Documentation
¶
Index ¶
- Constants
- func GetEffectiveNamespace(ctx fiber.Ctx, explicit string) string
- func NewAuthMiddleware(c client.Client, configs ...AuthConfig) fiber.Handler
- func NewLoggingMiddleware() fiber.Handler
- func NewMetricsMiddleware() fiber.Handler
- func NewTaskMessageStore(reader client.Reader, messages store.MessageStore, taskKey client.ObjectKey, ...) tools.TaskMessageStore
- func NewTaskTranscriptSearcher(reader client.Reader, sessions store.SessionStore, ...) tools.TranscriptSearcher
- func NewTracingMiddleware() fiber.Handler
- func NormalizeListContinue(token string) string
- func RegisterACPMCPBroker(app *fiber.App, broker *controller.ACPMCPBroker) error
- func ResolveNamespace(c fiber.Ctx, explicit string, watchNamespace string, enforceIsolation bool) (string, error)
- func StreamPodLogs(ctx context.Context, clientset kubernetes.Interface, ...) (io.ReadCloser, error)
- type ACPArtifactHandlers
- type ACPRuntimeAvailability
- type AnthropicCompatHandler
- type AnthropicContentBlock
- type AnthropicDelta
- type AnthropicError
- type AnthropicErrorDetail
- type AnthropicMessage
- type AnthropicMetadata
- type AnthropicRequest
- type AnthropicResponse
- type AnthropicStreamEvent
- type AnthropicThinking
- type AnthropicTool
- type AnthropicUsage
- type ApprovalDecisionRequest
- type AuthConfig
- type ChatConfig
- type ChatHandler
- type ChatRequest
- type ChatResponse
- type ChatUsage
- type CompatRouter
- type ContextToken
- type ContextTokenAuthorizationConfig
- type ContextTokenAuthorizationConfigOptions
- type ContextTokenConfig
- type ContextTokenExchangeRequest
- type ContextTokenExchanger
- type ContextTokenProfileConfig
- type ContextTokenTTSClient
- type ContextTokenTTSConfig
- type ControllerEpochFenceSource
- type ControllerEpochReader
- type ControllerEpochStoreFenceSource
- type ConversationMessage
- type CreateAgentRequest
- type CreateProviderRequest
- type CreateRepositoryMonitorCommandRequest
- type CreateRepositoryMonitorRequest
- type CreateRepositoryMonitorRunRequest
- type CreateRepositoryScanRequest
- type CreateSkillRequest
- type CreateSubstrateActorPoolRequest
- type CreateTaskRequest
- type CreateToolRequest
- type ExecutionEventResponse
- type ForkTaskRequest
- type ForkTaskResponse
- type Handlers
- func (h *Handlers) ApplyMemoryProposal(c fiber.Ctx) error
- func (h *Handlers) ArchiveMemoryProposal(c fiber.Ctx) error
- func (h *Handlers) CreateAgent(c fiber.Ctx) error
- func (h *Handlers) CreateAgentRuntime(c fiber.Ctx) error
- func (h *Handlers) CreateManualSecurityScan(c fiber.Ctx) error
- func (h *Handlers) CreateMemory(c fiber.Ctx) error
- func (h *Handlers) CreateMemoryProposal(c fiber.Ctx) error
- func (h *Handlers) CreateProvider(c fiber.Ctx) error
- func (h *Handlers) CreateRepositoryMonitor(c fiber.Ctx) error
- func (h *Handlers) CreateRepositoryMonitorCommandEvent(c fiber.Ctx) error
- func (h *Handlers) CreateRepositoryMonitorRun(c fiber.Ctx) error
- func (h *Handlers) CreateRepositoryScan(c fiber.Ctx) error
- func (h *Handlers) CreateSecurityPullRequest(c fiber.Ctx) error
- func (h *Handlers) CreateSkill(c fiber.Ctx) error
- func (h *Handlers) CreateSubstrateActorPool(c fiber.Ctx) error
- func (h *Handlers) CreateTask(c fiber.Ctx) error
- func (h *Handlers) CreateTool(c fiber.Ctx) error
- func (h *Handlers) DecideTaskApproval(c fiber.Ctx) error
- func (h *Handlers) DeleteAgent(c fiber.Ctx) error
- func (h *Handlers) DeleteAgentRuntime(c fiber.Ctx) error
- func (h *Handlers) DeleteMemory(c fiber.Ctx) error
- func (h *Handlers) DeleteProvider(c fiber.Ctx) error
- func (h *Handlers) DeleteRepositoryMonitor(c fiber.Ctx) error
- func (h *Handlers) DeleteRepositoryScan(c fiber.Ctx) error
- func (h *Handlers) DeleteSession(c fiber.Ctx) error
- func (h *Handlers) DeleteSkill(c fiber.Ctx) error
- func (h *Handlers) DeleteSubstrateActorPool(c fiber.Ctx) error
- func (h *Handlers) DeleteTask(c fiber.Ctx) error
- func (h *Handlers) DeleteTool(c fiber.Ctx) error
- func (h *Handlers) DisableMemory(c fiber.Ctx) error
- func (h *Handlers) DismissSecurityFinding(c fiber.Ctx) error
- func (h *Handlers) DownloadTaskArtifact(c fiber.Ctx) error
- func (h *Handlers) EnableMemory(c fiber.Ctx) error
- func (h *Handlers) ForkTask(c fiber.Ctx) error
- func (h *Handlers) GenerateSecurityPatch(c fiber.Ctx) error
- func (h *Handlers) GetAgent(c fiber.Ctx) error
- func (h *Handlers) GetAgentRuntime(c fiber.Ctx) error
- func (h *Handlers) GetGateway(c fiber.Ctx) error
- func (h *Handlers) GetGatewayBinding(c fiber.Ctx) error
- func (h *Handlers) GetGatewayClass(c fiber.Ctx) error
- func (h *Handlers) GetGatewayDelivery(c fiber.Ctx) error
- func (h *Handlers) GetGatewayEvent(c fiber.Ctx) error
- func (h *Handlers) GetMemory(c fiber.Ctx) error
- func (h *Handlers) GetMemoryProposal(c fiber.Ctx) error
- func (h *Handlers) GetProvider(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitor(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitorActionRecord(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitorCommandEvent(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitorGitHubMutation(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitorImplementationJob(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitorImplementationPatchPreview(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryMonitorWorkAction(c fiber.Ctx) error
- func (h *Handlers) GetRepositoryScan(c fiber.Ctx) error
- func (h *Handlers) GetRuntimePool(c fiber.Ctx) error
- func (h *Handlers) GetSecurityFinding(c fiber.Ctx) error
- func (h *Handlers) GetSecurityReviewSlice(c fiber.Ctx) error
- func (h *Handlers) GetSession(c fiber.Ctx) error
- func (h *Handlers) GetSkill(c fiber.Ctx) error
- func (h *Handlers) GetSkillContent(c fiber.Ctx) error
- func (h *Handlers) GetSubstrateActorPool(c fiber.Ctx) error
- func (h *Handlers) GetTask(c fiber.Ctx) error
- func (h *Handlers) GetTaskChildren(c fiber.Ctx) error
- func (h *Handlers) GetTaskLogs(c fiber.Ctx) error
- func (h *Handlers) GetTaskPlan(c fiber.Ctx) error
- func (h *Handlers) GetTaskResult(c fiber.Ctx) error
- func (h *Handlers) GetTaskTrace(c fiber.Ctx) error
- func (h *Handlers) GetThreatModel(c fiber.Ctx) error
- func (h *Handlers) GetTool(c fiber.Ctx) error
- func (h *Handlers) GetUsageOther(c fiber.Ctx) error
- func (h *Handlers) GetUsageReport(c fiber.Ctx) error
- func (h *Handlers) GetUsageWork(c fiber.Ctx) error
- func (h *Handlers) HandleGatewayEvent(c fiber.Ctx) error
- func (h *Handlers) HandleGitHubWebhook(c fiber.Ctx) error
- func (h *Handlers) Healthz(c fiber.Ctx) error
- func (h *Handlers) ListAgentRuntimes(c fiber.Ctx) error
- func (h *Handlers) ListAgents(c fiber.Ctx) error
- func (h *Handlers) ListGatewayBindings(c fiber.Ctx) error
- func (h *Handlers) ListGatewayClasses(c fiber.Ctx) error
- func (h *Handlers) ListGatewayDeliveries(c fiber.Ctx) error
- func (h *Handlers) ListGatewayEvents(c fiber.Ctx) error
- func (h *Handlers) ListGateways(c fiber.Ctx) error
- func (h *Handlers) ListMemories(c fiber.Ctx) error
- func (h *Handlers) ListMemoryProposals(c fiber.Ctx) error
- func (h *Handlers) ListProviders(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorActionRecords(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorCommandEvents(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorEvents(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorGitHubMutations(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorImplementationJobs(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorItems(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorRuns(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitorWorkActions(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryMonitors(c fiber.Ctx) error
- func (h *Handlers) ListRepositoryScans(c fiber.Ctx) error
- func (h *Handlers) ListRuntimePools(c fiber.Ctx) error
- func (h *Handlers) ListSecretNames(c fiber.Ctx) error
- func (h *Handlers) ListSecurityDroppedFindings(c fiber.Ctx) error
- func (h *Handlers) ListSecurityFindings(c fiber.Ctx) error
- func (h *Handlers) ListSecurityPatchProposals(c fiber.Ctx) error
- func (h *Handlers) ListSecurityReviewSlices(c fiber.Ctx) error
- func (h *Handlers) ListSecurityScanRuns(c fiber.Ctx) error
- func (h *Handlers) ListSessionEvents(c fiber.Ctx) error
- func (h *Handlers) ListSessions(c fiber.Ctx) error
- func (h *Handlers) ListSkills(c fiber.Ctx) error
- func (h *Handlers) ListSubstrateActorPools(c fiber.Ctx) error
- func (h *Handlers) ListTaskApprovals(c fiber.Ctx) error
- func (h *Handlers) ListTaskArtifacts(c fiber.Ctx) error
- func (h *Handlers) ListTaskEvents(c fiber.Ctx) error
- func (h *Handlers) ListTasks(c fiber.Ctx) error
- func (h *Handlers) ListTools(c fiber.Ctx) error
- func (h *Handlers) Readyz(c fiber.Ctx) error
- func (h *Handlers) ReopenSecurityFinding(c fiber.Ctx) error
- func (h *Handlers) RetryGatewayDelivery(c fiber.Ctx) error
- func (h *Handlers) ReviewMemoryProposal(c fiber.Ctx) error
- func (h *Handlers) StreamSessionEvents(c fiber.Ctx) error
- func (h *Handlers) StreamTaskEvents(c fiber.Ctx) error
- func (h *Handlers) UpdateAgent(c fiber.Ctx) error
- func (h *Handlers) UpdateAgentRuntime(c fiber.Ctx) error
- func (h *Handlers) UpdateMemory(c fiber.Ctx) error
- func (h *Handlers) UpdateProvider(c fiber.Ctx) error
- func (h *Handlers) UpdateRepositoryMonitor(c fiber.Ctx) error
- func (h *Handlers) UpdateRepositoryScan(c fiber.Ctx) error
- func (h *Handlers) UpdateSkill(c fiber.Ctx) error
- func (h *Handlers) UpdateSubstrateActorPool(c fiber.Ctx) error
- func (h *Handlers) UpdateThreatModel(c fiber.Ctx) error
- func (h *Handlers) UpdateTool(c fiber.Ctx) error
- func (h *Handlers) ValidateSecurityFinding(c fiber.Ctx) error
- type HandlersConfig
- type ImageSource
- type InternalHandlers
- func (h *InternalHandlers) ApplyMemoryProposal(c fiber.Ctx) error
- func (h *InternalHandlers) ArchiveMemoryProposal(c fiber.Ctx) error
- func (h *InternalHandlers) CreateMemory(c fiber.Ctx) error
- func (h *InternalHandlers) CreateMemoryProposal(c fiber.Ctx) error
- func (h *InternalHandlers) DeleteMemory(c fiber.Ctx) error
- func (h *InternalHandlers) DisableMemory(c fiber.Ctx) error
- func (h *InternalHandlers) EnableMemory(c fiber.Ctx) error
- func (h *InternalHandlers) GetMemory(c fiber.Ctx) error
- func (h *InternalHandlers) GetMemoryProposal(c fiber.Ctx) error
- func (h *InternalHandlers) GetMessages(c fiber.Ctx) error
- func (h *InternalHandlers) GetPlan(c fiber.Ctx) error
- func (h *InternalHandlers) GetSessionTranscript(c fiber.Ctx) error
- func (h *InternalHandlers) ListMemories(c fiber.Ctx) error
- func (h *InternalHandlers) ListMemoryProposals(c fiber.Ctx) error
- func (h *InternalHandlers) ReviewMemoryProposal(c fiber.Ctx) error
- func (h *InternalHandlers) SearchTranscript(c fiber.Ctx) error
- func (h *InternalHandlers) SendMessage(c fiber.Ctx) error
- func (h *InternalHandlers) SubmitExecutionEvent(c fiber.Ctx) error
- func (h *InternalHandlers) SubmitPlan(c fiber.Ctx) error
- func (h *InternalHandlers) SubmitResult(c fiber.Ctx) error
- func (h *InternalHandlers) UpdateExecutionWorkspaceStatus(c fiber.Ctx) error
- func (h *InternalHandlers) UpdateMemory(c fiber.Ctx) error
- func (h *InternalHandlers) UploadArtifact(c fiber.Ctx) error
- type InternalHandlersConfig
- type ListExecutionEventsResponse
- type ListMeta
- type ListResponse
- type ListSessionExecutionEventsResponse
- type ListTaskApprovalsResponse
- type MetadataRequest
- type OAIChoice
- type OAIError
- type OAIErrorDetail
- type OAIFunctionCall
- type OAIFunctionDef
- type OAIJSONSchemaSpec
- type OAIMessage
- type OAIModel
- type OAIModelList
- type OAIRequest
- type OAIResponse
- type OAIResponseFormat
- type OAITool
- type OAIToolCall
- type OAIUsage
- type OIDCConfig
- type OpenAICompatHandler
- type Pagination
- type ProviderResolutionInfo
- type ProviderResolver
- func (r *ProviderResolver) LookupProvider(ctx context.Context, name, namespace string) (*corev1alpha1.Provider, error)
- func (r *ProviderResolver) Resolve(ctx context.Context, opts ResolveOpts) (llm.Provider, string, error)
- func (r *ProviderResolver) ResolveAPIKey(ctx context.Context, providerCRD *corev1alpha1.Provider) (string, error)
- func (r *ProviderResolver) ResolveWithInfo(ctx context.Context, opts ResolveOpts) (llm.Provider, string, ProviderResolutionInfo, error)
- type ResolveOpts
- type SSEEvent
- type SecretNameResponse
- type Server
- type ServerConfig
- type SessionExecutionEventResponse
- type StreamOptions
- type SubmitExecutionEventRequest
- type SubmitExecutionEventResponse
- type SystemPromptBuilder
- type TokenHeaderConfig
- type ToolCallInfo
- type ToolExecutor
- func (e *ToolExecutor) Execute(ctx context.Context, toolCall llm.ToolCall) (string, error)
- func (e *ToolExecutor) SetAgentCreateAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)
- func (e *ToolExecutor) SetAgentDeleteAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)
- func (e *ToolExecutor) SetAgentUpdateAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)
- func (e *ToolExecutor) SetAllowedTools(allowedTools []llm.Tool)
- func (e *ToolExecutor) SetExecutionMode(mode executionmode.Mode)
- func (e *ToolExecutor) SetPolicyReader(reader client.Reader)
- func (e *ToolExecutor) SetSecretReadAuthorizer(authorize func(context.Context, string, string) error)
- func (e *ToolExecutor) SetTaskCreateAuthorizer(authorize func(context.Context, *corev1alpha1.Task) error)
- func (e *ToolExecutor) SetTaskDeleteAuthorizer(authorize func(context.Context, *corev1alpha1.Task) error)
- type ToolResult
- type UpdateAgentRequest
- type UpdateProviderRequest
- type UpdateRepositoryMonitorRequest
- type UpdateRepositoryScanRequest
- type UpdateSkillRequest
- type UpdateSubstrateActorPoolRequest
- type UpdateThreatModelRequest
- type UpdateToolRequest
- type UserInfo
Constants ¶
const ( // AuthHeader is the header name for authorization AuthHeader = "Authorization" // XAPIKeyHeader is the header name for the Anthropic-style API key XAPIKeyHeader = "x-api-key" // BearerPrefix is the prefix for bearer tokens BearerPrefix = "Bearer " // UserInfoContextKey is the context key for storing user info UserInfoContextKey = "userInfo" // AuthTypeTokenReview identifies Kubernetes TokenReview authentication. AuthTypeTokenReview = "tokenReview" // AuthTypeOIDC identifies OIDC JWT authentication. AuthTypeOIDC = "oidc" )
const ( // AuthTypeContextToken identifies generic transaction/context token authentication. AuthTypeContextToken = "contextToken" // ContextTokenProfileTransactionToken identifies Orka's strict transaction-token profile. ContextTokenProfileTransactionToken = transactiontoken.ProfileName // TransactionTokenHeaderName is the default HTTP transaction-token header. TransactionTokenHeaderName = transactiontoken.HeaderName // TransactionTokenJWTType is the JWT typ header required by the profile. TransactionTokenJWTType = transactiontoken.JWTType )
const ( // ContextTokenAuthorizationModeOff disables context-token authorization checks. ContextTokenAuthorizationModeOff = "off" // ContextTokenAuthorizationModeAudit logs context-token authorization failures but allows the request. ContextTokenAuthorizationModeAudit = "audit" // ContextTokenAuthorizationModeEnforce rejects requests that fail context-token authorization. ContextTokenAuthorizationModeEnforce = "enforce" // ContextTokenScopeTaskCreate authorizes context-token callers to create Orka Tasks. ContextTokenScopeTaskCreate = "orka:tasks:create" // ContextTokenScopeTaskGet authorizes context-token callers to read a Task and its related data. ContextTokenScopeTaskGet = "orka:tasks:get" // ContextTokenScopeTaskList authorizes context-token callers to list Tasks. ContextTokenScopeTaskList = "orka:tasks:list" // ContextTokenScopeTaskDelete authorizes context-token callers to delete Tasks. ContextTokenScopeTaskDelete = "orka:tasks:delete" // ContextTokenScopeToolsRead authorizes context-token callers to read Tool definitions. ContextTokenScopeToolsRead = "orka:tools:read" // ContextTokenScopeToolsUse authorizes context-token callers to execute Orka-managed tools. ContextTokenScopeToolsUse = "orka:tools:use" // ContextTokenScopeProvidersUse authorizes context-token callers to use configured model providers. ContextTokenScopeProvidersUse = "orka:providers:use" // ContextTokenScopeSecretsRead authorizes context-token callers to read Secret metadata. ContextTokenScopeSecretsRead = "orka:secrets:read" // ContextTokenScopeSecretsCredentialsRead authorizes use of cluster-managed outbound credential material, including Secret data and ServiceAccount tokens. ContextTokenScopeSecretsCredentialsRead = "orka:secrets:credentials:read" // ContextTokenScopeAgentsRead authorizes context-token callers to read Agent definitions. ContextTokenScopeAgentsRead = "orka:agents:read" // ContextTokenScopeAgentsWrite authorizes context-token callers to mutate Agent definitions. ContextTokenScopeAgentsWrite = "orka:agents:write" // ContextTokenScopeMemoryRead authorizes context-token callers to read memory resources. ContextTokenScopeMemoryRead = "orka:memory:read" // ContextTokenScopeMemoryWrite authorizes context-token callers to mutate memory resources. ContextTokenScopeMemoryWrite = "orka:memory:write" // ContextTokenScopeSessionsRead authorizes context-token callers to read sessions. ContextTokenScopeSessionsRead = "orka:sessions:read" // ContextTokenScopeSessionsWrite authorizes context-token callers to delete or mutate sessions. ContextTokenScopeSessionsWrite = "orka:sessions:write" // ContextTokenScopeSecurityRead authorizes context-token callers to read security scan resources. ContextTokenScopeSecurityRead = "orka:security:read" // ContextTokenScopeSecurityWrite authorizes context-token callers to mutate security scan resources. ContextTokenScopeSecurityWrite = "orka:security:write" // ContextTokenScopeMonitorsRead authorizes context-token callers to read repository monitor resources. ContextTokenScopeMonitorsRead = "orka:monitors:read" // ContextTokenScopeMonitorsWrite authorizes context-token callers to mutate repository monitor resources. ContextTokenScopeMonitorsWrite = "orka:monitors:write" // ContextTokenScopeMonitorsOperate authorizes context-token callers to enqueue repository monitor operations. ContextTokenScopeMonitorsOperate = "orka:monitors:operate" // ContextTokenScopeSkillsRead authorizes context-token callers to read Skills. ContextTokenScopeSkillsRead = "orka:skills:read" // ContextTokenScopeSkillsWrite authorizes context-token callers to mutate Skills. ContextTokenScopeSkillsWrite = "orka:skills:write" )
const ( // ContextTokenTTSTokenSourceNone disables Orka-initiated token exchanges. ContextTokenTTSTokenSourceNone = contexttoken.TTSTokenSourceNone // ContextTokenTTSTokenSourceServiceAccount uses Orka's ServiceAccount identity for exchanges. ContextTokenTTSTokenSourceServiceAccount = contexttoken.TTSTokenSourceServiceAccount // ContextTokenTTSTokenSourceIncoming uses the incoming subject token for exchanges. ContextTokenTTSTokenSourceIncoming = contexttoken.TTSTokenSourceIncoming )
const ( // ContextScopeGatewaysRead authorizes gateway resource and ledger reads. ContextScopeGatewaysRead = "orka:gateways:read" // ContextScopeGatewaysOperate authorizes dead-lettered delivery retries. ContextScopeGatewaysOperate = "orka:gateways:operate" )
const ( // DefaultLimit is the default number of items per page DefaultLimit = 100 // MaxLimit is the maximum number of items per page MaxLimit = 500 )
const ContextTokenScopeConfigMapsRead = "orka:" + "configmaps:read"
ContextTokenScopeConfigMapsRead authorizes context-token callers to read ConfigMaps used as operation inputs.
const OAIErrorTypeInvalidRequest = "invalid_request_error"
OAIErrorTypeInvalidRequest is the OpenAI error type for a request the API will not act on.
Variables ¶
This section is empty.
Functions ¶
func GetEffectiveNamespace ¶
GetEffectiveNamespace returns the namespace to use for a request. Priority: explicit namespace > SA namespace from token > "default"
func NewAuthMiddleware ¶
func NewAuthMiddleware(c client.Client, configs ...AuthConfig) fiber.Handler
NewAuthMiddleware creates a new authentication middleware.
func NewLoggingMiddleware ¶
NewLoggingMiddleware creates a logging middleware
func NewMetricsMiddleware ¶
NewMetricsMiddleware creates a metrics middleware
func NewTaskMessageStore ¶ added in v0.2.0
func NewTaskMessageStore(reader client.Reader, messages store.MessageStore, taskKey client.ObjectKey, taskUID string, taskProvenanceProtected bool, guard func(context.Context, func(context.Context) error) error) tools.TaskMessageStore
NewTaskMessageStore binds brokered messaging to the controller-authenticated Task identity. Parent names alone never authorize coordination access. guard must come from the authenticated MCP prompt context.
func NewTaskTranscriptSearcher ¶ added in v0.2.0
func NewTaskTranscriptSearcher(reader client.Reader, sessions store.SessionStore, gatewayEvents store.GatewayEventStore, taskKey client.ObjectKey, taskUID string, taskProvenanceProtected bool, guard func(context.Context, func(context.Context) error) error) tools.TranscriptSearcher
NewTaskTranscriptSearcher binds brokered search to an authenticated Task. The identity must come from the controller MCP broker, never tool arguments. Live Task and session authorization is repeated for each search and cleanup retry. guard must come from the authenticated MCP prompt context.
func NewTracingMiddleware ¶
NewTracingMiddleware creates an OpenTelemetry tracing middleware.
func NormalizeListContinue ¶ added in v0.2.0
NormalizeListContinue strips the controller-runtime cache sentinel from a list continue token. Cache-backed lists report "continue-not-supported" whenever a limit was applied; clients that follow it verbatim would otherwise receive a 500 from the cache on the next page.
func RegisterACPMCPBroker ¶ added in v0.2.0
func RegisterACPMCPBroker(app *fiber.App, broker *controller.ACPMCPBroker) error
RegisterACPMCPBroker installs the controller-side prompt MCP broker without coupling broker construction to Server or cmd/main.go. Callers construct the broker with the current durable stores and controller clients, then register it before starting the Fiber app.
func ResolveNamespace ¶
func ResolveNamespace(c fiber.Ctx, explicit string, watchNamespace string, enforceIsolation bool) (string, error)
ResolveNamespace determines the effective namespace for a request. When watchNamespace is set: it's the only allowed namespace (explicit mismatches are rejected with 403). Otherwise: explicit param > SA namespace from token > "default". If enforceIsolation is true, the resolved namespace must match the user's SA namespace.
func StreamPodLogs ¶
func StreamPodLogs(ctx context.Context, clientset kubernetes.Interface, namespace, podName, containerName string) (io.ReadCloser, error)
StreamPodLogs streams logs from a pod
Types ¶
type ACPArtifactHandlers ¶ added in v0.2.0
type ACPArtifactHandlers struct {
// contains filtered or unexported fields
}
func NewACPArtifactHandlers ¶ added in v0.2.0
func NewACPArtifactHandlers(service *artifactcap.Service) (*ACPArtifactHandlers, error)
type ACPRuntimeAvailability ¶ added in v0.2.0
ACPRuntimeAvailability identifies built-in profiles backed by configured, digest-pinned RuntimePool images.
type AnthropicCompatHandler ¶
type AnthropicCompatHandler struct {
// contains filtered or unexported fields
}
AnthropicCompatHandler implements Anthropic-compatible /v1/messages endpoints. This allows Anthropic-compatible clients to use Orka as a custom provider.
func NewAnthropicCompatHandler ¶
func NewAnthropicCompatHandler(c client.Client, apiReader client.Reader, watchNamespace string, enforceNamespaceIsolation bool, config ChatConfig, resolver *ProviderResolver, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *AnthropicCompatHandler
NewAnthropicCompatHandler creates an Anthropic-compatible API handler.
func (*AnthropicCompatHandler) HandleListModels ¶
func (h *AnthropicCompatHandler) HandleListModels(c fiber.Ctx) error
HandleListModels handles GET /anthropic/v1/models.
func (*AnthropicCompatHandler) HandleMessages ¶
func (h *AnthropicCompatHandler) HandleMessages(c fiber.Ctx) error
HandleMessages handles POST /anthropic/v1/messages.
type AnthropicContentBlock ¶
type AnthropicContentBlock struct {
Type string `json:"type"`
Text string `json:"text,omitempty"`
ID string `json:"id,omitempty"`
Name string `json:"name,omitempty"`
Input json.RawMessage `json:"input,omitempty"`
ToolUseID string `json:"tool_use_id,omitempty"`
Content json.RawMessage `json:"content,omitempty"`
Thinking string `json:"thinking,omitempty"`
Source *ImageSource `json:"source,omitempty"`
}
AnthropicContentBlock represents a typed content block in Anthropic messages. The Type field determines which other fields are populated.
type AnthropicDelta ¶
type AnthropicDelta struct {
Type string `json:"type,omitempty"`
Text string `json:"text,omitempty"`
PartialJSON string `json:"partial_json,omitempty"`
Thinking string `json:"thinking,omitempty"`
StopReason *string `json:"stop_reason,omitempty"`
StopSequence *string `json:"stop_sequence,omitempty"`
}
AnthropicDelta carries incremental updates within a streaming event.
type AnthropicError ¶
type AnthropicError struct {
Type string `json:"type"`
Error AnthropicErrorDetail `json:"error"`
}
AnthropicError is the standard error response format for the Anthropic API.
type AnthropicErrorDetail ¶
AnthropicErrorDetail contains the error type and message.
type AnthropicMessage ¶
type AnthropicMessage struct {
Role string `json:"role"`
Content json.RawMessage `json:"content"`
}
AnthropicMessage is a single message in an Anthropic conversation. Content is json.RawMessage because it can be a string or []ContentBlock.
type AnthropicMetadata ¶
type AnthropicMetadata struct {
UserID string `json:"user_id,omitempty"`
}
AnthropicMetadata contains request metadata.
type AnthropicRequest ¶
type AnthropicRequest struct {
Model string `json:"model"`
Messages []AnthropicMessage `json:"messages"`
MaxTokens int `json:"max_tokens"`
System json.RawMessage `json:"system,omitempty"`
Stream bool `json:"stream,omitempty"`
Temperature *float64 `json:"temperature,omitempty"`
TopP *float64 `json:"top_p,omitempty"`
TopK *int `json:"top_k,omitempty"`
StopSequences []string `json:"stop_sequences,omitempty"`
Tools []AnthropicTool `json:"tools,omitempty"`
ToolChoice json.RawMessage `json:"tool_choice,omitempty"`
Metadata *AnthropicMetadata `json:"metadata,omitempty"`
Thinking *AnthropicThinking `json:"thinking,omitempty"`
}
AnthropicRequest represents an incoming Anthropic Messages API request.
type AnthropicResponse ¶
type AnthropicResponse struct {
ID string `json:"id"`
Type string `json:"type"`
Role string `json:"role"`
Content []AnthropicContentBlock `json:"content"`
Model string `json:"model"`
StopReason *string `json:"stop_reason"`
StopSequence *string `json:"stop_sequence"`
Usage AnthropicUsage `json:"usage"`
}
AnthropicResponse is the non-streaming response from the Anthropic Messages API.
type AnthropicStreamEvent ¶
type AnthropicStreamEvent struct {
Type string `json:"type"`
Message *AnthropicResponse `json:"message,omitempty"`
Index int `json:"index,omitempty"`
ContentBlock *AnthropicContentBlock `json:"content_block,omitempty"`
Delta *AnthropicDelta `json:"delta,omitempty"`
Usage *AnthropicUsage `json:"usage,omitempty"`
}
AnthropicStreamEvent is a single SSE event in an Anthropic streaming response.
type AnthropicThinking ¶
type AnthropicThinking struct {
Type string `json:"type"`
BudgetTokens int `json:"budget_tokens,omitempty"`
}
AnthropicThinking configures extended thinking.
type AnthropicTool ¶
type AnthropicTool struct {
Name string `json:"name"`
Description string `json:"description,omitempty"`
InputSchema json.RawMessage `json:"input_schema"`
}
AnthropicTool defines a tool available for the model to call.
type AnthropicUsage ¶
type AnthropicUsage struct {
InputTokens int `json:"input_tokens"`
OutputTokens int `json:"output_tokens"`
}
AnthropicUsage contains token usage statistics.
type ApprovalDecisionRequest ¶
type AuthConfig ¶
type AuthConfig struct {
OIDC OIDCConfig
ContextTokens ContextTokenConfig
// TokenReviewAudiences scopes Kubernetes ServiceAccount authentication to
// the exact audiences requested by this listener. The cache key includes
// the normalized audience set so a token authenticated on an unscoped
// listener cannot be replayed against an audience-bound listener.
TokenReviewAudiences []string
}
AuthConfig holds authentication middleware configuration.
type ChatConfig ¶
type ChatConfig struct {
Enabled bool
Provider string
Model string
MaxIterations int
MaxDuration time.Duration
ToolTimeout time.Duration
MaxConcurrent int
MaxTasksPerTurn int
MaxSessionSize int // bytes
MaxPrematureEndRetries int // re-prompts when the model emits text without the GOAL_STATE sentinel
RuntimeAvailability ACPRuntimeAvailability
ExecutionMode executionmode.Mode
}
ChatConfig holds configuration for the chat handler.
type ChatHandler ¶
type ChatHandler struct {
// contains filtered or unexported fields
}
ChatHandler implements the orchestrator chat endpoints.
func NewChatHandler ¶
func NewChatHandler(c client.Client, apiReader client.Reader, sm *controller.SessionManager, config ChatConfig, watchNamespace string, enforceNS bool, ss store.SessionStore, rs store.ResultStore, resolver *ProviderResolver, kubeClientOpt ...kubernetes.Interface) *ChatHandler
NewChatHandler creates a new ChatHandler.
func (*ChatHandler) HandleCancelChat ¶
func (ch *ChatHandler) HandleCancelChat(c fiber.Ctx) error
HandleCancelChat handles DELETE /api/v1/chat/{sessionId}.
func (*ChatHandler) HandleChat ¶
func (ch *ChatHandler) HandleChat(c fiber.Ctx) error
HandleChat handles POST /api/v1/chat.
func (*ChatHandler) HandleChatConfig ¶
func (ch *ChatHandler) HandleChatConfig(c fiber.Ctx) error
HandleChatConfig handles GET /api/v1/chat/config.
type ChatRequest ¶
type ChatRequest struct {
Message string `json:"message"`
SessionID string `json:"sessionId,omitempty"`
Provider string `json:"provider,omitempty"`
Model string `json:"model,omitempty"`
Namespace string `json:"namespace,omitempty"`
Temperature *float64 `json:"temperature,omitempty"`
MaxTokens *int32 `json:"maxTokens,omitempty"`
SystemPrompt string `json:"systemPrompt,omitempty"`
AgentRef string `json:"agentRef,omitempty"`
}
ChatRequest is the request body for POST /api/v1/chat.
type ChatResponse ¶
type ChatResponse struct {
SessionID string `json:"sessionId"`
Message string `json:"message"`
ToolCalls []ToolCallInfo `json:"toolCalls,omitempty"`
Usage ChatUsage `json:"usage"`
}
ChatResponse is the response body for POST /api/v1/chat (JSON mode).
type ChatUsage ¶
type ChatUsage struct {
InputTokens int `json:"inputTokens"`
OutputTokens int `json:"outputTokens"`
LLMCalls int `json:"llmCalls"`
ToolCalls int `json:"toolCalls"`
TasksCreated int `json:"tasksCreated"`
Duration string `json:"duration"`
}
ChatUsage holds usage statistics for a chat turn.
type CompatRouter ¶ added in v0.2.0
type CompatRouter struct {
// contains filtered or unexported fields
}
CompatRouter forwards the four model compatibility routes to independent, namespace-scoped Orka installations. It authenticates ServiceAccount tokens; the receiving installation reauthenticates the same token and authorizes the route and each tool operation. It has no access to tenant resources or stores.
func NewCompatRouter ¶ added in v0.2.0
NewCompatRouter freezes the operator's namespace-to-installation allowlist. Targets are API origins, without a path, credentials, query or fragment.
func (*CompatRouter) Close ¶ added in v0.2.0
func (r *CompatRouter) Close()
Close releases idle connections when the router shuts down.
func (*CompatRouter) ServeHTTP ¶ added in v0.2.0
func (r *CompatRouter) ServeHTTP(w http.ResponseWriter, req *http.Request)
type ContextToken ¶
type ContextToken struct {
Profile string
Type string
Issuer string
Subject string
Audience []string
TransactionID string
Scope string
Scopes []string
RequestingWorkload string
TransactionContext map[string]any
RequesterContext map[string]any
Claims map[string]any
}
ContextToken contains verified transaction/context token identity and metadata.
type ContextTokenAuthorizationConfig ¶
type ContextTokenAuthorizationConfig struct {
Mode string
TaskCreateScopes []string
TaskReadScopes []string
TaskListScopes []string
TaskDeleteScopes []string
TaskUpdateScopes []string
ToolReadScopes []string
ToolUseScopes []string
ProviderUseScopes []string
SecretReadScopeList []string
SecretCredentialReadScopeList []string
AgentReadScopes []string
AgentWriteScopes []string
MemoryReadScopes []string
MemoryWriteScopes []string
SessionReadScopes []string
SessionWriteScopes []string
SecurityReadScopes []string
SecurityWriteScopes []string
MonitorReadScopes []string
MonitorWriteScopes []string
MonitorOperateScopes []string
SkillReadScopes []string
SkillWriteScopes []string
GatewayReadScopes []string
GatewayOperateScopes []string
ConfigMapReadScopeList []string
}
ContextTokenAuthorizationConfig controls optional authorization checks derived from verified context-token scope and transaction context claims.
func NewContextTokenAuthorizationConfig ¶
func NewContextTokenAuthorizationConfig(opts ContextTokenAuthorizationConfigOptions) (ContextTokenAuthorizationConfig, error)
NewContextTokenAuthorizationConfig builds context-token authorization config.
func (ContextTokenAuthorizationConfig) ConfigMapReadScopes ¶
func (c ContextTokenAuthorizationConfig) ConfigMapReadScopes() []string
func (ContextTokenAuthorizationConfig) Enabled ¶
func (c ContextTokenAuthorizationConfig) Enabled() bool
Enabled reports whether context-token authorization is configured.
func (ContextTokenAuthorizationConfig) SecretCredentialReadScopes ¶
func (c ContextTokenAuthorizationConfig) SecretCredentialReadScopes() []string
func (ContextTokenAuthorizationConfig) SecretReadScopes ¶
func (c ContextTokenAuthorizationConfig) SecretReadScopes() []string
type ContextTokenAuthorizationConfigOptions ¶
type ContextTokenAuthorizationConfigOptions struct {
Mode string
TaskCreateScopes string
TaskReadScopes string
TaskListScopes string
TaskDeleteScopes string
TaskUpdateScopes string
ToolReadScopes string
ToolUseScopes string
ProviderUseScopes string
SecretReadScopes string
SecretCredentialReadScopes string
AgentReadScopes string
AgentWriteScopes string
MemoryReadScopes string
MemoryWriteScopes string
SessionReadScopes string
SessionWriteScopes string
SecurityReadScopes string
SecurityWriteScopes string
MonitorReadScopes string
MonitorWriteScopes string
MonitorOperateScopes string
SkillReadScopes string
SkillWriteScopes string
GatewayReadScopes string
GatewayOperateScopes string
ConfigMapReadScopes string
}
ContextTokenAuthorizationConfigOptions names the inputs used to build context-token authorization config.
type ContextTokenConfig ¶
type ContextTokenConfig struct {
Profiles []ContextTokenProfileConfig
}
ContextTokenConfig holds generic transaction/context token validation settings.
func NewContextTokenConfig ¶
func NewContextTokenConfig(profile, issuer, audience, jwksURL, headers string) (ContextTokenConfig, error)
NewContextTokenConfig builds context-token configuration for a named profile.
func (ContextTokenConfig) Enabled ¶
func (c ContextTokenConfig) Enabled() bool
Enabled reports whether context-token authentication is configured.
type ContextTokenExchangeRequest ¶
type ContextTokenExchangeRequest = contexttoken.ExchangeRequest
ContextTokenExchangeRequest describes a TTS exchange or replacement request.
type ContextTokenExchanger ¶
type ContextTokenExchanger = contexttoken.Exchanger
ContextTokenExchanger exchanges subject tokens for transaction tokens.
type ContextTokenProfileConfig ¶
type ContextTokenProfileConfig struct {
Name string
Issuer string
Audience string
JWKSURL string
Headers []TokenHeaderConfig
ExpectedType string
RequiredClaims []string
}
ContextTokenProfileConfig describes validation settings for a context-token profile.
type ContextTokenTTSClient ¶
type ContextTokenTTSClient = contexttoken.TTSClient
ContextTokenTTSClient is a strict transaction-token TTS client.
type ContextTokenTTSConfig ¶
type ContextTokenTTSConfig = contexttoken.TTSConfig
ContextTokenTTSConfig controls optional transaction-token TTS integration.
func NewContextTokenTTSConfig ¶
func NewContextTokenTTSConfig(endpoint, audience, timeout, tokenSource, childTTL, toolTTL string) (ContextTokenTTSConfig, error)
NewContextTokenTTSConfig builds TTS integration config from flag/env values.
type ControllerEpochFenceSource ¶ added in v0.2.0
type ControllerEpochFenceSource interface {
CurrentFence(context.Context) (store.ControllerEpochFence, error)
}
ControllerEpochFenceSource exposes the controller's current durable fence to internal broker authorization paths.
type ControllerEpochReader ¶ added in v0.2.0
type ControllerEpochStoreFenceSource ¶ added in v0.2.0
type ControllerEpochStoreFenceSource struct {
// contains filtered or unexported fields
}
ControllerEpochStoreFenceSource reads the current fence directly from the durable epoch store. Unlike ControllerEpochManager, it is safe for API handlers on non-leader replicas because it has no leader-readiness barrier.
func NewControllerEpochStoreFenceSource ¶ added in v0.2.0
func NewControllerEpochStoreFenceSource(epochs ControllerEpochReader) *ControllerEpochStoreFenceSource
func (*ControllerEpochStoreFenceSource) CurrentFence ¶ added in v0.2.0
func (s *ControllerEpochStoreFenceSource) CurrentFence(ctx context.Context) (store.ControllerEpochFence, error)
type ConversationMessage ¶
ConversationMessage represents a single message in a chat conversation.
type CreateAgentRequest ¶
type CreateAgentRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.AgentSpec `json:"spec"`
}
CreateAgentRequest is the request body for creating an agent
type CreateProviderRequest ¶
type CreateProviderRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.ProviderSpec `json:"spec"`
}
type CreateRepositoryMonitorCommandRequest ¶
type CreateRepositoryMonitorCommandRequest struct {
Kind string `json:"kind"`
Number int64 `json:"number"`
Intent string `json:"intent"`
TargetSHA string `json:"targetSHA,omitempty"`
}
CreateRepositoryMonitorCommandRequest records an explicit monitor command from the Orka API.
type CreateRepositoryMonitorRequest ¶
type CreateRepositoryMonitorRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.RepositoryMonitorSpec `json:"spec"`
}
type CreateRepositoryScanRequest ¶
type CreateRepositoryScanRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.RepositoryScanSpec `json:"spec"`
}
type CreateSkillRequest ¶
type CreateSkillRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.SkillSpec `json:"spec"`
}
CreateSkillRequest is the request body for creating a skill
type CreateSubstrateActorPoolRequest ¶
type CreateSubstrateActorPoolRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.SubstrateActorPoolSpec `json:"spec"`
}
type CreateTaskRequest ¶
type CreateTaskRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec *corev1alpha1.TaskSpec `json:"spec,omitempty"`
Annotations map[string]string `json:"annotations,omitempty"`
Type corev1alpha1.TaskType `json:"type"`
Image string `json:"image,omitempty"`
Command []string `json:"command,omitempty"`
Args []string `json:"args,omitempty"`
Env []corev1.EnvVar `json:"env,omitempty"`
Timeout string `json:"timeout,omitempty"`
Priority *int32 `json:"priority,omitempty"`
RetryPolicy *corev1alpha1.RetryPolicy `json:"retryPolicy,omitempty"`
WebhookURL string `json:"webhookURL,omitempty"`
SecretRef *corev1alpha1.SecretReference `json:"secretRef,omitempty"`
SessionRef *corev1alpha1.SessionReference `json:"sessionRef,omitempty"`
AI *corev1alpha1.AISpec `json:"ai,omitempty"`
AgentRef *corev1alpha1.AgentReference `json:"agentRef,omitempty"`
Prompt string `json:"prompt,omitempty"`
AgentRuntime *corev1alpha1.AgentRuntimeSpec `json:"agentRuntime,omitempty"`
Execution *corev1alpha1.ExecutionSpec `json:"execution,omitempty"`
Workspace *corev1alpha1.WorkspaceConfig `json:"workspace,omitempty"`
PriorTaskRef *corev1alpha1.PriorTaskReference `json:"priorTaskRef,omitempty"`
Schedule string `json:"schedule,omitempty"`
TimeZone *string `json:"timeZone,omitempty"`
ConcurrencyPolicy string `json:"concurrencyPolicy,omitempty"`
Suspend *bool `json:"suspend,omitempty"`
}
CreateTaskRequest is the request body for creating a task
type CreateToolRequest ¶
type CreateToolRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Metadata MetadataRequest `json:"metadata"`
Spec corev1alpha1.ToolSpec `json:"spec"`
}
type ExecutionEventResponse ¶
type ExecutionEventResponse struct {
ID string `json:"id"`
Namespace string `json:"namespace"`
StreamType string `json:"streamType"`
StreamID string `json:"streamID"`
Seq int64 `json:"seq"`
Type string `json:"type"`
Severity string `json:"severity"`
TaskName string `json:"taskName,omitempty"`
SessionName string `json:"sessionName,omitempty"`
AgentName string `json:"agentName,omitempty"`
ToolName string `json:"toolName,omitempty"`
ToolCallID string `json:"toolCallID,omitempty"`
Provider string `json:"provider,omitempty"`
Model string `json:"model,omitempty"`
StopReason string `json:"stopReason,omitempty"`
InputTokens int `json:"inputTokens,omitempty"`
OutputTokens int `json:"outputTokens,omitempty"`
CachedInputTokens int `json:"cachedInputTokens,omitempty"`
ContextWindowUsed *int `json:"contextWindowUsed,omitempty"`
ContextWindowSize *int `json:"contextWindowSize,omitempty"`
Summary string `json:"summary,omitempty"`
Content json.RawMessage `json:"content,omitempty"`
ContentText string `json:"contentText,omitempty"`
Truncation *events.ExecutionEventTruncation `json:"truncation,omitempty"`
CreatedAt time.Time `json:"createdAt"`
}
ExecutionEventResponse is the public API representation of an execution event.
func NewExecutionEventResponse ¶
func NewExecutionEventResponse(event store.ExecutionEvent) ExecutionEventResponse
NewExecutionEventResponse converts a store event to an API DTO and intentionally omits store-only fields such as ExecutionEvent.Internal.
type ForkTaskRequest ¶
type ForkTaskRequest struct {
AfterSeq *int64 `json:"afterSeq,omitempty"`
NewTaskName string `json:"newTaskName,omitempty"`
AgentRef *corev1alpha1.AgentReference `json:"agentRef,omitempty"`
Prompt string `json:"prompt,omitempty"`
Workspace *corev1alpha1.WorkspaceConfig `json:"workspace,omitempty"`
// ExecutionCheckpoint explicitly selects workspace data. AfterSeq selects
// transcript context independently and is not a filesystem checkpoint.
ExecutionCheckpoint *corev1alpha1.WorkspaceCheckpointReference `json:"executionCheckpoint,omitempty"`
}
type ForkTaskResponse ¶
type Handlers ¶
type Handlers struct {
// contains filtered or unexported fields
}
func NewHandlers ¶
func NewHandlers(cfg HandlersConfig) *Handlers
NewHandlers creates a new Handlers instance
func (*Handlers) ApplyMemoryProposal ¶
ApplyMemoryProposal applies an accepted memory proposal into durable memory.
func (*Handlers) ArchiveMemoryProposal ¶
ArchiveMemoryProposal archives a proposal without applying it.
func (*Handlers) CreateAgent ¶
CreateAgent creates a new agent
func (*Handlers) CreateAgentRuntime ¶ added in v0.2.0
func (*Handlers) CreateManualSecurityScan ¶
CreateManualSecurityScan creates and starts a manual scan task.
func (*Handlers) CreateMemory ¶
CreateMemory creates a namespace-scoped memory.
func (*Handlers) CreateMemoryProposal ¶
CreateMemoryProposal creates a governance proposal. It does not apply proposals automatically.
func (*Handlers) CreateProvider ¶
CreateProvider creates a provider.
func (*Handlers) CreateRepositoryMonitor ¶
CreateRepositoryMonitor creates a new durable repository monitor.
func (*Handlers) CreateRepositoryMonitorCommandEvent ¶
CreateRepositoryMonitorCommandEvent records an API-created monitor command and best-effort queues its run.
func (*Handlers) CreateRepositoryMonitorRun ¶
CreateRepositoryMonitorRun records a manual monitor run request.
func (*Handlers) CreateRepositoryScan ¶
CreateRepositoryScan creates a new repository scan configuration.
func (*Handlers) CreateSecurityPullRequest ¶
CreateSecurityPullRequest returns the pull request reconciled by the governed patch Task.
func (*Handlers) CreateSkill ¶
CreateSkill creates a new skill
func (*Handlers) CreateSubstrateActorPool ¶
CreateSubstrateActorPool creates an Orka Substrate actor pool.
func (*Handlers) CreateTask ¶
CreateTask creates a new task
func (*Handlers) CreateTool ¶
CreateTool creates a Tool CRD.
func (*Handlers) DecideTaskApproval ¶
DecideTaskApproval handles POST /api/v1/tasks/{id}/approvals/{approvalID}/decision.
func (*Handlers) DeleteAgent ¶
DeleteAgent deletes an agent
func (*Handlers) DeleteAgentRuntime ¶ added in v0.2.0
func (*Handlers) DeleteMemory ¶
DeleteMemory soft-deletes a memory.
func (*Handlers) DeleteProvider ¶
DeleteProvider deletes a provider.
func (*Handlers) DeleteRepositoryMonitor ¶
DeleteRepositoryMonitor deletes a repository monitor configuration.
func (*Handlers) DeleteRepositoryScan ¶
DeleteRepositoryScan deletes a repository scan configuration.
func (*Handlers) DeleteSession ¶
DeleteSession deletes a session
func (*Handlers) DeleteSkill ¶
DeleteSkill deletes a skill
func (*Handlers) DeleteSubstrateActorPool ¶
DeleteSubstrateActorPool deletes an Orka Substrate actor pool.
func (*Handlers) DeleteTask ¶
DeleteTask deletes a task
func (*Handlers) DeleteTool ¶
DeleteTool deletes a Tool CRD.
func (*Handlers) DisableMemory ¶
DisableMemory disables a memory for recall without deleting it.
func (*Handlers) DismissSecurityFinding ¶
DismissSecurityFinding marks a finding as dismissed.
func (*Handlers) DownloadTaskArtifact ¶
DownloadTaskArtifact downloads a specific artifact file
func (*Handlers) EnableMemory ¶
EnableMemory enables a previously disabled memory.
func (*Handlers) GenerateSecurityPatch ¶
GenerateSecurityPatch creates a patch proposal task for a finding.
func (*Handlers) GetAgentRuntime ¶ added in v0.2.0
func (*Handlers) GetGateway ¶
GetGateway gets one namespaced adapter instance.
func (*Handlers) GetGatewayBinding ¶
GetGatewayBinding gets one namespaced semantic binding.
func (*Handlers) GetGatewayClass ¶
GetGatewayClass gets one cluster-scoped adapter profile.
func (*Handlers) GetGatewayDelivery ¶
GetGatewayDelivery gets one durable outbox record.
func (*Handlers) GetGatewayEvent ¶
GetGatewayEvent gets one normalized ingress record.
func (*Handlers) GetMemoryProposal ¶
GetMemoryProposal gets a proposal by ID.
func (*Handlers) GetProvider ¶
GetProvider returns a configured LLM provider.
func (*Handlers) GetRepositoryMonitor ¶
GetRepositoryMonitor returns a repository monitor configuration.
func (*Handlers) GetRepositoryMonitorActionRecord ¶
GetRepositoryMonitorActionRecord fetches one durable action record.
func (*Handlers) GetRepositoryMonitorCommandEvent ¶
GetRepositoryMonitorCommandEvent fetches one durable command event.
func (*Handlers) GetRepositoryMonitorGitHubMutation ¶
GetRepositoryMonitorGitHubMutation fetches one mutation audit record.
func (*Handlers) GetRepositoryMonitorImplementationJob ¶
GetRepositoryMonitorImplementationJob fetches one implementation job.
func (*Handlers) GetRepositoryMonitorImplementationPatchPreview ¶
GetRepositoryMonitorImplementationPatchPreview returns safe patch artifact metadata for an implementation job.
func (*Handlers) GetRepositoryMonitorWorkAction ¶
GetRepositoryMonitorWorkAction fetches one durable workflow action.
func (*Handlers) GetRepositoryScan ¶
GetRepositoryScan returns a repository scan configuration.
func (*Handlers) GetRuntimePool ¶ added in v0.2.0
func (*Handlers) GetSecurityFinding ¶
GetSecurityFinding returns a finding by ID.
func (*Handlers) GetSecurityReviewSlice ¶
GetSecurityReviewSlice returns one deterministic review slice.
func (*Handlers) GetSession ¶
GetSession gets a session
func (*Handlers) GetSkillContent ¶
GetSkillContent gets the raw content of a skill
func (*Handlers) GetSubstrateActorPool ¶
GetSubstrateActorPool gets an Orka Substrate actor pool.
func (*Handlers) GetTaskChildren ¶
GetTaskChildren returns child tasks for a given parent task
func (*Handlers) GetTaskLogs ¶
GetTaskLogs gets logs for a task
func (*Handlers) GetTaskPlan ¶
GetTaskPlan gets the autonomous plan state for a task
func (*Handlers) GetTaskResult ¶
GetTaskResult gets the result of a task
func (*Handlers) GetTaskTrace ¶
GetTaskTrace handles GET /api/v1/tasks/{id}/trace.
func (*Handlers) GetThreatModel ¶
GetThreatModel returns the current threat model for a repository.
func (*Handlers) GetUsageOther ¶ added in v0.2.0
func (*Handlers) GetUsageReport ¶ added in v0.2.0
func (*Handlers) HandleGatewayEvent ¶
HandleGatewayEvent accepts one adapter-authenticated normalized event.
func (*Handlers) ListAgentRuntimes ¶ added in v0.2.0
func (*Handlers) ListAgents ¶
ListAgents lists available agents
func (*Handlers) ListGatewayBindings ¶
ListGatewayBindings lists namespaced semantic bindings.
func (*Handlers) ListGatewayClasses ¶
ListGatewayClasses lists cluster-scoped adapter profiles.
func (*Handlers) ListGatewayDeliveries ¶
ListGatewayDeliveries lists durable outbox records.
func (*Handlers) ListGatewayEvents ¶
ListGatewayEvents lists normalized durable ingress records.
func (*Handlers) ListGateways ¶
ListGateways lists namespaced adapter instances.
func (*Handlers) ListMemories ¶
ListMemories lists namespace-scoped memories.
func (*Handlers) ListMemoryProposals ¶
ListMemoryProposals lists memory governance proposals.
func (*Handlers) ListProviders ¶
ListProviders lists configured LLM providers.
func (*Handlers) ListRepositoryMonitorActionRecords ¶
ListRepositoryMonitorActionRecords lists durable monitor action records.
func (*Handlers) ListRepositoryMonitorCommandEvents ¶
ListRepositoryMonitorCommandEvents lists durable label/API command events.
func (*Handlers) ListRepositoryMonitorEvents ¶
ListRepositoryMonitorEvents lists audit events for a repository monitor.
func (*Handlers) ListRepositoryMonitorGitHubMutations ¶
ListRepositoryMonitorGitHubMutations lists controller-owned GitHub mutation audit records.
func (*Handlers) ListRepositoryMonitorImplementationJobs ¶
ListRepositoryMonitorImplementationJobs lists durable issue implementation jobs.
func (*Handlers) ListRepositoryMonitorItems ¶
ListRepositoryMonitorItems lists current items for a repository monitor.
func (*Handlers) ListRepositoryMonitorRuns ¶
ListRepositoryMonitorRuns lists durable runs for a repository monitor.
func (*Handlers) ListRepositoryMonitorWorkActions ¶
ListRepositoryMonitorWorkActions lists durable workflow queue actions.
func (*Handlers) ListRepositoryMonitors ¶
ListRepositoryMonitors lists configured repository monitors.
func (*Handlers) ListRepositoryScans ¶
ListRepositoryScans lists configured repository scans.
func (*Handlers) ListRuntimePools ¶ added in v0.2.0
func (*Handlers) ListSecretNames ¶
ListSecretNames lists secret names in a namespace (metadata only, no data)
func (*Handlers) ListSecurityDroppedFindings ¶
ListSecurityDroppedFindings lists diagnostics for v2 findings rejected during ingestion.
func (*Handlers) ListSecurityFindings ¶
ListSecurityFindings lists findings for a repository.
func (*Handlers) ListSecurityPatchProposals ¶
ListSecurityPatchProposals lists patch proposals for a finding.
func (*Handlers) ListSecurityReviewSlices ¶
ListSecurityReviewSlices lists deterministic review slices for a repository.
func (*Handlers) ListSecurityScanRuns ¶
ListSecurityScanRuns lists stored scan runs for a repository.
func (*Handlers) ListSessionEvents ¶
ListSessionEvents handles GET /api/v1/sessions/{id}/events.
func (*Handlers) ListSessions ¶
ListSessions lists sessions
func (*Handlers) ListSkills ¶
ListSkills lists available skills
func (*Handlers) ListSubstrateActorPools ¶
ListSubstrateActorPools lists Orka Substrate actor pools.
func (*Handlers) ListTaskApprovals ¶
ListTaskApprovals handles GET /api/v1/tasks/{id}/approvals.
func (*Handlers) ListTaskArtifacts ¶
ListTaskArtifacts lists artifacts for a task
func (*Handlers) ListTaskEvents ¶
ListTaskEvents handles GET /api/v1/tasks/{id}/events.
func (*Handlers) ReopenSecurityFinding ¶
ReopenSecurityFinding reopens a dismissed finding.
func (*Handlers) RetryGatewayDelivery ¶
RetryGatewayDelivery manually requeues one dead-lettered delivery.
func (*Handlers) ReviewMemoryProposal ¶
ReviewMemoryProposal records a review decision without applying the proposal automatically.
func (*Handlers) StreamSessionEvents ¶
StreamSessionEvents handles GET /api/v1/sessions/{id}/stream?after=N.
func (*Handlers) StreamTaskEvents ¶
StreamTaskEvents handles GET /api/v1/tasks/{id}/stream?after=N.
func (*Handlers) UpdateAgent ¶
UpdateAgent updates an existing agent
func (*Handlers) UpdateAgentRuntime ¶ added in v0.2.0
func (*Handlers) UpdateMemory ¶
UpdateMemory updates mutable fields on a memory.
func (*Handlers) UpdateProvider ¶
UpdateProvider updates a provider spec.
func (*Handlers) UpdateRepositoryMonitor ¶
UpdateRepositoryMonitor updates an existing repository monitor.
func (*Handlers) UpdateRepositoryScan ¶
UpdateRepositoryScan updates an existing repository scan.
func (*Handlers) UpdateSkill ¶
UpdateSkill updates an existing skill
func (*Handlers) UpdateSubstrateActorPool ¶
UpdateSubstrateActorPool updates an Orka Substrate actor pool.
func (*Handlers) UpdateThreatModel ¶
UpdateThreatModel replaces the current threat model.
func (*Handlers) UpdateTool ¶
UpdateTool updates a Tool CRD.
type HandlersConfig ¶
type HandlersConfig struct {
Client client.Client
APIReader client.Reader
WatchNamespace string
ExecutionMode executionmode.Mode
EnforceNamespaceIsolation bool
ContextTokenAuthorization ContextTokenAuthorizationConfig
ResultStore store.ResultStore
SessionStore store.SessionStore
SessionManager *controller.SessionManager
PlanStore store.PlanStore
KubeClient kubernetes.Interface
HealthChecker store.HealthChecker
ArtifactStore store.ArtifactStore
MemoryStore store.MemoryStore
MemoryProposalStore store.MemoryProposalStore
SecurityStore store.SecurityStore
RepositoryMonitorStore store.RepositoryMonitorStore
ExecutionEventStore store.ExecutionEventStore
GatewayEventStore store.GatewayEventStore
GatewayDeliveryStore store.GatewayDeliveryStore
GatewayService *gatewayruntime.Service
}
HandlersConfig holds configuration for creating Handlers.
type ImageSource ¶
type ImageSource struct {
Type string `json:"type"`
MediaType string `json:"media_type"`
Data string `json:"data"`
}
ImageSource represents a base64-encoded image source in an Anthropic content block.
type InternalHandlers ¶
type InternalHandlers struct {
// contains filtered or unexported fields
}
InternalHandlers contains handlers for internal worker endpoints.
func NewInternalHandlers ¶
func NewInternalHandlers(rs store.ResultStore, ss store.SessionStore, ps store.PlanStore, ms store.MessageStore, as store.ArtifactStore, configs ...InternalHandlersConfig) *InternalHandlers
NewInternalHandlers creates a new InternalHandlers instance.
func (*InternalHandlers) ApplyMemoryProposal ¶
func (h *InternalHandlers) ApplyMemoryProposal(c fiber.Ctx) error
ApplyMemoryProposal applies an accepted memory proposal into durable memory in the namespace in the internal route.
func (*InternalHandlers) ArchiveMemoryProposal ¶
func (h *InternalHandlers) ArchiveMemoryProposal(c fiber.Ctx) error
ArchiveMemoryProposal archives a proposal in the namespace in the internal route without applying it.
func (*InternalHandlers) CreateMemory ¶
func (h *InternalHandlers) CreateMemory(c fiber.Ctx) error
CreateMemory creates a memory in the namespace in the internal route.
func (*InternalHandlers) CreateMemoryProposal ¶
func (h *InternalHandlers) CreateMemoryProposal(c fiber.Ctx) error
CreateMemoryProposal creates a memory governance proposal in the namespace in the internal route.
func (*InternalHandlers) DeleteMemory ¶
func (h *InternalHandlers) DeleteMemory(c fiber.Ctx) error
DeleteMemory soft-deletes a memory in the namespace in the internal route.
func (*InternalHandlers) DisableMemory ¶
func (h *InternalHandlers) DisableMemory(c fiber.Ctx) error
DisableMemory disables a memory for recall in the namespace in the internal route.
func (*InternalHandlers) EnableMemory ¶
func (h *InternalHandlers) EnableMemory(c fiber.Ctx) error
EnableMemory enables a memory for recall in the namespace in the internal route.
func (*InternalHandlers) GetMemory ¶
func (h *InternalHandlers) GetMemory(c fiber.Ctx) error
GetMemory gets a memory by ID from the namespace in the internal route.
func (*InternalHandlers) GetMemoryProposal ¶
func (h *InternalHandlers) GetMemoryProposal(c fiber.Ctx) error
GetMemoryProposal gets a memory proposal by ID from the namespace in the internal route.
func (*InternalHandlers) GetMessages ¶
func (h *InternalHandlers) GetMessages(c fiber.Ctx) error
GetMessages handles GET /internal/v1/messages/{namespace}/{taskName}. Workers call this to check for messages from sibling tasks.
func (*InternalHandlers) GetPlan ¶
func (h *InternalHandlers) GetPlan(c fiber.Ctx) error
GetPlan handles GET /internal/v1/plans/{namespace}/{taskName}. Workers call this to load the current plan state at startup.
func (*InternalHandlers) GetSessionTranscript ¶
func (h *InternalHandlers) GetSessionTranscript(c fiber.Ctx) error
GetSessionTranscript handles GET /internal/v1/sessions/{namespace}/{name}/transcript. Returns the session transcript as JSONL (one JSON object per line).
func (*InternalHandlers) ListMemories ¶
func (h *InternalHandlers) ListMemories(c fiber.Ctx) error
ListMemories lists memories for the namespace in the internal route.
func (*InternalHandlers) ListMemoryProposals ¶
func (h *InternalHandlers) ListMemoryProposals(c fiber.Ctx) error
ListMemoryProposals lists memory proposals for the namespace in the internal route.
func (*InternalHandlers) ReviewMemoryProposal ¶
func (h *InternalHandlers) ReviewMemoryProposal(c fiber.Ctx) error
ReviewMemoryProposal records a review decision without applying the proposal automatically.
func (*InternalHandlers) SearchTranscript ¶
func (h *InternalHandlers) SearchTranscript(c fiber.Ctx) error
SearchTranscript handles GET /internal/v1/sessions/{namespace}/search. It searches namespace-scoped session transcripts and returns compact snippets.
func (*InternalHandlers) SendMessage ¶
func (h *InternalHandlers) SendMessage(c fiber.Ctx) error
SendMessage handles POST /internal/v1/messages/{namespace}. Workers call this to send messages to sibling tasks.
func (*InternalHandlers) SubmitExecutionEvent ¶
func (h *InternalHandlers) SubmitExecutionEvent(c fiber.Ctx) error
SubmitExecutionEvent handles POST /internal/v1/events/{namespace}/{streamType}/{streamID}. Workers call this to append sanitized execution timeline events.
func (*InternalHandlers) SubmitPlan ¶
func (h *InternalHandlers) SubmitPlan(c fiber.Ctx) error
SubmitPlan handles POST /internal/v1/plans/{namespace}/{taskName}. Workers call this to persist autonomous plan state.
func (*InternalHandlers) SubmitResult ¶
func (h *InternalHandlers) SubmitResult(c fiber.Ctx) error
SubmitResult handles POST /internal/v1/results/{namespace}/{taskName}. Workers call this to persist task results.
func (*InternalHandlers) UpdateExecutionWorkspaceStatus ¶
func (h *InternalHandlers) UpdateExecutionWorkspaceStatus(c fiber.Ctx) error
UpdateExecutionWorkspaceStatus handles POST /internal/v1/tasks/{namespace}/{taskName}/execution-workspace/status.
func (*InternalHandlers) UpdateMemory ¶
func (h *InternalHandlers) UpdateMemory(c fiber.Ctx) error
UpdateMemory updates a memory in the namespace in the internal route.
func (*InternalHandlers) UploadArtifact ¶
func (h *InternalHandlers) UploadArtifact(c fiber.Ctx) error
UploadArtifact handles POST /internal/v1/artifacts/{namespace}/{taskName}/{filename}. Workers call this to upload artifact files.
type InternalHandlersConfig ¶
type InternalHandlersConfig struct {
Client client.Client
APIReader client.Reader
MemoryStore store.MemoryStore
MemoryProposalStore store.MemoryProposalStore
ExecutionEventStore store.ExecutionEventStore
GatewayEventStore store.GatewayEventStore
// TaskProvenanceProtected permits cross-task coordination only when the
// Task provenance admission webhook protects coordination ancestry.
TaskProvenanceProtected bool
}
InternalHandlersConfig holds optional configuration for internal handlers.
type ListExecutionEventsResponse ¶
type ListExecutionEventsResponse struct {
Namespace string `json:"namespace"`
StreamType string `json:"streamType"`
StreamID string `json:"streamID"`
AfterSeq int64 `json:"afterSeq"`
LatestSeq int64 `json:"latestSeq"`
Events []ExecutionEventResponse `json:"events"`
}
ListExecutionEventsResponse is the API response for listing one event stream.
func NewListExecutionEventsResponse ¶
func NewListExecutionEventsResponse(namespace, streamType, streamID string, afterSeq, latestSeq int64, storeEvents []store.ExecutionEvent) ListExecutionEventsResponse
NewListExecutionEventsResponse builds a list DTO from store events.
type ListMeta ¶
type ListMeta struct {
Continue string `json:"continue,omitempty"`
RemainingItemCount *int64 `json:"remainingItemCount,omitempty"`
}
ListMeta contains pagination metadata
type ListResponse ¶
ListResponse is a generic list response with pagination
type ListSessionExecutionEventsResponse ¶
type ListSessionExecutionEventsResponse struct {
Namespace string `json:"namespace"`
StreamType string `json:"streamType"`
StreamID string `json:"streamID"`
AfterSeq int64 `json:"afterSeq"`
LatestSeq int64 `json:"latestSeq"`
Events []SessionExecutionEventResponse `json:"events"`
}
ListSessionExecutionEventsResponse is the API response for an aggregated session stream.
func NewListSessionExecutionEventsResponse ¶
func NewListSessionExecutionEventsResponse(namespace, sessionName string, afterSeq, latestSeq int64, storeEvents []store.SessionExecutionEvent) ListSessionExecutionEventsResponse
NewListSessionExecutionEventsResponse builds a session timeline DTO.
type MetadataRequest ¶
type MetadataRequest struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Labels map[string]string `json:"labels,omitempty"`
Annotations map[string]string `json:"annotations,omitempty"`
}
MetadataRequest holds Kubernetes-style metadata fields
type OAIChoice ¶
type OAIChoice struct {
Index int `json:"index"`
Message *OAIMessage `json:"message,omitempty"`
Delta *OAIMessage `json:"delta,omitempty"`
FinishReason *string `json:"finish_reason"`
}
OAIChoice is a choice in the response.
type OAIError ¶
type OAIError struct {
Error OAIErrorDetail `json:"error"`
}
OAIError is the OpenAI error response format.
type OAIErrorDetail ¶
type OAIErrorDetail struct {
Message string `json:"message"`
Type string `json:"type"`
Param *string `json:"param"`
Code *string `json:"code"`
}
OAIErrorDetail is the error detail.
type OAIFunctionCall ¶
OAIFunctionCall is a function call within a tool call.
type OAIFunctionDef ¶
type OAIFunctionDef struct {
Name string `json:"name"`
Description string `json:"description,omitempty"`
Parameters json.RawMessage `json:"parameters,omitempty"`
}
OAIFunctionDef is an OpenAI function definition.
type OAIJSONSchemaSpec ¶
type OAIJSONSchemaSpec struct {
Name string `json:"name"`
Schema map[string]any `json:"schema,omitempty"`
Strict *bool `json:"strict,omitempty"`
Description string `json:"description,omitempty"`
}
OAIJSONSchemaSpec holds the json_schema details within response_format.
type OAIMessage ¶
type OAIMessage struct {
Role string `json:"role,omitempty"`
Content any `json:"content"` // string or []ContentPart
Name string `json:"name,omitempty"`
ToolCalls []OAIToolCall `json:"tool_calls,omitempty"`
ToolCallID string `json:"tool_call_id,omitempty"`
Refusal *string `json:"refusal,omitempty"`
}
OAIMessage represents an OpenAI chat message.
type OAIModel ¶
type OAIModel struct {
ID string `json:"id"`
Object string `json:"object"`
Created int64 `json:"created"`
OwnedBy string `json:"owned_by"`
}
OAIModel is the model object for /openai/v1/models.
type OAIModelList ¶
OAIModelList is the response for GET /openai/v1/models.
type OAIRequest ¶
type OAIRequest struct {
Model string `json:"model"`
Messages []OAIMessage `json:"messages"`
Tools []OAITool `json:"tools,omitempty"`
Temperature *float64 `json:"temperature,omitempty"`
MaxTokens *int `json:"max_tokens,omitempty"`
MaxCompTokens *int `json:"max_completion_tokens,omitempty"`
Stream bool `json:"stream,omitempty"`
StreamOptions *StreamOptions `json:"stream_options,omitempty"`
Stop any `json:"stop,omitempty"`
TopP *float64 `json:"top_p,omitempty"`
FrequencyPenalty *float64 `json:"frequency_penalty,omitempty"`
PresencePenalty *float64 `json:"presence_penalty,omitempty"`
N *int `json:"n,omitempty"`
User string `json:"user,omitempty"`
ResponseFormat *OAIResponseFormat `json:"response_format,omitempty"`
}
OAIRequest is the OpenAI chat completion request format.
type OAIResponse ¶
type OAIResponse struct {
ID string `json:"id"`
Object string `json:"object"`
Created int64 `json:"created"`
Model string `json:"model"`
Choices []OAIChoice `json:"choices"`
Usage *OAIUsage `json:"usage,omitempty"`
SystemFingerprint string `json:"system_fingerprint,omitempty"`
}
OAIResponse is the OpenAI chat completion response.
type OAIResponseFormat ¶
type OAIResponseFormat struct {
Type string `json:"type"` // "text", "json_object", "json_schema"
JSONSchema *OAIJSONSchemaSpec `json:"json_schema,omitempty"`
}
OAIResponseFormat is the OpenAI response_format field.
type OAITool ¶
type OAITool struct {
Type string `json:"type"` // "function"
Function OAIFunctionDef `json:"function"`
}
OAITool is an OpenAI tool definition.
type OAIToolCall ¶
type OAIToolCall struct {
Index *int `json:"index,omitempty"`
ID string `json:"id,omitempty"`
Type string `json:"type,omitempty"` // "function"
Function OAIFunctionCall `json:"function"`
}
OAIToolCall is an OpenAI tool call.
type OAIUsage ¶
type OAIUsage struct {
PromptTokens int `json:"prompt_tokens"`
CompletionTokens int `json:"completion_tokens"`
TotalTokens int `json:"total_tokens"`
}
OAIUsage contains token usage statistics.
type OIDCConfig ¶
type OIDCConfig struct {
Issuer string
Audience string
JWKSURL string
AllowedSubjects []string
Namespace string
}
OIDCConfig holds OpenID Connect JWT validation settings.
func (OIDCConfig) Enabled ¶
func (c OIDCConfig) Enabled() bool
Enabled reports whether OIDC authentication is configured.
type OpenAICompatHandler ¶
type OpenAICompatHandler struct {
// contains filtered or unexported fields
}
OpenAICompatHandler implements OpenAI-compatible /openai/v1/chat/completions and /openai/v1/models endpoints. This allows OpenAI-compatible clients to use Orka as a custom provider.
func NewOpenAICompatHandler ¶
func NewOpenAICompatHandler(c client.Client, apiReader client.Reader, watchNamespace string, enforceNS bool, config ChatConfig, resolver *ProviderResolver, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *OpenAICompatHandler
NewOpenAICompatHandler creates an OpenAI-compatible API handler.
func (*OpenAICompatHandler) HandleChatCompletions ¶
func (h *OpenAICompatHandler) HandleChatCompletions(c fiber.Ctx) error
HandleChatCompletions handles POST /openai/v1/chat/completions.
func (*OpenAICompatHandler) HandleListModels ¶
func (h *OpenAICompatHandler) HandleListModels(c fiber.Ctx) error
HandleListModels handles GET /openai/v1/models.
type Pagination ¶
Pagination holds pagination parameters
func ParsePagination ¶
func ParsePagination(limitStr, continueToken string) (*Pagination, error)
ParsePagination parses pagination parameters from query strings
type ProviderResolutionInfo ¶
ProviderResolutionInfo contains the Provider CRD metadata selected for a request.
type ProviderResolver ¶
type ProviderResolver struct {
// contains filtered or unexported fields
}
ProviderResolver resolves LLM providers from Kubernetes CRDs and secrets. It consolidates provider lookup, API key resolution, and provider construction logic shared by the chat, OpenAI-compat, and Anthropic-compat handlers.
func NewProviderResolver ¶
func NewProviderResolver(c client.Client, config ChatConfig) *ProviderResolver
NewProviderResolver creates a new ProviderResolver.
func (*ProviderResolver) LookupProvider ¶
func (r *ProviderResolver) LookupProvider(ctx context.Context, name, namespace string) (*corev1alpha1.Provider, error)
LookupProvider fetches a Provider CRD by name and namespace.
func (*ProviderResolver) Resolve ¶
func (r *ProviderResolver) Resolve(ctx context.Context, opts ResolveOpts) (llm.Provider, string, error)
Resolve finds the appropriate LLM provider and model for a request. It handles provider/model string parsing, Kubernetes secret resolution, and provider construction.
When AgentRef or ProviderName is set, provider lookups are fatal (errors are returned). Otherwise, intermediate lookups are non-fatal and fall through to defaults.
func (*ProviderResolver) ResolveAPIKey ¶
func (r *ProviderResolver) ResolveAPIKey(ctx context.Context, providerCRD *corev1alpha1.Provider) (string, error)
ResolveAPIKey extracts the API key from a Provider CRD's secret reference.
func (*ProviderResolver) ResolveWithInfo ¶
func (r *ProviderResolver) ResolveWithInfo(ctx context.Context, opts ResolveOpts) (llm.Provider, string, ProviderResolutionInfo, error)
ResolveWithInfo finds the appropriate LLM provider and model for a request, and also returns the selected Provider CRD metadata.
type ResolveOpts ¶
type ResolveOpts struct {
ProviderName string // explicit provider name (chat handler)
ModelStr string // "provider/model" format or plain model (compat handlers)
Model string // explicit model override (chat handler)
AgentRef string // agent reference for agent-based resolution (chat handler)
Namespace string
RequireModel bool // return error if model is empty after resolution
// RequireExplicitProvider disables every implicit Provider selection,
// including configured, default-named, and sole-ready Providers. Handlers
// set it for context-token requests so every request without an explicit
// Provider or Agent-bound Provider has the same outcome.
RequireExplicitProvider bool
// AuthorizeProviderReference runs on an explicitly named Provider before
// its credential is read or any implicit selection happens. It receives
// the loaded Provider's metadata (name, namespace, type) so type-based
// grants apply; when the Provider does not exist it receives the name
// only, and its rejection is returned in place of the not-found error so
// missing and unauthorized names stay indistinguishable to scoped
// callers.
AuthorizeProviderReference func(ProviderResolutionInfo) error
// AuthorizeProviderUse runs after the effective model is known but before
// the Provider credential is read.
AuthorizeProviderUse func(ProviderResolutionInfo, string) error
}
ResolveOpts configures how a provider is resolved.
type SSEEvent ¶
type SSEEvent struct {
SessionID string `json:"sessionId"`
Content string `json:"content,omitempty"`
ToolCall any `json:"toolCall,omitempty"`
Error any `json:"error,omitempty"`
Usage any `json:"usage,omitempty"`
}
SSEEvent is the payload for server-sent events during streaming.
type SecretNameResponse ¶
type SecretNameResponse struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Type string `json:"type"`
}
SecretNameResponse is a minimal representation of a Secret for dropdown lists
type Server ¶
type Server struct {
ResultStore store.ResultStore
SessionStore store.SessionStore
PlanStore store.PlanStore
MessageStore store.MessageStore
ArtifactStore store.ArtifactStore
MemoryStore store.MemoryStore
MemoryProposalStore store.MemoryProposalStore
ExecutionEventStore store.ExecutionEventStore
GatewayEventStore store.GatewayEventStore
// contains filtered or unexported fields
}
Server is the REST API server
func NewServer ¶
func NewServer(c client.Client, sessionManager *controller.SessionManager, config ServerConfig) *Server
NewServer creates a new API server
func (*Server) RegisterACPMCPBroker ¶ added in v0.2.0
func (s *Server) RegisterACPMCPBroker(broker *controller.ACPMCPBroker) error
RegisterACPMCPBroker installs the prompt-scoped broker on this API server.
type ServerConfig ¶
type ServerConfig struct {
Port int
WatchNamespace string
ExecutionMode executionmode.Mode
EnforceNamespaceIsolation bool
OIDC OIDCConfig
ContextTokens ContextTokenConfig
ContextTokenAuthorization ContextTokenAuthorizationConfig
Chat ChatConfig
ResultStore store.ResultStore
SessionStore store.SessionStore
PlanStore store.PlanStore
MessageStore store.MessageStore
ArtifactStore store.ArtifactStore
ArtifactReservations artifactcap.CapabilityReservationRecorder
AgentExecutionSnapshots store.AgentExecutionSnapshotStore
ExternalEffects store.ExternalEffectIdentityReader
MemoryStore store.MemoryStore
MemoryProposalStore store.MemoryProposalStore
SecurityStore store.SecurityStore
RepositoryMonitorStore store.RepositoryMonitorStore
ExecutionEventStore store.ExecutionEventStore
GatewayEventStore store.GatewayEventStore
GatewayDeliveryStore store.GatewayDeliveryStore
GatewayService *gatewayruntime.Service
HealthChecker store.HealthChecker
Clientset kubernetes.Interface
APIReader client.Reader
TaskProvenanceProtected bool
ControllerEpochs ControllerEpochFenceSource
E2EPromptFaultEnabled bool
}
ServerConfig holds configuration for the API server
type SessionExecutionEventResponse ¶
type SessionExecutionEventResponse struct {
ExecutionEventResponse
TaskSeq int64 `json:"taskSeq"`
TaskStreamID string `json:"taskStreamID"`
}
SessionExecutionEventResponse is the public representation of a task-derived session event. Seq is the session-level cursor; taskSeq is the source task stream sequence.
func NewSessionExecutionEventResponse ¶
func NewSessionExecutionEventResponse(event store.SessionExecutionEvent) SessionExecutionEventResponse
NewSessionExecutionEventResponse converts an aggregated store event to a session DTO.
type StreamOptions ¶
type StreamOptions struct {
IncludeUsage bool `json:"include_usage,omitempty"`
}
StreamOptions holds stream-specific options.
type SubmitExecutionEventRequest ¶
type SubmitExecutionEventRequest struct {
Type string `json:"type"`
Severity string `json:"severity,omitempty"`
TaskName string `json:"taskName,omitempty"`
SessionName string `json:"sessionName,omitempty"`
AgentName string `json:"agentName,omitempty"`
ToolName string `json:"toolName,omitempty"`
ToolCallID string `json:"toolCallID,omitempty"`
Summary string `json:"summary,omitempty"`
Content json.RawMessage `json:"content,omitempty"`
ContentText string `json:"contentText,omitempty"`
Truncation *events.ExecutionEventTruncation `json:"truncation,omitempty"`
}
SubmitExecutionEventRequest is the internal worker submission DTO. Unknown JSON fields are ignored by Go's standard decoder; route handlers can opt into strict decoding later by using json.Decoder.DisallowUnknownFields.
func (SubmitExecutionEventRequest) ToStoreEvent ¶
func (r SubmitExecutionEventRequest) ToStoreEvent(namespace, streamType, streamID string) (*store.ExecutionEvent, error)
ToStoreEvent converts a submission DTO to the store-facing event contract.
type SubmitExecutionEventResponse ¶
type SubmitExecutionEventResponse struct {
ID string `json:"id"`
Seq int64 `json:"seq"`
CreatedAt time.Time `json:"createdAt"`
}
SubmitExecutionEventResponse is returned after an event append succeeds.
type SystemPromptBuilder ¶
type SystemPromptBuilder struct {
// contains filtered or unexported fields
}
SystemPromptBuilder constructs the orchestrator system prompt with dynamic context from the cluster (agents, tools).
func NewSystemPromptBuilder ¶
func NewSystemPromptBuilder(c client.Client, namespace string, availability ACPRuntimeAvailability) *SystemPromptBuilder
NewSystemPromptBuilder creates a new SystemPromptBuilder.
func (*SystemPromptBuilder) BuildSystemPrompt ¶
func (b *SystemPromptBuilder) BuildSystemPrompt(ctx context.Context, userSystemPrompt string) (string, error)
BuildSystemPrompt assembles the full system prompt with dynamic context.
type TokenHeaderConfig ¶
TokenHeaderConfig describes one HTTP header location from which a token can be extracted.
type ToolCallInfo ¶
type ToolCallInfo struct {
Name string `json:"name"`
Args json.RawMessage `json:"args"`
Result json.RawMessage `json:"result"`
}
ToolCallInfo describes a tool invocation and its result.
type ToolExecutor ¶
type ToolExecutor struct {
// contains filtered or unexported fields
}
ToolExecutor executes orchestrator LLM tool calls by creating and managing Kubernetes resources (Tasks, Agents, Tools, Sessions).
func NewToolExecutor ¶
func NewToolExecutor(c client.Client, sm *controller.SessionManager, namespace, sessionID, watchNamespace string, enforceNS bool, maxTasks int, toolTimeout time.Duration, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *ToolExecutor
NewToolExecutor creates a new ToolExecutor.
func (*ToolExecutor) Execute ¶
Execute dispatches a tool call to the appropriate handler and returns the JSON-serialized result.
func (*ToolExecutor) SetAgentCreateAuthorizer ¶
func (e *ToolExecutor) SetAgentCreateAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)
SetAgentCreateAuthorizer installs an authorization hook for tools that create Agents.
func (*ToolExecutor) SetAgentDeleteAuthorizer ¶
func (e *ToolExecutor) SetAgentDeleteAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)
SetAgentDeleteAuthorizer installs an authorization hook for tools that delete Agents.
func (*ToolExecutor) SetAgentUpdateAuthorizer ¶
func (e *ToolExecutor) SetAgentUpdateAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)
SetAgentUpdateAuthorizer installs an authorization hook for tools that update Agents.
func (*ToolExecutor) SetAllowedTools ¶
func (e *ToolExecutor) SetAllowedTools(allowedTools []llm.Tool)
SetAllowedTools restricts execution to the tools exposed and authorized for the current request. When SetAllowedTools is not called, execution is unrestricted; an empty allowlist intentionally denies all tool calls.
func (*ToolExecutor) SetExecutionMode ¶ added in v0.2.0
func (e *ToolExecutor) SetExecutionMode(mode executionmode.Mode)
SetExecutionMode supplies the immutable installation mode used by trusted Agent-producing chat tools.
func (*ToolExecutor) SetPolicyReader ¶ added in v0.2.0
func (e *ToolExecutor) SetPolicyReader(reader client.Reader)
SetPolicyReader supplies the authoritative reader used by coordination tools.
func (*ToolExecutor) SetSecretReadAuthorizer ¶
func (e *ToolExecutor) SetSecretReadAuthorizer(authorize func(context.Context, string, string) error)
SetSecretReadAuthorizer installs an authorization hook for tools that read Secrets.
func (*ToolExecutor) SetTaskCreateAuthorizer ¶
func (e *ToolExecutor) SetTaskCreateAuthorizer(authorize func(context.Context, *corev1alpha1.Task) error)
SetTaskCreateAuthorizer installs an authorization hook for tools that create Tasks.
func (*ToolExecutor) SetTaskDeleteAuthorizer ¶
func (e *ToolExecutor) SetTaskDeleteAuthorizer(authorize func(context.Context, *corev1alpha1.Task) error)
SetTaskDeleteAuthorizer installs an authorization hook for tools that delete Tasks.
type ToolResult ¶
type ToolResult struct {
Success bool `json:"success"`
Data any `json:"data,omitempty"`
Error string `json:"error,omitempty"`
ErrorType string `json:"errorType,omitempty"`
Suggestion string `json:"suggestion,omitempty"`
}
ToolResult represents the result of a tool execution.
type UpdateAgentRequest ¶
type UpdateAgentRequest struct {
Spec corev1alpha1.AgentSpec `json:"spec"`
}
UpdateAgentRequest is the request body for updating an agent
type UpdateProviderRequest ¶
type UpdateProviderRequest struct {
Spec corev1alpha1.ProviderSpec `json:"spec"`
}
type UpdateRepositoryMonitorRequest ¶
type UpdateRepositoryMonitorRequest struct {
Spec corev1alpha1.RepositoryMonitorSpec `json:"spec"`
}
type UpdateRepositoryScanRequest ¶
type UpdateRepositoryScanRequest struct {
Spec corev1alpha1.RepositoryScanSpec `json:"spec"`
}
type UpdateSkillRequest ¶
type UpdateSkillRequest struct {
Spec corev1alpha1.SkillSpec `json:"spec"`
}
UpdateSkillRequest is the request body for updating a skill
type UpdateSubstrateActorPoolRequest ¶
type UpdateSubstrateActorPoolRequest struct {
Spec corev1alpha1.SubstrateActorPoolSpec `json:"spec"`
}
type UpdateToolRequest ¶
type UpdateToolRequest struct {
Spec corev1alpha1.ToolSpec `json:"spec"`
}
type UserInfo ¶
type UserInfo struct {
Username string
UID string
Groups []string
Extra map[string]authenticationv1.ExtraValue
Namespace string // Extracted from ServiceAccount username (system:serviceaccount:<ns>:<name>)
AuthType string
Subject string
Email string
Issuer string
Roles []string
ContextToken *ContextToken
}
UserInfo contains information about the authenticated user.
func GetUserInfo ¶
GetUserInfo retrieves user info from the context
Source Files
¶
- acp_artifact_authorization.go
- acp_artifact_handlers.go
- acp_credential_broker.go
- acp_e2e_fault.go
- acp_mcp_broker_registration.go
- anthropic_compat.go
- anthropic_streaming.go
- anthropic_tool_loop.go
- approval_handlers.go
- auth.go
- auth_http.go
- auth_token.go
- brokered_task_data.go
- chat.go
- chat_system_prompt.go
- chat_tool_authorization.go
- chat_tool_executor.go
- compat_coordinator.go
- compat_router.go
- compat_router_cors.go
- compat_tool_context.go
- context_token.go
- context_token_authorization.go
- context_token_configmap_scope.go
- context_token_tts.go
- execution_event_dto.go
- execution_event_handlers.go
- external_authorization.go
- external_tool_authorization.go
- fork_handlers.go
- gateway_context_scopes.go
- gateway_handlers.go
- gateway_ingress_limiter.go
- github_label_webhook.go
- github_monitor_commands.go
- handlers.go
- internal_caller_authorization.go
- internal_execution_event_handlers.go
- internal_handlers.go
- internal_harness_artifact_authorization.go
- internal_harness_workload_authorization.go
- internal_memory_handlers.go
- internal_task_mutation.go
- jwt.go
- kubernetes_task_authorization.go
- memory_handlers.go
- middleware.go
- monitor_handlers.go
- namespace.go
- oidc.go
- openai_compat.go
- pagination.go
- provider_resolver.go
- resource_handlers.go
- runtime_resource_handlers.go
- security_handlers.go
- server.go
- session_transcript.go
- static.go
- task_access.go
- task_message_store.go
- task_timeline_reader.go
- task_trace_handlers.go
- task_transcript_search.go
- task_workspace.go
- trace_context.go
- transaction_metadata.go
- usage_handlers.go
- usage_recording.go
- workspace_class_authorization.go