@domesystems/templates 0.1.1 → 0.2.0

package/ai-agent-for-notion/template.yaml

@@ -1,143 +0,0 @@
-apiVersion: templates.domesystems.ai/v1
-kind: Template
-
-metadata:
-  name: answer-from-knowledge-base
-  slug: ai-agent-for-notion
-  title: Ask questions across your Notion workspace
-  target_query: notion ai agent
-  summary: >-
-    A chat agent that answers questions from your Notion workspace. The
-    connection carries 43 tools, twenty-odd of which write. Two are permitted.
-    Ask it to create a page and it will try — and Dome will refuse, naming the
-    rule that refused it.
-  domain: productivity
-  shape: interactive-assistant
-  ui: chat
-  business_pattern: consumes
-  governance_interest: [read-only, tool-scoped-access, caller-scoped-access]
-
-# Library-only topology and documentation data. `dome.tf` is the deployable source.
-catalog:
-  gateway:
-    name: knowledge
-    description: Read-only Notion surface for the knowledge answerer
-    default: true
-
-  connections:
-    - name: notion
-      protocol: streamable-http
-      url: https://mcp.notion.com/mcp
-      # Notion runs two auth systems for one product: the REST API takes
-      # internal integration tokens, the MCP server takes user-delegated OAuth
-      # and 403s an `ntn_` token with `restricted_resource`. Dome self-registers
-      # via DCR and prints a consent URL.
-      auth:
-        method: oauth
-        credential: shared
-        oauth:
-          client_origin: dcr
-          registration_url: https://mcp.notion.com/register
-          authorize_url: https://mcp.notion.com/authorize
-          token_url: https://mcp.notion.com/token
-          revoke_url: https://mcp.notion.com/token
-          scopes: [default]
-      permit:
-        - notion-search
-        - notion-fetch
-      # On the gateway on purpose, so the model can see it and try. Cedar
-      # forbids it, and a forbid beats the auto-generated Agent Form permit.
-      # Without this there is no denial to observe.
-      forbid:
-        - notion-create-pages
-
-  model:
-    name: sonnet
-    provider: anthropic
-    model_id: claude-sonnet-5
-    secret:
-      env: ANTHROPIC_API_KEY
-      variable: anthropic_api_key
-      label: an Anthropic API key
-
-  pool:
-    name: answerer-pool
-    default: true
-
-  agent:
-    name: knowledge-answerer
-    # The gateway will not believe an act-as header it cannot verify. OIDC is
-    # the real answer but `--actas-oidc-url` must be https on a public host,
-    # so a stub on a laptop cannot issue; hmac is the local path.
-    act_as:
-      method: hmac
-      required: false          # reads without a persona still work
-      secret: ACTAS_HMAC_SECRET
-      # Alice may be acted as. Bob may not, and is refused at verification —
-      # before Cedar is consulted at all.
-      allowed_subjects: [alice]
-
-  rules:
-    file: rules/answerer.cedar
-
-  guards:
-    filters:
-      - name: redact-ssn-from-pages
-        description: Redact US SSN patterns out of Notion page content
-        why: >-
-          A wiki is where people paste things. Cedar decides which pages the
-          agent may read; it says nothing about what is inside one. This is the
-          control for the content rather than the access, and it runs before
-          the agent — not the provider — sees the page.
-        config: guards/redact-ssn-from-pages.json
-        bind: { tool: notion, direction: response }
-
-  quotas:
-    # What the agent may spend in a day, across model and tool traffic.
-    - subject: agent
-      agent: knowledge-answerer
-      unit: dome_usd
-      limit: 5
-      window: daily
-      name: knowledge-answerer daily spend
-    # And the same cap applied independently to each verified end user, which
-    # is the quota that pairs with act-as: one caller cannot spend the agent's
-    # whole day. Without --per-caller, whoever asks first gets it all.
-    - subject: model
-      model: sonnet
-      unit: dome_usd
-      limit: 2
-      window: daily
-      per_caller: true
-      name: per-caller model spend
-
-app:
-  runtime:
-    pattern: chat
-    language: python
-    image_tag: dev
-  agent:
-    prompt: app/instructions.md
-    help: app/help.md
-    model: claude-sonnet-5
-    max_tokens: 2048
-    skills:
-      - name: answer-from-notion
-        description: Search the workspace, read the most relevant pages, answer from them.
-        tools:
-          - notion/notion-search
-          - notion/notion-fetch
-          - notion/notion-create-pages
-    invoker:
-      kind: chat
-  options:
-    # alice is permitted, bob is refused. Same question, different answer,
-    # because of who is asking rather than what was asked.
-    identity:
-      mode: oidc-stub
-      personas:
-        - id: alice
-        - id: bob
-    model:
-      provider: anthropic
-      model: claude-sonnet-5

package/ai-agent-for-notion/verification.json

@@ -1,7 +0,0 @@
-{
-  "verified": "2026-09-12T19:25:35Z",
-  "context": "api-domesystems-ai-dome-systems-core-dome-library",
-  "gateway": "knowledge",
-  "agent": "knowledge-answerer",
-  "cli": "1.0.2"
-}

package/ai-agent-for-release-notes/.env.example

@@ -1,15 +0,0 @@
-# The container holds exactly one secret.
-#
-# Tool credentials went into Dome when dome import ran and live behind the gateway.
-# The provider key lives with the Broker. Neither is here, and neither should be.
-
-# Revealed once after import: dome import outputs <job-id>
-DOME_TOKEN=
-
-# The gateway ROOT — not a bare host, and not the /mcp path.
-# Copy the "Gateway URL" from the command above. The container derives
-# /mcp for tools and /v1/messages for models from it.
-DOME_GATEWAY_URL=
-
-# the repository to draft notes for, as owner/repo — your choice, and the token must reach it
-TARGET_REPO=

package/ai-agent-for-release-notes/app/agent.yaml

@@ -1,36 +0,0 @@
-name: release-notes-writer
-title: Draft release notes from merged pull requests
-summary: "A scheduled job that turns merged pull requests into a release-note draft.\
-  \ It can read one repository's pull\
-  \ requests and commits. It cannot open an issue, merge, or cut the release \u2014\
-  \ and it cannot read the source diff, which is the same tool it is allowed to call,\
-  \ refused on one of its parameters."
-shape: scheduled-job
-prompt_file: instructions.md
-help_file: help.md
-starters:
-- Draft release notes for pull requests merged into ${TARGET_REPO} in the 14 days
-  before ${TODAY}.
-model: claude-sonnet-5
-pool: release-pool
-max_tokens: 8192
-skills:
-- name: draft-release-notes
-  description: Read merged pull requests in a window and write user-facing notes.
-  tools:
-  - github/list_pull_requests
-  - github/pull_request_read
-  - github/list_commits
-  - github/create_issue
-invoker:
-  kind: cron
-  schedule: 0 9 * * MON
-options:
-  identity:
-    mode: none
-  env:
-  - name: TARGET_REPO
-    label: "the repository to draft notes for, as owner/repo \u2014 your choice, and\
-      \ the token must reach it"
-forbidden:
-- github/create_issue

package/ai-agent-for-release-notes/app/help.md

@@ -1,20 +0,0 @@
-Press **Run now** to draft release notes from pull requests merged since the
-last release.
-
-Runs here are manual. The template declares a weekly schedule, which the Dome
-agent runtime will act on once it ships — nothing in this container does.
-
-The result is the draft. On the left, each run is listed with the calls it made
-and how long each took — select an earlier run to compare.
-
-This agent reads one repository's pull requests and commits. It cannot open an
-issue, merge, or cut the release — those calls are refused.
-
-**Watch the diff get refused.** GitHub replaced nine per-pull-request reads with
-one `pull_request_read` tool that takes a `method`, so allowing or denying by
-tool name would mean all nine or none. This template allows the tool and
-refuses one parameter: `method: get_diff` returns the source code, which release
-notes are not written from. The run log shows the same tool permitted on one
-call and denied on the next, and the rule that decided it.
-
-The record of what ran is the audit log in Dome, not this page.

package/ai-agent-for-release-notes/app/instructions.md

@@ -1,19 +0,0 @@
-You draft release notes for a software project.
-
-Each run:
-
-1. List pull requests merged into the default branch of the repository named in
-   your task, in the window it gives you.
-2. Read the ones whose titles or bodies suggest user-visible change. Skip
-   dependency bumps, CI changes, and internal refactors unless they change
-   behavior. Where a title is not enough to say what is now different for a
-   user, look at the pull request in whatever more detail you can get.
-3. Produce notes in three sections — Added, Changed, Fixed. Omit any section
-   with nothing in it.
-
-Write for someone who uses the software and does not read the code. One line
-per change, in the present tense, describing what is now different for them.
-Link the pull request number at the end of each line.
-
-If nothing user-visible merged in the window, say exactly that. A release note
-that pads an empty week with internal churn trains people to stop reading.

package/ai-agent-for-release-notes/docker-compose.yml

@@ -1,18 +0,0 @@
-#
-# Without DOME_TOKEN this starts in offline mode: the chrome works and the
-# allow-list is still enforced, but tools and model are simulated.
-services:
-  app:
-    # Built and published by dome-systems/template-runtime.
-    image: ghcr.io/dome-systems/runtime-py-run:dev
-    env_file: .env
-    volumes:
-      - ./app:/config:ro
-    ports:
-      - "3000:3000"
-    healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:3000/health', timeout=2)"]
-      interval: 30s
-      timeout: 3s
-      start_period: 10s
-      retries: 3

package/ai-agent-for-release-notes/dome.tf

@@ -1,165 +0,0 @@
-terraform {
-  required_providers {
-    dome = { source = "dome-systems/dome", version = ">= 0.1.0" }
-  }
-}
-
-variable "workspace_id" { type = string }
-variable "github_token" {
-  type      = string
-  sensitive = true
-}
-variable "anthropic_api_key" {
-  type      = string
-  sensitive = true
-}
-
-resource "dome_gateway" "release" {
-  workspace_id = var.workspace_id
-  name         = "release"
-  description  = "Read-only GitHub surface for the release-notes job"
-  is_default   = true
-}
-
-resource "dome_mcp_connection" "github" {
-  workspace_id    = var.workspace_id
-  name            = "github"
-  protocol        = "streamable-http"
-  url             = "https://api.githubcopilot.com/mcp/"
-  auth_method     = "api-key"
-  credential_type = "shared"
-  secret_values   = { Authorization = var.github_token }
-}
-
-resource "dome_llm_connection" "sonnet" {
-  workspace_id    = var.workspace_id
-  name            = "sonnet"
-  provider_id     = "anthropic"
-  provider_config = jsonencode({ model = "claude-sonnet-5" })
-  auth_method     = "api-key"
-  credential_type = "shared"
-  secret_values   = { Authorization = var.anthropic_api_key }
-}
-
-resource "dome_llm_pool" "release" {
-  workspace_id = var.workspace_id
-  name         = "release-pool"
-  is_default   = true
-}
-
-resource "dome_llm_pool_member" "sonnet" {
-  workspace_id   = var.workspace_id
-  pool           = dome_llm_pool.release.name
-  llm_connection = dome_llm_connection.sonnet.name
-}
-
-resource "dome_gateway_llm_pool" "release" {
-  workspace_id = var.workspace_id
-  gateway      = dome_gateway.release.name
-  llm_pool     = dome_llm_pool.release.name
-}
-
-resource "dome_gateway_tool" "list_pull_requests" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "list_pull_requests"
-}
-
-resource "dome_gateway_tool" "pull_request_read" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "pull_request_read"
-}
-
-resource "dome_gateway_tool" "list_commits" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "list_commits"
-}
-
-resource "dome_gateway_tool" "create_issue" {
-  workspace_id   = var.workspace_id
-  gateway        = dome_gateway.release.name
-  mcp_connection = dome_mcp_connection.github.name
-  tool           = "create_issue"
-}
-
-resource "dome_agent" "release_notes_writer" {
-  workspace_id     = var.workspace_id
-  name             = "release-notes-writer"
-  allowed_gateways = [dome_gateway.release.name]
-}
-
-resource "dome_agent_rules_bundle" "release_notes_writer" {
-  workspace_id = var.workspace_id
-  agent        = dome_agent.release_notes_writer.name
-  files = {
-    "release-notes.cedar" = <<-EOT
-      permit ( principal, action == Dome::Action::"mcp:discover", resource );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/list_pull_requests" );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/pull_request_read" );
-      permit ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/list_commits" );
-      forbid ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/create_issue" );
-      forbid ( principal, action == Dome::Action::"mcp:call", resource == Dome::MCPTool::"github/pull_request_read" ) when { resource.arguments.method == "get_diff" };
-    EOT
-  }
-}
-
-resource "dome_filter" "block_leaked_keys" {
-  workspace_id = var.workspace_id
-  name         = "block-leaked-keys"
-  description  = "Withhold a tool result carrying a private key"
-  config = jsonencode({
-    json = { components = [{ fieldActions = [{ matcher = { path = "**.text", contentMatchers = [
-      { substring = { value = "BEGIN RSA PRIVATE KEY" } },
-      { substring = { value = "BEGIN OPENSSH PRIVATE KEY" } },
-      { substring = { value = "BEGIN PRIVATE KEY" } },
-      { substring = { value = "BEGIN EC PRIVATE KEY" } },
-    ] }, action = "FILTER_ACTION_BLOCK" }] }] }
-  })
-}
-
-resource "dome_mcp_connection_filters" "github_responses" {
-  workspace_id   = var.workspace_id
-  mcp_connection = dome_mcp_connection.github.name
-  direction      = "response"
-  filters        = [dome_filter.block_leaked_keys.name]
-}
-
-resource "dome_quota" "agent_daily_spend" {
-  workspace_id = var.workspace_id
-  dimension    = "llm"
-  unit         = "dome_usd"
-  subject_type = "agent"
-  subject      = dome_agent.release_notes_writer.name
-  scope        = "total"
-  window       = "daily"
-  limit_amount = 2000000
-  name         = "release-notes-writer daily spend"
-}
-
-resource "dome_quota" "github_calls" {
-  workspace_id = var.workspace_id
-  dimension    = "tool"
-  unit         = "calls"
-  subject_type = "tool_connection"
-  subject      = dome_mcp_connection.github.name
-  scope        = "total"
-  window       = "daily"
-  limit_amount = 1000
-  name         = "github calls per day"
-}
-
-resource "dome_agent_key" "runtime" {
-  workspace_id = var.workspace_id
-  agent        = dome_agent.release_notes_writer.name
-  name         = "runtime"
-}
-
-output "release_notes_writer_token" {
-  value     = dome_agent_key.runtime.token
-  sensitive = true
-}

package/ai-agent-for-release-notes/guards/block-leaked-keys.json

@@ -1,38 +0,0 @@
-{
-  "json": {
-    "components": [
-      {
-        "fieldActions": [
-          {
-            "matcher": {
-              "path": "**.text",
-              "contentMatchers": [
-                {
-                  "substring": {
-                    "value": "BEGIN RSA PRIVATE KEY"
-                  }
-                },
-                {
-                  "substring": {
-                    "value": "BEGIN OPENSSH PRIVATE KEY"
-                  }
-                },
-                {
-                  "substring": {
-                    "value": "BEGIN PRIVATE KEY"
-                  }
-                },
-                {
-                  "substring": {
-                    "value": "BEGIN EC PRIVATE KEY"
-                  }
-                }
-              ]
-            },
-            "action": "FILTER_ACTION_BLOCK"
-          }
-        ]
-      }
-    ]
-  }
-}

package/ai-agent-for-release-notes/rules/release-notes.cedar

@@ -1,49 +0,0 @@
-// draft-release-notes — authorization rules
-//
-// Two kinds of boundary, which is why this template exists alongside the other
-// two. The first is the familiar one: a write tool is on the gateway and denied.
-// The second is the one MCP consolidation forces.
-//
-// GitHub replaced nine per-pull-request reads with a single `pull_request_read`
-// taking a `method` — get, get_diff, get_files, get_reviews, get_commits and
-// four more. A tool-name allow-list can only take all nine or none. Release
-// notes are written from titles, bodies and commits; the diff is the source
-// code, and there is no reason for it to reach a model. So the tool is
-// permitted and the one method is refused, on the argument.
-
-permit ( principal, action == Dome::Action::"mcp:discover", resource );
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/list_pull_requests"
-);
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/pull_request_read"
-);
-
-permit (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/list_commits"
-);
-
-// A forbid is the only thing that narrows the auto-generated Agent Form, which
-// permits every tool attached to the gateway.
-forbid (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/create_issue"
-);
-
-// Same tool as the permit above. The gateway evaluates this against the real
-// call arguments, so `method: get` is served and `method: get_diff` is refused.
-forbid (
-  principal,
-  action == Dome::Action::"mcp:call",
-  resource == Dome::MCPTool::"github/pull_request_read"
-)
-when { resource.arguments.method == "get_diff" };

package/ai-agent-for-release-notes/template.yaml

@@ -1,156 +0,0 @@
-apiVersion: templates.domesystems.ai/v1
-kind: Template
-
-metadata:
-  name: draft-release-notes
-  slug: ai-agent-for-release-notes
-  title: Draft release notes from merged pull requests
-  target_query: github ai agent release notes
-  summary: >-
-    A scheduled job that turns merged pull requests into a release-note draft.
-    It can read one repository's
-    pull requests and commits. It cannot open an issue, merge, or cut the
-    release — and it cannot read the source diff, which is the same tool it is
-    allowed to call, refused on one of its parameters.
-  domain: engineering
-  shape: scheduled-job
-  ui: run
-  business_pattern: consumes
-  governance_interest: [read-only, tool-scoped-access, argument-scoped-access]
-
-# Library-only topology and documentation data. `dome.tf` is the deployable source.
-catalog:
-  gateway:
-    name: release
-    description: Read-only GitHub surface for the release-notes job
-    default: true
-
-  connections:
-    - name: github
-      protocol: streamable-http
-      url: https://api.githubcopilot.com/mcp/
-      auth:
-        method: api-key
-        credential: shared
-        secret:
-          env: GITHUB_TOKEN
-          variable: github_token
-          label: a GitHub fine-grained personal access token
-          steps:
-            - "Create one at https://github.com/settings/personal-access-tokens/new"
-            - "Scope it to the single repository you want release notes for"
-            - "Read access to Contents and Pull requests is enough"
-            - "export GITHUB_TOKEN=github_pat_..."
-          note: "It goes into Dome, not into your app. This template never writes."
-      # `get_pull_request` used to be here and does not exist. GitHub
-      # consolidated nine per-PR reads into one `pull_request_read` taking a
-      # `method`, with no deprecated alias — and `FilterTools` drops unknown
-      # names silently, so the template would have quietly lost a tool.
-      # Verified against github/github-mcp-server, then against the live
-      # connection with `lint --live`.
-      permit:
-        - list_pull_requests
-        - pull_request_read
-        - list_commits
-      # A real write, on the gateway on purpose so the model can try it. Cedar
-      # forbids it, and a forbid beats the auto-generated Agent Form permit.
-      forbid:
-        - create_issue
-      # And the consolidation problem itself. `pull_request_read` is permitted,
-      # but one of its nine methods returns the source diff — which release
-      # notes do not need and which puts the code in the model's context. A
-      # tool-name allow-list cannot express that. Cedar on the arguments can,
-      # and the gateway enforces it on the real call, not just in `simulate`.
-      forbid_arguments:
-        - tool: pull_request_read
-          when: 'resource.arguments.method == "get_diff"'
-          why: the diff is the source code, and release notes are written from titles and commits
-          example_denied: { method: get_diff, owner: OWNER, repo: REPO, pullNumber: 1 }
-          example_allowed: { method: get, owner: OWNER, repo: REPO, pullNumber: 1 }
-
-  model:
-    name: sonnet
-    provider: anthropic
-    model_id: claude-sonnet-5
-    secret:
-      env: ANTHROPIC_API_KEY
-      variable: anthropic_api_key
-      label: an Anthropic API key
-
-  pool:
-    name: release-pool
-    default: true
-
-  agent:
-    name: release-notes-writer
-
-  rules:
-    file: rules/release-notes.cedar
-
-  guards:
-    filters:
-      - name: block-leaked-keys
-        description: Withhold a tool result carrying a private key
-        why: >-
-          Pull request bodies are prose written in a hurry, and private keys end
-          up in them. This agent pipes that prose into a model, so a leaked key
-          would be copied into a provider's context and into the draft. The
-          result is blocked rather than redacted: if a key is in the payload,
-          the right answer is that the agent does not get the payload.
-        config: guards/block-leaked-keys.json
-        bind: { tool: github, direction: response }
-
-  quotas:
-    # A headless job on a schedule is the thing most likely to run away
-    # unnoticed, so the cap is tighter than the interactive templates'.
-    - subject: agent
-      agent: release-notes-writer
-      unit: dome_usd
-      limit: 2
-      window: daily
-      name: release-notes-writer daily spend
-    # Counted in calls, not dollars, because what goes wrong with a repository
-    # crawl is a rate limit rather than a bill.
-    - subject: tool-connection
-      connection: github
-      unit: calls
-      limit: 1000
-      window: daily
-      name: github calls per day
-
-app:
-  runtime:
-    pattern: run
-    language: python
-    image_tag: dev
-  agent:
-    prompt: app/instructions.md
-    help: app/help.md
-    # The run surface uses the first starter as its task prompt, and `${VAR}`
-    # is filled from the declared run parameters below. Without the repo in
-    # here the agent was told it would be "given the run parameters" and then
-    # given nothing.
-    starters:
-      - Draft release notes for pull requests merged into ${TARGET_REPO} in the
-        14 days before ${TODAY}.
-    model: claude-sonnet-5
-    max_tokens: 8192
-    skills:
-      - name: draft-release-notes
-        description: Read merged pull requests in a window and write user-facing notes.
-        tools:
-          - github/list_pull_requests
-          - github/pull_request_read
-          - github/list_commits
-          - github/create_issue
-    invoker:
-      kind: cron
-      schedule: "0 9 * * MON"
-  options:
-    identity:
-      mode: none
-    # Run parameters. `${VAR}` in a starter, prompt or help file is filled from
-    # these; the label is what `.env.example` tells the reader to put there.
-    env:
-      - name: TARGET_REPO
-        label: "the repository to draft notes for, as owner/repo — your choice, and the token must reach it"