support-to-fix-engineer/README.md

support-to-fix-engineer

A deterministic a2a-pack agent that turns an authenticated customer support case into evidence-backed engineering fix artifacts while preserving human control.

Public skills

Exactly five typed tools are exposed on the Agent Card:

1. triage_case — redacts ticket/evidence, correlates release/change/support evidence, classifies severity and owner.
2. reproduce_issue — creates a deterministic minimal reproduction and validates HTTP health-check URLs with SSRF protections.
3. propose_fix — ranks hypotheses with supporting/contradicting provenance and emits diagnosis.json plus patch.diff without repository writes.
4. validate_fix — runs deterministic static validation of the patch and emits validation.json; it never executes arbitrary shell.
5. prepare_delivery — emits delivery.md with a branch/commit/PR draft and customer-safe summary. Consequential actions require I_APPROVE_THE_LISTED_STEPS bound to the immutable plan digest and still never merge/deploy.

Safety defaults

• dry_run=true by default.
• No LLM credential is required or read.
• No arbitrary shell, merge, deployment, tenant expansion, or arbitrary URL fetching.
• Tickets/logs are untrusted evidence; prompt-injection-like text is detected and warned about.
• Secrets and common PII are redacted before artifacts/events/results.
• Artifacts are written under outputs/support-cases/{case_id}/ and also emitted through A2A artifacts.
• Workspace writes use read/write overlay grants and are restricted by WorkspaceAccess deny patterns.

Consumer setup

Caller-configured integrations are declared for Gitea, Kubernetes, Argo CD, observability, tenant allowlists, and HTTP health-check host allowlists. This implementation is intentionally fail-closed and does not call external systems unless future reviewed code adds exact egress hosts and mocked tests.

Approval

Repository branch/commit/PR draft actions require:

• dry_run=false
• approval_acknowledgement="I_APPROVE_THE_LISTED_STEPS"
• approval_plan_digest exactly matching the digest returned by prepare_delivery for the immutable plan

The agent never merges or deploys.