@domesystems/templates 0.1.0 → 0.2.0

package/ai-agent-for-release-notes/rules/release-notes.cedar

@@ -1,49 +0,0 @@
-// draft-release-notes — authorization rules
-//
-// Two kinds of boundary, which is why this template exists alongside the other
-// two. The first is the familiar one: a write tool is on the gateway and denied.
-// The second is the one MCP consolidation forces.
-//
-// GitHub replaced nine per-pull-request reads with a single `pull_request_read`
-// taking a `method` — get, get_diff, get_files, get_reviews, get_commits and
-// four more. A tool-name allow-list can only take all nine or none. Release
-// notes are written from titles, bodies and commits; the diff is the source
-// code, and there is no reason for it to reach a model. So the tool is
-// permitted and the one method is refused, on the argument.
-
-permit ( principal, action == Dome::Action::"mcp:discover", resource );
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/list_pull_requests"
-);
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/pull_request_read"
-);
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/list_commits"
-);
-
-// A forbid is the only thing that narrows the auto-generated Agent Form, which
-// permits every tool attached to the gateway.
-forbid (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/create_issue"
-);
-
-// Same tool as the permit above. The gateway evaluates this against the real
-// call arguments, so `method: get` is served and `method: get_diff` is refused.
-forbid (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/pull_request_read"
-)
-when { resource.arguments.method == "get_diff" };

package/ai-agent-for-release-notes/template.yaml

@@ -1,155 +0,0 @@
-apiVersion: templates.domesystems.ai/v1
-kind: Template
-
-metadata:
-  name: draft-release-notes
-  slug: ai-agent-for-release-notes
-  title: Draft release notes from merged pull requests
-  target_query: github ai agent release notes
-  summary: >-
-    A scheduled job that turns merged pull requests into a release-note draft.
-    It can read one repository's
-    pull requests and commits. It cannot open an issue, merge, or cut the
-    release — and it cannot read the source diff, which is the same tool it is
-    allowed to call, refused on one of its parameters.
-  domain: engineering
-  shape: scheduled-job
-  ui: run
-  business_pattern: consumes
-  governance_interest: [read-only, tool-scoped-access, argument-scoped-access]
-
-# Library-only topology and documentation data. `dome.tf` is the deployable source.
-catalog:
-  gateway:
-    name: release
-    description: Read-only GitHub surface for the release-notes job
-    default: true
-
-  connections:
-    - name: github
-      protocol: streamable-http
-      url: https://api.githubcopilot.com/mcp/
-      auth:
-        method: api-key
-        credential: shared
-        secret:
-          env: GITHUB_TOKEN
-          variable: github_token
-          label: a GitHub fine-grained personal access token
-          steps:
-            - "Create one at https://github.com/settings/personal-access-tokens/new"
-            - "Scope it to the single repository you want release notes for"
-            - "Read access to Contents and Pull requests is enough"
-            - "export GITHUB_TOKEN=github_pat_..."
-          note: "It goes into Dome, not into your app. This template never writes."
-      # `get_pull_request` used to be here and does not exist. GitHub
-      # consolidated nine per-PR reads into one `pull_request_read` taking a
-      # `method`, with no deprecated alias — and `FilterTools` drops unknown
-      # names silently, so the template would have quietly lost a tool.
-      # Verified against github/github-mcp-server, then against the live
-      # connection with `lint --live`.
-      permit:
-        - list_pull_requests
-        - pull_request_read
-        - list_commits
-      # A real write, on the gateway on purpose so the model can try it. Cedar
-      # forbids it, and a forbid beats the auto-generated Agent Form permit.
-      forbid:
-        - create_issue
-      # And the consolidation problem itself. `pull_request_read` is permitted,
-      # but one of its nine methods returns the source diff — which release
-      # notes do not need and which puts the code in the model's context. A
-      # tool-name allow-list cannot express that. Cedar on the arguments can,
-      # and the gateway enforces it on the real call, not just in `simulate`.
-      forbid_arguments:
-        - tool: pull_request_read
-          when: 'resource.arguments.method == "get_diff"'
-          why: the diff is the source code, and release notes are written from titles and commits
-          example_denied: { method: get_diff, owner: OWNER, repo: REPO, pullNumber: 1 }
-          example_allowed: { method: get, owner: OWNER, repo: REPO, pullNumber: 1 }
-
-  model:
-    name: sonnet
-    provider: anthropic
-    model_id: claude-sonnet-5
-    secret:
-      env: ANTHROPIC_API_KEY
-      variable: anthropic_api_key
-      label: an Anthropic API key
-
-  pool:
-    name: release-pool
-    default: true
-
-  agent:
-    name: release-notes-writer
-
-  rules:
-    file: rules/release-notes.cedar
-
-  guards:
-    filters:
-      - name: block-leaked-keys
-        description: Withhold a tool result carrying a private key
-        why: >-
-          Pull request bodies are prose written in a hurry, and private keys end
-          up in them. This agent pipes that prose into a model, so a leaked key
-          would be copied into a provider's context and into the draft. The
-          result is blocked rather than redacted: if a key is in the payload,
-          the right answer is that the agent does not get the payload.
-        config: guards/block-leaked-keys.json
-        bind: { tool: github, direction: response }
-
-  quotas:
-    # A headless job on a schedule is the thing most likely to run away
-    # unnoticed, so the cap is tighter than the interactive templates'.
-    - subject: agent
-      agent: release-notes-writer
-      unit: dome_usd
-      limit: 2
-      window: daily
-      name: release-notes-writer daily spend
-    # Counted in calls, not dollars, because what goes wrong with a repository
-    # crawl is a rate limit rather than a bill.
-    - subject: tool-connection
-      connection: github
-      unit: calls
-      limit: 1000
-      window: daily
-      name: github calls per day
-
-app:
-  runtime:
-    pattern: run
-    language: python
-  agent:
-    prompt: app/instructions.md
-    help: app/help.md
-    # The run surface uses the first starter as its task prompt, and `${VAR}`
-    # is filled from the declared run parameters below. Without the repo in
-    # here the agent was told it would be "given the run parameters" and then
-    # given nothing.
-    starters:
-      - Draft release notes for pull requests merged into ${TARGET_REPO} in the
-        14 days before ${TODAY}.
-    model: claude-sonnet-5
-    max_tokens: 8192
-    skills:
-      - name: draft-release-notes
-        description: Read merged pull requests in a window and write user-facing notes.
-        tools:
-          - github/list_pull_requests
-          - github/pull_request_read
-          - github/list_commits
-          - github/create_issue
-    invoker:
-      kind: cron
-      schedule: "0 9 * * MON"
-  options:
-    identity:
-      mode: none
-    # Run parameters. `${VAR}` in a starter, prompt or help file is filled from
-    # these; the label is what `.env.example` tells the reader to put there.
-    env:
-      - name: TARGET_REPO
-        label: "the repository to draft notes for, as owner/repo — your choice, and the token must reach it"