Files
support-to-fix-engineer/README.md
2026-07-13 03:02:38 +00:00

38 lines
2.1 KiB
Markdown

# support-to-fix-engineer
A deterministic a2a-pack agent that turns an authenticated customer support case into evidence-backed engineering fix artifacts while preserving human control.
## Public skills
Exactly five typed tools are exposed on the Agent Card:
1. `triage_case` — redacts ticket/evidence, correlates release/change/support evidence, classifies severity and owner.
2. `reproduce_issue` — creates a deterministic minimal reproduction and validates HTTP health-check URLs with SSRF protections.
3. `propose_fix` — ranks hypotheses with supporting/contradicting provenance and emits `diagnosis.json` plus `patch.diff` without repository writes.
4. `validate_fix` — runs deterministic static validation of the patch and emits `validation.json`; it never executes arbitrary shell.
5. `prepare_delivery` — emits `delivery.md` with a branch/commit/PR draft and customer-safe summary. Consequential actions require `I_APPROVE_THE_LISTED_STEPS` bound to the immutable plan digest and still never merge/deploy.
## Safety defaults
- `dry_run=true` by default.
- No LLM credential is required or read.
- No arbitrary shell, merge, deployment, tenant expansion, or arbitrary URL fetching.
- Tickets/logs are untrusted evidence; prompt-injection-like text is detected and warned about.
- Secrets and common PII are redacted before artifacts/events/results.
- Artifacts are written under `outputs/support-cases/{case_id}/` and also emitted through A2A artifacts.
- Workspace writes use read/write overlay grants and are restricted by `WorkspaceAccess` deny patterns.
## Consumer setup
Caller-configured integrations are declared for Gitea, Kubernetes, Argo CD, observability, tenant allowlists, and HTTP health-check host allowlists. This implementation is intentionally fail-closed and does not call external systems unless future reviewed code adds exact egress hosts and mocked tests.
## Approval
Repository branch/commit/PR draft actions require:
- `dry_run=false`
- `approval_acknowledgement="I_APPROVE_THE_LISTED_STEPS"`
- `approval_plan_digest` exactly matching the digest returned by `prepare_delivery` for the immutable plan
The agent never merges or deploys.