@oneuptime/common 14.0.8 → 14.0.9

package/Models/DatabaseModels/Index.ts

@@ -1,6 +1,7 @@
 import AcmeCertificate from "./AcmeCertificate";
 import AcmeChallenge from "./AcmeChallenge";
 import KubernetesCluster from "./KubernetesCluster";
+import KubernetesAiAgent from "./KubernetesAiAgent";
 import KubernetesClusterOwnerTeam from "./KubernetesClusterOwnerTeam";
 import KubernetesClusterOwnerUser from "./KubernetesClusterOwnerUser";
 import KubernetesResource from "./KubernetesResource";
@@ -908,6 +909,7 @@ const AllModelTypes: Array<{
   StatusPageSCIMLog,
 
   KubernetesCluster,
+  KubernetesAiAgent,
   KubernetesClusterOwnerTeam,
   KubernetesClusterOwnerUser,
   KubernetesResource,

package/Models/DatabaseModels/KubernetesAiAgent.ts

@@ -0,0 +1,364 @@
+import KubernetesCluster from "./KubernetesCluster";
+import Project from "./Project";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import TenantColumn from "../../Types/Database/TenantColumn";
+import IconProp from "../../Types/Icon/IconProp";
+import { JSONObject } from "../../Types/JSON";
+import {
+  KubernetesAiAgentConnectionStatus,
+  KubernetesAiAgentRegistrationRefusalReason,
+} from "../../Types/Kubernetes/KubernetesClusterAiAccess";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+
+/*
+ * Who may see a cluster's Kubernetes AI agent: exactly who may read the
+ * cluster (KubernetesCluster's read list). Nobody writes a row through the
+ * API — the agent registers and heartbeats through
+ * /kubernetes-ai-agent-ingest, and an admin reset goes through the cluster's
+ * AI access API, both as root.
+ */
+const CLUSTER_READERS: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.ProjectMember,
+  Permission.Viewer,
+  Permission.SettingsAdmin,
+  Permission.SettingsMember,
+  Permission.SettingsViewer,
+  Permission.ReadKubernetesCluster,
+];
+
+/*
+ * The Kubernetes AI agent of one cluster: the slim in-cluster kubectl
+ * executor the kubernetes-agent chart installs (image
+ * oneuptime/kubernetes-ai-agent). It is deliberately NOT a Runner: it never
+ * appears on the Runners page, is never handed a credential and runs nothing
+ * but AI kubectl jobs (RunnerJob rows targeted at it through
+ * RunnerJob.targetKubernetesAiAgentId) with its own ServiceAccount.
+ *
+ * One row per cluster. The agent registers with the project's telemetry
+ * ingestion key and receives an agent key; only the key's sha256 is kept
+ * (keyHash), and no user can read it. The dashboard reads the row through the
+ * cluster's AI access status, which is why there is no CRUD API and no API
+ * documentation for this table (UserProjectSsoConsent is the precedent).
+ */
+@TenantColumn("projectId")
+@TableAccessControl({
+  create: [],
+  read: CLUSTER_READERS,
+  delete: [],
+  update: [],
+})
+/*
+ * One agent per cluster, enforced by the database: two pods registering for
+ * the same new cluster at once must not both create a row. Named, and
+ * declared here rather than only in a migration, so TypeORM's schema builder
+ * recognises it and never generates a DROP for it.
+ */
+@Index("IDX_KubernetesAiAgent_kubernetesClusterId", ["kubernetesClusterId"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
+@TableMetadata({
+  tableName: "KubernetesAiAgent",
+  singularName: "Kubernetes AI Agent",
+  pluralName: "Kubernetes AI Agents",
+  icon: IconProp.Cube,
+  tableDescription:
+    "The Kubernetes AI agent installed in a cluster by the Kubernetes agent chart: the in-cluster kubectl executor OneUptime AI uses to investigate (and, when allowed, fix) that cluster. One per cluster. Managed by the server; not user-writable.",
+})
+@Entity({
+  name: "KubernetesAiAgent",
+})
+export default class KubernetesAiAgent extends BaseModel {
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "Relation to Project Resource in which this object belongs",
+  })
+  @ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "projectId" })
+  public project?: Project = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    canReadOnRelationQuery: true,
+    title: "Project ID",
+    description: "ID of your OneUptime Project in which this object belongs",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public projectId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "kubernetesClusterId",
+    type: TableColumnType.Entity,
+    modelType: KubernetesCluster,
+    title: "Kubernetes Cluster",
+    description: "The cluster this Kubernetes AI agent runs in.",
+  })
+  @ManyToOne(
+    () => {
+      return KubernetesCluster;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "kubernetesClusterId" })
+  public kubernetesCluster?: KubernetesCluster = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    canReadOnRelationQuery: true,
+    title: "Kubernetes Cluster ID",
+    description:
+      "ID of the cluster this Kubernetes AI agent runs in. A cluster has at most one agent.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public kubernetesClusterId?: ObjectID = undefined;
+
+  /*
+   * sha256 (hex) of the agent key the agent presents on every request after
+   * registration. The key itself is never stored. Null after an admin reset:
+   * no key matches, so the running pod fails authentication and registers
+   * again. Unreadable by every role — even a hash of a bearer credential is
+   * nothing the dashboard or the API should hand out.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: false,
+    title: "Key Hash",
+    description:
+      "SHA-256 of the key the agent authenticates with. Set by the server; never readable.",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public keyHash?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: false,
+    title: "Agent Version",
+    description:
+      "Self-reported version of the Kubernetes AI agent. Updated on registration and every heartbeat.",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public agentVersion?: string = undefined;
+
+  /*
+   * The agent's last reported posture (KubernetesAgentPosture), stored bare
+   * — not under a hostInfo.kubernetes wrapper like a Runner's — and always
+   * read back through parseKubernetesAgentPosture. The server forces
+   * inCluster and clusterIdentifier before storing it.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "Posture",
+    description:
+      "What the agent last reported about itself: whether it may write, the namespaces it may write in, whether it may run node operations, its own namespace and its kubectl and chart versions. Set by the server.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: true,
+  })
+  public posture?: JSONObject = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "Last Alive At",
+    description: "Most recent registration or heartbeat from this agent.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastAliveAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: true,
+    isDefaultValueColumn: true,
+    canReadOnRelationQuery: true,
+    title: "Connection Status",
+    description:
+      "connected while the agent registers and heartbeats; disconnected once it signs off or is reset. It is online only when connected AND its last heartbeat is recent.",
+    defaultValue: "disconnected",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: false,
+    default: "disconnected",
+  })
+  public connectionStatus?: KubernetesAiAgentConnectionStatus = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Registered At",
+    description: "When the agent last registered and was issued a key.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastRegisteredAt?: Date = undefined;
+
+  /*
+   * The TelemetryIngestionKey whose request last minted this agent's key
+   * (TelemetryRequest.ingestionKeyPolicy.ingestionKeyId), so an operator
+   * who revokes a leaked key can tell which agents it registered. No foreign
+   * key: deleting an ingestion key must not delete or re-key an agent.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    title: "Registered With Ingestion Key ID",
+    description:
+      "ID of the telemetry ingestion key the agent last registered with.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public registeredWithIngestionKeyId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Refused Registration At",
+    description:
+      "When another agent pod last tried to register for this cluster and was refused.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastRefusedRegistrationAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: CLUSTER_READERS,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: false,
+    title: "Last Refused Registration Reason",
+    description:
+      "Why that registration was refused, for example previous_instance_online.",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public lastRefusedRegistrationReason?: KubernetesAiAgentRegistrationRefusalReason =
+    undefined;
+}

package/Models/DatabaseModels/KubernetesCluster.ts

@@ -1203,13 +1203,13 @@ export default class KubernetesCluster extends BaseModel {
     type: TableColumnType.Boolean,
     title: "Let AI Investigate With kubectl",
     description:
-      "When on, OneUptime AI runs read-only kubectl commands (get, describe, logs, events, top, rollout status) on this cluster while investigating incidents and alerts linked to it, and uses their output, with secret values redacted, as evidence. Nothing is ever changed by an investigation. Anyone who may edit the cluster can turn it on or off.",
-    defaultValue: false,
+      "When on, OneUptime AI runs read-only kubectl commands (get, describe, logs, events, top, rollout status) on this cluster, through the cluster's Kubernetes AI agent, while investigating incidents and alerts linked to it, and uses their output, with secret values redacted, as evidence. Nothing is ever changed by an investigation. On by default. Anyone who may edit the cluster can turn it on or off.",
+    defaultValue: true,
   })
   @Column({
     type: ColumnType.Boolean,
     nullable: false,
-    default: false,
+    default: true,
   })
   public isAiInvestigationEnabled?: boolean = undefined;
 

package/Models/DatabaseModels/Project.ts

@@ -1582,7 +1582,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Boolean,
     title: "Enable AI Command Execution",
     description:
-      "When enabled, auto-remediation rules may let the AI compose and run commands on opted-in Runners (with an operator allowlist for auto-execution, and one-click approval for everything else). Off by default.",
+      "When enabled, auto-remediation rules may let the AI compose and run commands on opted-in Runners (with an operator allowlist for auto-execution, and one-click approval for everything else), and AI may fix Kubernetes clusters reached through a Runner with a Kubernetes credential. Fixes on a cluster through its in-cluster Kubernetes AI agent do not need it: that cluster's AI agent page and the agent's write access decide. Off by default.",
     defaultValue: false,
     example: false,
   })
@@ -1593,8 +1593,19 @@ export default class Project extends TenantModel {
   })
   public enableAiCommandExecution?: boolean = undefined;
 
+  /*
+   * The automatic-investigation opt-ins are ON for projects created from now
+   * on, and the column default stays OFF on purpose. ProjectService's
+   * onBeforeCreate turns both on when the create request leaves them unset
+   * (every project created in the dashboard), which is why a creator may
+   * set them (create ACL): a create that says false keeps false. The column
+   * default and defaultValue stay false so existing projects are not
+   * switched on (that would start spending their AI budget), and so the
+   * generated Terraform provider's static default does not flip existing
+   * Terraform-managed projects on their next apply.
+   */
   @ColumnAccessControl({
-    create: [],
+    create: [Permission.User],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -1612,7 +1623,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Boolean,
     title: "Enable Automatic Incident Investigation",
     description:
-      "When enabled, OneUptime's AI SRE automatically investigates every new incident and posts a cited root cause analysis to the incident timeline. Requires AI to be enabled and an LLM provider to be configured.",
+      "When enabled, OneUptime's AI SRE automatically investigates every new incident and posts a cited root cause analysis to the incident timeline; any auto-remediation for the incident waits until that investigation settles. On for new projects created in OneUptime; projects that existed before keep their setting. Drafting a postmortem when an incident resolves is a separate setting (Enable Automatic Postmortem Draft). Requires AI to be enabled and an LLM provider to be configured.",
     defaultValue: false,
     example: true,
   })
@@ -1623,8 +1634,9 @@ export default class Project extends TenantModel {
   })
   public enableAutomaticIncidentInvestigation?: boolean = undefined;
 
+  // On for new projects; see enableAutomaticIncidentInvestigation above.
   @ColumnAccessControl({
-    create: [],
+    create: [Permission.User],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -1642,7 +1654,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Boolean,
     title: "Enable Automatic Alert Investigation",
     description:
-      "When enabled, OneUptime's AI SRE automatically investigates every new alert and posts a cited root cause analysis to the alert timeline. Requires AI to be enabled and an LLM provider to be configured.",
+      "When enabled, OneUptime's AI SRE automatically investigates every new alert and posts a cited root cause analysis to the alert timeline. On for new projects created in OneUptime; projects that existed before keep their setting. Requires AI to be enabled and an LLM provider to be configured.",
     defaultValue: false,
     example: true,
   })
@@ -1653,6 +1665,44 @@ export default class Project extends TenantModel {
   })
   public enableAutomaticAlertInvestigation?: boolean = undefined;
 
+  /*
+   * Drafting a postmortem when an incident resolves used to ride on
+   * enableAutomaticIncidentInvestigation. It is its own switch now, off by
+   * default, so turning investigations on for new projects does not also
+   * start writing postmortem notes. The migration that added it copied each
+   * existing project's investigation flag into it, so nothing changed for
+   * projects that already had the behaviour.
+   */
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Automatic Postmortem Draft",
+    description:
+      "When enabled, OneUptime's AI SRE drafts a postmortem from the incident's timeline and telemetry when an incident is resolved, for a human to review and edit. It never overwrites a postmortem that already exists. Off by default. Requires AI to be enabled and an LLM provider to be configured.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public enableAutomaticPostmortemDraft?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/ProxmoxResource.ts

@@ -42,6 +42,16 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
  * hard-deleted once lastSeenAt falls behind "now - 15min" for clusters
  * that remain connected.
  *
+ * One exception to that prune: a Node that reports itself over the
+ * Proxmox VE native OpenTelemetry push (isNativePush). Those pushes
+ * never say which nodes the cluster has, so a node that goes quiet
+ * cannot be told apart from one that was removed: its row is kept for
+ * the retention window (PVE_SILENT_NODE_RETENTION_HOURS, 7 days by
+ * default) while the nodes still alive report it as Offline
+ * (ProxmoxResourceService.markNodesNotReporting — isUp only, never
+ * lastSeenAt), however long a OneUptime outage interrupts them, until it
+ * reports again or is removed with removeOfflineNode ("Remove Node").
+ *
  * Writes go through ProxmoxResourceService under isRoot; users never
  * create/update/delete rows directly.
  *
@@ -73,7 +83,7 @@ const READ_PERMISSIONS: Array<Permission> = [
   pluralName: "Proxmox Resources",
   icon: IconProp.Cube,
   tableDescription:
-    "Snapshot of a Proxmox VE object (node, guest or storage) as last reported by the Proxmox agent. Populated by the telemetry ingest pipeline; not user-editable.",
+    "Snapshot of a Proxmox VE object (node, guest or storage) as last reported by the Proxmox agent or by Proxmox VE's native OpenTelemetry push, where a node that stops reporting is marked offline by the nodes still reporting. Populated by the telemetry ingest pipeline; not user-editable.",
 })
 @Index(["projectId", "proxmoxClusterId", "kind", "externalId"], {
   unique: true,
@@ -618,6 +628,44 @@ export default class ProxmoxResource extends BaseModel {
   })
   public metricsUpdatedAt?: Date = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: READ_PERMISSIONS,
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "Is Native Push",
+    description:
+      "True when this row comes from Proxmox VE's built-in OpenTelemetry push, where each node reports only itself; false (or null) for the Proxmox Agent, which asks the cluster about every node. A native-push node that stops reporting is kept, and reported as Offline by the nodes still alive, for the retention window.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Boolean,
+  })
+  public isNativePush?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: READ_PERMISSIONS,
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    canReadOnRelationQuery: true,
+    title: "Not Reporting Marked At",
+    description:
+      "Proxmox VE native push: when the nodes still alive last reported this node as having stopped reporting (refreshed at most once a minute while they keep reporting it). Cleared by the node's own next report. Null for every other row.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public notReportingMarkedAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: READ_PERMISSIONS,

package/Models/DatabaseModels/RunnerJob.ts

@@ -1,3 +1,4 @@
+import KubernetesAiAgent from "./KubernetesAiAgent";
 import KubernetesCluster from "./KubernetesCluster";
 import Project from "./Project";
 import Runner from "./Runner";
@@ -460,6 +461,80 @@ export default class RunnerJob extends BaseModel {
   })
   public targetAgentId?: ObjectID = undefined;
 
+  /*
+   * The Kubernetes AI agent an AI kubectl job is targeted at, when the
+   * cluster is reached through its agent rather than a Runner. An AI kubectl
+   * job sets exactly one of targetAgentId (a Runner) and this; only the named
+   * agent may claim it. The agent's id is also written to assignedAgentId on
+   * claim (that column has no foreign key), so the job heartbeat and result
+   * paths are the Runner's own. Deleting the agent row nulls this, which
+   * leaves the job claimable by nobody.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.RunbookViewer,
+      Permission.ReadRunbookExecution,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "targetKubernetesAiAgentId",
+    type: TableColumnType.Entity,
+    modelType: KubernetesAiAgent,
+    title: "Target Kubernetes AI Agent",
+    description:
+      "The Kubernetes AI agent this AI kubectl job runs on, when the cluster is reached through its agent rather than a Runner. Only this agent may claim the job.",
+  })
+  @ManyToOne(
+    () => {
+      return KubernetesAiAgent;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "targetKubernetesAiAgentId" })
+  public targetKubernetesAiAgent?: KubernetesAiAgent = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.RunbookAdmin,
+      Permission.RunbookMember,
+      Permission.RunbookViewer,
+      Permission.ReadRunbookExecution,
+    ],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    title: "Target Kubernetes AI Agent ID",
+    description:
+      "ID of the Kubernetes AI agent that should claim and execute this job.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public targetKubernetesAiAgentId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [