# support-to-fix-engineer

A deterministic a2a-pack agent that turns an authenticated customer support case into evidence-backed engineering fix artifacts while preserving human control.

## Public skills

Exactly five typed tools are exposed on the Agent Card:

1. `triage_case` — redacts ticket/evidence, correlates release/change/support evidence, classifies severity and owner.
2. `reproduce_issue` — creates a deterministic minimal reproduction and validates HTTP health-check URLs with SSRF protections.
3. `propose_fix` — ranks hypotheses with supporting/contradicting provenance and emits `diagnosis.json` plus `patch.diff` without repository writes.
4. `validate_fix` — runs deterministic static validation of the patch and emits `validation.json`; it never executes arbitrary shell.
5. `prepare_delivery` — emits `delivery.md` with a branch/commit/PR draft and customer-safe summary. Consequential actions require `I_APPROVE_THE_LISTED_STEPS` bound to the immutable plan digest and still never merge/deploy.

## Safety defaults

- `dry_run=true` by default.
- No LLM credential is required or read.
- No arbitrary shell, merge, deployment, tenant expansion, or arbitrary URL fetching.
- Tickets/logs are untrusted evidence; prompt-injection-like text is detected and warned about.
- Secrets and common PII are redacted before artifacts/events/results.
- Artifacts are written under `outputs/support-cases/{case_id}/` and also emitted through A2A artifacts.
- Workspace writes use read/write overlay grants and are restricted by `WorkspaceAccess` deny patterns.

## Consumer setup

Caller-configured integrations are declared for Gitea, Kubernetes, Argo CD, observability, tenant allowlists, and HTTP health-check host allowlists. This implementation is intentionally fail-closed and does not call external systems unless future reviewed code adds exact egress hosts and mocked tests.

## Approval

Repository branch/commit/PR draft actions require:

- `dry_run=false`
- `approval_acknowledgement="I_APPROVE_THE_LISTED_STEPS"`
- `approval_plan_digest` exactly matching the digest returned by `prepare_delivery` for the immutable plan

The agent never merges or deploys.