From 2fd7ae5692c36cd7fc2df7ba35f22064ee408335 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Mon, 13 Jul 2026 10:40:16 -0500 Subject: [PATCH] =?UTF-8?q?feat(infra):=20wire=20agent-runtime=20=E2=86=92?= =?UTF-8?q?=20real=20Core=20on=20local=20kind=20(GT-438)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The agent-runtime factory already builds the real HttpCoreEvaluationAdapter when AGENT_RUNTIME_CORE_ENDPOINT is set. Point the local-kind agent-runtime at the in-cluster core-api service so it governs over the REAL stateless Core, not the stub. - evolith-agent-runtime values-local: extraEnv AGENT_RUNTIME_CORE_ENDPOINT (http://evolith-core-api-evolith-core-api/api/v1/evaluate) + CORE_TOKEN + AUDIT_DIR. - Verified in the kind cluster: POST /v1/agent/handle produced a real POST /api/v1/evaluate to core-api (SecurityAudit 200 ALLOW 569ms, from the runtime pod). The real Core rigorously returns 39 findings (GOV-000 etc.) on the empty workspace context — correct behaviour the stub hid; real workspace-context assembly is the next piece. Board: GT-438 → IN-PROGRESS (core-eval real wired + verified on kind). Co-Authored-By: Claude Opus 4.8 --- .../infra/helm/evolith-agent-runtime/values-local.yaml | 8 ++++++++ reference/core/control-center/gaps/gap-tracking.es.md | 4 ++-- reference/core/control-center/gaps/gap-tracking.md | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/product/infra/helm/evolith-agent-runtime/values-local.yaml b/product/infra/helm/evolith-agent-runtime/values-local.yaml index e190f763c..6d0c6959e 100644 --- a/product/infra/helm/evolith-agent-runtime/values-local.yaml +++ b/product/infra/helm/evolith-agent-runtime/values-local.yaml @@ -7,6 +7,14 @@ image: replicaCount: 1 +# GT-438 (local kind): govern over the REAL stateless Core in the cluster (not the stub). +# The agent-runtime calls core-api POST /api/v1/evaluate over the in-cluster service, with +# the shared local API key. AGENT_RUNTIME_CORE_ENDPOINT must be the FULL evaluate URL. +extraEnv: + AGENT_RUNTIME_CORE_ENDPOINT: "http://evolith-core-api-evolith-core-api/api/v1/evaluate" + AGENT_RUNTIME_CORE_TOKEN: "local-dev-key" + AGENT_RUNTIME_AUDIT_DIR: "/tmp/audit" + ingressRoute: enabled: false diff --git a/reference/core/control-center/gaps/gap-tracking.es.md b/reference/core/control-center/gaps/gap-tracking.es.md index b1c7ae757..cfefad6f3 100644 --- a/reference/core/control-center/gaps/gap-tracking.es.md +++ b/reference/core/control-center/gaps/gap-tracking.es.md @@ -100,7 +100,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida | [`GT-435`](./gap-reference-catalog.es.md#gt-435) | EPIC — Camino a Producción del diagrama conceptual de la suite (Core hubs → Hermes/Agent Runtime → Exposición CLI/API/MCP → Tracker → satélites). Evaluación 2026-07-04: Core ~95% listo (L4); el único bloqueante de CD activo es `GT-324`; la distribución está bloqueada por la deprecación a 0.0.1; el agent-runtime usa stubs por defecto; el Tracker es un scaffold .NET real pero desfasado del diseño actual de Core. **Umbrella — descompuesto en `GT-436`…`GT-446` (+ `GT-324`), organizado en dos milestones: `GT-447` (Objetivo 1 — funcional local) y `GT-448` (Objetivo 2 — producción).** | `Cross` | Cross | P0 | XL | `PENDIENTE` | | [`GT-436`](./gap-reference-catalog.es.md#gt-436) | Publicar los paquetes npm. El scope viejo `@evolith/*` estaba contaminado con historial publicado (1.0.x/1.1.x/2.0.0-beta/tombstones) que bloqueaba un 1.0.0 limpio, así que se renombró toda la familia a un scope nuevo unificado. **HECHO (0edaa22b): los 7 libs publicados a `1.0.0` limpio bajo `@beyondnet/evolith-*` (core-domain, infra-providers, core, agent-runtime, sdk, mcp, cli — todos HTTP 200 en el registry). Viejos `@evolith/*` deprecados apuntando a los nuevos (4 quedaron en estado 404 corrupto del registry, inservibles de todos modos).** Follow-on: barrido de docs `@evolith/*` → `@beyondnet/evolith-*`. | `CLI` | Cross | P0 | M | `COMPLETADO` | | [`GT-437`](./gap-reference-catalog.es.md#gt-437) | Añadir `agent-runtime-api` al CI/CD (docker build+push a GHCR + deploy Coolify) — hoy tiene Dockerfile pero NINGÚN workflow lo buildea/testea/despliega. | `Infra` | Cross | P1 | M | `PENDIENTE` | -| [`GT-438`](./gap-reference-catalog.es.md#gt-438) | Cableado de adapters de producción para `agent-runtime-api`: el bootstrap por defecto usa `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + estado in-memory; cablear Core-eval real (HTTP), engine (Hermes/routing), memoria durable + scheduler por defecto/env en prod. | `Agent Runtime` | Cross | P1 | M | `PENDIENTE` | +| [`GT-438`](./gap-reference-catalog.es.md#gt-438) | Cableado de adapters de producción para `agent-runtime-api`: el bootstrap por defecto usa `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + estado in-memory; cablear Core-eval real (HTTP), engine (Hermes/routing), memoria durable + scheduler por defecto/env en prod. **EN-PROGRESO (kind local):** el `HttpCoreEvaluationAdapter` real ya está en la factory (por env); cableado + **verificado en el cluster kind** — `values-local` del agent-runtime setea `AGENT_RUNTIME_CORE_ENDPOINT` al servicio `core-api` in-cluster, y un `POST /v1/agent/handle` produjo un `POST /api/v1/evaluate` real al core-api (SecurityAudit: `200 ALLOW 569ms`, desde el pod del runtime). El runtime ya gobierna sobre el Core REAL, no el stub. **Pendiente:** agent-engine real (gated GT-385), estado durable, y ensamblar un contexto de workspace real (hoy el Core evalúa un contexto vacío → 39 findings correctos tipo GOV-000). | `Agent Runtime` | Cross | P1 | M | `EN-PROGRESO` | | [`GT-439`](./gap-reference-catalog.es.md#gt-439) | Forzar auth fail-closed + cablear `TenantCorpusGuard` (ABAC multi-tenant, GT-394 runtime): `EVOLITH_API_KEY` es opt-in y el guard de tenant está definido pero no en `APP_GUARD`; sin extracción de tenant-claim del JWT, sin aislamiento de corpus por tenant. | `Security` | Cross | P1 | M | `EN-PROGRESO` | | [`GT-440`](./gap-reference-catalog.es.md#gt-440) | Completar observabilidad: añadir `/metrics` (Prometheus) a `mcp-server` + `agent-runtime-api`; `OTEL_EXPORTER_OTLP_ENDPOINT` configurable; split liveness/readiness. **HECHO (b3c6557f): `/metrics` en los 3 servicios (core-api existente + mcp `evolith_mcp_*` + agent-runtime `evolith_agent_runtime_*`), `/health/live`+`/health/ready` en mcp+agent-runtime, OTEL endpoint por env. Verificado en el stack local (todos 200).** | `Observability` | Cross | P1 | M | `COMPLETADO` | | [`GT-441`](./gap-reference-catalog.es.md#gt-441) | HITL real de aprobación (extiende GT-387): el `AutoApprovalAdapter` por defecto auto-aprueba y `ChatApprovalAdapter`/`SlackApprovalAdapter` son stubs — cablear un flujo human-in-the-loop real de Tracker/chat detrás de `IApprovalPort`. | `Agent Runtime` | Cross | P1 | M | `EN-PROGRESO` | @@ -547,7 +547,7 @@ Este tablero es la única fuente de verdad para deuda técnica, gaps, oportunida | [`GT-246`](./gap-reference-catalog.es.md#gt-246) | Implementar experimentos Chaos Mesh/Litmus | `QA` | Cross | P3 | L | `COMPLETADO` | -**Progreso:** 503 / 532 completados · 17 en progreso · 10 pendientes · 2 diferido +**Progreso:** 503 / 532 completados · 18 en progreso · 9 pendientes · 2 diferido **Oleada 2026-06-23 (auditoría profunda de Winston III):** Añadidos 14 gaps nuevos `GT-212`…`GT-225` del Winston Audit Playbook que cubren: higiene de estado ADR (GT-212), metadata + presupuestos operativos + corpus de guías por topología (GT-213, GT-217, GT-219), observabilidad + OpenAPI en controladores REST (GT-214, GT-215), paridad de input-schemas OPA + densidad de tests por topología (GT-216, GT-222), plantillas de rollback + on-call de Fase 05 (GT-218), cobertura de ramas CLI + paridad de envelope --format + limpieza de skip-list (GT-220, GT-224, GT-225), audit logging HTTP de MCP (GT-221), y tests e2e de paridad cross-surface (GT-223). diff --git a/reference/core/control-center/gaps/gap-tracking.md b/reference/core/control-center/gaps/gap-tracking.md index 00249b53b..df4f7eb20 100644 --- a/reference/core/control-center/gaps/gap-tracking.md +++ b/reference/core/control-center/gaps/gap-tracking.md @@ -100,7 +100,7 @@ This board is the single source of truth for technical debt, gaps, opportunities | [`GT-435`](./gap-reference-catalog.md#gt-435) | EPIC — Road to Production of the conceptual suite diagram (Core hubs → Hermes/Agent Runtime → Exposure CLI/API/MCP → Tracker → satellites). Assessment 2026-07-04: Core ~95% ready (L4); the sole active CD blocker is `GT-324`; distribution blocked by the 0.0.1 package deprecation; agent-runtime defaults to stubs; Tracker is a real .NET scaffold but lagging the current Core design. **Umbrella — decomposed into `GT-436`…`GT-446` (+ `GT-324`), organized under two milestones: `GT-447` (Objective 1 — local functional) and `GT-448` (Objective 2 — production).** | `Cross` | Cross | P0 | XL | `PENDING` | | [`GT-436`](./gap-reference-catalog.md#gt-436) | Ship the npm packages. The old `@evolith/*` scope was polluted with published history (1.0.x/1.1.x/2.0.0-beta/tombstones) that blocked a clean 1.0.0, so the whole library family was renamed to a fresh unified scope. **DONE (0edaa22b): all 7 libs published at a clean `1.0.0` under `@beyondnet/evolith-*` (core-domain, infra-providers, core, agent-runtime, sdk, mcp, cli — all HTTP 200 on the registry). Old `@evolith/*` deprecated pointing to the new names (4 are in a broken 404 registry state and unusable anyway).** Follow-on: sweep the docs from `@evolith/*` → `@beyondnet/evolith-*`. | `CLI` | Cross | P0 | M | `DONE` | | [`GT-437`](./gap-reference-catalog.md#gt-437) | Add `agent-runtime-api` to CI/CD (docker build+push to GHCR + Coolify deploy) — today it has a Dockerfile but is NOT built/tested/deployed by any workflow. | `Infra` | Cross | P1 | M | `PENDING` | -| [`GT-438`](./gap-reference-catalog.md#gt-438) | Production adapter wiring for `agent-runtime-api`: default bootstrap uses `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + in-memory state; wire real Core-eval (HTTP), engine (Hermes/routing), durable memory + scheduler by default/env in prod. | `Agent Runtime` | Cross | P1 | M | `PENDING` | +| [`GT-438`](./gap-reference-catalog.md#gt-438) | Production adapter wiring for `agent-runtime-api`: default bootstrap uses `StubCoreEvaluationAdapter` + `StubAgentEngineAdapter` + in-memory state; wire real Core-eval (HTTP), engine (Hermes/routing), durable memory + scheduler by default/env in prod. **IN-PROGRESS (local kind):** the real `HttpCoreEvaluationAdapter` is already in the factory (env-driven); wired + **verified in the kind cluster** — the agent-runtime `values-local` sets `AGENT_RUNTIME_CORE_ENDPOINT` to the in-cluster `core-api` service, and a `POST /v1/agent/handle` produced a real `POST /api/v1/evaluate` to core-api (SecurityAudit: `200 ALLOW 569ms`, from the runtime pod). The runtime now governs over the REAL Core, not the stub. **Remaining:** real agent-engine (GT-385-gated), durable state, and assembling a real workspace context (today the Core evaluates an empty context → 39 correct GOV-000-style findings). | `Agent Runtime` | Cross | P1 | M | `IN-PROGRESS` | | [`GT-439`](./gap-reference-catalog.md#gt-439) | Enforce fail-closed auth + wire `TenantCorpusGuard` (ABAC multi-tenancy, GT-394 runtime): `EVOLITH_API_KEY` is opt-in and the tenant guard is defined but not in `APP_GUARD`; no JWT tenant-claim extraction, no per-tenant corpus isolation. | `Security` | Cross | P1 | M | `IN-PROGRESS` | | [`GT-440`](./gap-reference-catalog.md#gt-440) | Observability completeness: add `/metrics` (Prometheus) to `mcp-server` + `agent-runtime-api`; `OTEL_EXPORTER_OTLP_ENDPOINT` configurable; liveness/readiness split. **DONE (b3c6557f): `/metrics` on all 3 services (core-api existing + mcp `evolith_mcp_*` + agent-runtime `evolith_agent_runtime_*`), `/health/live`+`/health/ready` on mcp+agent-runtime, OTEL endpoint via env. Verified on the local stack (all 200).** | `Observability` | Cross | P1 | M | `DONE` | | [`GT-441`](./gap-reference-catalog.md#gt-441) | Real HITL approval (extends GT-387): the default `AutoApprovalAdapter` auto-grants and `ChatApprovalAdapter`/`SlackApprovalAdapter` are stubs — wire a real Tracker/chat human-in-the-loop workflow behind `IApprovalPort`. | `Agent Runtime` | Cross | P1 | M | `IN-PROGRESS` | @@ -547,7 +547,7 @@ This board is the single source of truth for technical debt, gaps, opportunities | [`GT-246`](./gap-reference-catalog.md#gt-246) | Implement Chaos Mesh/Litmus experiments | `QA` | Cross | P3 | L | `DONE` | -**Progress:** 503 / 532 done · 17 in progress · 10 pending · 2 deferred +**Progress:** 503 / 532 done · 18 in progress · 9 pending · 2 deferred **Wave 2026-06-23 (Winston deep audit III):** Added 14 new gaps `GT-212`…`GT-225` from the Winston Audit Playbook covering: ADR status hygiene (GT-212), topology manifest metadata + operational budgets + guidance corpus (GT-213, GT-217, GT-219), REST controller observability + OpenAPI (GT-214, GT-215), OPA input-schema parity + per-topology test density (GT-216, GT-222), SDLC Phase 05 rollback + on-call templates (GT-218), CLI branch coverage + envelope format coverage + skip-list cleanup (GT-220, GT-224, GT-225), MCP HTTP audit logging (GT-221), and cross-surface parity e2e tests (GT-223).