profit/agent-governance
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit: Agent Governance System Phase 8

Browse Source 
Phase 8 Production Hardening with complete governance infrastructure:

- Vault integration with tiered policies (T0-T4)
- DragonflyDB state management
- SQLite audit ledger
- Pipeline DSL and templates
- Promotion/revocation engine
- Checkpoint system for session persistence
- Health manager and circuit breaker for fault tolerance
- GitHub/Slack integrations
- Architectural test pipeline with bug watcher, suggestion engine, council review
- Multi-agent chaos testing framework

Test Results:
- Governance tests: 68/68 passing
- E2E workflow: 16/16 passing
- Phase 2 Vault: 14/14 passing
- Integration tests: 27/27 passing

Coverage: 57.6% average across 12 phases

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
profit
2026-01-23 22:07:06 -05:00
co-authored by Claude Opus 4.5
commit 77655c298c
338 changed files with 63491 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/FIRST_TASK.md
+137
View File
@@ -0,0 +1,137 @@
# First Task for Tier 1 Promotion
## Overview
This document describes the "first task" that a newly promoted Tier 1 agent
must complete to validate their operational capabilities.
## Prerequisites
- Agent has been promoted from Tier 0 to Tier 1
- Agent has valid Vault AppRole credentials for Tier 1
- Sandbox environment is available (localhost)
## The Task: Deploy a Monitoring Endpoint
**Objective:** Deploy a simple HTTP health check endpoint that reports system status.
### Requirements
1. Deploy a container that:
- Responds to HTTP requests on port 9999
- Returns JSON with system health information
- Is connected to the `spark-net` network
- Has proper labels for governance tracking
2. Verify the deployment:
- Container is running
- Endpoint responds within 100ms
- Response includes valid JSON
3. Document the deployment:
- Record action in governance ledger
- Create evidence package
### Implementation Options
#### Option A: Ansible (Recommended for First Task)
```bash
cd /opt/agent-governance/sandbox/ansible
# Check mode first (like Tier 0)
ansible-playbook -i /opt/agent-governance/inventory/sandbox.yml \
deploy-service.yml --check \
-e service_name=health-endpoint \
-e image=nginx:alpine \
-e port=9999
# Execute (Tier 1 capability)
ansible-playbook -i /opt/agent-governance/inventory/sandbox.yml \
deploy-service.yml \
-e service_name=health-endpoint \
-e image=nginx:alpine \
-e port=9999
```
#### Option B: Terraform
```bash
cd /opt/agent-governance/sandbox/terraform/docker-service
terraform init
terraform plan -var="service_name=health-endpoint" -var="external_port=9999"
terraform apply -var="service_name=health-endpoint" -var="external_port=9999"
```
#### Option C: Direct Docker (Governed Wrapper)
```bash
/opt/agent-governance/wrappers/docker-governed.sh run -d \
--name health-endpoint \
--network spark-net \
-p 9999:80 \
nginx:alpine
```
### Verification
```bash
# Check container is running
docker ps --filter name=health-endpoint
# Test endpoint
curl -s http://localhost:9999 | head -5
# Measure response time
curl -w "%{time_total}\n" -o /dev/null -s http://localhost:9999
```
### Success Criteria
| Criterion | Requirement |
|-----------|-------------|
| Container Running | Status: Up |
| Network Attached | spark-net |
| Port Exposed | 9999 |
| Response Time | < 100ms |
| Ledger Entry | Recorded |
### Recording the Task
After successful completion:
```bash
# Record in ledger
python3 /opt/agent-governance/agents/tier0-agent/agent.py plan \
--title "Tier 1 First Task Complete" \
--description "Deployed health-endpoint service on port 9999" \
--target localhost \
--steps '[{"action":"deploy","command":"docker run...","status":"success"}]'
# Create evidence
python3 /opt/agent-governance/evidence/evidence.py create \
--agent-id tier1-agent-001 \
--action "first_task_deployment" \
--artifacts "docker_ps_output.txt,curl_response.json"
```
## Rollback Procedure
If the task fails:
```bash
# Using Ansible
ansible-playbook rollback-service.yml -e service_name=health-endpoint
# Or directly
docker stop health-endpoint && docker rm health-endpoint
```
## Next Steps
After completing this task:
1. Agent demonstrates basic execution capability
2. Agent can proceed to more complex tasks
3. Track record builds toward Tier 2 promotion
sandbox/README.md
+99
View File
@@ -0,0 +1,99 @@
# Sandbox Environment
## Overview
The sandbox environment provides a safe space for agents to execute tasks
without affecting production systems. Currently configured to use localhost
(the current VM) as the primary sandbox target.
## Structure
```
/opt/agent-governance/sandbox/
├── README.md # This file
├── FIRST_TASK.md # First task for Tier 1 promotion
├── ansible/
│ ├── deploy-service.yml # Deploy Docker services
│ └── rollback-service.yml # Rollback deployments
└── terraform/
└── docker-service/
└── main.tf # Terraform Docker provider config
```
## Current Environment
| Component | Status | Port |
|-----------|--------|------|
| Docker | Running | - |
| Vault | Running | 8200 |
| DragonflyDB | Running | 6379 |
| Spark Master | Running | 9944, 7077 |
| Spark Worker | Running | - |
| Redis Cache | Running | 6380 |
| Nginx Proxy | Running | 8888 |
| Prometheus | Running | 9090 |
## Inventory
The sandbox inventory is defined in `/opt/agent-governance/inventory/sandbox.yml`.
**Available Targets:**
| Host | Access | Purpose |
|------|--------|---------|
| localhost | Tier 0-4 | Primary sandbox (current VM) |
| staging-local | Tier 2-4 | Staging (Docker namespace) |
## Usage by Tier
### Tier 0 (Observer)
- Can read inventory and documentation
- Can generate plans using Ansible `--check` mode
- Can run `terraform plan` (no apply)
- Cannot execute any changes
### Tier 1 (Operator)
- Can execute Ansible playbooks on sandbox hosts
- Can run `terraform apply` on sandbox
- Limited to sandbox targets only
### Tier 2+ (Builder, Executor, Architect)
- Full sandbox access
- Staging access
- Production access varies by tier
## Quick Start
### Deploy a Service (Tier 1+)
```bash
# Ansible
ansible-playbook -i /opt/agent-governance/inventory/sandbox.yml \
/opt/agent-governance/sandbox/ansible/deploy-service.yml \
-e service_name=my-service \
-e image=nginx:alpine \
-e port=8080
# Terraform
cd /opt/agent-governance/sandbox/terraform/docker-service
terraform init
terraform apply -var="service_name=my-service"
```
### Plan Only (Tier 0)
```bash
# Ansible check mode
ansible-playbook --check deploy-service.yml -e service_name=test
# Terraform plan
terraform plan -var="service_name=test"
```
## Future Expansion
When Proxmox is available:
- Add dedicated sandbox VMs (sandbox-vm-01, sandbox-vm-02, sandbox-vm-03)
- Configure network isolation
- Enable snapshot-based rollback
- Add more complex multi-VM scenarios
sandbox/STATUS.md
+35
View File
@@ -0,0 +1,35 @@
# Status: Sandbox
## Current Phase
** NOT STARTED**
## Tasks
| Status | Task | Updated |
|--------|------|---------|
| ☐ | *No tasks defined* | - |
## Dependencies
*No external dependencies.*
## Issues / Blockers
*No current issues or blockers.*
## Activity Log
### 2026-01-23 23:25:39 UTC
- **Phase**: COMPLETE
- **Action**: Sandboxed environments for Terraform/Ansible
- **Details**: Phase updated to complete
### 2026-01-23 23:25:09 UTC
- **Phase**: NOT STARTED
- **Action**: Initialized
- **Details**: Status tracking initialized for this directory.
---
*Last updated: 2026-01-23 23:25:39 UTC*
sandbox/ansible/README.md
+33
View File
@@ -0,0 +1,33 @@
# Ansible
> Ansible sandbox and examples
## Overview
This directory contains ansible sandbox and examples.
## Key Files
| File | Description |
|------|-------------|
| `deploy-service.yml` | Configuration |
| `rollback-service.yml` | Configuration |
## Interfaces / APIs
*Document any APIs, CLI commands, or interfaces here.*
## Status
** Not Started**
See [STATUS.md](./STATUS.md) for detailed progress tracking.
## Architecture Reference
Part of the [Agent Governance System](/opt/agent-governance/docs/ARCHITECTURE.md).
Parent: [Sandbox](..)
---
*Last updated: 2026-01-23 23:25:09 UTC*
sandbox/ansible/STATUS.md
+30
View File
@@ -0,0 +1,30 @@
# Status: Ansible
## Current Phase
** NOT STARTED**
## Tasks
| Status | Task | Updated |
|--------|------|---------|
| ☐ | *No tasks defined* | - |
## Dependencies
*No external dependencies.*
## Issues / Blockers
*No current issues or blockers.*
## Activity Log
### 2026-01-23 23:25:09 UTC
- **Phase**: NOT STARTED
- **Action**: Initialized
- **Details**: Status tracking initialized for this directory.
---
*Last updated: 2026-01-23 23:25:09 UTC*
sandbox/ansible/deploy-service.yml
+91
View File
@@ -0,0 +1,91 @@
---
# Sample Ansible Playbook: Deploy Docker Service
# ===============================================
# This playbook is designed for Tier 1+ agents to deploy
# containerized services to the sandbox environment.
#
# Usage:
# ansible-playbook -i inventory/sandbox.yml deploy-service.yml \
# -e service_name=myapp -e image=nginx:alpine -e port=8080
#
# For Tier 0 agents: Generate plan only (check mode)
# ansible-playbook --check deploy-service.yml
- name: Deploy Docker Service to Sandbox
hosts: localhost
connection: local
gather_facts: yes
vars:
service_name: "{{ service_name | default('test-service') }}"
image: "{{ image | default('nginx:alpine') }}"
port: "{{ port | default('8080') }}"
network: "{{ network | default('spark-net') }}"
restart_policy: "{{ restart_policy | default('unless-stopped') }}"
tasks:
- name: Preflight - Verify Docker is running
command: docker info
register: docker_info
changed_when: false
tags: [preflight]
- name: Preflight - Check if container already exists
command: "docker ps -a --filter name={{ service_name }} --format '{{ '{{' }}.Names{{ '}}' }}'"
register: existing_container
changed_when: false
tags: [preflight]
- name: Stop existing container if running
command: "docker stop {{ service_name }}"
when: existing_container.stdout != ""
ignore_errors: yes
tags: [deploy]
- name: Remove existing container
command: "docker rm {{ service_name }}"
when: existing_container.stdout != ""
ignore_errors: yes
tags: [deploy]
- name: Pull latest image
command: "docker pull {{ image }}"
register: pull_result
changed_when: "'Downloaded' in pull_result.stdout or 'Pull complete' in pull_result.stdout"
tags: [deploy]
- name: Deploy container
command: >
docker run -d
--name {{ service_name }}
--network {{ network }}
--restart {{ restart_policy }}
-p {{ port }}:{{ port }}
{{ image }}
register: deploy_result
tags: [deploy]
- name: Wait for service to be healthy
command: "docker inspect --format='{{ '{{' }}.State.Running{{ '}}' }}' {{ service_name }}"
register: health_check
until: health_check.stdout == "true"
retries: 10
delay: 2
tags: [verify]
- name: Verify - Show container status
command: "docker ps --filter name={{ service_name }} --format 'table {{ '{{' }}.Names{{ '}}' }}\t{{ '{{' }}.Status{{ '}}' }}\t{{ '{{' }}.Ports{{ '}}' }}'"
register: final_status
changed_when: false
tags: [verify]
- name: Report deployment result
debug:
msg: |
Service deployed successfully:
Name: {{ service_name }}
Image: {{ image }}
Port: {{ port }}
Network: {{ network }}
Status: {{ final_status.stdout }}
tags: [verify]
sandbox/ansible/rollback-service.yml
+40
View File
@@ -0,0 +1,40 @@
---
# Sample Ansible Playbook: Rollback Docker Service
# =================================================
# Rollback playbook for undoing service deployments.
#
# Usage:
# ansible-playbook rollback-service.yml -e service_name=myapp
- name: Rollback Docker Service
hosts: localhost
connection: local
gather_facts: no
vars:
service_name: "{{ service_name | mandatory }}"
remove_volumes: "{{ remove_volumes | default(false) }}"
tasks:
- name: Check if container exists
command: "docker ps -a --filter name={{ service_name }} --format '{{ '{{' }}.Names{{ '}}' }}'"
register: container_check
changed_when: false
- name: Stop container
command: "docker stop {{ service_name }}"
when: container_check.stdout != ""
ignore_errors: yes
- name: Remove container
command: "docker rm {{ service_name }}"
when: container_check.stdout != ""
- name: Remove associated volumes (optional)
command: "docker volume rm {{ service_name }}-data"
when: remove_volumes | bool
ignore_errors: yes
- name: Confirm rollback
debug:
msg: "Service {{ service_name }} has been rolled back"
sandbox/terraform/README.md
+32
View File
@@ -0,0 +1,32 @@
# Terraform
> Terraform sandbox and examples
## Overview
This directory contains terraform sandbox and examples.
## Key Files
| File | Description |
|------|-------------|
| *No files yet* | |
## Interfaces / APIs
*Document any APIs, CLI commands, or interfaces here.*
## Status
** Not Started**
See [STATUS.md](./STATUS.md) for detailed progress tracking.
## Architecture Reference
Part of the [Agent Governance System](/opt/agent-governance/docs/ARCHITECTURE.md).
Parent: [Sandbox](..)
---
*Last updated: 2026-01-23 23:25:09 UTC*
sandbox/terraform/STATUS.md
+30
View File
@@ -0,0 +1,30 @@
# Status: Terraform
## Current Phase
** NOT STARTED**
## Tasks
| Status | Task | Updated |
|--------|------|---------|
| ☐ | *No tasks defined* | - |
## Dependencies
*No external dependencies.*
## Issues / Blockers
*No current issues or blockers.*
## Activity Log
### 2026-01-23 23:25:09 UTC
- **Phase**: NOT STARTED
- **Action**: Initialized
- **Details**: Status tracking initialized for this directory.
---
*Last updated: 2026-01-23 23:25:09 UTC*
sandbox/terraform/docker-service/README.md
+32
View File
@@ -0,0 +1,32 @@
# Docker Service
> Terraform sandbox and examples - docker-service submodule
## Overview
This directory contains terraform sandbox and examples - docker-service submodule.
## Key Files
| File | Description |
|------|-------------|
| *No files yet* | |
## Interfaces / APIs
*Document any APIs, CLI commands, or interfaces here.*
## Status
** Not Started**
See [STATUS.md](./STATUS.md) for detailed progress tracking.
## Architecture Reference
Part of the [Agent Governance System](/opt/agent-governance/docs/ARCHITECTURE.md).
Parent: [Terraform](..)
---
*Last updated: 2026-01-23 23:25:09 UTC*
sandbox/terraform/docker-service/STATUS.md
+30
View File
@@ -0,0 +1,30 @@
# Status: Docker Service
## Current Phase
** NOT STARTED**
## Tasks
| Status | Task | Updated |
|--------|------|---------|
| ☐ | *No tasks defined* | - |
## Dependencies
*No external dependencies.*
## Issues / Blockers
*No current issues or blockers.*
## Activity Log
### 2026-01-23 23:25:09 UTC
- **Phase**: NOT STARTED
- **Action**: Initialized
- **Details**: Status tracking initialized for this directory.
---
*Last updated: 2026-01-23 23:25:09 UTC*
sandbox/terraform/docker-service/main.tf
+150
View File
@@ -0,0 +1,150 @@
# Terraform Configuration: Docker Service Deployment
# ===================================================
# This configuration manages Docker containers on localhost.
# Designed for Tier 1+ agents to deploy services.
#
# For Tier 0 agents: Plan only (terraform plan)
#
# Usage:
# terraform init
# terraform plan -var="service_name=myapp" -var="image=nginx:alpine"
# terraform apply # Tier 1+ only
terraform {
required_providers {
docker = {
source = "kreuzwerker/docker"
version = "~> 3.0"
}
}
}
provider "docker" {
host = "unix:///var/run/docker.sock"
}
# Variables
variable "service_name" {
description = "Name of the service/container"
type = string
default = "tf-managed-service"
}
variable "image" {
description = "Docker image to deploy"
type = string
default = "nginx:alpine"
}
variable "internal_port" {
description = "Container internal port"
type = number
default = 80
}
variable "external_port" {
description = "Host external port"
type = number
default = 8090
}
variable "network_name" {
description = "Docker network to attach"
type = string
default = "spark-net"
}
variable "environment" {
description = "Environment variables for the container"
type = map(string)
default = {}
}
variable "labels" {
description = "Labels to apply to the container"
type = map(string)
default = {
"managed-by" = "terraform"
"agent-tier" = "1"
}
}
# Data source to reference existing network
data "docker_network" "main" {
name = var.network_name
}
# Pull the image
resource "docker_image" "service" {
name = var.image
keep_locally = true
}
# Create the container
resource "docker_container" "service" {
name = var.service_name
image = docker_image.service.image_id
ports {
internal = var.internal_port
external = var.external_port
}
networks_advanced {
name = data.docker_network.main.name
}
restart = "unless-stopped"
dynamic "env" {
for_each = var.environment
content {
key = env.key
value = env.value
}
}
labels {
label = "managed-by"
value = "terraform"
}
labels {
label = "service-name"
value = var.service_name
}
# Health check
healthcheck {
test = ["CMD", "wget", "-q", "--spider", "http://localhost:${var.internal_port}/"]
interval = "30s"
timeout = "10s"
retries = 3
start_period = "10s"
}
lifecycle {
create_before_destroy = true
}
}
# Outputs
output "container_id" {
description = "The ID of the deployed container"
value = docker_container.service.id
}
output "container_name" {
description = "The name of the deployed container"
value = docker_container.service.name
}
output "service_url" {
description = "URL to access the service"
value = "http://localhost:${var.external_port}"
}
output "network" {
description = "Network the container is attached to"
value = var.network_name
}