@domesystems/templates 0.1.0 → 0.2.0

package/ai-agent-for-notion/dome.tf

@@ -1,163 +0,0 @@
-terraform {
-  required_providers {
-    dome = { source = "dome-systems/dome", version = ">= 0.1.0" }
-  }
-}
-
-variable "workspace_id" { type = string }
-variable "anthropic_api_key" {
-  type      = string
-  sensitive = true
-}
-variable "actas_hmac_secret" {
-  type      = string
-  sensitive = true
-}
-
-resource "dome_gateway" "knowledge" {
-  workspace_id = var.workspace_id
-  name         = "knowledge"
-  description  = "Read-only Notion surface for the knowledge answerer"
-  is_default   = true
-}
-
-resource "dome_mcp_connection" "notion" {
-  workspace_id    = var.workspace_id
-  name            = "notion"
-  protocol        = "streamable-http"
-  url             = "https://mcp.notion.com/mcp"
-  auth_method     = "oauth"
-  credential_type = "shared"
-  oauth = {
-    client_origin    = "dcr"
-    registration_url = "https://mcp.notion.com/register"
-    authorize_url    = "https://mcp.notion.com/authorize"
-    token_url        = "https://mcp.notion.com/token"
-    revoke_url       = "https://mcp.notion.com/token"
-    default_scopes   = ["default"]
-  }
-}
-
-resource "dome_llm_connection" "sonnet" {
-  workspace_id    = var.workspace_id
-  name            = "sonnet"
-  provider_id     = "anthropic"
-  provider_config = jsonencode({ model = "claude-sonnet-5" })
-  auth_method     = "api-key"
-  credential_type = "shared"
-  secret_values   = { Authorization = var.anthropic_api_key }
-}
-
-resource "dome_llm_pool" "answerer" {
-  workspace_id = var.workspace_id
-  name         = "answerer-pool"
-  is_default   = true
-}
-
-resource "dome_llm_pool_member" "sonnet" {
-  workspace_id   = var.workspace_id
-  pool           = dome_llm_pool.answerer.name
-  llm_connection = dome_llm_connection.sonnet.name
-}
-
-resource "dome_gateway_llm_pool" "answerer" {
-  workspace_id = var.workspace_id
-  gateway      = dome_gateway.knowledge.name
-  llm_pool     = dome_llm_pool.answerer.name
-}
-
-resource "dome_gateway_tool" "notion_search" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.knowledge.name
-  mcp_connection = dome_mcp_connection.notion.name
-  tool           = "notion-search"
-}
-
-resource "dome_gateway_tool" "notion_fetch" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.knowledge.name
-  mcp_connection = dome_mcp_connection.notion.name
-  tool           = "notion-fetch"
-}
-
-# This write tool is deliberately reachable so the agent can demonstrate the
-# Cedar refusal below.
-resource "dome_gateway_tool" "notion_create_pages" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.knowledge.name
-  mcp_connection = dome_mcp_connection.notion.name
-  tool           = "notion-create-pages"
-}
-
-resource "dome_agent" "knowledge_answerer" {
-  workspace_id           = var.workspace_id
-  name                   = "knowledge-answerer"
-  allowed_gateways       = [dome_gateway.knowledge.name]
-  act_as                 = { method = "hmac", required = false }
-  act_as_hmac_secret     = var.actas_hmac_secret
-  actas_allowed_subjects = ["alice"]
-}
-
-resource "dome_agent_rules_bundle" "knowledge_answerer" {
-  workspace_id = var.workspace_id
-  agent        = dome_agent.knowledge_answerer.name
-  files = {
-    "answerer.cedar" = <<-EOT
-      permit ( principal, action == Dome::Action::"mcp:discover", resource );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"notion/notion-search" );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"notion/notion-fetch" );
-      forbid ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"notion/notion-create-pages" );
-    EOT
-  }
-}
-
-resource "dome_filter" "redact_ssn_from_pages" {
-  workspace_id = var.workspace_id
-  name         = "redact-ssn-from-pages"
-  description  = "Redact US SSN patterns out of Notion page content"
-  config = jsonencode({
-    json = { components = [{ fieldActions = [{ matcher = { path = "**.text", contentMatchers = [{ ssn = {} }] }, action = "FILTER_ACTION_REDACT", redactTarget = "REDACT_TARGET_CONTENT_MATCHES" }] }] }
-  })
-}
-
-resource "dome_mcp_connection_filters" "notion_responses" {
-  workspace_id   = var.workspace_id
-  mcp_connection = dome_mcp_connection.notion.name
-  direction      = "response"
-  filters        = [dome_filter.redact_ssn_from_pages.name]
-}
-
-resource "dome_quota" "agent_daily_spend" {
-  workspace_id = var.workspace_id
-  dimension    = "llm"
-  unit         = "dome_usd"
-  subject_type = "agent"
-  subject      = dome_agent.knowledge_answerer.name
-  scope        = "total"
-  window       = "daily"
-  limit_amount = 5000000
-  name         = "knowledge-answerer daily spend"
-}
-
-resource "dome_quota" "caller_daily_spend" {
-  workspace_id = var.workspace_id
-  dimension    = "llm"
-  unit         = "dome_usd"
-  subject_type = "model"
-  subject      = dome_llm_connection.sonnet.name
-  scope        = "per_caller"
-  window       = "daily"
-  limit_amount = 2000000
-  name         = "per-caller model spend"
-}
-
-resource "dome_agent_key" "runtime" {
-  workspace_id = var.workspace_id
-  agent        = dome_agent.knowledge_answerer.name
-  name         = "runtime"
-}
-
-output "knowledge_answerer_token" {
-  value     = dome_agent_key.runtime.token
-  sensitive = true
-}

package/ai-agent-for-notion/guards/redact-ssn-from-pages.json

@@ -1,22 +0,0 @@
-{
-  "json": {
-    "components": [
-      {
-        "fieldActions": [
-          {
-            "matcher": {
-              "path": "**.text",
-              "contentMatchers": [
-                {
-                  "ssn": {}
-                }
-              ]
-            },
-            "action": "FILTER_ACTION_REDACT",
-            "redactTarget": "REDACT_TARGET_CONTENT_MATCHES"
-          }
-        ]
-      }
-    ]
-  }
-}

package/ai-agent-for-notion/rules/answerer.cedar

@@ -1,29 +0,0 @@
-// answer-from-knowledge-base — authorization rules
-//
-// The Notion MCP server carries 43 tools, twenty-odd of which write:
-// create-pages, update-page, move-pages, duplicate-page, create-database.
-// Two reads are permitted. One write is deliberately reachable and denied,
-// so the refusal can be observed rather than merely asserted.
-
-permit ( principal, action == Dome::Action::"mcp:discover", resource );
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"notion/notion-search"
-);
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"notion/notion-fetch"
-);
-
-// Registering an agent against a gateway auto-generates an Agent Form policy
-// permitting any tool whose `gateways` attribute contains that gateway. A
-// permit cannot narrow that; only a forbid can. Cedar forbid always wins.
-forbid (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"notion/notion-create-pages"
-);

package/ai-agent-for-notion/template.yaml

@@ -1,142 +0,0 @@
-apiVersion: templates.domesystems.ai/v1
-kind: Template
-
-metadata:
-  name: answer-from-knowledge-base
-  slug: ai-agent-for-notion
-  title: Ask questions across your Notion workspace
-  target_query: notion ai agent
-  summary: >-
-    A chat agent that answers questions from your Notion workspace. The
-    connection carries 43 tools, twenty-odd of which write. Two are permitted.
-    Ask it to create a page and it will try — and Dome will refuse, naming the
-    rule that refused it.
-  domain: productivity
-  shape: interactive-assistant
-  ui: chat
-  business_pattern: consumes
-  governance_interest: [read-only, tool-scoped-access, caller-scoped-access]
-
-# Library-only topology and documentation data. `dome.tf` is the deployable source.
-catalog:
-  gateway:
-    name: knowledge
-    description: Read-only Notion surface for the knowledge answerer
-    default: true
-
-  connections:
-    - name: notion
-      protocol: streamable-http
-      url: https://mcp.notion.com/mcp
-      # Notion runs two auth systems for one product: the REST API takes
-      # internal integration tokens, the MCP server takes user-delegated OAuth
-      # and 403s an `ntn_` token with `restricted_resource`. Dome self-registers
-      # via DCR and prints a consent URL.
-      auth:
-        method: oauth
-        credential: shared
-        oauth:
-          client_origin: dcr
-          registration_url: https://mcp.notion.com/register
-          authorize_url: https://mcp.notion.com/authorize
-          token_url: https://mcp.notion.com/token
-          revoke_url: https://mcp.notion.com/token
-          scopes: [default]
-      permit:
-        - notion-search
-        - notion-fetch
-      # On the gateway on purpose, so the model can see it and try. Cedar
-      # forbids it, and a forbid beats the auto-generated Agent Form permit.
-      # Without this there is no denial to observe.
-      forbid:
-        - notion-create-pages
-
-  model:
-    name: sonnet
-    provider: anthropic
-    model_id: claude-sonnet-5
-    secret:
-      env: ANTHROPIC_API_KEY
-      variable: anthropic_api_key
-      label: an Anthropic API key
-
-  pool:
-    name: answerer-pool
-    default: true
-
-  agent:
-    name: knowledge-answerer
-    # The gateway will not believe an act-as header it cannot verify. OIDC is
-    # the real answer but `--actas-oidc-url` must be https on a public host,
-    # so a stub on a laptop cannot issue; hmac is the local path.
-    act_as:
-      method: hmac
-      required: false          # reads without a persona still work
-      secret: ACTAS_HMAC_SECRET
-      # Alice may be acted as. Bob may not, and is refused at verification —
-      # before Cedar is consulted at all.
-      allowed_subjects: [alice]
-
-  rules:
-    file: rules/answerer.cedar
-
-  guards:
-    filters:
-      - name: redact-ssn-from-pages
-        description: Redact US SSN patterns out of Notion page content
-        why: >-
-          A wiki is where people paste things. Cedar decides which pages the
-          agent may read; it says nothing about what is inside one. This is the
-          control for the content rather than the access, and it runs before
-          the agent — not the provider — sees the page.
-        config: guards/redact-ssn-from-pages.json
-        bind: { tool: notion, direction: response }
-
-  quotas:
-    # What the agent may spend in a day, across model and tool traffic.
-    - subject: agent
-      agent: knowledge-answerer
-      unit: dome_usd
-      limit: 5
-      window: daily
-      name: knowledge-answerer daily spend
-    # And the same cap applied independently to each verified end user, which
-    # is the quota that pairs with act-as: one caller cannot spend the agent's
-    # whole day. Without --per-caller, whoever asks first gets it all.
-    - subject: model
-      model: sonnet
-      unit: dome_usd
-      limit: 2
-      window: daily
-      per_caller: true
-      name: per-caller model spend
-
-app:
-  runtime:
-    pattern: chat
-    language: python
-  agent:
-    prompt: app/instructions.md
-    help: app/help.md
-    model: claude-sonnet-5
-    max_tokens: 2048
-    skills:
-      - name: answer-from-notion
-        description: Search the workspace, read the most relevant pages, answer from them.
-        tools:
-          - notion/notion-search
-          - notion/notion-fetch
-          - notion/notion-create-pages
-    invoker:
-      kind: chat
-  options:
-    # alice is permitted, bob is refused. Same question, different answer,
-    # because of who is asking rather than what was asked.
-    identity:
-      mode: oidc-stub
-      personas:
-        - id: alice
-        - id: bob
-    model:
-      provider: anthropic
-      model: claude-sonnet-5

package/ai-agent-for-notion/verification.json

@@ -1,7 +0,0 @@
-{
-  "verified": "2026-09-12T19:25:35Z",
-  "context": "api-domesystems-ai-dome-systems-core-dome-library",
-  "gateway": "knowledge",
-  "agent": "knowledge-answerer",
-  "cli": "1.0.2"
-}

package/ai-agent-for-release-notes/.env.example

@@ -1,15 +0,0 @@
-# The container holds exactly one secret.
-#
-# Tool credentials went into Dome when dome import ran and live behind the gateway.
-# The provider key lives with the Broker. Neither is here, and neither should be.
-
-# Revealed once after import: dome import outputs <job-id>
-DOME_TOKEN=
-
-# The gateway ROOT — not a bare host, and not the /mcp path.
-# Copy the "Gateway URL" from the command above. The container derives
-# /mcp for tools and /v1/messages for models from it.
-DOME_GATEWAY_URL=
-
-# the repository to draft notes for, as owner/repo — your choice, and the token must reach it
-TARGET_REPO=

package/ai-agent-for-release-notes/app/agent.yaml

@@ -1,36 +0,0 @@
-name: release-notes-writer
-title: Draft release notes from merged pull requests
-summary: "A scheduled job that turns merged pull requests into a release-note draft.\
-  \ It can read one repository's pull\
-  \ requests and commits. It cannot open an issue, merge, or cut the release \u2014\
-  \ and it cannot read the source diff, which is the same tool it is allowed to call,\
-  \ refused on one of its parameters."
-shape: scheduled-job
-prompt_file: instructions.md
-help_file: help.md
-starters:
-- Draft release notes for pull requests merged into ${TARGET_REPO} in the 14 days
-  before ${TODAY}.
-model: claude-sonnet-5
-pool: release-pool
-max_tokens: 8192
-skills:
-- name: draft-release-notes
-  description: Read merged pull requests in a window and write user-facing notes.
-  tools:
-  - github/list_pull_requests
-  - github/pull_request_read
-  - github/list_commits
-  - github/create_issue
-invoker:
-  kind: cron
-  schedule: 0 9 * * MON
-options:
-  identity:
-    mode: none
-  env:
-  - name: TARGET_REPO
-    label: "the repository to draft notes for, as owner/repo \u2014 your choice, and\
-      \ the token must reach it"
-forbidden:
-- github/create_issue

package/ai-agent-for-release-notes/app/help.md

@@ -1,20 +0,0 @@
-Press **Run now** to draft release notes from pull requests merged since the
-last release.
-
-Runs here are manual. The template declares a weekly schedule, which the Dome
-agent runtime will act on once it ships — nothing in this container does.
-
-The result is the draft. On the left, each run is listed with the calls it made
-and how long each took — select an earlier run to compare.
-
-This agent reads one repository's pull requests and commits. It cannot open an
-issue, merge, or cut the release — those calls are refused.
-
-**Watch the diff get refused.** GitHub replaced nine per-pull-request reads with
-one `pull_request_read` tool that takes a `method`, so allowing or denying by
-tool name would mean all nine or none. This template allows the tool and
-refuses one parameter: `method: get_diff` returns the source code, which release
-notes are not written from. The run log shows the same tool permitted on one
-call and denied on the next, and the rule that decided it.
-
-The record of what ran is the audit log in Dome, not this page.

package/ai-agent-for-release-notes/app/instructions.md

@@ -1,19 +0,0 @@
-You draft release notes for a software project.
-
-Each run:
-
-1. List pull requests merged into the default branch of the repository named in
-   your task, in the window it gives you.
-2. Read the ones whose titles or bodies suggest user-visible change. Skip
-   dependency bumps, CI changes, and internal refactors unless they change
-   behavior. Where a title is not enough to say what is now different for a
-   user, look at the pull request in whatever more detail you can get.
-3. Produce notes in three sections — Added, Changed, Fixed. Omit any section
-   with nothing in it.
-
-Write for someone who uses the software and does not read the code. One line
-per change, in the present tense, describing what is now different for them.
-Link the pull request number at the end of each line.
-
-If nothing user-visible merged in the window, say exactly that. A release note
-that pads an empty week with internal churn trains people to stop reading.

package/ai-agent-for-release-notes/docker-compose.yml

@@ -1,18 +0,0 @@
-#
-# Without DOME_TOKEN this starts in offline mode: the chrome works and the
-# allow-list is still enforced, but tools and model are simulated.
-services:
-  app:
-    # Built and published by dome-systems/template-runtime.
-    image: ghcr.io/dome-systems/runtime-py-run:dev
-    env_file: .env
-    volumes:
-      - ./app:/config:ro
-    ports:
-      - "3000:3000"
-    healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:3000/health', timeout=2)"]
-      interval: 30s
-      timeout: 3s
-      start_period: 10s
-      retries: 3

package/ai-agent-for-release-notes/dome.tf

@@ -1,165 +0,0 @@
-terraform {
-  required_providers {
-    dome = { source = "dome-systems/dome", version = ">= 0.1.0" }
-  }
-}
-
-variable "workspace_id" { type = string }
-variable "github_token" {
-  type      = string
-  sensitive = true
-}
-variable "anthropic_api_key" {
-  type      = string
-  sensitive = true
-}
-
-resource "dome_gateway" "release" {
-  workspace_id = var.workspace_id
-  name         = "release"
-  description  = "Read-only GitHub surface for the release-notes job"
-  is_default   = true
-}
-
-resource "dome_mcp_connection" "github" {
-  workspace_id    = var.workspace_id
-  name            = "github"
-  protocol        = "streamable-http"
-  url             = "https://api.githubcopilot.com/mcp/"
-  auth_method     = "api-key"
-  credential_type = "shared"
-  secret_values   = { Authorization = var.github_token }
-}
-
-resource "dome_llm_connection" "sonnet" {
-  workspace_id    = var.workspace_id
-  name            = "sonnet"
-  provider_id     = "anthropic"
-  provider_config = jsonencode({ model = "claude-sonnet-5" })
-  auth_method     = "api-key"
-  credential_type = "shared"
-  secret_values   = { Authorization = var.anthropic_api_key }
-}
-
-resource "dome_llm_pool" "release" {
-  workspace_id = var.workspace_id
-  name         = "release-pool"
-  is_default   = true
-}
-
-resource "dome_llm_pool_member" "sonnet" {
-  workspace_id   = var.workspace_id
-  pool           = dome_llm_pool.release.name
-  llm_connection = dome_llm_connection.sonnet.name
-}
-
-resource "dome_gateway_llm_pool" "release" {
-  workspace_id = var.workspace_id
-  gateway      = dome_gateway.release.name
-  llm_pool     = dome_llm_pool.release.name
-}
-
-resource "dome_gateway_tool" "list_pull_requests" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "list_pull_requests"
-}
-
-resource "dome_gateway_tool" "pull_request_read" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "pull_request_read"
-}
-
-resource "dome_gateway_tool" "list_commits" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "list_commits"
-}
-
-resource "dome_gateway_tool" "create_issue" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "create_issue"
-}
-
-resource "dome_agent" "release_notes_writer" {
-  workspace_id     = var.workspace_id
-  name             = "release-notes-writer"
-  allowed_gateways = [dome_gateway.release.name]
-}
-
-resource "dome_agent_rules_bundle" "release_notes_writer" {
-  workspace_id = var.workspace_id
-  agent        = dome_agent.release_notes_writer.name
-  files = {
-    "release-notes.cedar" = <<-EOT
-      permit ( principal, action == Dome::Action::"mcp:discover", resource );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/list_pull_requests" );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/pull_request_read" );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/list_commits" );
-      forbid ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/create_issue" );
-      forbid ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/pull_request_read" ) when { resource.arguments.method == "get_diff" };
-    EOT
-  }
-}
-
-resource "dome_filter" "block_leaked_keys" {
-  workspace_id = var.workspace_id
-  name         = "block-leaked-keys"
-  description  = "Withhold a tool result carrying a private key"
-  config = jsonencode({
-    json = { components = [{ fieldActions = [{ matcher = { path = "**.text", contentMatchers = [
-      { substring = { value = "BEGIN RSA PRIVATE KEY" } },
-      { substring = { value = "BEGIN OPENSSH PRIVATE KEY" } },
-      { substring = { value = "BEGIN PRIVATE KEY" } },
-      { substring = { value = "BEGIN EC PRIVATE KEY" } },
-    ] }, action = "FILTER_ACTION_BLOCK" }] }] }
-  })
-}
-
-resource "dome_mcp_connection_filters" "github_responses" {
-  workspace_id   = var.workspace_id
-  mcp_connection = dome_mcp_connection.github.name
-  direction      = "response"
-  filters        = [dome_filter.block_leaked_keys.name]
-}
-
-resource "dome_quota" "agent_daily_spend" {
-  workspace_id = var.workspace_id
-  dimension    = "llm"
-  unit         = "dome_usd"
-  subject_type = "agent"
-  subject      = dome_agent.release_notes_writer.name
-  scope        = "total"
-  window       = "daily"
-  limit_amount = 2000000
-  name         = "release-notes-writer daily spend"
-}
-
-resource "dome_quota" "github_calls" {
-  workspace_id = var.workspace_id
-  dimension    = "tool"
-  unit         = "calls"
-  subject_type = "tool_connection"
-  subject      = dome_mcp_connection.github.name
-  scope        = "total"
-  window       = "daily"
-  limit_amount = 1000
-  name         = "github calls per day"
-}
-
-resource "dome_agent_key" "runtime" {
-  workspace_id = var.workspace_id
-  agent        = dome_agent.release_notes_writer.name
-  name         = "runtime"
-}
-
-output "release_notes_writer_token" {
-  value     = dome_agent_key.runtime.token
-  sensitive = true
-}

package/ai-agent-for-release-notes/guards/block-leaked-keys.json

@@ -1,38 +0,0 @@
-{
-  "json": {
-    "components": [
-      {
-        "fieldActions": [
-          {
-            "matcher": {
-              "path": "**.text",
-              "contentMatchers": [
-                {
-                  "substring": {
-                    "value": "BEGIN RSA PRIVATE KEY"
-                  }
-                },
-                {
-                  "substring": {
-                    "value": "BEGIN OPENSSH PRIVATE KEY"
-                  }
-                },
-                {
-                  "substring": {
-                    "value": "BEGIN PRIVATE KEY"
-                  }
-                },
-                {
-                  "substring": {
-                    "value": "BEGIN EC PRIVATE KEY"
-                  }
-                }
-              ]
-            },
-            "action": "FILTER_ACTION_BLOCK"
-          }
-        ]
-      }
-    ]
-  }
-}