A deterministic a2a-pack agent that turns an authenticated customer support case into evidence-backed engineering fix artifacts while preserving human control.

Public skills

Exactly five typed tools are exposed on the Agent Card:

triage_case — redacts ticket/evidence, correlates release/change/support evidence, classifies severity and owner.
reproduce_issue — creates a deterministic minimal reproduction and validates HTTP health-check URLs with SSRF protections.
propose_fix — ranks hypotheses with supporting/contradicting provenance and emits diagnosis.json plus patch.diff without repository writes.
validate_fix — runs deterministic static validation of the patch and emits validation.json; it never executes arbitrary shell.
prepare_delivery — emits delivery.md with a branch/commit/PR draft and customer-safe summary. Consequential actions require I_APPROVE_THE_LISTED_STEPS bound to the immutable plan digest and still never merge/deploy.

Safety defaults

dry_run=true by default.
No LLM credential is required or read.
No arbitrary shell, merge, deployment, tenant expansion, or arbitrary URL fetching.
Tickets/logs are untrusted evidence; prompt-injection-like text is detected and warned about.
Secrets and common PII are redacted before artifacts/events/results.
Artifacts are written under outputs/support-cases/{case_id}/ and also emitted through A2A artifacts.
Workspace writes use read/write overlay grants and are restricted by WorkspaceAccess deny patterns.

Consumer setup

Caller-configured integrations are declared for Gitea, Kubernetes, Argo CD, observability, tenant allowlists, and HTTP health-check host allowlists. This implementation is intentionally fail-closed and does not call external systems unless future reviewed code adds exact egress hosts and mocked tests.

Approval

Repository branch/commit/PR draft actions require:

dry_run=false
approval_acknowledgement="I_APPROVE_THE_LISTED_STEPS"
approval_plan_digest exactly matching the digest returned by prepare_delivery for the immutable plan

The agent never merges or deploys.