Skip to content

feat: archetype v2 + secret 变量名对齐（ADR-0008） #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
randypanding merged 1 commit into from
Aug 18, 2026
Merged

feat: archetype v2 + secret 变量名对齐（ADR-0008） #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion governance/GOVERNANCE.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@ domains:
strength: enforced
schema: standards/agent/event.schema.yaml
- id: AR-8
intent: "agent 必须声明 archetype（builder/checker/orchestrator/curator/interface/observer/operator）；同一声明不得兼任 builder 与 checker；checker 强制 private workspace；分类决定权限基线与审计强度"
intent: "agent 必须声明 archetype（十原型封顶：builder/planner/checker/judge/orchestrator/curator/interface/observer/researcher/operator，ADR-0008）；builder↔checker、planner↔builder 不得同一声明；checker 强制 private workspace；judge 模型别名须异于争议双方；新增第 11 原型须 ADR 论证"
strength: enforced
validate: agent-registry/scripts/validate.py
- id: AR-9
Expand Down
2 changes: 1 addition & 1 deletion governance/expected-state.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
"delete_branch_on_merge": true,
"exclude_repos": ["AI_Web_School"]
},
"org_secrets_required": ["CB_APP_ID", "CB_APP_KEY"],
"org_secrets_required": ["CB_APP_ID", "AGENT_APP_SECRET"],
"github_app": {
"name": "cloudbrid-agent",
"id": 4632704,
Expand Down
14 changes: 7 additions & 7 deletions scripts/gh-app-token.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
#
# 用法：
# export CB_APP_ID=123456 # App 详情页的 App ID
# export CB_APP_KEY_FILE=~/.config/cloudbird/cloudbird-agent.pem
# # CI / secret 场景改用字面量： export CB_APP_KEY="<PEM 全文>"
# export AGENT_APP_SECRET_FILE=~/.config/cloudbird/cloudbird-agent.pem
# # CI / secret 场景改用字面量（org secret 同名注入）： export AGENT_APP_SECRET="<PEM 全文>"
#
# GH_TOKEN=$(bash gh-app-token.sh) # 作用域=安装的全部仓库
# GH_TOKEN=$(REPO=template-service bash gh-app-token.sh) # 作用域=单仓库（推荐）
Expand All @@ -24,12 +24,12 @@ ORG="${ORG:-Cloudbird-Software}"
APP_ID="${CB_APP_ID:?需要环境变量 CB_APP_ID（GitHub App 设置页的 App ID）}"

# 私钥：优先文件，其次字面量（CI secret 里通常存 PEM 全文）
if [[ -n "${CB_APP_KEY_FILE:-}" && -f "$CB_APP_KEY_FILE" ]]; then
KEY=$(cat "$CB_APP_KEY_FILE")
elif [[ -n "${CB_APP_KEY:-}" ]]; then
KEY="$CB_APP_KEY"
if [[ -n "${AGENT_APP_SECRET_FILE:-}" && -f "$AGENT_APP_SECRET_FILE" ]]; then
KEY=$(cat "$AGENT_APP_SECRET_FILE")
elif [[ -n "${AGENT_APP_SECRET:-}" ]]; then
KEY="$AGENT_APP_SECRET"
else
echo "错误：需要 CB_APP_KEY_FILE（私钥文件路径）或 CB_APP_KEY（PEM 内容）" >&2
echo "错误：需要 AGENT_APP_SECRET_FILE（私钥文件路径）或 AGENT_APP_SECRET（PEM 内容）" >&2
exit 1
fi

Expand Down
20 changes: 14 additions & 6 deletions standards/agent/agent.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,25 @@ properties:
version: {type: string, pattern: "^[0-9]+\\.[0-9]+\\.[0-9]+$"}
status: {enum: [proposed, approved, deprecated, rejected]}
archetype:
enum: [builder, checker, orchestrator, curator, interface, observer, operator]
enum: [builder, planner, checker, judge, orchestrator, curator, interface, observer, researcher, operator]
description: |
原型（信任边界分类，AR-8）。分类决定默认权限基线/凭据策略/审计强度：
builder 生产者：写代码/文档/artifacts；产出必须被独立 checker 验收
checker 检查者：只读为主，输出=判决(pass/fail+理由)；强制 private workspace
orchestrator 编排者：任务分解/分配/汇总，不直接产 artifacts；高审计
原型（信任边界分类，AR-8 v2，ADR-0008）。分类决定默认权限基线/凭据策略/审计强度：
builder 生产者：写实现代码/产品文档；产出必须被独立 checker 验收；永不写自身验收测试
planner 计划者（设计时）：意图→波次计划+工作卡+测试规格；只写计划产物不写实现；
下游毒化风险高→高审计；计划须过 checker 评审方可执行
checker 检查者：验收判决(pass/fail+理由)+测试作者权（从 planner 规格转译为测试代码，
只可写 tests/** 不可写实现）；强制 private workspace + strict
judge 仲裁者：域内分歧裁决（测试抖动/评审分歧/规格歧义）；管辖权由团队声明授权，
越域必上升人类；模型别名须与争议双方(builder/checker)均不同；判决可被 owner 推翻
orchestrator 编排者（运行时）：分配/监控/汇总，不产 artifacts；高审计
curator 保管者：治理仓/registry 维护、归档审核（persistent 团队主力）
interface 接口者：对外通道接收需求/汇报；低权限转发+翻译
observer 观测者：只读采集度量/事件分析；只写数据层
researcher 检索者：读外部网络/代码库/文档，产出结构化引用报告；常以 as_tool 被 worker
调用实现上下文经济（全文留在 researcher，worker 只收结论+引用）；不写仓库不碰生产
operator 运维者：部署/回滚；strict 模式，生产动作全 ask+人工审批(RL-1)
约束：同一声明单 archetype；builder 与 checker 不得同一声明（利益分离）
约束：同一声明单 archetype；builder 与 checker 不得同一声明（利益分离）；
planner 与 builder 不得同一声明（标准制定者不可施工）
role: {type: string, description: "一句话职责；决定团队装配"}
identity:
type: object
Expand Down