-    runtime:
-      scalability: single-instance
-      executionModel: batch
-
-spec:
-  role: |
-    Automated service account token rotation manager.
-
-    Rotates GitLab/GitHub service account tokens on schedule,
-    validates new tokens, and updates vault secrets.
-
-  llm:
-    provider: none # KAGENT doesn't need LLM
-
-  tools:
-    - name: validate_token
-      description: Validate a token has required scopes
-
-    - name: rotate_token
-      description: Rotate a service account token
-
-    - name: verify_token
-      description: Verify new token works correctly
-
-    - name: update_vault
-      description: Update Vault secret with new token
-
-  authentication:
-    type: service_account
-    scopes:
-      - api
-      - read_user
-      - write_repository
-    auto_refresh: true
-    self_rotate: true  # ⚠️ Key feature: Agent can rotate its own token
-    rotation_policy:
-      enabled: true
-      interval_days: 90  # Rotate every 90 days
-      notify_on_rotation: true
-      manage_service_accounts:  # ⚠️ Key feature: Manages other accounts
-        - gitlab_token_webhook_manager
-        - gitlab_token_ci_orchestrator
-        - gitlab_token_content_reviewer
-        - gitlab_token_security_scanner
-
-  schedule:
-    cron: "0 2 * * 0"  # Weekly Sunday 2:00 AM UTC
-    timezone: UTC
-
-  observability:
-    logging:
-      level: info
-      format: json
-    monitoring:
-      enabled: true
-      metrics_port: 9090

package/examples/infrastructure/token-rotation/openapi.yaml

@@ -1,133 +0,0 @@
-openapi: 3.1.0
-info:
-  title: Token Rotation Manager API
-  version: 1.0.0
-  description: |
-    Minimal reference API for token rotation pattern.
-
-    For production API, see platform-agents/@ossa/token-rotation-manager/openapi.yaml
-
-servers:
-  - url: https://your-workflow.example.com/v1
-    description: Production
-
-paths:
-  /token-rotation/validate:
-    post:
-      summary: Validate token scopes
-      description: Check if token has required scopes
-      operationId: validateToken
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [token, scopes]
-              properties:
-                token:
-                  type: string
-                  description: Token to validate
-                scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: Required scopes
-      responses:
-        '200':
-          description: Validation result
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  valid:
-                    type: boolean
-                  missingScopes:
-                    type: array
-                    items:
-                      type: string
-
-  /token-rotation/rotate:
-    post:
-      summary: Rotate service account token
-      description: Generate new token for service account
-      operationId: rotateToken
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [serviceAccount]
-              properties:
-                serviceAccount:
-                  type: string
-                  description: Service account name
-      responses:
-        '200':
-          description: New token generated
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  token:
-                    type: string
-                  expiresAt:
-                    type: string
-                    format: date-time
-
-  /token-rotation/verify:
-    post:
-      summary: Verify new token works
-      description: Test new token against API
-      operationId: verifyToken
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              type: object
-              required: [token]
-              properties:
-                token:
-                  type: string
-      responses:
-        '200':
-          description: Token verified
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  valid:
-                    type: boolean
-                  scopes:
-                    type: array
-                    items:
-                      type: string
-
-  /token-rotation/status:
-    get:
-      summary: Get rotation status
-      description: Check when tokens were last rotated
-      operationId: getStatus
-      responses:
-        '200':
-          description: Rotation status
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  lastRotation:
-                    type: string
-                    format: date-time
-                  nextRotation:
-                    type: string
-                    format: date-time
-                  managedAccounts:
-                    type: array
-                    items:
-                      type: string

package/examples/integration-patterns/agent-to-agent-orchestration.ossa.yaml

@@ -1,115 +0,0 @@
-apiVersion: ossa/v0.4.7
-kind: Agent
-metadata:
-  name: workflow-orchestrator
-  version: 1.0.0
-  description: 'Orchestrates multi-agent workflows by coordinating specialized worker
-    agents.
-
-    Manages workflow state, handles failures, and aggregates results.
-
-    '
-spec:
-  role: 'You are a workflow orchestrator. Your job is to:
-
-    1. Break down complex tasks into subtasks
-
-    2. Delegate subtasks to appropriate worker agents
-
-    3. Monitor progress and handle failures
-
-    4. Aggregate results from worker agents
-
-    5. Provide final output to the user
-
-
-    Always coordinate clearly, handle errors gracefully, and provide status updates.
-
-    '
-  llm:
-    provider: openai
-    model: gpt-4
-    temperature: 0.3
-  tools:
-  - type: http
-    name: invoke_research_agent
-    description: 'Delegate research tasks to the specialized research agent.
-
-      Returns comprehensive research results on the requested topic.
-
-      '
-    endpoint: http://research-agent:8080/api/v1/research
-    config:
-      method: POST
-      timeout: 60
-    auth:
-      type: bearer
-      credentials: ORCHESTRATOR_TOKEN
-  - type: http
-    name: invoke_analysis_agent
-    description: 'Delegate analysis tasks to the specialized analysis agent.
-
-      Analyzes data and provides insights.
-
-      '
-    endpoint: http://analysis-agent:8080/api/v1/analyze
-    config:
-      method: POST
-      timeout: 30
-    auth:
-      type: bearer
-      credentials: ORCHESTRATOR_TOKEN
-  - type: http
-    name: invoke_writing_agent
-    description: 'Delegate writing tasks to the specialized writing agent.
-
-      Creates well-structured content based on research and analysis.
-
-      '
-    endpoint: http://writing-agent:8080/api/v1/write
-    config:
-      method: POST
-      timeout: 45
-    auth:
-      type: bearer
-      credentials: ORCHESTRATOR_TOKEN
-  - type: http
-    name: check_agent_status
-    description: 'Check the status and health of worker agents.
-
-      Returns availability, current load, and capability status.
-
-      '
-    endpoint: http://agent-registry:8080/api/v1/agents/status
-    config:
-      method: GET
-      timeout: 5
-  autonomy:
-    level: autonomous
-    approval_required: false
-    allowed_actions:
-    - invoke_research_agent
-    - invoke_analysis_agent
-    - invoke_writing_agent
-    - check_agent_status
-  constraints:
-    cost:
-      maxTokensPerDay: 500000
-      maxCostPerDay: 50.0
-      currency: USD
-    performance:
-      maxLatencySeconds: 120
-      maxConcurrentRequests: 5
-      timeoutSeconds: 180
-  observability:
-    tracing:
-      enabled: true
-      exporter: otlp
-      endpoint: http://jaeger:4318
-    metrics:
-      enabled: true
-      exporter: prometheus
-      endpoint: http://prometheus:9090/metrics
-    logging:
-      level: info
-      format: json

package/examples/kagent/README.md

@@ -1,32 +0,0 @@
-# kAgent Examples
-
-OSSA agent manifests for Kubernetes-native agent deployment.
-
-## Examples
-
-- **ossa-kagent-poc.ossa.yaml** - POC: OSSA-first manifest for kagent.dev (v1alpha2). Export with `ossa export ossa-kagent-poc.ossa.yaml --platform kagent --crd-version v1alpha2 -o ./out`; deploy with `kubectl apply -f out/`.
-- **compliance-validator.ossa.yaml** - Validates FedRAMP/HIPAA compliance
-- **cost-optimizer.ossa.yaml** - Optimizes cloud infrastructure costs
-- **documentation-agent.ossa.yaml** - Generates technical documentation
-- **k8s-troubleshooter.ossa.yaml** - Kubernetes troubleshooting and diagnostics
-- **security-scanner.ossa.yaml** - Security vulnerability scanning
-
-All examples follow OSSA v0.4 specification.
-
-## Usage
-
-Validate any example:
-
-```bash
-ossa validate compliance-validator.ossa.yaml
-```
-
-Deploy to Kubernetes (e.g. with your platform CLI; optional: agent-buildkit):
-
-```bash
-buildkit agents deploy compliance-validator.ossa.yaml
-```
-
-## Schema
-
-All manifests validate against: `spec/v0.2.2/ossa-0.2.2.schema.json`