workspai 0.74.0 → 0.75.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/contracts/agent-framework-capabilities.v1.json +454 -0
- package/contracts/cli-runtime-command-inventory.v1.snapshot.json +166 -0
- package/contracts/create-planner-capabilities.v1.json +24 -0
- package/contracts/extension-cli-compatibility.v1.json +6 -0
- package/contracts/published-contract-catalog.v1.json +30 -0
- package/contracts/runtime-command-surface.v1.json +71 -1
- package/contracts/workspace-intelligence/agent-framework-adapter-manifest.v1.json +2127 -0
- package/contracts/workspace-intelligence/agent-framework-admission-candidate.v1.json +193 -0
- package/contracts/workspace-intelligence/agent-framework-change-plan.v1.json +280 -0
- package/contracts/workspace-intelligence/agent-framework-conformance-report.v1.json +269 -0
- package/contracts/workspace-intelligence/agent-framework-ownership-receipt.v1.json +147 -0
- package/contracts/workspace-intelligence/workspace-model.v1.json +4 -0
- package/contracts/workspace-intelligence-architecture.v1.json +28 -2
- package/dist/analyze-FRQVJ3VJ.js +1 -0
- package/dist/{artifact-remediation-plan-OVTQM7HN.js → artifact-remediation-plan-HD5K52UJ.js} +1 -1
- package/dist/autopilot-release-D3UES53H.js +1 -0
- package/dist/capabilities-command-VK3LQLP2.js +1 -0
- package/dist/{chunk-TBOIXIQA.js → chunk-36VNERGC.js} +1 -1
- package/dist/{chunk-ZNKZ2KXR.js → chunk-4DX4HBG3.js} +1 -1
- package/dist/chunk-4KEZQLBU.js +2 -0
- package/dist/{chunk-PKKSRXUS.js → chunk-6B7L4NZE.js} +1 -1
- package/dist/chunk-7NKM6EHE.js +7 -0
- package/dist/{chunk-FE5R6EUV.js → chunk-BLEIUQL6.js} +1 -1
- package/dist/{chunk-37SWTS2B.js → chunk-BR6QIYQS.js} +1 -1
- package/dist/chunk-CGNMS32W.js +97 -0
- package/dist/{chunk-4JJDDL3X.js → chunk-CK73SQFF.js} +1 -1
- package/dist/chunk-CMLLERGG.js +418 -0
- package/dist/{chunk-MGL6DBOR.js → chunk-COOVCORC.js} +1 -1
- package/dist/chunk-D4AMCZJU.js +7 -0
- package/dist/chunk-DFREJHG7.js +1 -0
- package/dist/{chunk-C43NXRRE.js → chunk-DJH2CH42.js} +1 -1
- package/dist/chunk-DT3LRKZQ.js +1 -0
- package/dist/{chunk-UHT2SW7O.js → chunk-FS3WLRQ4.js} +1 -1
- package/dist/chunk-G3ZC5W4U.js +1 -0
- package/dist/{chunk-KCIET26G.js → chunk-GE46XKD2.js} +1 -1
- package/dist/{chunk-DPC5DKH6.js → chunk-GIFAGOMK.js} +1 -1
- package/dist/{chunk-BTJPTJLT.js → chunk-HLSOZOL3.js} +3 -3
- package/dist/chunk-J4J3RYCL.js +4 -0
- package/dist/{chunk-JK6XEF7K.js → chunk-JKAAKE4Z.js} +1 -1
- package/dist/{chunk-G6ADWA2B.js → chunk-LMOTDLJF.js} +1 -1
- package/dist/{chunk-IQFXLJIM.js → chunk-MXI2DWLL.js} +1 -1
- package/dist/{chunk-5Y4YRYZI.js → chunk-NFWUAEVQ.js} +1 -1
- package/dist/chunk-NGU7RYXA.js +9 -0
- package/dist/{chunk-3WHE7V4M.js → chunk-NLRZFIC6.js} +1 -1
- package/dist/chunk-O2CFT2A3.js +1 -0
- package/dist/{chunk-EBQS5T7Q.js → chunk-OA2YJN22.js} +1 -1
- package/dist/chunk-OH6LV5JP.js +6 -0
- package/dist/{chunk-773WUMFU.js → chunk-P5RZO5BY.js} +13 -13
- package/dist/{chunk-XVTN5DDV.js → chunk-RU3UT7GJ.js} +1 -1
- package/dist/{chunk-TVSMNF5G.js → chunk-RX3U7JKF.js} +4 -4
- package/dist/chunk-SRCZX2KC.js +13 -0
- package/dist/chunk-TXVMHEJS.js +1 -0
- package/dist/chunk-V5WVGPOP.js +1 -0
- package/dist/{chunk-FY4X2VOE.js → chunk-VHMDWRDG.js} +2 -2
- package/dist/{chunk-H333GKL4.js → chunk-W7I65IXY.js} +1 -1
- package/dist/chunk-WOPZX56J.js +2 -0
- package/dist/chunk-YP436V7Q.js +2 -0
- package/dist/{chunk-HAZGSAKP.js → chunk-ZI54C2AO.js} +1 -1
- package/dist/{chunk-SAZXL36B.js → chunk-ZW4QV6SB.js} +1 -1
- package/dist/{create-EKA2QG5R.js → create-7UENFCJK.js} +1 -1
- package/dist/{demo-kit-RKTHTXHJ.js → demo-kit-ALW6OSQV.js} +1 -1
- package/dist/{doctor-BXSNADVR.js → doctor-KGADT4PI.js} +1 -1
- package/dist/{dotnet-webapi-clean-VJX6SGGP.js → dotnet-webapi-clean-6Z4EXEJY.js} +1 -1
- package/dist/{goal-lifecycle-XXWNMIAD.js → goal-lifecycle-HIQGDEEP.js} +1 -1
- package/dist/goal-pack-63PEP2ND.js +1 -0
- package/dist/{gofiber-standard-I6ASLOEE.js → gofiber-standard-TDJQIVQZ.js} +1 -1
- package/dist/{gogin-standard-U2LSRLIP.js → gogin-standard-UEF3IHSJ.js} +1 -1
- package/dist/index.d.ts +18 -0
- package/dist/index.js +267 -249
- package/dist/{pipeline-JLOC2SUT.js → pipeline-VFI35PR4.js} +1 -1
- package/dist/{project-agent-entry-ZNUHGCVC.js → project-agent-entry-Z3OY3S7T.js} +1 -1
- package/dist/{project-intelligence-lens-W72OUEDW.js → project-intelligence-lens-YWICXW6P.js} +1 -1
- package/dist/{project-test-coverage-5PXAHBYQ.js → project-test-coverage-3P5FH6E5.js} +1 -1
- package/dist/proof-carrying-change-BAP2C3KV.js +1 -0
- package/dist/{pythonRapidkitExec-44ORGQ4R.js → pythonRapidkitExec-UMFLDIYR.js} +1 -1
- package/dist/{rust-axum-JMV7UPO7.js → rust-axum-4TRVPFMB.js} +1 -1
- package/dist/{springboot-standard-OC2RS3KC.js → springboot-standard-COWL75GT.js} +1 -1
- package/dist/verified-goal-A6WOMNTU.js +1 -0
- package/dist/{workspace-XTIGVLGH.js → workspace-PAXTJCMH.js} +1 -1
- package/dist/{workspace-agent-sync-TN6QDNBR.js → workspace-agent-sync-MGCEF4ON.js} +1 -1
- package/dist/{workspace-archive-OSMU3CK6.js → workspace-archive-3AURTMYA.js} +1 -1
- package/dist/{workspace-context-Y3TNY2XZ.js → workspace-context-2G6QZ6D3.js} +1 -1
- package/dist/{workspace-contract-GRZY7WRD.js → workspace-contract-VWPOIYHJ.js} +1 -1
- package/dist/{workspace-explain-KUYHJFLY.js → workspace-explain-HLEBUK4K.js} +1 -1
- package/dist/{workspace-feedback-D6HJLKBQ.js → workspace-feedback-FF34CSJE.js} +1 -1
- package/dist/{workspace-foundation-ZBUJTR56.js → workspace-foundation-X7LOGTS3.js} +1 -1
- package/dist/{workspace-graph-stream-KC2XUAE4.js → workspace-graph-stream-XGSRDRLI.js} +1 -1
- package/dist/{workspace-history-WWPS4U7H.js → workspace-history-EQG5UBKW.js} +1 -1
- package/dist/{workspace-intelligence-26YT6KMN.js → workspace-intelligence-GFJKIWBX.js} +1 -1
- package/dist/{workspace-intelligence-benchmark-QFVTUBDO.js → workspace-intelligence-benchmark-R5MEGJQS.js} +1 -1
- package/dist/{workspace-intelligence-runner-HVYKHCTX.js → workspace-intelligence-runner-BU6JKNUD.js} +1 -1
- package/dist/{workspace-knowledge-graph-RL3I2FHY.js → workspace-knowledge-graph-OUTCLYS2.js} +1 -1
- package/dist/workspace-knowledge-graph-snapshot-XWJRUMAC.js +1 -0
- package/dist/workspace-mcp-serve-JYUKX3YS.js +3 -0
- package/dist/workspace-model-DUGPW5IB.js +1 -0
- package/dist/{workspace-onboarding-BY6RUBBH.js → workspace-onboarding-C4CKWTJ3.js} +1 -1
- package/dist/{workspace-readme-HA6XLDME.js → workspace-readme-4FCKAQME.js} +1 -1
- package/dist/{workspace-registry-summary-VKTJ7PHV.js → workspace-registry-summary-4KX4QD55.js} +1 -1
- package/dist/{workspace-repair-engine-RBM7NCGI.js → workspace-repair-engine-OVW4J3DI.js} +1 -1
- package/dist/workspace-run-NVQGRZYO.js +1 -0
- package/dist/{workspace-verify-NFJ7RKKT.js → workspace-verify-B7HEFYO6.js} +1 -1
- package/dist/workspace-watch-TQYAMLIV.js +1 -0
- package/docs/README.md +4 -1
- package/docs/agent-framework-adapters.md +279 -0
- package/docs/ci-workflows.md +1 -1
- package/docs/commands-reference.md +16 -0
- package/docs/contracts/COMMAND_OWNERSHIP_MATRIX.md +5 -0
- package/docs/creating-workspaces-and-projects.md +18 -4
- package/package.json +7 -1
- package/scripts/enterprise-package-smoke.mjs +98 -0
- package/dist/analyze-IA33T6MY.js +0 -1
- package/dist/autopilot-release-T327V7QK.js +0 -1
- package/dist/capabilities-command-NFGX42CH.js +0 -1
- package/dist/chunk-46QH3ZVI.js +0 -105
- package/dist/chunk-5EVBOUYW.js +0 -3
- package/dist/chunk-D6BL7ARI.js +0 -2
- package/dist/chunk-DLLHUG2Q.js +0 -9
- package/dist/chunk-DTLLIA2C.js +0 -1
- package/dist/chunk-FYR4FD7K.js +0 -1
- package/dist/chunk-H5DRKXXC.js +0 -2
- package/dist/chunk-IUOMBLRR.js +0 -2
- package/dist/chunk-K3FXRBER.js +0 -4
- package/dist/chunk-LEEOZRWR.js +0 -7
- package/dist/chunk-NCZJUPG5.js +0 -97
- package/dist/chunk-ND5YAC4T.js +0 -1
- package/dist/chunk-SVGUAVMG.js +0 -1
- package/dist/chunk-TGDXD4CD.js +0 -1
- package/dist/chunk-VLKX5U4H.js +0 -13
- package/dist/chunk-YYELANJO.js +0 -7
- package/dist/goal-pack-NTHYLISY.js +0 -1
- package/dist/proof-carrying-change-WLUPMUO7.js +0 -1
- package/dist/verified-goal-6O2JZOOR.js +0 -1
- package/dist/workspace-knowledge-graph-snapshot-JEJMRQZL.js +0 -1
- package/dist/workspace-mcp-serve-2FGRXJG4.js +0 -3
- package/dist/workspace-model-2ODVOWDQ.js +0 -1
- package/dist/workspace-run-JCA5WPCR.js +0 -1
- package/dist/workspace-watch-3DBBB6IP.js +0 -1
- /package/dist/{chunk-K33JJVQZ.js → chunk-VN2MKTQO.js} +0 -0
|
@@ -0,0 +1,279 @@
|
|
|
1
|
+
# Agent Framework Adapter Contract
|
|
2
|
+
|
|
3
|
+
Workspai treats an agent framework as an execution integration, not as the
|
|
4
|
+
source of repository truth. A project kit may scaffold a framework and an
|
|
5
|
+
existing project may attach the same framework, but both paths must use one
|
|
6
|
+
versioned adapter contract.
|
|
7
|
+
|
|
8
|
+
```text
|
|
9
|
+
new-project kit ----\
|
|
10
|
+
-> framework adapter -> framework runtime
|
|
11
|
+
existing project ---/ |
|
|
12
|
+
-> Workspai Context, Goal, PCC, and Verify
|
|
13
|
+
```
|
|
14
|
+
|
|
15
|
+
Microsoft Agent Framework is the first concrete implementation of this
|
|
16
|
+
foundation. Its Python and .NET adapters are intentionally separate because
|
|
17
|
+
their package graphs, runtime requirements, entrypoints, and verification
|
|
18
|
+
commands differ. Both are available for governed attachment after their exact
|
|
19
|
+
manifest digests pass the required Linux, macOS, and Windows conformance lanes
|
|
20
|
+
and are bound into the reviewed release-admission inventory.
|
|
21
|
+
|
|
22
|
+
## Published contracts
|
|
23
|
+
|
|
24
|
+
| Contract | Purpose |
|
|
25
|
+
| ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
|
|
26
|
+
| `contracts/agent-framework-capabilities.v1.json` | Normative ownership, capability, lifecycle, security, versioning, and admission rules |
|
|
27
|
+
| `contracts/workspace-intelligence/agent-framework-adapter-manifest.v1.json` | JSON Schema for one framework/version adapter declaration |
|
|
28
|
+
| `contracts/workspace-intelligence/agent-framework-conformance-report.v1.json` | JSON Schema for reproducible adapter admission evidence |
|
|
29
|
+
| `contracts/workspace-intelligence/agent-framework-change-plan.v1.json` | Portable, mutation-free scaffold or attach plan returned to the host |
|
|
30
|
+
| `contracts/workspace-intelligence/agent-framework-ownership-receipt.v1.json` | Hash-bound proof of the files Workspai may safely refresh |
|
|
31
|
+
| `contracts/workspace-intelligence/agent-framework-admission-candidate.v1.json` | Review-pending, digest-bound index of the complete cross-platform evidence matrix |
|
|
32
|
+
|
|
33
|
+
The schemas are also discoverable through
|
|
34
|
+
`contracts/published-contract-catalog.v1.json` and the extension compatibility
|
|
35
|
+
contract.
|
|
36
|
+
|
|
37
|
+
The CLI runtime foundation loads only bounded JSON manifests from an authorized
|
|
38
|
+
root. It does not dynamically import adapter code during discovery. A manifest
|
|
39
|
+
that escapes through `..` or a symlink, exceeds the size limit, fails JSON
|
|
40
|
+
Schema validation, or violates semantic admission rules is rejected.
|
|
41
|
+
|
|
42
|
+
## Authority boundary
|
|
43
|
+
|
|
44
|
+
Workspai owns:
|
|
45
|
+
|
|
46
|
+
- canonical Workspace Model and Knowledge Graph evidence;
|
|
47
|
+
- bounded Context, Goal scope, and impact;
|
|
48
|
+
- mutation admission, Proof-Carrying Change state, and effect receipts;
|
|
49
|
+
- independent verification and canonical evidence sealing;
|
|
50
|
+
- ownership-safe managed writes.
|
|
51
|
+
|
|
52
|
+
The selected framework owns:
|
|
53
|
+
|
|
54
|
+
- agent and workflow execution;
|
|
55
|
+
- model invocation and framework-native tool dispatch;
|
|
56
|
+
- conversation, memory, checkpoint, and runtime state;
|
|
57
|
+
- channels, schedules, handoffs, and framework telemetry.
|
|
58
|
+
|
|
59
|
+
An adapter must not convert model or framework output into verified Workspai
|
|
60
|
+
evidence. Source mutation must cross the PCC or Repair approval boundary, and
|
|
61
|
+
verification remains owned by the CLI.
|
|
62
|
+
|
|
63
|
+
## Capability truth
|
|
64
|
+
|
|
65
|
+
Every manifest declares every capability. Values are explicit:
|
|
66
|
+
|
|
67
|
+
- `native`: supplied and owned by the framework;
|
|
68
|
+
- `adapter-provided`: supplied by a bounded adapter implementation;
|
|
69
|
+
- `conditional`: available only when declared prerequisites are satisfied;
|
|
70
|
+
- `unsupported`: not available and never implied by UI or documentation.
|
|
71
|
+
|
|
72
|
+
Framework identity, project runtime, and model provider are independent. A
|
|
73
|
+
Python or TypeScript project can select a framework and then select any model
|
|
74
|
+
provider admitted by that framework without changing Workspai truth.
|
|
75
|
+
|
|
76
|
+
Detection uses weighted, typed authored probes rather than framework names or
|
|
77
|
+
generated Workspai files. Supported probes are contained paths, bounded literal
|
|
78
|
+
file reads, and package declarations from npm, PyPI, or NuGet manifests.
|
|
79
|
+
Dependency discovery can scan only declared suffixes, within a declared maximum
|
|
80
|
+
depth and a fixed global entry budget. Generated markers can confirm an already
|
|
81
|
+
detected framework but can never select one. Multiple matching adapters are a
|
|
82
|
+
conflict, not a ranking guess.
|
|
83
|
+
|
|
84
|
+
## Microsoft Agent Framework baseline
|
|
85
|
+
|
|
86
|
+
The built-in implementation currently targets the upstream stable baselines
|
|
87
|
+
verified from the Microsoft source tree:
|
|
88
|
+
|
|
89
|
+
| Adapter | Tested framework | Runtime | Authored detection |
|
|
90
|
+
| ---------------------------------- | ---------------- | --------------- | ------------------------------------------ |
|
|
91
|
+
| `microsoft-agent-framework-python` | `1.17.0` | Python `>=3.10` | `agent-framework` PyPI package family |
|
|
92
|
+
| `microsoft-agent-framework-dotnet` | `1.20.0` | .NET `>=8.0` | `Microsoft.Agents.AI` NuGet package family |
|
|
93
|
+
|
|
94
|
+
The first provider profile pins its integration independently: Python uses
|
|
95
|
+
`agent-framework-foundry` `1.12.0`, while .NET uses
|
|
96
|
+
`Microsoft.Agents.AI.Foundry` `1.20.0-preview.260831.1` over the stable
|
|
97
|
+
`Microsoft.Agents.AI` `1.20.0` core. Preview integration status is not
|
|
98
|
+
misrepresented as framework stability.
|
|
99
|
+
|
|
100
|
+
Each adapter implements detection, scaffold and attach planning, managed-file
|
|
101
|
+
rendering, project context, validation, and runtime resolution. It never
|
|
102
|
+
installs a dependency, invokes a model, executes generated code, or writes a
|
|
103
|
+
source file directly. The lifecycle host binds the target project and every
|
|
104
|
+
content digest into the PCC event chain, requires an explicit filesystem grant,
|
|
105
|
+
then atomically applies the unchanged plan and records effect evidence.
|
|
106
|
+
|
|
107
|
+
Generated starter files use an isolated `agents/<instance>` root and keep
|
|
108
|
+
adapter state under `.workspai/agent-frameworks/<adapter>/<instance>.json`.
|
|
109
|
+
That instance contains the only runtime dependency manifest; the project root
|
|
110
|
+
does not receive an empty Python or .NET manifest that could be mistaken for a
|
|
111
|
+
second executable unit. Workspace Model reports these projects as `agent`,
|
|
112
|
+
retains `microsoft-agent-framework` as their framework identity, and reports
|
|
113
|
+
only lifecycle stages backed by concrete manifests, entrypoints, tests, or an
|
|
114
|
+
owned project runner.
|
|
115
|
+
Each starter also includes credentialless tests for the bounded context
|
|
116
|
+
boundary and an environment-name example with no secret values. Python uses
|
|
117
|
+
the host platform's normal Python 3 launcher and remains dependency-free for
|
|
118
|
+
these tests; .NET uses a separately pinned test project. The conformance matrix
|
|
119
|
+
executes these tests in addition to compiling and exercising the deterministic
|
|
120
|
+
framework lifecycle.
|
|
121
|
+
Existing user-authored files are blockers, never overwrite targets. A managed
|
|
122
|
+
comment alone does not prove ownership: refresh also requires the previous
|
|
123
|
+
Workspai ownership receipt, which is bound to the exact adapter-manifest digest;
|
|
124
|
+
locally modified managed files fail closed.
|
|
125
|
+
Provider credentials remain environment references. The first provider profile uses
|
|
126
|
+
Microsoft Foundry, but provider identity is not part of framework identity and
|
|
127
|
+
additional profiles must preserve the same security boundary.
|
|
128
|
+
|
|
129
|
+
A path-filtered six-lane adapter matrix compiles the generated Python and .NET
|
|
130
|
+
projects on Linux, macOS, and Windows. Every lane records all 18 mandatory
|
|
131
|
+
checks, the exact runtime and framework baseline, a digest of the adapter
|
|
132
|
+
manifest, and one bounded evidence file per check. Reports are retained as CI
|
|
133
|
+
artifacts for review. A final job validates every evidence path and admits the
|
|
134
|
+
matrix only when all three operating-system lanes pass for both adapters.
|
|
135
|
+
Python conformance is pinned to 3.10.11, the final Python 3.10 release with
|
|
136
|
+
cross-platform binary installers; this provides one reproducible minimum-runtime
|
|
137
|
+
baseline while the adapter continues to declare Python `>=3.10` support.
|
|
138
|
+
|
|
139
|
+
After verification, CI emits one admission-candidate artifact. It binds the
|
|
140
|
+
source commit, CLI version, adapter-manifest digests, lane reports, and every
|
|
141
|
+
evidence file by SHA-256. Its status is always `pending`: successful CI produces
|
|
142
|
+
reviewable evidence, not release authority. Only the protected version-update
|
|
143
|
+
branch may convert that candidate into the exact release-admission inventory,
|
|
144
|
+
and the resulting pull request still passes normal review and repository gates.
|
|
145
|
+
|
|
146
|
+
CI evidence is not silently trusted at runtime. The default registry remains
|
|
147
|
+
blocked when callers provide neither raw conformance reports nor explicit
|
|
148
|
+
permission to use the bundled reviewed release inventory. User-facing commands
|
|
149
|
+
enable that inventory deliberately and fail closed if an adapter version,
|
|
150
|
+
manifest digest, framework baseline, runtime, or platform list has changed.
|
|
151
|
+
|
|
152
|
+
## Attach an agent runtime
|
|
153
|
+
|
|
154
|
+
Build current Workspace Intelligence first, then inspect the release-admitted
|
|
155
|
+
runtimes:
|
|
156
|
+
|
|
157
|
+
```bash
|
|
158
|
+
npx workspai workspace intelligence run --for-agent generic --strict --json
|
|
159
|
+
npx workspai agent framework list --json
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
Planning creates a Goal-bound, hash-bound Proof-Carrying Change but does not
|
|
163
|
+
write project files:
|
|
164
|
+
|
|
165
|
+
```bash
|
|
166
|
+
npx workspai agent framework plan \
|
|
167
|
+
--project api \
|
|
168
|
+
--runtime python \
|
|
169
|
+
--name support-agent
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
The interactive attach command displays the same plan and asks before granting
|
|
173
|
+
its filesystem effect. Automation must opt in with `--yes` and records the
|
|
174
|
+
identity supplied by `--granted-by`:
|
|
175
|
+
|
|
176
|
+
```bash
|
|
177
|
+
npx workspai agent framework attach \
|
|
178
|
+
--project api \
|
|
179
|
+
--runtime python \
|
|
180
|
+
--name support-agent
|
|
181
|
+
```
|
|
182
|
+
|
|
183
|
+
The operation writes only isolated adapter-owned files, records an ownership
|
|
184
|
+
receipt, and returns the canonical intelligence and Change verification
|
|
185
|
+
commands to run next. It never installs packages, calls a model, persists a
|
|
186
|
+
credential, or executes generated code. A separately authorized saved plan can
|
|
187
|
+
be applied with `agent framework apply`.
|
|
188
|
+
|
|
189
|
+
The PCC stores both the exact adapter plan and a framework-neutral architecture
|
|
190
|
+
prediction. Verification compares byte-backed artifact changes, requires typed
|
|
191
|
+
receipts for mutations inside the immutable project scope, and does not blame a
|
|
192
|
+
Change for concurrent work in another registered project. Its actual Graph
|
|
193
|
+
overlay is scoped by the same immutable lease, and entities, relations, and
|
|
194
|
+
proofs derived from an explicitly predicted artifact are treated as expected
|
|
195
|
+
consequences rather than unrelated surprises. A blocked or no-op
|
|
196
|
+
request created without an external Goal closes its generated Change and Goal
|
|
197
|
+
instead of leaving actionable lifecycle state behind.
|
|
198
|
+
|
|
199
|
+
The same admitted lifecycle is available for a new project:
|
|
200
|
+
|
|
201
|
+
```bash
|
|
202
|
+
npx workspai create project agent.microsoft.python support-agent
|
|
203
|
+
npx workspai create project agent.microsoft.dotnet operations-agent
|
|
204
|
+
```
|
|
205
|
+
|
|
206
|
+
Create writes a minimal runtime identity, registers the project, creates the
|
|
207
|
+
Goal and PCC, applies the adapter-owned scaffold, and records its ownership
|
|
208
|
+
receipt before committing the project lifecycle transaction. A failed scaffold
|
|
209
|
+
rolls back the new directory and workspace registration. Detection itself
|
|
210
|
+
remains read-only and never authorizes writes.
|
|
211
|
+
|
|
212
|
+
A workspace may contain multiple independently scoped framework adapters. A
|
|
213
|
+
project that deliberately connects two frameworks must declare that bridge;
|
|
214
|
+
Workspai never infers cross-framework execution from coincidental dependencies.
|
|
215
|
+
|
|
216
|
+
## Security defaults
|
|
217
|
+
|
|
218
|
+
- Network access is denied unless explicitly granted.
|
|
219
|
+
- Secrets are referenced from an external secret source and never persisted in
|
|
220
|
+
portable artifacts.
|
|
221
|
+
- Generated-code execution is disabled unless explicitly granted.
|
|
222
|
+
- Mutating tools require approval.
|
|
223
|
+
- Framework state and external input remain untrusted.
|
|
224
|
+
- Telemetry must redact sensitive values.
|
|
225
|
+
- Paths must be relative, contained, and checked across symlink boundaries.
|
|
226
|
+
|
|
227
|
+
## Version and stability policy
|
|
228
|
+
|
|
229
|
+
Every adapter pins exact tested framework versions and declares a bounded
|
|
230
|
+
supported range. Upstream status constrains Workspai status:
|
|
231
|
+
|
|
232
|
+
- a `stable` adapter requires a stable upstream and the complete passing
|
|
233
|
+
platform/runtime conformance matrix;
|
|
234
|
+
- a beta upstream can be exposed only as `preview`;
|
|
235
|
+
- a maintenance-mode upstream can be exposed only as `compatibility`;
|
|
236
|
+
- a deprecated upstream cannot produce a new-project scaffold.
|
|
237
|
+
|
|
238
|
+
This prevents a framework upgrade from silently changing generated structure,
|
|
239
|
+
tool permissions, state semantics, or verification behavior.
|
|
240
|
+
|
|
241
|
+
## Conformance admission
|
|
242
|
+
|
|
243
|
+
All checks listed in the capabilities contract are mandatory. They cover
|
|
244
|
+
schema and protocol compatibility, truthful detection, safe scaffold and attach
|
|
245
|
+
plans, managed-file ownership, user-file preservation, path containment,
|
|
246
|
+
secret safety, evidence-generation binding, mutation admission, verification,
|
|
247
|
+
failure isolation, idempotency, offline behavior, and cross-platform paths.
|
|
248
|
+
|
|
249
|
+
A report is admitted only when every required check passes, counts match the
|
|
250
|
+
recorded checks, and no blocker remains. A skipped required check is a blocked
|
|
251
|
+
result, not partial support.
|
|
252
|
+
|
|
253
|
+
Admission covers every advertised platform, runtime, and exact tested-framework
|
|
254
|
+
version lane. Reports are bound to the manifest digest, so older evidence cannot
|
|
255
|
+
authorize a changed adapter. Missing or duplicate lanes, mismatched identities,
|
|
256
|
+
and unadvertised runtimes fail closed.
|
|
257
|
+
|
|
258
|
+
The generic boundary was hardened against two deliberately different
|
|
259
|
+
integration shapes: a filesystem-first Node.js framework and the
|
|
260
|
+
multi-language Microsoft Agent Framework. Only the Microsoft adapters are now
|
|
261
|
+
implemented, and their preview state still prevents premature selection.
|
|
262
|
+
|
|
263
|
+
## Implementation sequence
|
|
264
|
+
|
|
265
|
+
1. Keep this v1 contract stable and validate it in CLI, extension, and package
|
|
266
|
+
publication gates.
|
|
267
|
+
2. Use the framework-neutral registry, detector, and bounded manifest loader.
|
|
268
|
+
3. Review the Microsoft Python and .NET digest-bound evidence produced by the
|
|
269
|
+
full conformance matrix.
|
|
270
|
+
4. Keep automated upstream discovery separate from release authority: open or
|
|
271
|
+
refresh one version pull request, rerun the full matrix, bind the exact green
|
|
272
|
+
candidate, then rely on protected-branch review before merge.
|
|
273
|
+
5. Admit another framework only after its create and attach paths share these
|
|
274
|
+
ownership, rollback, and verification guarantees.
|
|
275
|
+
|
|
276
|
+
AutoGen is not planned as a new-project target because Microsoft Agent
|
|
277
|
+
Framework is its supported successor path. Eve, LangGraph, and OpenAI Agents
|
|
278
|
+
SDK are not advertised; each requires its own adapter, tested baseline, and
|
|
279
|
+
conformance evidence.
|
package/docs/ci-workflows.md
CHANGED
|
@@ -95,7 +95,7 @@ Validate or preview the current CLI announcement locally:
|
|
|
95
95
|
npm --workspace workspai run check:release-announcement
|
|
96
96
|
npm --workspace workspai run release:announcement -- \
|
|
97
97
|
--product workspai-cli \
|
|
98
|
-
--tag v0.
|
|
98
|
+
--tag v0.75.0 \
|
|
99
99
|
--markdown-output /tmp/workspai-discord-announcement.md
|
|
100
100
|
```
|
|
101
101
|
|
|
@@ -81,6 +81,10 @@ npx workspai change abort --change <change-id> --reason <text> [--actor <identit
|
|
|
81
81
|
npx workspai change capsule validate --change <change-id> [--workspace <path>] [--json]
|
|
82
82
|
npx workspai change capsule export --change <change-id> --output <path> [--workspace <path>] [--json]
|
|
83
83
|
npx workspai agent bootstrap [--project <path>] [--for-agent <host>] [--no-live-inputs] [--strict] [--json]
|
|
84
|
+
npx workspai agent framework list [--json]
|
|
85
|
+
npx workspai agent framework plan --project <name> --runtime <python|dotnet> --name <agent> [--goal <goal-id>] [--workspace <path>] [--json]
|
|
86
|
+
npx workspai agent framework attach --project <name> --runtime <python|dotnet> --name <agent> [-y] [--granted-by <identity>] [--workspace <path>] [--json]
|
|
87
|
+
npx workspai agent framework apply --change <change-id> --project <name> --runtime <python|dotnet> [--workspace <path>] [--json]
|
|
84
88
|
```
|
|
85
89
|
|
|
86
90
|
Recommended CI:
|
|
@@ -262,6 +266,18 @@ the same receipt and can audit every supported host with `--for-agent all`.
|
|
|
262
266
|
Blocked receipts exit `2`; strict mode also maps degraded evidence to exit `2`.
|
|
263
267
|
See [Canonical-first agent entry](./agent-entry.md).
|
|
264
268
|
|
|
269
|
+
`agent framework` is the governed bridge between Workspai evidence and an
|
|
270
|
+
agent runtime. `list` exposes only exact release-admitted baselines. `plan`
|
|
271
|
+
creates or reuses a scoped Goal, begins a Proof-Carrying Change, and attaches a
|
|
272
|
+
hash-bound file plan without writing project files. `attach` shows that plan
|
|
273
|
+
and requires an interactive confirmation or explicit `--yes` before granting
|
|
274
|
+
the filesystem effect and writing an isolated `agents/<name>` directory.
|
|
275
|
+
Dependency installation, credentials, generated-code execution, and model
|
|
276
|
+
provider calls are never implied by that approval. `apply` is the automation
|
|
277
|
+
counterpart for a plan that was separately authorized with `change authorize`.
|
|
278
|
+
Any adapter, version, manifest, runtime, or platform drift invalidates its
|
|
279
|
+
bundled release admission until the complete conformance matrix passes again.
|
|
280
|
+
|
|
265
281
|
`workspace feedback record` is a non-interactive machine interface. It requires
|
|
266
282
|
exactly one JSON object on stdin and `--json`; an empty stdin or interactive TTY
|
|
267
283
|
is rejected. Required fields are `actionId`, `summary`, and `outcome`. The
|
|
@@ -78,6 +78,11 @@ These nested Commander commands are implemented and orchestrated by Workspai CLI
|
|
|
78
78
|
- `product manifest create`
|
|
79
79
|
- `product plan`
|
|
80
80
|
- `agent bootstrap`
|
|
81
|
+
- `agent framework`
|
|
82
|
+
- `agent framework list`
|
|
83
|
+
- `agent framework plan`
|
|
84
|
+
- `agent framework attach`
|
|
85
|
+
- `agent framework apply`
|
|
81
86
|
- `project agent-entry`
|
|
82
87
|
- `project commands`
|
|
83
88
|
- `project coverage`
|
|
@@ -307,8 +307,8 @@ npx workspai create
|
|
|
307
307
|
If you choose project creation, the same project flow is used.
|
|
308
308
|
|
|
309
309
|
When the terminal is interactive and the current directory is not inside a
|
|
310
|
-
workspace, **every supported backend, frontend, desktop, and extension kit** shows the
|
|
311
|
-
management question before scaffolding:
|
|
310
|
+
workspace, **every supported backend, frontend, desktop, agent, and extension kit** shows the
|
|
311
|
+
workspace management question before scaffolding:
|
|
312
312
|
|
|
313
313
|
```text
|
|
314
314
|
This project is outside a Workspai workspace. How should it be managed?
|
|
@@ -338,6 +338,8 @@ npx workspai create project frontend.nextjs dashboard
|
|
|
338
338
|
npx workspai create project desktop.tauri desktop-app
|
|
339
339
|
npx workspai create project desktop.electron admin-console
|
|
340
340
|
npx workspai create project extension.vscode editor-tools
|
|
341
|
+
npx workspai create project agent.microsoft.python support-agent
|
|
342
|
+
npx workspai create project agent.microsoft.dotnet operations-agent
|
|
341
343
|
npx workspai create project php.laravel customer-api
|
|
342
344
|
```
|
|
343
345
|
|
|
@@ -384,6 +386,18 @@ Workspai has official-generator paths for:
|
|
|
384
386
|
The ecosystem's official generator creates the application. Workspai then adds
|
|
385
387
|
project metadata and performs the selected workspace registration.
|
|
386
388
|
|
|
389
|
+
## Agent Framework kits
|
|
390
|
+
|
|
391
|
+
| Kit | Runtime | Framework baseline | Behavior |
|
|
392
|
+
| ------------------------ | ------- | ------------------ | ------------------------------------------ |
|
|
393
|
+
| `agent.microsoft.python` | Python | Release-admitted | Goal + PCC + owned isolated agent scaffold |
|
|
394
|
+
| `agent.microsoft.dotnet` | .NET | Release-admitted | Goal + PCC + owned isolated agent scaffold |
|
|
395
|
+
|
|
396
|
+
Agent kits require Workspace governance and therefore do not accept
|
|
397
|
+
`--no-workspace`. They do not install dependencies, call a model, or store
|
|
398
|
+
credentials. Their exact framework versions are promoted only after the full
|
|
399
|
+
Linux, macOS, and Windows conformance matrix passes.
|
|
400
|
+
|
|
387
401
|
## Desktop, extension, and additional backend generators
|
|
388
402
|
|
|
389
403
|
| Category | Project | Kit | Creation owner |
|
|
@@ -394,8 +408,8 @@ project metadata and performs the selected workspace registration.
|
|
|
394
408
|
| Desktop | Electron Forge | `desktop.electron` | create-electron-app |
|
|
395
409
|
| Extension | VS Code Extension | `extension.vscode` | generator-code |
|
|
396
410
|
|
|
397
|
-
Every generated project receives a canonical `kind` and `category`. The
|
|
398
|
-
user-facing categories are `backend`, `frontend`, `desktop`, and `extension`;
|
|
411
|
+
Every generated project receives a canonical `kind` and `category`. The five
|
|
412
|
+
user-facing creation categories are `backend`, `frontend`, `desktop`, `agent`, and `extension`;
|
|
399
413
|
they remain visible in the Workspace Model and Knowledge Graph so consumers do
|
|
400
414
|
not have to guess a project’s role from its runtime.
|
|
401
415
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "workspai",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.75.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
|
|
6
6
|
"keywords": [
|
|
@@ -113,6 +113,12 @@
|
|
|
113
113
|
"test:scenarios:docker": "bash scripts/scenario-matrix.sh",
|
|
114
114
|
"test:runtime-matrix": "node scripts/runtime-acceptance-matrix.mjs",
|
|
115
115
|
"test:runtime-contract": "node scripts/runtime-acceptance-matrix.mjs --contract-only",
|
|
116
|
+
"test:agent-framework:python": "tsx scripts/smoke-microsoft-agent-framework-adapter.ts --runtime python",
|
|
117
|
+
"test:agent-framework:dotnet": "tsx scripts/smoke-microsoft-agent-framework-adapter.ts --runtime dotnet",
|
|
118
|
+
"verify:agent-framework:matrix": "tsx scripts/verify-agent-framework-conformance.ts --reports test-results/agent-framework-conformance",
|
|
119
|
+
"discover:agent-framework:versions": "tsx scripts/discover-agent-framework-versions.ts",
|
|
120
|
+
"propose:agent-framework:versions": "tsx scripts/propose-agent-framework-version-update.ts",
|
|
121
|
+
"promote:agent-framework:admission": "tsx scripts/promote-agent-framework-release-admission.ts",
|
|
116
122
|
"prepush:test:runtime-contract": "node scripts/run-cached-prepush-gate.mjs runtime-contract",
|
|
117
123
|
"test:runtime-matrix:full": "node scripts/runtime-acceptance-matrix.mjs --full",
|
|
118
124
|
"test:real-world": "node scripts/real-world-qualification.mjs",
|
|
@@ -207,6 +207,8 @@ const REQUIRED_PACKAGE_FILES = [
|
|
|
207
207
|
'contracts/workspace-intelligence/workspace-repair-transaction.v1.json',
|
|
208
208
|
'contracts/workspace-intelligence/project-agent-entry.v1.json',
|
|
209
209
|
'contracts/workspace-intelligence/agent-bootstrap-receipt.v1.json',
|
|
210
|
+
'contracts/workspace-intelligence/agent-framework-change-plan.v1.json',
|
|
211
|
+
'contracts/workspace-intelligence/agent-framework-ownership-receipt.v1.json',
|
|
210
212
|
'contracts/extension-cli-compatibility.v1.json',
|
|
211
213
|
'data/modules-embeddings.json',
|
|
212
214
|
'templates/kits/fastapi-standard/README.md.j2',
|
|
@@ -345,9 +347,104 @@ function assertCliContracts() {
|
|
|
345
347
|
}
|
|
346
348
|
}
|
|
347
349
|
|
|
350
|
+
const frameworks = parseTrailingJson(runCli(['agent', 'framework', 'list', '--json']));
|
|
351
|
+
if (
|
|
352
|
+
frameworks.schemaVersion !== 'workspai.agent-framework-list.v1' ||
|
|
353
|
+
frameworks.adapters?.length !== 2 ||
|
|
354
|
+
frameworks.adapters.some((adapter) => adapter.status !== 'admitted')
|
|
355
|
+
) {
|
|
356
|
+
fail('published CLI does not expose the two exact release-admitted framework adapters');
|
|
357
|
+
}
|
|
358
|
+
|
|
348
359
|
log(`verified CLI contract surfaces for v${version.version}`);
|
|
349
360
|
}
|
|
350
361
|
|
|
362
|
+
function smokeCreateAgentFrameworkKits() {
|
|
363
|
+
const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'workspai-agent-kit-smoke-'));
|
|
364
|
+
const workspaceName = 'agent-kit-workspace';
|
|
365
|
+
const workspacePath = path.join(tempDir, workspaceName);
|
|
366
|
+
const createWorkspace = spawnSync(
|
|
367
|
+
process.execPath,
|
|
368
|
+
[
|
|
369
|
+
cliPath,
|
|
370
|
+
'create',
|
|
371
|
+
'workspace',
|
|
372
|
+
workspaceName,
|
|
373
|
+
'--output',
|
|
374
|
+
tempDir,
|
|
375
|
+
'--profile',
|
|
376
|
+
'minimal',
|
|
377
|
+
'--skip-python-engine',
|
|
378
|
+
'--skip-git',
|
|
379
|
+
'--yes',
|
|
380
|
+
],
|
|
381
|
+
{ cwd: tempDir, encoding: 'utf8', env: cliEnv(), stdio: ['ignore', 'pipe', 'pipe'] }
|
|
382
|
+
);
|
|
383
|
+
if (createWorkspace.status !== 0) {
|
|
384
|
+
fail(
|
|
385
|
+
`agent kit workspace creation failed with exit ${createWorkspace.status}\n${createWorkspace.stdout}\n${createWorkspace.stderr}`
|
|
386
|
+
);
|
|
387
|
+
}
|
|
388
|
+
|
|
389
|
+
const scenarios = [
|
|
390
|
+
{
|
|
391
|
+
kit: 'agent.microsoft.python',
|
|
392
|
+
name: 'python-agent',
|
|
393
|
+
expectedFiles: [
|
|
394
|
+
'README.md',
|
|
395
|
+
'.workspai/project.json',
|
|
396
|
+
'.workspai/agent-frameworks/microsoft-agent-framework-python/primary.json',
|
|
397
|
+
'agents/primary/main.py',
|
|
398
|
+
'agents/primary/pyproject.toml',
|
|
399
|
+
'agents/primary/tests/test_context.py',
|
|
400
|
+
'agents/primary/.env.example',
|
|
401
|
+
'agents/primary/README.md',
|
|
402
|
+
],
|
|
403
|
+
},
|
|
404
|
+
{
|
|
405
|
+
kit: 'agent.microsoft.dotnet',
|
|
406
|
+
name: 'dotnet-agent',
|
|
407
|
+
expectedFiles: [
|
|
408
|
+
'README.md',
|
|
409
|
+
'.workspai/project.json',
|
|
410
|
+
'.workspai/agent-frameworks/microsoft-agent-framework-dotnet/primary.json',
|
|
411
|
+
'agents/primary/Program.cs',
|
|
412
|
+
'agents/primary/WorkspaiContext.cs',
|
|
413
|
+
'agents/primary/Primary.csproj',
|
|
414
|
+
'agents/primary/tests/Primary.Tests.csproj',
|
|
415
|
+
'agents/primary/tests/WorkspaiContextTests.cs',
|
|
416
|
+
'agents/primary/.env.example',
|
|
417
|
+
'agents/primary/README.md',
|
|
418
|
+
],
|
|
419
|
+
},
|
|
420
|
+
];
|
|
421
|
+
try {
|
|
422
|
+
for (const scenario of scenarios) {
|
|
423
|
+
const result = spawnSync(
|
|
424
|
+
process.execPath,
|
|
425
|
+
[cliPath, 'create', 'project', scenario.kit, scenario.name, '--skip-git', '--yes'],
|
|
426
|
+
{
|
|
427
|
+
cwd: workspacePath,
|
|
428
|
+
encoding: 'utf8',
|
|
429
|
+
env: cliEnv(),
|
|
430
|
+
stdio: ['ignore', 'pipe', 'pipe'],
|
|
431
|
+
}
|
|
432
|
+
);
|
|
433
|
+
if (result.status !== 0) {
|
|
434
|
+
fail(
|
|
435
|
+
`${scenario.kit} governed create failed with exit ${result.status}\n${result.stdout}\n${result.stderr}`
|
|
436
|
+
);
|
|
437
|
+
}
|
|
438
|
+
assertGeneratedProject(path.join(workspacePath, scenario.name), scenario.expectedFiles);
|
|
439
|
+
}
|
|
440
|
+
const ownershipRoot = path.join(workspacePath, '.workspai', 'agent-frameworks', 'ownership');
|
|
441
|
+
if (!fs.existsSync(ownershipRoot)) fail('agent kit smoke did not record ownership receipts');
|
|
442
|
+
} finally {
|
|
443
|
+
fs.rmSync(tempDir, { recursive: true, force: true });
|
|
444
|
+
}
|
|
445
|
+
log(`verified ${scenarios.length} governed agent framework create scenarios`);
|
|
446
|
+
}
|
|
447
|
+
|
|
351
448
|
function assertGeneratedProject(projectPath, expectedFiles) {
|
|
352
449
|
for (const relativePath of expectedFiles) {
|
|
353
450
|
const absolutePath = path.join(projectPath, relativePath);
|
|
@@ -532,6 +629,7 @@ for (const relativePath of [
|
|
|
532
629
|
assertPackContents();
|
|
533
630
|
assertCliContracts();
|
|
534
631
|
smokeCreateNpmBackedKits();
|
|
632
|
+
smokeCreateAgentFrameworkKits();
|
|
535
633
|
smokeCreateOfflineFallbackKits();
|
|
536
634
|
|
|
537
635
|
log('enterprise package smoke passed');
|
package/dist/analyze-IA33T6MY.js
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
export{b as printAnalyzeReport,a as runAnalyze}from'./chunk-DLLHUG2Q.js';
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-4JJDDL3X.js';
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
export{b as runDoctorCapabilities}from'./chunk-JK6XEF7K.js';
|