A deterministic, no-LLM a2a-pack agent that guides and validates a customer integration from requirements through a tested handoff while keeping credentials and production changes under customer control.

Public skills

The Agent Card exposes exactly five typed tools:

design_integration — captures systems, auth methods, data contracts, rate limits, environments, compliance constraints, and success criteria; writes architecture.md and mapping.json.
generate_connector — creates a minimal Python or TypeScript connector only under outputs/integrations/{integration_id}/.
validate_contract — validates JSON Schema, OpenAPI 3, and webhook contracts with deterministic fixtures; writes contract-report.json.
run_acceptance — performs dry-run/default-safe acceptance checks, with optional allowlisted network checks; writes acceptance-report.json.
prepare_handoff — produces rollout, rollback, monitoring, and operator handoff documentation; writes handoff.md.

Safety model

Default dry_run=true.
No LLM credentials are required or read.
Raw credentials are rejected/redacted; callers configure secret references in their own setup.
All durable writes are path-contained under outputs/integrations/{integration_id}/.
The agent does not deploy, merge, mutate customer systems, execute arbitrary shell, or fetch arbitrary URLs.
External requests require explicit allowlist, HTTPS, DNS/IP SSRF checks, redirect blocking/revalidation, bounded payloads, timeouts, retries, and idempotency keys.
Delivery plans require I_APPROVE_THE_LISTED_STEPS and a matching plan digest, but execution remains outside the agent under operator control.

Consumer setup

Optional caller-managed setup fields are published for Gitea, API endpoints, object storage, observability, Kubernetes, and Argo CD. The agent only stores references, not values.

Synthetic webhook acceptance path

Call design_integration, generate_connector, validate_contract, run_acceptance, and prepare_handoff with a webhook-style contract and dry_run=true. Expected workspace outputs:

outputs/integrations/{integration_id}/architecture.md
outputs/integrations/{integration_id}/mapping.json
outputs/integrations/{integration_id}/connector/...
outputs/integrations/{integration_id}/contract-report.json
outputs/integrations/{integration_id}/acceptance-report.json
outputs/integrations/{integration_id}/handoff.md