38 lines
2.1 KiB
Markdown
38 lines
2.1 KiB
Markdown
# support-to-fix-engineer
|
|
|
|
A deterministic a2a-pack agent that turns an authenticated customer support case into evidence-backed engineering fix artifacts while preserving human control.
|
|
|
|
## Public skills
|
|
|
|
Exactly five typed tools are exposed on the Agent Card:
|
|
|
|
1. `triage_case` — redacts ticket/evidence, correlates release/change/support evidence, classifies severity and owner.
|
|
2. `reproduce_issue` — creates a deterministic minimal reproduction and validates HTTP health-check URLs with SSRF protections.
|
|
3. `propose_fix` — ranks hypotheses with supporting/contradicting provenance and emits `diagnosis.json` plus `patch.diff` without repository writes.
|
|
4. `validate_fix` — runs deterministic static validation of the patch and emits `validation.json`; it never executes arbitrary shell.
|
|
5. `prepare_delivery` — emits `delivery.md` with a branch/commit/PR draft and customer-safe summary. Consequential actions require `I_APPROVE_THE_LISTED_STEPS` bound to the immutable plan digest and still never merge/deploy.
|
|
|
|
## Safety defaults
|
|
|
|
- `dry_run=true` by default.
|
|
- No LLM credential is required or read.
|
|
- No arbitrary shell, merge, deployment, tenant expansion, or arbitrary URL fetching.
|
|
- Tickets/logs are untrusted evidence; prompt-injection-like text is detected and warned about.
|
|
- Secrets and common PII are redacted before artifacts/events/results.
|
|
- Artifacts are written under `outputs/support-cases/{case_id}/` and also emitted through A2A artifacts.
|
|
- Workspace writes use read/write overlay grants and are restricted by `WorkspaceAccess` deny patterns.
|
|
|
|
## Consumer setup
|
|
|
|
Caller-configured integrations are declared for Gitea, Kubernetes, Argo CD, observability, tenant allowlists, and HTTP health-check host allowlists. This implementation is intentionally fail-closed and does not call external systems unless future reviewed code adds exact egress hosts and mocked tests.
|
|
|
|
## Approval
|
|
|
|
Repository branch/commit/PR draft actions require:
|
|
|
|
- `dry_run=false`
|
|
- `approval_acknowledgement="I_APPROVE_THE_LISTED_STEPS"`
|
|
- `approval_plan_digest` exactly matching the digest returned by `prepare_delivery` for the immutable plan
|
|
|
|
The agent never merges or deploys.
|