api

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 21, 2026 License: MIT Imports: 104 Imported by: 0

Documentation

Index

Constants

View Source
const (
	// AuthHeader is the header name for authorization
	AuthHeader = "Authorization"

	// XAPIKeyHeader is the header name for the Anthropic-style API key
	XAPIKeyHeader = "x-api-key"

	// BearerPrefix is the prefix for bearer tokens
	BearerPrefix = "Bearer "

	// UserInfoContextKey is the context key for storing user info
	UserInfoContextKey = "userInfo"

	// AuthTypeTokenReview identifies Kubernetes TokenReview authentication.
	AuthTypeTokenReview = "tokenReview"

	// AuthTypeOIDC identifies OIDC JWT authentication.
	AuthTypeOIDC = "oidc"
)
View Source
const (
	// AuthTypeContextToken identifies generic transaction/context token authentication.
	AuthTypeContextToken = "contextToken"

	// ContextTokenProfileTransactionToken identifies Orka's strict transaction-token profile.
	ContextTokenProfileTransactionToken = transactiontoken.ProfileName

	// TransactionTokenHeaderName is the default HTTP transaction-token header.
	TransactionTokenHeaderName = transactiontoken.HeaderName

	// TransactionTokenJWTType is the JWT typ header required by the profile.
	TransactionTokenJWTType = transactiontoken.JWTType
)
View Source
const (

	// ContextTokenAuthorizationModeOff disables context-token authorization checks.
	ContextTokenAuthorizationModeOff = "off"
	// ContextTokenAuthorizationModeAudit logs context-token authorization failures but allows the request.
	ContextTokenAuthorizationModeAudit = "audit"
	// ContextTokenAuthorizationModeEnforce rejects requests that fail context-token authorization.
	ContextTokenAuthorizationModeEnforce = "enforce"

	// ContextTokenScopeTaskCreate authorizes context-token callers to create Orka Tasks.
	ContextTokenScopeTaskCreate = "orka:tasks:create"
	// ContextTokenScopeTaskGet authorizes context-token callers to read a Task and its related data.
	ContextTokenScopeTaskGet = "orka:tasks:get"
	// ContextTokenScopeTaskList authorizes context-token callers to list Tasks.
	ContextTokenScopeTaskList = "orka:tasks:list"
	// ContextTokenScopeTaskDelete authorizes context-token callers to delete Tasks.
	ContextTokenScopeTaskDelete = "orka:tasks:delete"
	// ContextTokenScopeToolsRead authorizes context-token callers to read Tool definitions.
	ContextTokenScopeToolsRead = "orka:tools:read"
	// ContextTokenScopeToolsUse authorizes context-token callers to execute Orka-managed tools.
	ContextTokenScopeToolsUse = "orka:tools:use"
	// ContextTokenScopeProvidersUse authorizes context-token callers to use configured model providers.
	ContextTokenScopeProvidersUse = "orka:providers:use"
	// ContextTokenScopeSecretsRead authorizes context-token callers to read Secret metadata.
	ContextTokenScopeSecretsRead = "orka:secrets:read"
	// ContextTokenScopeSecretsCredentialsRead authorizes use of cluster-managed outbound credential material, including Secret data and ServiceAccount tokens.
	ContextTokenScopeSecretsCredentialsRead = "orka:secrets:credentials:read"
	// ContextTokenScopeAgentsRead authorizes context-token callers to read Agent definitions.
	ContextTokenScopeAgentsRead = "orka:agents:read"
	// ContextTokenScopeAgentsWrite authorizes context-token callers to mutate Agent definitions.
	ContextTokenScopeAgentsWrite = "orka:agents:write"
	// ContextTokenScopeMemoryRead authorizes context-token callers to read memory resources.
	ContextTokenScopeMemoryRead = "orka:memory:read"
	// ContextTokenScopeMemoryWrite authorizes context-token callers to mutate memory resources.
	ContextTokenScopeMemoryWrite = "orka:memory:write"
	// ContextTokenScopeSessionsRead authorizes context-token callers to read sessions.
	ContextTokenScopeSessionsRead = "orka:sessions:read"
	// ContextTokenScopeSessionsWrite authorizes context-token callers to delete or mutate sessions.
	ContextTokenScopeSessionsWrite = "orka:sessions:write"
	// ContextTokenScopeSecurityRead authorizes context-token callers to read security scan resources.
	ContextTokenScopeSecurityRead = "orka:security:read"
	// ContextTokenScopeSecurityWrite authorizes context-token callers to mutate security scan resources.
	ContextTokenScopeSecurityWrite = "orka:security:write"
	// ContextTokenScopeMonitorsRead authorizes context-token callers to read repository monitor resources.
	ContextTokenScopeMonitorsRead = "orka:monitors:read"
	// ContextTokenScopeMonitorsWrite authorizes context-token callers to mutate repository monitor resources.
	ContextTokenScopeMonitorsWrite = "orka:monitors:write"
	// ContextTokenScopeMonitorsOperate authorizes context-token callers to enqueue repository monitor operations.
	ContextTokenScopeMonitorsOperate = "orka:monitors:operate"
	// ContextTokenScopeSkillsRead authorizes context-token callers to read Skills.
	ContextTokenScopeSkillsRead = "orka:skills:read"
	// ContextTokenScopeSkillsWrite authorizes context-token callers to mutate Skills.
	ContextTokenScopeSkillsWrite = "orka:skills:write"
)
View Source
const (
	// ContextTokenTTSTokenSourceNone disables Orka-initiated token exchanges.
	ContextTokenTTSTokenSourceNone = contexttoken.TTSTokenSourceNone
	// ContextTokenTTSTokenSourceServiceAccount uses Orka's ServiceAccount identity for exchanges.
	ContextTokenTTSTokenSourceServiceAccount = contexttoken.TTSTokenSourceServiceAccount
	// ContextTokenTTSTokenSourceIncoming uses the incoming subject token for exchanges.
	ContextTokenTTSTokenSourceIncoming = contexttoken.TTSTokenSourceIncoming
)
View Source
const (
	// ContextScopeGatewaysRead authorizes gateway resource and ledger reads.
	ContextScopeGatewaysRead = "orka:gateways:read"
	// ContextScopeGatewaysOperate authorizes dead-lettered delivery retries.
	ContextScopeGatewaysOperate = "orka:gateways:operate"
)
View Source
const (
	// DefaultLimit is the default number of items per page
	DefaultLimit = 100

	// MaxLimit is the maximum number of items per page
	MaxLimit = 500
)
View Source
const ContextTokenScopeConfigMapsRead = "orka:" + "configmaps:read"

ContextTokenScopeConfigMapsRead authorizes context-token callers to read ConfigMaps used as operation inputs.

View Source
const OAIErrorTypeInvalidRequest = "invalid_request_error"

OAIErrorTypeInvalidRequest is the OpenAI error type for a request the API will not act on.

Variables

This section is empty.

Functions

func GetEffectiveNamespace

func GetEffectiveNamespace(ctx fiber.Ctx, explicit string) string

GetEffectiveNamespace returns the namespace to use for a request. Priority: explicit namespace > SA namespace from token > "default"

func NewAuthMiddleware

func NewAuthMiddleware(c client.Client, configs ...AuthConfig) fiber.Handler

NewAuthMiddleware creates a new authentication middleware.

func NewLoggingMiddleware

func NewLoggingMiddleware() fiber.Handler

NewLoggingMiddleware creates a logging middleware

func NewMetricsMiddleware

func NewMetricsMiddleware() fiber.Handler

NewMetricsMiddleware creates a metrics middleware

func NewTaskMessageStore added in v0.2.0

func NewTaskMessageStore(reader client.Reader, messages store.MessageStore, taskKey client.ObjectKey, taskUID string, taskProvenanceProtected bool, guard func(context.Context, func(context.Context) error) error) tools.TaskMessageStore

NewTaskMessageStore binds brokered messaging to the controller-authenticated Task identity. Parent names alone never authorize coordination access. guard must come from the authenticated MCP prompt context.

func NewTaskTranscriptSearcher added in v0.2.0

func NewTaskTranscriptSearcher(reader client.Reader, sessions store.SessionStore, gatewayEvents store.GatewayEventStore, taskKey client.ObjectKey, taskUID string, taskProvenanceProtected bool, guard func(context.Context, func(context.Context) error) error) tools.TranscriptSearcher

NewTaskTranscriptSearcher binds brokered search to an authenticated Task. The identity must come from the controller MCP broker, never tool arguments. Live Task and session authorization is repeated for each search and cleanup retry. guard must come from the authenticated MCP prompt context.

func NewTracingMiddleware

func NewTracingMiddleware() fiber.Handler

NewTracingMiddleware creates an OpenTelemetry tracing middleware.

func NormalizeListContinue added in v0.2.0

func NormalizeListContinue(token string) string

NormalizeListContinue strips the controller-runtime cache sentinel from a list continue token. Cache-backed lists report "continue-not-supported" whenever a limit was applied; clients that follow it verbatim would otherwise receive a 500 from the cache on the next page.

func RegisterACPMCPBroker added in v0.2.0

func RegisterACPMCPBroker(app *fiber.App, broker *controller.ACPMCPBroker) error

RegisterACPMCPBroker installs the controller-side prompt MCP broker without coupling broker construction to Server or cmd/main.go. Callers construct the broker with the current durable stores and controller clients, then register it before starting the Fiber app.

func ResolveNamespace

func ResolveNamespace(c fiber.Ctx, explicit string, watchNamespace string, enforceIsolation bool) (string, error)

ResolveNamespace determines the effective namespace for a request. When watchNamespace is set: it's the only allowed namespace (explicit mismatches are rejected with 403). Otherwise: explicit param > SA namespace from token > "default". If enforceIsolation is true, the resolved namespace must match the user's SA namespace.

func StreamPodLogs

func StreamPodLogs(ctx context.Context, clientset kubernetes.Interface, namespace, podName, containerName string) (io.ReadCloser, error)

StreamPodLogs streams logs from a pod

Types

type ACPArtifactHandlers added in v0.2.0

type ACPArtifactHandlers struct {
	// contains filtered or unexported fields
}

func NewACPArtifactHandlers added in v0.2.0

func NewACPArtifactHandlers(service *artifactcap.Service) (*ACPArtifactHandlers, error)

func (*ACPArtifactHandlers) Download added in v0.2.0

func (h *ACPArtifactHandlers) Download(c fiber.Ctx) error

func (*ACPArtifactHandlers) Upload added in v0.2.0

func (h *ACPArtifactHandlers) Upload(c fiber.Ctx) error

type ACPRuntimeAvailability added in v0.2.0

type ACPRuntimeAvailability struct {
	Codex    bool
	Claude   bool
	Copilot  bool
	OpenCode bool
}

ACPRuntimeAvailability identifies built-in profiles backed by configured, digest-pinned RuntimePool images.

type AnthropicCompatHandler

type AnthropicCompatHandler struct {
	// contains filtered or unexported fields
}

AnthropicCompatHandler implements Anthropic-compatible /v1/messages endpoints. This allows Anthropic-compatible clients to use Orka as a custom provider.

func NewAnthropicCompatHandler

func NewAnthropicCompatHandler(c client.Client, apiReader client.Reader, watchNamespace string, enforceNamespaceIsolation bool, config ChatConfig, resolver *ProviderResolver, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *AnthropicCompatHandler

NewAnthropicCompatHandler creates an Anthropic-compatible API handler.

func (*AnthropicCompatHandler) HandleListModels

func (h *AnthropicCompatHandler) HandleListModels(c fiber.Ctx) error

HandleListModels handles GET /anthropic/v1/models.

func (*AnthropicCompatHandler) HandleMessages

func (h *AnthropicCompatHandler) HandleMessages(c fiber.Ctx) error

HandleMessages handles POST /anthropic/v1/messages.

type AnthropicContentBlock

type AnthropicContentBlock struct {
	Type      string          `json:"type"`
	Text      string          `json:"text,omitempty"`
	ID        string          `json:"id,omitempty"`
	Name      string          `json:"name,omitempty"`
	Input     json.RawMessage `json:"input,omitempty"`
	ToolUseID string          `json:"tool_use_id,omitempty"`
	Content   json.RawMessage `json:"content,omitempty"`
	Thinking  string          `json:"thinking,omitempty"`
	Source    *ImageSource    `json:"source,omitempty"`
}

AnthropicContentBlock represents a typed content block in Anthropic messages. The Type field determines which other fields are populated.

type AnthropicDelta

type AnthropicDelta struct {
	Type         string  `json:"type,omitempty"`
	Text         string  `json:"text,omitempty"`
	PartialJSON  string  `json:"partial_json,omitempty"`
	Thinking     string  `json:"thinking,omitempty"`
	StopReason   *string `json:"stop_reason,omitempty"`
	StopSequence *string `json:"stop_sequence,omitempty"`
}

AnthropicDelta carries incremental updates within a streaming event.

type AnthropicError

type AnthropicError struct {
	Type  string               `json:"type"`
	Error AnthropicErrorDetail `json:"error"`
}

AnthropicError is the standard error response format for the Anthropic API.

type AnthropicErrorDetail

type AnthropicErrorDetail struct {
	Type    string `json:"type"`
	Message string `json:"message"`
}

AnthropicErrorDetail contains the error type and message.

type AnthropicMessage

type AnthropicMessage struct {
	Role    string          `json:"role"`
	Content json.RawMessage `json:"content"`
}

AnthropicMessage is a single message in an Anthropic conversation. Content is json.RawMessage because it can be a string or []ContentBlock.

type AnthropicMetadata

type AnthropicMetadata struct {
	UserID string `json:"user_id,omitempty"`
}

AnthropicMetadata contains request metadata.

type AnthropicRequest

type AnthropicRequest struct {
	Model         string             `json:"model"`
	Messages      []AnthropicMessage `json:"messages"`
	MaxTokens     int                `json:"max_tokens"`
	System        json.RawMessage    `json:"system,omitempty"`
	Stream        bool               `json:"stream,omitempty"`
	Temperature   *float64           `json:"temperature,omitempty"`
	TopP          *float64           `json:"top_p,omitempty"`
	TopK          *int               `json:"top_k,omitempty"`
	StopSequences []string           `json:"stop_sequences,omitempty"`
	Tools         []AnthropicTool    `json:"tools,omitempty"`
	ToolChoice    json.RawMessage    `json:"tool_choice,omitempty"`
	Metadata      *AnthropicMetadata `json:"metadata,omitempty"`
	Thinking      *AnthropicThinking `json:"thinking,omitempty"`
}

AnthropicRequest represents an incoming Anthropic Messages API request.

type AnthropicResponse

type AnthropicResponse struct {
	ID           string                  `json:"id"`
	Type         string                  `json:"type"`
	Role         string                  `json:"role"`
	Content      []AnthropicContentBlock `json:"content"`
	Model        string                  `json:"model"`
	StopReason   *string                 `json:"stop_reason"`
	StopSequence *string                 `json:"stop_sequence"`
	Usage        AnthropicUsage          `json:"usage"`
}

AnthropicResponse is the non-streaming response from the Anthropic Messages API.

type AnthropicStreamEvent

type AnthropicStreamEvent struct {
	Type         string                 `json:"type"`
	Message      *AnthropicResponse     `json:"message,omitempty"`
	Index        int                    `json:"index,omitempty"`
	ContentBlock *AnthropicContentBlock `json:"content_block,omitempty"`
	Delta        *AnthropicDelta        `json:"delta,omitempty"`
	Usage        *AnthropicUsage        `json:"usage,omitempty"`
}

AnthropicStreamEvent is a single SSE event in an Anthropic streaming response.

type AnthropicThinking

type AnthropicThinking struct {
	Type         string `json:"type"`
	BudgetTokens int    `json:"budget_tokens,omitempty"`
}

AnthropicThinking configures extended thinking.

type AnthropicTool

type AnthropicTool struct {
	Name        string          `json:"name"`
	Description string          `json:"description,omitempty"`
	InputSchema json.RawMessage `json:"input_schema"`
}

AnthropicTool defines a tool available for the model to call.

type AnthropicUsage

type AnthropicUsage struct {
	InputTokens  int `json:"input_tokens"`
	OutputTokens int `json:"output_tokens"`
}

AnthropicUsage contains token usage statistics.

type ApprovalDecisionRequest

type ApprovalDecisionRequest struct {
	Decision string `json:"decision"`
	Reason   string `json:"reason,omitempty"`
}

type AuthConfig

type AuthConfig struct {
	OIDC          OIDCConfig
	ContextTokens ContextTokenConfig

	// TokenReviewAudiences scopes Kubernetes ServiceAccount authentication to
	// the exact audiences requested by this listener. The cache key includes
	// the normalized audience set so a token authenticated on an unscoped
	// listener cannot be replayed against an audience-bound listener.
	TokenReviewAudiences []string
}

AuthConfig holds authentication middleware configuration.

type ChatConfig

type ChatConfig struct {
	Enabled                bool
	Provider               string
	Model                  string
	MaxIterations          int
	MaxDuration            time.Duration
	ToolTimeout            time.Duration
	MaxConcurrent          int
	MaxTasksPerTurn        int
	MaxSessionSize         int // bytes
	MaxPrematureEndRetries int // re-prompts when the model emits text without the GOAL_STATE sentinel
	RuntimeAvailability    ACPRuntimeAvailability
	ExecutionMode          executionmode.Mode
}

ChatConfig holds configuration for the chat handler.

type ChatHandler

type ChatHandler struct {
	// contains filtered or unexported fields
}

ChatHandler implements the orchestrator chat endpoints.

func NewChatHandler

func NewChatHandler(c client.Client, apiReader client.Reader, sm *controller.SessionManager, config ChatConfig, watchNamespace string, enforceNS bool, ss store.SessionStore, rs store.ResultStore, resolver *ProviderResolver, kubeClientOpt ...kubernetes.Interface) *ChatHandler

NewChatHandler creates a new ChatHandler.

func (*ChatHandler) HandleCancelChat

func (ch *ChatHandler) HandleCancelChat(c fiber.Ctx) error

HandleCancelChat handles DELETE /api/v1/chat/{sessionId}.

func (*ChatHandler) HandleChat

func (ch *ChatHandler) HandleChat(c fiber.Ctx) error

HandleChat handles POST /api/v1/chat.

func (*ChatHandler) HandleChatConfig

func (ch *ChatHandler) HandleChatConfig(c fiber.Ctx) error

HandleChatConfig handles GET /api/v1/chat/config.

type ChatRequest

type ChatRequest struct {
	Message      string   `json:"message"`
	SessionID    string   `json:"sessionId,omitempty"`
	Provider     string   `json:"provider,omitempty"`
	Model        string   `json:"model,omitempty"`
	Namespace    string   `json:"namespace,omitempty"`
	Temperature  *float64 `json:"temperature,omitempty"`
	MaxTokens    *int32   `json:"maxTokens,omitempty"`
	SystemPrompt string   `json:"systemPrompt,omitempty"`
	AgentRef     string   `json:"agentRef,omitempty"`
}

ChatRequest is the request body for POST /api/v1/chat.

type ChatResponse

type ChatResponse struct {
	SessionID string         `json:"sessionId"`
	Message   string         `json:"message"`
	ToolCalls []ToolCallInfo `json:"toolCalls,omitempty"`
	Usage     ChatUsage      `json:"usage"`
}

ChatResponse is the response body for POST /api/v1/chat (JSON mode).

type ChatUsage

type ChatUsage struct {
	InputTokens  int    `json:"inputTokens"`
	OutputTokens int    `json:"outputTokens"`
	LLMCalls     int    `json:"llmCalls"`
	ToolCalls    int    `json:"toolCalls"`
	TasksCreated int    `json:"tasksCreated"`
	Duration     string `json:"duration"`
}

ChatUsage holds usage statistics for a chat turn.

type CompatRouter added in v0.2.0

type CompatRouter struct {
	// contains filtered or unexported fields
}

CompatRouter forwards the four model compatibility routes to independent, namespace-scoped Orka installations. It authenticates ServiceAccount tokens; the receiving installation reauthenticates the same token and authorizes the route and each tool operation. It has no access to tenant resources or stores.

func NewCompatRouter added in v0.2.0

func NewCompatRouter(c client.Client, namespaces map[string]string) (*CompatRouter, error)

NewCompatRouter freezes the operator's namespace-to-installation allowlist. Targets are API origins, without a path, credentials, query or fragment.

func (*CompatRouter) Close added in v0.2.0

func (r *CompatRouter) Close()

Close releases idle connections when the router shuts down.

func (*CompatRouter) ServeHTTP added in v0.2.0

func (r *CompatRouter) ServeHTTP(w http.ResponseWriter, req *http.Request)

type ContextToken

type ContextToken struct {
	Profile            string
	Type               string
	Issuer             string
	Subject            string
	Audience           []string
	TransactionID      string
	Scope              string
	Scopes             []string
	RequestingWorkload string
	TransactionContext map[string]any
	RequesterContext   map[string]any
	Claims             map[string]any
}

ContextToken contains verified transaction/context token identity and metadata.

type ContextTokenAuthorizationConfig

type ContextTokenAuthorizationConfig struct {
	Mode                          string
	TaskCreateScopes              []string
	TaskReadScopes                []string
	TaskListScopes                []string
	TaskDeleteScopes              []string
	TaskUpdateScopes              []string
	ToolReadScopes                []string
	ToolUseScopes                 []string
	ProviderUseScopes             []string
	SecretReadScopeList           []string
	SecretCredentialReadScopeList []string
	AgentReadScopes               []string
	AgentWriteScopes              []string
	MemoryReadScopes              []string
	MemoryWriteScopes             []string
	SessionReadScopes             []string
	SessionWriteScopes            []string
	SecurityReadScopes            []string
	SecurityWriteScopes           []string
	MonitorReadScopes             []string
	MonitorWriteScopes            []string
	MonitorOperateScopes          []string
	SkillReadScopes               []string
	SkillWriteScopes              []string
	GatewayReadScopes             []string
	GatewayOperateScopes          []string
	ConfigMapReadScopeList        []string
}

ContextTokenAuthorizationConfig controls optional authorization checks derived from verified context-token scope and transaction context claims.

func NewContextTokenAuthorizationConfig

func NewContextTokenAuthorizationConfig(opts ContextTokenAuthorizationConfigOptions) (ContextTokenAuthorizationConfig, error)

NewContextTokenAuthorizationConfig builds context-token authorization config.

func (ContextTokenAuthorizationConfig) ConfigMapReadScopes

func (c ContextTokenAuthorizationConfig) ConfigMapReadScopes() []string

func (ContextTokenAuthorizationConfig) Enabled

Enabled reports whether context-token authorization is configured.

func (ContextTokenAuthorizationConfig) SecretCredentialReadScopes

func (c ContextTokenAuthorizationConfig) SecretCredentialReadScopes() []string

func (ContextTokenAuthorizationConfig) SecretReadScopes

func (c ContextTokenAuthorizationConfig) SecretReadScopes() []string

type ContextTokenAuthorizationConfigOptions

type ContextTokenAuthorizationConfigOptions struct {
	Mode                       string
	TaskCreateScopes           string
	TaskReadScopes             string
	TaskListScopes             string
	TaskDeleteScopes           string
	TaskUpdateScopes           string
	ToolReadScopes             string
	ToolUseScopes              string
	ProviderUseScopes          string
	SecretReadScopes           string
	SecretCredentialReadScopes string
	AgentReadScopes            string
	AgentWriteScopes           string
	MemoryReadScopes           string
	MemoryWriteScopes          string
	SessionReadScopes          string
	SessionWriteScopes         string
	SecurityReadScopes         string
	SecurityWriteScopes        string
	MonitorReadScopes          string
	MonitorWriteScopes         string
	MonitorOperateScopes       string
	SkillReadScopes            string
	SkillWriteScopes           string
	GatewayReadScopes          string
	GatewayOperateScopes       string
	ConfigMapReadScopes        string
}

ContextTokenAuthorizationConfigOptions names the inputs used to build context-token authorization config.

type ContextTokenConfig

type ContextTokenConfig struct {
	Profiles []ContextTokenProfileConfig
}

ContextTokenConfig holds generic transaction/context token validation settings.

func NewContextTokenConfig

func NewContextTokenConfig(profile, issuer, audience, jwksURL, headers string) (ContextTokenConfig, error)

NewContextTokenConfig builds context-token configuration for a named profile.

func (ContextTokenConfig) Enabled

func (c ContextTokenConfig) Enabled() bool

Enabled reports whether context-token authentication is configured.

type ContextTokenExchangeRequest

type ContextTokenExchangeRequest = contexttoken.ExchangeRequest

ContextTokenExchangeRequest describes a TTS exchange or replacement request.

type ContextTokenExchanger

type ContextTokenExchanger = contexttoken.Exchanger

ContextTokenExchanger exchanges subject tokens for transaction tokens.

type ContextTokenProfileConfig

type ContextTokenProfileConfig struct {
	Name           string
	Issuer         string
	Audience       string
	JWKSURL        string
	Headers        []TokenHeaderConfig
	ExpectedType   string
	RequiredClaims []string
}

ContextTokenProfileConfig describes validation settings for a context-token profile.

type ContextTokenTTSClient

type ContextTokenTTSClient = contexttoken.TTSClient

ContextTokenTTSClient is a strict transaction-token TTS client.

type ContextTokenTTSConfig

type ContextTokenTTSConfig = contexttoken.TTSConfig

ContextTokenTTSConfig controls optional transaction-token TTS integration.

func NewContextTokenTTSConfig

func NewContextTokenTTSConfig(endpoint, audience, timeout, tokenSource, childTTL, toolTTL string) (ContextTokenTTSConfig, error)

NewContextTokenTTSConfig builds TTS integration config from flag/env values.

type ControllerEpochFenceSource added in v0.2.0

type ControllerEpochFenceSource interface {
	CurrentFence(context.Context) (store.ControllerEpochFence, error)
}

ControllerEpochFenceSource exposes the controller's current durable fence to internal broker authorization paths.

type ControllerEpochReader added in v0.2.0

type ControllerEpochReader interface {
	GetControllerEpochFence(context.Context, string) (store.ControllerEpochFence, error)
}

type ControllerEpochStoreFenceSource added in v0.2.0

type ControllerEpochStoreFenceSource struct {
	// contains filtered or unexported fields
}

ControllerEpochStoreFenceSource reads the current fence directly from the durable epoch store. Unlike ControllerEpochManager, it is safe for API handlers on non-leader replicas because it has no leader-readiness barrier.

func NewControllerEpochStoreFenceSource added in v0.2.0

func NewControllerEpochStoreFenceSource(epochs ControllerEpochReader) *ControllerEpochStoreFenceSource

func (*ControllerEpochStoreFenceSource) CurrentFence added in v0.2.0

type ConversationMessage

type ConversationMessage struct {
	Role    string `json:"role"`
	Content string `json:"content"`
}

ConversationMessage represents a single message in a chat conversation.

type CreateAgentRequest

type CreateAgentRequest struct {
	Name      string                 `json:"name"`
	Namespace string                 `json:"namespace"`
	Metadata  MetadataRequest        `json:"metadata"`
	Spec      corev1alpha1.AgentSpec `json:"spec"`
}

CreateAgentRequest is the request body for creating an agent

type CreateProviderRequest

type CreateProviderRequest struct {
	Name      string                    `json:"name"`
	Namespace string                    `json:"namespace"`
	Metadata  MetadataRequest           `json:"metadata"`
	Spec      corev1alpha1.ProviderSpec `json:"spec"`
}

type CreateRepositoryMonitorCommandRequest

type CreateRepositoryMonitorCommandRequest struct {
	Kind      string `json:"kind"`
	Number    int64  `json:"number"`
	Intent    string `json:"intent"`
	TargetSHA string `json:"targetSHA,omitempty"`
}

CreateRepositoryMonitorCommandRequest records an explicit monitor command from the Orka API.

type CreateRepositoryMonitorRequest

type CreateRepositoryMonitorRequest struct {
	Name      string                             `json:"name"`
	Namespace string                             `json:"namespace"`
	Metadata  MetadataRequest                    `json:"metadata"`
	Spec      corev1alpha1.RepositoryMonitorSpec `json:"spec"`
}

type CreateRepositoryMonitorRunRequest

type CreateRepositoryMonitorRunRequest struct {
	TargetKind   string `json:"targetKind,omitempty"`
	TargetNumber int64  `json:"targetNumber,omitempty"`
	TargetSHA    string `json:"targetSHA,omitempty"`
}

type CreateRepositoryScanRequest

type CreateRepositoryScanRequest struct {
	Name      string                          `json:"name"`
	Namespace string                          `json:"namespace"`
	Metadata  MetadataRequest                 `json:"metadata"`
	Spec      corev1alpha1.RepositoryScanSpec `json:"spec"`
}

type CreateSkillRequest

type CreateSkillRequest struct {
	Name      string                 `json:"name"`
	Namespace string                 `json:"namespace"`
	Metadata  MetadataRequest        `json:"metadata"`
	Spec      corev1alpha1.SkillSpec `json:"spec"`
}

CreateSkillRequest is the request body for creating a skill

type CreateSubstrateActorPoolRequest

type CreateSubstrateActorPoolRequest struct {
	Name      string                              `json:"name"`
	Namespace string                              `json:"namespace"`
	Metadata  MetadataRequest                     `json:"metadata"`
	Spec      corev1alpha1.SubstrateActorPoolSpec `json:"spec"`
}

type CreateTaskRequest

type CreateTaskRequest struct {
	Name              string                           `json:"name"`
	Namespace         string                           `json:"namespace"`
	Metadata          MetadataRequest                  `json:"metadata"`
	Spec              *corev1alpha1.TaskSpec           `json:"spec,omitempty"`
	Annotations       map[string]string                `json:"annotations,omitempty"`
	Type              corev1alpha1.TaskType            `json:"type"`
	Image             string                           `json:"image,omitempty"`
	Command           []string                         `json:"command,omitempty"`
	Args              []string                         `json:"args,omitempty"`
	Env               []corev1.EnvVar                  `json:"env,omitempty"`
	Timeout           string                           `json:"timeout,omitempty"`
	Priority          *int32                           `json:"priority,omitempty"`
	RetryPolicy       *corev1alpha1.RetryPolicy        `json:"retryPolicy,omitempty"`
	WebhookURL        string                           `json:"webhookURL,omitempty"`
	SecretRef         *corev1alpha1.SecretReference    `json:"secretRef,omitempty"`
	SessionRef        *corev1alpha1.SessionReference   `json:"sessionRef,omitempty"`
	AI                *corev1alpha1.AISpec             `json:"ai,omitempty"`
	AgentRef          *corev1alpha1.AgentReference     `json:"agentRef,omitempty"`
	Prompt            string                           `json:"prompt,omitempty"`
	AgentRuntime      *corev1alpha1.AgentRuntimeSpec   `json:"agentRuntime,omitempty"`
	Execution         *corev1alpha1.ExecutionSpec      `json:"execution,omitempty"`
	Workspace         *corev1alpha1.WorkspaceConfig    `json:"workspace,omitempty"`
	PriorTaskRef      *corev1alpha1.PriorTaskReference `json:"priorTaskRef,omitempty"`
	Schedule          string                           `json:"schedule,omitempty"`
	TimeZone          *string                          `json:"timeZone,omitempty"`
	ConcurrencyPolicy string                           `json:"concurrencyPolicy,omitempty"`
	Suspend           *bool                            `json:"suspend,omitempty"`
}

CreateTaskRequest is the request body for creating a task

type CreateToolRequest

type CreateToolRequest struct {
	Name      string                `json:"name"`
	Namespace string                `json:"namespace"`
	Metadata  MetadataRequest       `json:"metadata"`
	Spec      corev1alpha1.ToolSpec `json:"spec"`
}

type ExecutionEventResponse

type ExecutionEventResponse struct {
	ID                string                           `json:"id"`
	Namespace         string                           `json:"namespace"`
	StreamType        string                           `json:"streamType"`
	StreamID          string                           `json:"streamID"`
	Seq               int64                            `json:"seq"`
	Type              string                           `json:"type"`
	Severity          string                           `json:"severity"`
	TaskName          string                           `json:"taskName,omitempty"`
	SessionName       string                           `json:"sessionName,omitempty"`
	AgentName         string                           `json:"agentName,omitempty"`
	ToolName          string                           `json:"toolName,omitempty"`
	ToolCallID        string                           `json:"toolCallID,omitempty"`
	Provider          string                           `json:"provider,omitempty"`
	Model             string                           `json:"model,omitempty"`
	StopReason        string                           `json:"stopReason,omitempty"`
	InputTokens       int                              `json:"inputTokens,omitempty"`
	OutputTokens      int                              `json:"outputTokens,omitempty"`
	CachedInputTokens int                              `json:"cachedInputTokens,omitempty"`
	ContextWindowUsed *int                             `json:"contextWindowUsed,omitempty"`
	ContextWindowSize *int                             `json:"contextWindowSize,omitempty"`
	Summary           string                           `json:"summary,omitempty"`
	Content           json.RawMessage                  `json:"content,omitempty"`
	ContentText       string                           `json:"contentText,omitempty"`
	Truncation        *events.ExecutionEventTruncation `json:"truncation,omitempty"`
	CreatedAt         time.Time                        `json:"createdAt"`
}

ExecutionEventResponse is the public API representation of an execution event.

func NewExecutionEventResponse

func NewExecutionEventResponse(event store.ExecutionEvent) ExecutionEventResponse

NewExecutionEventResponse converts a store event to an API DTO and intentionally omits store-only fields such as ExecutionEvent.Internal.

type ForkTaskRequest

type ForkTaskRequest struct {
	AfterSeq    *int64                        `json:"afterSeq,omitempty"`
	NewTaskName string                        `json:"newTaskName,omitempty"`
	AgentRef    *corev1alpha1.AgentReference  `json:"agentRef,omitempty"`
	Prompt      string                        `json:"prompt,omitempty"`
	Workspace   *corev1alpha1.WorkspaceConfig `json:"workspace,omitempty"`
	// ExecutionCheckpoint explicitly selects workspace data. AfterSeq selects
	// transcript context independently and is not a filesystem checkpoint.
	ExecutionCheckpoint *corev1alpha1.WorkspaceCheckpointReference `json:"executionCheckpoint,omitempty"`
}

type ForkTaskResponse

type ForkTaskResponse struct {
	Namespace      string              `json:"namespace"`
	SourceTaskName string              `json:"sourceTaskName"`
	NewTaskName    string              `json:"newTaskName"`
	AfterSeq       int64               `json:"afterSeq"`
	ForkContext    forkcontext.Context `json:"forkContext"`
}

type Handlers

type Handlers struct {
	// contains filtered or unexported fields
}

func NewHandlers

func NewHandlers(cfg HandlersConfig) *Handlers

NewHandlers creates a new Handlers instance

func (*Handlers) ApplyMemoryProposal

func (h *Handlers) ApplyMemoryProposal(c fiber.Ctx) error

ApplyMemoryProposal applies an accepted memory proposal into durable memory.

func (*Handlers) ArchiveMemoryProposal

func (h *Handlers) ArchiveMemoryProposal(c fiber.Ctx) error

ArchiveMemoryProposal archives a proposal without applying it.

func (*Handlers) CreateAgent

func (h *Handlers) CreateAgent(c fiber.Ctx) error

CreateAgent creates a new agent

func (*Handlers) CreateAgentRuntime added in v0.2.0

func (h *Handlers) CreateAgentRuntime(c fiber.Ctx) error

func (*Handlers) CreateManualSecurityScan

func (h *Handlers) CreateManualSecurityScan(c fiber.Ctx) error

CreateManualSecurityScan creates and starts a manual scan task.

func (*Handlers) CreateMemory

func (h *Handlers) CreateMemory(c fiber.Ctx) error

CreateMemory creates a namespace-scoped memory.

func (*Handlers) CreateMemoryProposal

func (h *Handlers) CreateMemoryProposal(c fiber.Ctx) error

CreateMemoryProposal creates a governance proposal. It does not apply proposals automatically.

func (*Handlers) CreateProvider

func (h *Handlers) CreateProvider(c fiber.Ctx) error

CreateProvider creates a provider.

func (*Handlers) CreateRepositoryMonitor

func (h *Handlers) CreateRepositoryMonitor(c fiber.Ctx) error

CreateRepositoryMonitor creates a new durable repository monitor.

func (*Handlers) CreateRepositoryMonitorCommandEvent

func (h *Handlers) CreateRepositoryMonitorCommandEvent(c fiber.Ctx) error

CreateRepositoryMonitorCommandEvent records an API-created monitor command and best-effort queues its run.

func (*Handlers) CreateRepositoryMonitorRun

func (h *Handlers) CreateRepositoryMonitorRun(c fiber.Ctx) error

CreateRepositoryMonitorRun records a manual monitor run request.

func (*Handlers) CreateRepositoryScan

func (h *Handlers) CreateRepositoryScan(c fiber.Ctx) error

CreateRepositoryScan creates a new repository scan configuration.

func (*Handlers) CreateSecurityPullRequest

func (h *Handlers) CreateSecurityPullRequest(c fiber.Ctx) error

CreateSecurityPullRequest returns the pull request reconciled by the governed patch Task.

func (*Handlers) CreateSkill

func (h *Handlers) CreateSkill(c fiber.Ctx) error

CreateSkill creates a new skill

func (*Handlers) CreateSubstrateActorPool

func (h *Handlers) CreateSubstrateActorPool(c fiber.Ctx) error

CreateSubstrateActorPool creates an Orka Substrate actor pool.

func (*Handlers) CreateTask

func (h *Handlers) CreateTask(c fiber.Ctx) error

CreateTask creates a new task

func (*Handlers) CreateTool

func (h *Handlers) CreateTool(c fiber.Ctx) error

CreateTool creates a Tool CRD.

func (*Handlers) DecideTaskApproval

func (h *Handlers) DecideTaskApproval(c fiber.Ctx) error

DecideTaskApproval handles POST /api/v1/tasks/{id}/approvals/{approvalID}/decision.

func (*Handlers) DeleteAgent

func (h *Handlers) DeleteAgent(c fiber.Ctx) error

DeleteAgent deletes an agent

func (*Handlers) DeleteAgentRuntime added in v0.2.0

func (h *Handlers) DeleteAgentRuntime(c fiber.Ctx) error

func (*Handlers) DeleteMemory

func (h *Handlers) DeleteMemory(c fiber.Ctx) error

DeleteMemory soft-deletes a memory.

func (*Handlers) DeleteProvider

func (h *Handlers) DeleteProvider(c fiber.Ctx) error

DeleteProvider deletes a provider.

func (*Handlers) DeleteRepositoryMonitor

func (h *Handlers) DeleteRepositoryMonitor(c fiber.Ctx) error

DeleteRepositoryMonitor deletes a repository monitor configuration.

func (*Handlers) DeleteRepositoryScan

func (h *Handlers) DeleteRepositoryScan(c fiber.Ctx) error

DeleteRepositoryScan deletes a repository scan configuration.

func (*Handlers) DeleteSession

func (h *Handlers) DeleteSession(c fiber.Ctx) error

DeleteSession deletes a session

func (*Handlers) DeleteSkill

func (h *Handlers) DeleteSkill(c fiber.Ctx) error

DeleteSkill deletes a skill

func (*Handlers) DeleteSubstrateActorPool

func (h *Handlers) DeleteSubstrateActorPool(c fiber.Ctx) error

DeleteSubstrateActorPool deletes an Orka Substrate actor pool.

func (*Handlers) DeleteTask

func (h *Handlers) DeleteTask(c fiber.Ctx) error

DeleteTask deletes a task

func (*Handlers) DeleteTool

func (h *Handlers) DeleteTool(c fiber.Ctx) error

DeleteTool deletes a Tool CRD.

func (*Handlers) DisableMemory

func (h *Handlers) DisableMemory(c fiber.Ctx) error

DisableMemory disables a memory for recall without deleting it.

func (*Handlers) DismissSecurityFinding

func (h *Handlers) DismissSecurityFinding(c fiber.Ctx) error

DismissSecurityFinding marks a finding as dismissed.

func (*Handlers) DownloadTaskArtifact

func (h *Handlers) DownloadTaskArtifact(c fiber.Ctx) error

DownloadTaskArtifact downloads a specific artifact file

func (*Handlers) EnableMemory

func (h *Handlers) EnableMemory(c fiber.Ctx) error

EnableMemory enables a previously disabled memory.

func (*Handlers) ForkTask

func (h *Handlers) ForkTask(c fiber.Ctx) error

ForkTask handles POST /api/v1/tasks/{id}/fork.

func (*Handlers) GenerateSecurityPatch

func (h *Handlers) GenerateSecurityPatch(c fiber.Ctx) error

GenerateSecurityPatch creates a patch proposal task for a finding.

func (*Handlers) GetAgent

func (h *Handlers) GetAgent(c fiber.Ctx) error

GetAgent gets an agent by name

func (*Handlers) GetAgentRuntime added in v0.2.0

func (h *Handlers) GetAgentRuntime(c fiber.Ctx) error

func (*Handlers) GetGateway

func (h *Handlers) GetGateway(c fiber.Ctx) error

GetGateway gets one namespaced adapter instance.

func (*Handlers) GetGatewayBinding

func (h *Handlers) GetGatewayBinding(c fiber.Ctx) error

GetGatewayBinding gets one namespaced semantic binding.

func (*Handlers) GetGatewayClass

func (h *Handlers) GetGatewayClass(c fiber.Ctx) error

GetGatewayClass gets one cluster-scoped adapter profile.

func (*Handlers) GetGatewayDelivery

func (h *Handlers) GetGatewayDelivery(c fiber.Ctx) error

GetGatewayDelivery gets one durable outbox record.

func (*Handlers) GetGatewayEvent

func (h *Handlers) GetGatewayEvent(c fiber.Ctx) error

GetGatewayEvent gets one normalized ingress record.

func (*Handlers) GetMemory

func (h *Handlers) GetMemory(c fiber.Ctx) error

GetMemory gets a memory by ID.

func (*Handlers) GetMemoryProposal

func (h *Handlers) GetMemoryProposal(c fiber.Ctx) error

GetMemoryProposal gets a proposal by ID.

func (*Handlers) GetProvider

func (h *Handlers) GetProvider(c fiber.Ctx) error

GetProvider returns a configured LLM provider.

func (*Handlers) GetRepositoryMonitor

func (h *Handlers) GetRepositoryMonitor(c fiber.Ctx) error

GetRepositoryMonitor returns a repository monitor configuration.

func (*Handlers) GetRepositoryMonitorActionRecord

func (h *Handlers) GetRepositoryMonitorActionRecord(c fiber.Ctx) error

GetRepositoryMonitorActionRecord fetches one durable action record.

func (*Handlers) GetRepositoryMonitorCommandEvent

func (h *Handlers) GetRepositoryMonitorCommandEvent(c fiber.Ctx) error

GetRepositoryMonitorCommandEvent fetches one durable command event.

func (*Handlers) GetRepositoryMonitorGitHubMutation

func (h *Handlers) GetRepositoryMonitorGitHubMutation(c fiber.Ctx) error

GetRepositoryMonitorGitHubMutation fetches one mutation audit record.

func (*Handlers) GetRepositoryMonitorImplementationJob

func (h *Handlers) GetRepositoryMonitorImplementationJob(c fiber.Ctx) error

GetRepositoryMonitorImplementationJob fetches one implementation job.

func (*Handlers) GetRepositoryMonitorImplementationPatchPreview

func (h *Handlers) GetRepositoryMonitorImplementationPatchPreview(c fiber.Ctx) error

GetRepositoryMonitorImplementationPatchPreview returns safe patch artifact metadata for an implementation job.

func (*Handlers) GetRepositoryMonitorWorkAction

func (h *Handlers) GetRepositoryMonitorWorkAction(c fiber.Ctx) error

GetRepositoryMonitorWorkAction fetches one durable workflow action.

func (*Handlers) GetRepositoryScan

func (h *Handlers) GetRepositoryScan(c fiber.Ctx) error

GetRepositoryScan returns a repository scan configuration.

func (*Handlers) GetRuntimePool added in v0.2.0

func (h *Handlers) GetRuntimePool(c fiber.Ctx) error

func (*Handlers) GetSecurityFinding

func (h *Handlers) GetSecurityFinding(c fiber.Ctx) error

GetSecurityFinding returns a finding by ID.

func (*Handlers) GetSecurityReviewSlice

func (h *Handlers) GetSecurityReviewSlice(c fiber.Ctx) error

GetSecurityReviewSlice returns one deterministic review slice.

func (*Handlers) GetSession

func (h *Handlers) GetSession(c fiber.Ctx) error

GetSession gets a session

func (*Handlers) GetSkill

func (h *Handlers) GetSkill(c fiber.Ctx) error

GetSkill gets a skill by name

func (*Handlers) GetSkillContent

func (h *Handlers) GetSkillContent(c fiber.Ctx) error

GetSkillContent gets the raw content of a skill

func (*Handlers) GetSubstrateActorPool

func (h *Handlers) GetSubstrateActorPool(c fiber.Ctx) error

GetSubstrateActorPool gets an Orka Substrate actor pool.

func (*Handlers) GetTask

func (h *Handlers) GetTask(c fiber.Ctx) error

GetTask gets a task by ID

func (*Handlers) GetTaskChildren

func (h *Handlers) GetTaskChildren(c fiber.Ctx) error

GetTaskChildren returns child tasks for a given parent task

func (*Handlers) GetTaskLogs

func (h *Handlers) GetTaskLogs(c fiber.Ctx) error

GetTaskLogs gets logs for a task

func (*Handlers) GetTaskPlan

func (h *Handlers) GetTaskPlan(c fiber.Ctx) error

GetTaskPlan gets the autonomous plan state for a task

func (*Handlers) GetTaskResult

func (h *Handlers) GetTaskResult(c fiber.Ctx) error

GetTaskResult gets the result of a task

func (*Handlers) GetTaskTrace

func (h *Handlers) GetTaskTrace(c fiber.Ctx) error

GetTaskTrace handles GET /api/v1/tasks/{id}/trace.

func (*Handlers) GetThreatModel

func (h *Handlers) GetThreatModel(c fiber.Ctx) error

GetThreatModel returns the current threat model for a repository.

func (*Handlers) GetTool

func (h *Handlers) GetTool(c fiber.Ctx) error

GetTool gets a tool by name

func (*Handlers) GetUsageOther added in v0.2.0

func (h *Handlers) GetUsageOther(c fiber.Ctx) error

func (*Handlers) GetUsageReport added in v0.2.0

func (h *Handlers) GetUsageReport(c fiber.Ctx) error

func (*Handlers) GetUsageWork added in v0.2.0

func (h *Handlers) GetUsageWork(c fiber.Ctx) error

func (*Handlers) HandleGatewayEvent

func (h *Handlers) HandleGatewayEvent(c fiber.Ctx) error

HandleGatewayEvent accepts one adapter-authenticated normalized event.

func (*Handlers) HandleGitHubWebhook

func (h *Handlers) HandleGitHubWebhook(c fiber.Ctx) error

func (*Handlers) Healthz

func (h *Handlers) Healthz(c fiber.Ctx) error

Healthz handles health check requests

func (*Handlers) ListAgentRuntimes added in v0.2.0

func (h *Handlers) ListAgentRuntimes(c fiber.Ctx) error

func (*Handlers) ListAgents

func (h *Handlers) ListAgents(c fiber.Ctx) error

ListAgents lists available agents

func (*Handlers) ListGatewayBindings

func (h *Handlers) ListGatewayBindings(c fiber.Ctx) error

ListGatewayBindings lists namespaced semantic bindings.

func (*Handlers) ListGatewayClasses

func (h *Handlers) ListGatewayClasses(c fiber.Ctx) error

ListGatewayClasses lists cluster-scoped adapter profiles.

func (*Handlers) ListGatewayDeliveries

func (h *Handlers) ListGatewayDeliveries(c fiber.Ctx) error

ListGatewayDeliveries lists durable outbox records.

func (*Handlers) ListGatewayEvents

func (h *Handlers) ListGatewayEvents(c fiber.Ctx) error

ListGatewayEvents lists normalized durable ingress records.

func (*Handlers) ListGateways

func (h *Handlers) ListGateways(c fiber.Ctx) error

ListGateways lists namespaced adapter instances.

func (*Handlers) ListMemories

func (h *Handlers) ListMemories(c fiber.Ctx) error

ListMemories lists namespace-scoped memories.

func (*Handlers) ListMemoryProposals

func (h *Handlers) ListMemoryProposals(c fiber.Ctx) error

ListMemoryProposals lists memory governance proposals.

func (*Handlers) ListProviders

func (h *Handlers) ListProviders(c fiber.Ctx) error

ListProviders lists configured LLM providers.

func (*Handlers) ListRepositoryMonitorActionRecords

func (h *Handlers) ListRepositoryMonitorActionRecords(c fiber.Ctx) error

ListRepositoryMonitorActionRecords lists durable monitor action records.

func (*Handlers) ListRepositoryMonitorCommandEvents

func (h *Handlers) ListRepositoryMonitorCommandEvents(c fiber.Ctx) error

ListRepositoryMonitorCommandEvents lists durable label/API command events.

func (*Handlers) ListRepositoryMonitorEvents

func (h *Handlers) ListRepositoryMonitorEvents(c fiber.Ctx) error

ListRepositoryMonitorEvents lists audit events for a repository monitor.

func (*Handlers) ListRepositoryMonitorGitHubMutations

func (h *Handlers) ListRepositoryMonitorGitHubMutations(c fiber.Ctx) error

ListRepositoryMonitorGitHubMutations lists controller-owned GitHub mutation audit records.

func (*Handlers) ListRepositoryMonitorImplementationJobs

func (h *Handlers) ListRepositoryMonitorImplementationJobs(c fiber.Ctx) error

ListRepositoryMonitorImplementationJobs lists durable issue implementation jobs.

func (*Handlers) ListRepositoryMonitorItems

func (h *Handlers) ListRepositoryMonitorItems(c fiber.Ctx) error

ListRepositoryMonitorItems lists current items for a repository monitor.

func (*Handlers) ListRepositoryMonitorRuns

func (h *Handlers) ListRepositoryMonitorRuns(c fiber.Ctx) error

ListRepositoryMonitorRuns lists durable runs for a repository monitor.

func (*Handlers) ListRepositoryMonitorWorkActions

func (h *Handlers) ListRepositoryMonitorWorkActions(c fiber.Ctx) error

ListRepositoryMonitorWorkActions lists durable workflow queue actions.

func (*Handlers) ListRepositoryMonitors

func (h *Handlers) ListRepositoryMonitors(c fiber.Ctx) error

ListRepositoryMonitors lists configured repository monitors.

func (*Handlers) ListRepositoryScans

func (h *Handlers) ListRepositoryScans(c fiber.Ctx) error

ListRepositoryScans lists configured repository scans.

func (*Handlers) ListRuntimePools added in v0.2.0

func (h *Handlers) ListRuntimePools(c fiber.Ctx) error

func (*Handlers) ListSecretNames

func (h *Handlers) ListSecretNames(c fiber.Ctx) error

ListSecretNames lists secret names in a namespace (metadata only, no data)

func (*Handlers) ListSecurityDroppedFindings

func (h *Handlers) ListSecurityDroppedFindings(c fiber.Ctx) error

ListSecurityDroppedFindings lists diagnostics for v2 findings rejected during ingestion.

func (*Handlers) ListSecurityFindings

func (h *Handlers) ListSecurityFindings(c fiber.Ctx) error

ListSecurityFindings lists findings for a repository.

func (*Handlers) ListSecurityPatchProposals

func (h *Handlers) ListSecurityPatchProposals(c fiber.Ctx) error

ListSecurityPatchProposals lists patch proposals for a finding.

func (*Handlers) ListSecurityReviewSlices

func (h *Handlers) ListSecurityReviewSlices(c fiber.Ctx) error

ListSecurityReviewSlices lists deterministic review slices for a repository.

func (*Handlers) ListSecurityScanRuns

func (h *Handlers) ListSecurityScanRuns(c fiber.Ctx) error

ListSecurityScanRuns lists stored scan runs for a repository.

func (*Handlers) ListSessionEvents

func (h *Handlers) ListSessionEvents(c fiber.Ctx) error

ListSessionEvents handles GET /api/v1/sessions/{id}/events.

func (*Handlers) ListSessions

func (h *Handlers) ListSessions(c fiber.Ctx) error

ListSessions lists sessions

func (*Handlers) ListSkills

func (h *Handlers) ListSkills(c fiber.Ctx) error

ListSkills lists available skills

func (*Handlers) ListSubstrateActorPools

func (h *Handlers) ListSubstrateActorPools(c fiber.Ctx) error

ListSubstrateActorPools lists Orka Substrate actor pools.

func (*Handlers) ListTaskApprovals

func (h *Handlers) ListTaskApprovals(c fiber.Ctx) error

ListTaskApprovals handles GET /api/v1/tasks/{id}/approvals.

func (*Handlers) ListTaskArtifacts

func (h *Handlers) ListTaskArtifacts(c fiber.Ctx) error

ListTaskArtifacts lists artifacts for a task

func (*Handlers) ListTaskEvents

func (h *Handlers) ListTaskEvents(c fiber.Ctx) error

ListTaskEvents handles GET /api/v1/tasks/{id}/events.

func (*Handlers) ListTasks

func (h *Handlers) ListTasks(c fiber.Ctx) error

ListTasks lists tasks

func (*Handlers) ListTools

func (h *Handlers) ListTools(c fiber.Ctx) error

ListTools lists available tools

func (*Handlers) Readyz

func (h *Handlers) Readyz(c fiber.Ctx) error

Readyz handles readiness check requests

func (*Handlers) ReopenSecurityFinding

func (h *Handlers) ReopenSecurityFinding(c fiber.Ctx) error

ReopenSecurityFinding reopens a dismissed finding.

func (*Handlers) RetryGatewayDelivery

func (h *Handlers) RetryGatewayDelivery(c fiber.Ctx) error

RetryGatewayDelivery manually requeues one dead-lettered delivery.

func (*Handlers) ReviewMemoryProposal

func (h *Handlers) ReviewMemoryProposal(c fiber.Ctx) error

ReviewMemoryProposal records a review decision without applying the proposal automatically.

func (*Handlers) StreamSessionEvents

func (h *Handlers) StreamSessionEvents(c fiber.Ctx) error

StreamSessionEvents handles GET /api/v1/sessions/{id}/stream?after=N.

func (*Handlers) StreamTaskEvents

func (h *Handlers) StreamTaskEvents(c fiber.Ctx) error

StreamTaskEvents handles GET /api/v1/tasks/{id}/stream?after=N.

func (*Handlers) UpdateAgent

func (h *Handlers) UpdateAgent(c fiber.Ctx) error

UpdateAgent updates an existing agent

func (*Handlers) UpdateAgentRuntime added in v0.2.0

func (h *Handlers) UpdateAgentRuntime(c fiber.Ctx) error

func (*Handlers) UpdateMemory

func (h *Handlers) UpdateMemory(c fiber.Ctx) error

UpdateMemory updates mutable fields on a memory.

func (*Handlers) UpdateProvider

func (h *Handlers) UpdateProvider(c fiber.Ctx) error

UpdateProvider updates a provider spec.

func (*Handlers) UpdateRepositoryMonitor

func (h *Handlers) UpdateRepositoryMonitor(c fiber.Ctx) error

UpdateRepositoryMonitor updates an existing repository monitor.

func (*Handlers) UpdateRepositoryScan

func (h *Handlers) UpdateRepositoryScan(c fiber.Ctx) error

UpdateRepositoryScan updates an existing repository scan.

func (*Handlers) UpdateSkill

func (h *Handlers) UpdateSkill(c fiber.Ctx) error

UpdateSkill updates an existing skill

func (*Handlers) UpdateSubstrateActorPool

func (h *Handlers) UpdateSubstrateActorPool(c fiber.Ctx) error

UpdateSubstrateActorPool updates an Orka Substrate actor pool.

func (*Handlers) UpdateThreatModel

func (h *Handlers) UpdateThreatModel(c fiber.Ctx) error

UpdateThreatModel replaces the current threat model.

func (*Handlers) UpdateTool

func (h *Handlers) UpdateTool(c fiber.Ctx) error

UpdateTool updates a Tool CRD.

func (*Handlers) ValidateSecurityFinding

func (h *Handlers) ValidateSecurityFinding(c fiber.Ctx) error

ValidateSecurityFinding creates a validator/repro task for a finding.

type HandlersConfig

type HandlersConfig struct {
	Client                    client.Client
	APIReader                 client.Reader
	WatchNamespace            string
	ExecutionMode             executionmode.Mode
	EnforceNamespaceIsolation bool
	ContextTokenAuthorization ContextTokenAuthorizationConfig
	ResultStore               store.ResultStore
	SessionStore              store.SessionStore
	SessionManager            *controller.SessionManager
	PlanStore                 store.PlanStore
	KubeClient                kubernetes.Interface
	HealthChecker             store.HealthChecker
	ArtifactStore             store.ArtifactStore
	MemoryStore               store.MemoryStore
	MemoryProposalStore       store.MemoryProposalStore
	SecurityStore             store.SecurityStore
	RepositoryMonitorStore    store.RepositoryMonitorStore
	ExecutionEventStore       store.ExecutionEventStore
	GatewayEventStore         store.GatewayEventStore
	GatewayDeliveryStore      store.GatewayDeliveryStore
	GatewayService            *gatewayruntime.Service
}

HandlersConfig holds configuration for creating Handlers.

type ImageSource

type ImageSource struct {
	Type      string `json:"type"`
	MediaType string `json:"media_type"`
	Data      string `json:"data"`
}

ImageSource represents a base64-encoded image source in an Anthropic content block.

type InternalHandlers

type InternalHandlers struct {
	// contains filtered or unexported fields
}

InternalHandlers contains handlers for internal worker endpoints.

func NewInternalHandlers

NewInternalHandlers creates a new InternalHandlers instance.

func (*InternalHandlers) ApplyMemoryProposal

func (h *InternalHandlers) ApplyMemoryProposal(c fiber.Ctx) error

ApplyMemoryProposal applies an accepted memory proposal into durable memory in the namespace in the internal route.

func (*InternalHandlers) ArchiveMemoryProposal

func (h *InternalHandlers) ArchiveMemoryProposal(c fiber.Ctx) error

ArchiveMemoryProposal archives a proposal in the namespace in the internal route without applying it.

func (*InternalHandlers) CreateMemory

func (h *InternalHandlers) CreateMemory(c fiber.Ctx) error

CreateMemory creates a memory in the namespace in the internal route.

func (*InternalHandlers) CreateMemoryProposal

func (h *InternalHandlers) CreateMemoryProposal(c fiber.Ctx) error

CreateMemoryProposal creates a memory governance proposal in the namespace in the internal route.

func (*InternalHandlers) DeleteMemory

func (h *InternalHandlers) DeleteMemory(c fiber.Ctx) error

DeleteMemory soft-deletes a memory in the namespace in the internal route.

func (*InternalHandlers) DisableMemory

func (h *InternalHandlers) DisableMemory(c fiber.Ctx) error

DisableMemory disables a memory for recall in the namespace in the internal route.

func (*InternalHandlers) EnableMemory

func (h *InternalHandlers) EnableMemory(c fiber.Ctx) error

EnableMemory enables a memory for recall in the namespace in the internal route.

func (*InternalHandlers) GetMemory

func (h *InternalHandlers) GetMemory(c fiber.Ctx) error

GetMemory gets a memory by ID from the namespace in the internal route.

func (*InternalHandlers) GetMemoryProposal

func (h *InternalHandlers) GetMemoryProposal(c fiber.Ctx) error

GetMemoryProposal gets a memory proposal by ID from the namespace in the internal route.

func (*InternalHandlers) GetMessages

func (h *InternalHandlers) GetMessages(c fiber.Ctx) error

GetMessages handles GET /internal/v1/messages/{namespace}/{taskName}. Workers call this to check for messages from sibling tasks.

func (*InternalHandlers) GetPlan

func (h *InternalHandlers) GetPlan(c fiber.Ctx) error

GetPlan handles GET /internal/v1/plans/{namespace}/{taskName}. Workers call this to load the current plan state at startup.

func (*InternalHandlers) GetSessionTranscript

func (h *InternalHandlers) GetSessionTranscript(c fiber.Ctx) error

GetSessionTranscript handles GET /internal/v1/sessions/{namespace}/{name}/transcript. Returns the session transcript as JSONL (one JSON object per line).

func (*InternalHandlers) ListMemories

func (h *InternalHandlers) ListMemories(c fiber.Ctx) error

ListMemories lists memories for the namespace in the internal route.

func (*InternalHandlers) ListMemoryProposals

func (h *InternalHandlers) ListMemoryProposals(c fiber.Ctx) error

ListMemoryProposals lists memory proposals for the namespace in the internal route.

func (*InternalHandlers) ReviewMemoryProposal

func (h *InternalHandlers) ReviewMemoryProposal(c fiber.Ctx) error

ReviewMemoryProposal records a review decision without applying the proposal automatically.

func (*InternalHandlers) SearchTranscript

func (h *InternalHandlers) SearchTranscript(c fiber.Ctx) error

SearchTranscript handles GET /internal/v1/sessions/{namespace}/search. It searches namespace-scoped session transcripts and returns compact snippets.

func (*InternalHandlers) SendMessage

func (h *InternalHandlers) SendMessage(c fiber.Ctx) error

SendMessage handles POST /internal/v1/messages/{namespace}. Workers call this to send messages to sibling tasks.

func (*InternalHandlers) SubmitExecutionEvent

func (h *InternalHandlers) SubmitExecutionEvent(c fiber.Ctx) error

SubmitExecutionEvent handles POST /internal/v1/events/{namespace}/{streamType}/{streamID}. Workers call this to append sanitized execution timeline events.

func (*InternalHandlers) SubmitPlan

func (h *InternalHandlers) SubmitPlan(c fiber.Ctx) error

SubmitPlan handles POST /internal/v1/plans/{namespace}/{taskName}. Workers call this to persist autonomous plan state.

func (*InternalHandlers) SubmitResult

func (h *InternalHandlers) SubmitResult(c fiber.Ctx) error

SubmitResult handles POST /internal/v1/results/{namespace}/{taskName}. Workers call this to persist task results.

func (*InternalHandlers) UpdateExecutionWorkspaceStatus

func (h *InternalHandlers) UpdateExecutionWorkspaceStatus(c fiber.Ctx) error

UpdateExecutionWorkspaceStatus handles POST /internal/v1/tasks/{namespace}/{taskName}/execution-workspace/status.

func (*InternalHandlers) UpdateMemory

func (h *InternalHandlers) UpdateMemory(c fiber.Ctx) error

UpdateMemory updates a memory in the namespace in the internal route.

func (*InternalHandlers) UploadArtifact

func (h *InternalHandlers) UploadArtifact(c fiber.Ctx) error

UploadArtifact handles POST /internal/v1/artifacts/{namespace}/{taskName}/{filename}. Workers call this to upload artifact files.

type InternalHandlersConfig

type InternalHandlersConfig struct {
	Client              client.Client
	APIReader           client.Reader
	MemoryStore         store.MemoryStore
	MemoryProposalStore store.MemoryProposalStore
	ExecutionEventStore store.ExecutionEventStore
	GatewayEventStore   store.GatewayEventStore
	// TaskProvenanceProtected permits cross-task coordination only when the
	// Task provenance admission webhook protects coordination ancestry.
	TaskProvenanceProtected bool
}

InternalHandlersConfig holds optional configuration for internal handlers.

type ListExecutionEventsResponse

type ListExecutionEventsResponse struct {
	Namespace  string                   `json:"namespace"`
	StreamType string                   `json:"streamType"`
	StreamID   string                   `json:"streamID"`
	AfterSeq   int64                    `json:"afterSeq"`
	LatestSeq  int64                    `json:"latestSeq"`
	Events     []ExecutionEventResponse `json:"events"`
}

ListExecutionEventsResponse is the API response for listing one event stream.

func NewListExecutionEventsResponse

func NewListExecutionEventsResponse(namespace, streamType, streamID string, afterSeq, latestSeq int64, storeEvents []store.ExecutionEvent) ListExecutionEventsResponse

NewListExecutionEventsResponse builds a list DTO from store events.

type ListMeta

type ListMeta struct {
	Continue           string `json:"continue,omitempty"`
	RemainingItemCount *int64 `json:"remainingItemCount,omitempty"`
}

ListMeta contains pagination metadata

type ListResponse

type ListResponse struct {
	Items    any      `json:"items"`
	Metadata ListMeta `json:"metadata"`
}

ListResponse is a generic list response with pagination

type ListSessionExecutionEventsResponse

type ListSessionExecutionEventsResponse struct {
	Namespace  string                          `json:"namespace"`
	StreamType string                          `json:"streamType"`
	StreamID   string                          `json:"streamID"`
	AfterSeq   int64                           `json:"afterSeq"`
	LatestSeq  int64                           `json:"latestSeq"`
	Events     []SessionExecutionEventResponse `json:"events"`
}

ListSessionExecutionEventsResponse is the API response for an aggregated session stream.

func NewListSessionExecutionEventsResponse

func NewListSessionExecutionEventsResponse(namespace, sessionName string, afterSeq, latestSeq int64, storeEvents []store.SessionExecutionEvent) ListSessionExecutionEventsResponse

NewListSessionExecutionEventsResponse builds a session timeline DTO.

type ListTaskApprovalsResponse

type ListTaskApprovalsResponse struct {
	Namespace string               `json:"namespace"`
	TaskName  string               `json:"taskName"`
	Approvals []approvals.Approval `json:"approvals"`
}

type MetadataRequest

type MetadataRequest struct {
	Name        string            `json:"name"`
	Namespace   string            `json:"namespace"`
	Labels      map[string]string `json:"labels,omitempty"`
	Annotations map[string]string `json:"annotations,omitempty"`
}

MetadataRequest holds Kubernetes-style metadata fields

type OAIChoice

type OAIChoice struct {
	Index        int         `json:"index"`
	Message      *OAIMessage `json:"message,omitempty"`
	Delta        *OAIMessage `json:"delta,omitempty"`
	FinishReason *string     `json:"finish_reason"`
}

OAIChoice is a choice in the response.

type OAIError

type OAIError struct {
	Error OAIErrorDetail `json:"error"`
}

OAIError is the OpenAI error response format.

type OAIErrorDetail

type OAIErrorDetail struct {
	Message string  `json:"message"`
	Type    string  `json:"type"`
	Param   *string `json:"param"`
	Code    *string `json:"code"`
}

OAIErrorDetail is the error detail.

type OAIFunctionCall

type OAIFunctionCall struct {
	Name      string `json:"name"`
	Arguments string `json:"arguments"`
}

OAIFunctionCall is a function call within a tool call.

type OAIFunctionDef

type OAIFunctionDef struct {
	Name        string          `json:"name"`
	Description string          `json:"description,omitempty"`
	Parameters  json.RawMessage `json:"parameters,omitempty"`
}

OAIFunctionDef is an OpenAI function definition.

type OAIJSONSchemaSpec

type OAIJSONSchemaSpec struct {
	Name        string         `json:"name"`
	Schema      map[string]any `json:"schema,omitempty"`
	Strict      *bool          `json:"strict,omitempty"`
	Description string         `json:"description,omitempty"`
}

OAIJSONSchemaSpec holds the json_schema details within response_format.

type OAIMessage

type OAIMessage struct {
	Role       string        `json:"role,omitempty"`
	Content    any           `json:"content"` // string or []ContentPart
	Name       string        `json:"name,omitempty"`
	ToolCalls  []OAIToolCall `json:"tool_calls,omitempty"`
	ToolCallID string        `json:"tool_call_id,omitempty"`
	Refusal    *string       `json:"refusal,omitempty"`
}

OAIMessage represents an OpenAI chat message.

type OAIModel

type OAIModel struct {
	ID      string `json:"id"`
	Object  string `json:"object"`
	Created int64  `json:"created"`
	OwnedBy string `json:"owned_by"`
}

OAIModel is the model object for /openai/v1/models.

type OAIModelList

type OAIModelList struct {
	Object string     `json:"object"`
	Data   []OAIModel `json:"data"`
}

OAIModelList is the response for GET /openai/v1/models.

type OAIRequest

type OAIRequest struct {
	Model            string             `json:"model"`
	Messages         []OAIMessage       `json:"messages"`
	Tools            []OAITool          `json:"tools,omitempty"`
	Temperature      *float64           `json:"temperature,omitempty"`
	MaxTokens        *int               `json:"max_tokens,omitempty"`
	MaxCompTokens    *int               `json:"max_completion_tokens,omitempty"`
	Stream           bool               `json:"stream,omitempty"`
	StreamOptions    *StreamOptions     `json:"stream_options,omitempty"`
	Stop             any                `json:"stop,omitempty"`
	TopP             *float64           `json:"top_p,omitempty"`
	FrequencyPenalty *float64           `json:"frequency_penalty,omitempty"`
	PresencePenalty  *float64           `json:"presence_penalty,omitempty"`
	N                *int               `json:"n,omitempty"`
	User             string             `json:"user,omitempty"`
	ResponseFormat   *OAIResponseFormat `json:"response_format,omitempty"`
}

OAIRequest is the OpenAI chat completion request format.

type OAIResponse

type OAIResponse struct {
	ID                string      `json:"id"`
	Object            string      `json:"object"`
	Created           int64       `json:"created"`
	Model             string      `json:"model"`
	Choices           []OAIChoice `json:"choices"`
	Usage             *OAIUsage   `json:"usage,omitempty"`
	SystemFingerprint string      `json:"system_fingerprint,omitempty"`
}

OAIResponse is the OpenAI chat completion response.

type OAIResponseFormat

type OAIResponseFormat struct {
	Type       string             `json:"type"` // "text", "json_object", "json_schema"
	JSONSchema *OAIJSONSchemaSpec `json:"json_schema,omitempty"`
}

OAIResponseFormat is the OpenAI response_format field.

type OAITool

type OAITool struct {
	Type     string         `json:"type"` // "function"
	Function OAIFunctionDef `json:"function"`
}

OAITool is an OpenAI tool definition.

type OAIToolCall

type OAIToolCall struct {
	Index    *int            `json:"index,omitempty"`
	ID       string          `json:"id,omitempty"`
	Type     string          `json:"type,omitempty"` // "function"
	Function OAIFunctionCall `json:"function"`
}

OAIToolCall is an OpenAI tool call.

type OAIUsage

type OAIUsage struct {
	PromptTokens     int `json:"prompt_tokens"`
	CompletionTokens int `json:"completion_tokens"`
	TotalTokens      int `json:"total_tokens"`
}

OAIUsage contains token usage statistics.

type OIDCConfig

type OIDCConfig struct {
	Issuer          string
	Audience        string
	JWKSURL         string
	AllowedSubjects []string
	Namespace       string
}

OIDCConfig holds OpenID Connect JWT validation settings.

func (OIDCConfig) Enabled

func (c OIDCConfig) Enabled() bool

Enabled reports whether OIDC authentication is configured.

type OpenAICompatHandler

type OpenAICompatHandler struct {
	// contains filtered or unexported fields
}

OpenAICompatHandler implements OpenAI-compatible /openai/v1/chat/completions and /openai/v1/models endpoints. This allows OpenAI-compatible clients to use Orka as a custom provider.

func NewOpenAICompatHandler

func NewOpenAICompatHandler(c client.Client, apiReader client.Reader, watchNamespace string, enforceNS bool, config ChatConfig, resolver *ProviderResolver, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *OpenAICompatHandler

NewOpenAICompatHandler creates an OpenAI-compatible API handler.

func (*OpenAICompatHandler) HandleChatCompletions

func (h *OpenAICompatHandler) HandleChatCompletions(c fiber.Ctx) error

HandleChatCompletions handles POST /openai/v1/chat/completions.

func (*OpenAICompatHandler) HandleListModels

func (h *OpenAICompatHandler) HandleListModels(c fiber.Ctx) error

HandleListModels handles GET /openai/v1/models.

type Pagination

type Pagination struct {
	Limit    int64
	Continue string
}

Pagination holds pagination parameters

func ParsePagination

func ParsePagination(limitStr, continueToken string) (*Pagination, error)

ParsePagination parses pagination parameters from query strings

type ProviderResolutionInfo

type ProviderResolutionInfo struct {
	Name      string
	Namespace string
	Type      string
}

ProviderResolutionInfo contains the Provider CRD metadata selected for a request.

type ProviderResolver

type ProviderResolver struct {
	// contains filtered or unexported fields
}

ProviderResolver resolves LLM providers from Kubernetes CRDs and secrets. It consolidates provider lookup, API key resolution, and provider construction logic shared by the chat, OpenAI-compat, and Anthropic-compat handlers.

func NewProviderResolver

func NewProviderResolver(c client.Client, config ChatConfig) *ProviderResolver

NewProviderResolver creates a new ProviderResolver.

func (*ProviderResolver) LookupProvider

func (r *ProviderResolver) LookupProvider(ctx context.Context, name, namespace string) (*corev1alpha1.Provider, error)

LookupProvider fetches a Provider CRD by name and namespace.

func (*ProviderResolver) Resolve

func (r *ProviderResolver) Resolve(ctx context.Context, opts ResolveOpts) (llm.Provider, string, error)

Resolve finds the appropriate LLM provider and model for a request. It handles provider/model string parsing, Kubernetes secret resolution, and provider construction.

When AgentRef or ProviderName is set, provider lookups are fatal (errors are returned). Otherwise, intermediate lookups are non-fatal and fall through to defaults.

func (*ProviderResolver) ResolveAPIKey

func (r *ProviderResolver) ResolveAPIKey(ctx context.Context, providerCRD *corev1alpha1.Provider) (string, error)

ResolveAPIKey extracts the API key from a Provider CRD's secret reference.

func (*ProviderResolver) ResolveWithInfo

ResolveWithInfo finds the appropriate LLM provider and model for a request, and also returns the selected Provider CRD metadata.

type ResolveOpts

type ResolveOpts struct {
	ProviderName string // explicit provider name (chat handler)
	ModelStr     string // "provider/model" format or plain model (compat handlers)
	Model        string // explicit model override (chat handler)
	AgentRef     string // agent reference for agent-based resolution (chat handler)
	Namespace    string
	RequireModel bool // return error if model is empty after resolution
	// RequireExplicitProvider disables every implicit Provider selection,
	// including configured, default-named, and sole-ready Providers. Handlers
	// set it for context-token requests so every request without an explicit
	// Provider or Agent-bound Provider has the same outcome.
	RequireExplicitProvider bool
	// AuthorizeProviderReference runs on an explicitly named Provider before
	// its credential is read or any implicit selection happens. It receives
	// the loaded Provider's metadata (name, namespace, type) so type-based
	// grants apply; when the Provider does not exist it receives the name
	// only, and its rejection is returned in place of the not-found error so
	// missing and unauthorized names stay indistinguishable to scoped
	// callers.
	AuthorizeProviderReference func(ProviderResolutionInfo) error
	// AuthorizeProviderUse runs after the effective model is known but before
	// the Provider credential is read.
	AuthorizeProviderUse func(ProviderResolutionInfo, string) error
}

ResolveOpts configures how a provider is resolved.

type SSEEvent

type SSEEvent struct {
	SessionID string `json:"sessionId"`
	Content   string `json:"content,omitempty"`
	ToolCall  any    `json:"toolCall,omitempty"`
	Error     any    `json:"error,omitempty"`
	Usage     any    `json:"usage,omitempty"`
}

SSEEvent is the payload for server-sent events during streaming.

type SecretNameResponse

type SecretNameResponse struct {
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
	Type      string `json:"type"`
}

SecretNameResponse is a minimal representation of a Secret for dropdown lists

type Server

type Server struct {
	ResultStore         store.ResultStore
	SessionStore        store.SessionStore
	PlanStore           store.PlanStore
	MessageStore        store.MessageStore
	ArtifactStore       store.ArtifactStore
	MemoryStore         store.MemoryStore
	MemoryProposalStore store.MemoryProposalStore
	ExecutionEventStore store.ExecutionEventStore
	GatewayEventStore   store.GatewayEventStore
	// contains filtered or unexported fields
}

Server is the REST API server

func NewServer

func NewServer(c client.Client, sessionManager *controller.SessionManager, config ServerConfig) *Server

NewServer creates a new API server

func (*Server) RegisterACPMCPBroker added in v0.2.0

func (s *Server) RegisterACPMCPBroker(broker *controller.ACPMCPBroker) error

RegisterACPMCPBroker installs the prompt-scoped broker on this API server.

func (*Server) Start

func (s *Server) Start(ctx context.Context) error

Start starts the API server

type ServerConfig

type ServerConfig struct {
	Port                      int
	WatchNamespace            string
	ExecutionMode             executionmode.Mode
	EnforceNamespaceIsolation bool
	OIDC                      OIDCConfig
	ContextTokens             ContextTokenConfig
	ContextTokenAuthorization ContextTokenAuthorizationConfig
	Chat                      ChatConfig
	ResultStore               store.ResultStore
	SessionStore              store.SessionStore
	PlanStore                 store.PlanStore
	MessageStore              store.MessageStore
	ArtifactStore             store.ArtifactStore
	ArtifactReservations      artifactcap.CapabilityReservationRecorder
	AgentExecutionSnapshots   store.AgentExecutionSnapshotStore
	ExternalEffects           store.ExternalEffectIdentityReader
	MemoryStore               store.MemoryStore
	MemoryProposalStore       store.MemoryProposalStore
	SecurityStore             store.SecurityStore
	RepositoryMonitorStore    store.RepositoryMonitorStore
	ExecutionEventStore       store.ExecutionEventStore
	GatewayEventStore         store.GatewayEventStore
	GatewayDeliveryStore      store.GatewayDeliveryStore
	GatewayService            *gatewayruntime.Service
	HealthChecker             store.HealthChecker
	Clientset                 kubernetes.Interface
	APIReader                 client.Reader
	TaskProvenanceProtected   bool
	ControllerEpochs          ControllerEpochFenceSource
	E2EPromptFaultEnabled     bool
}

ServerConfig holds configuration for the API server

type SessionExecutionEventResponse

type SessionExecutionEventResponse struct {
	ExecutionEventResponse
	TaskSeq      int64  `json:"taskSeq"`
	TaskStreamID string `json:"taskStreamID"`
}

SessionExecutionEventResponse is the public representation of a task-derived session event. Seq is the session-level cursor; taskSeq is the source task stream sequence.

func NewSessionExecutionEventResponse

func NewSessionExecutionEventResponse(event store.SessionExecutionEvent) SessionExecutionEventResponse

NewSessionExecutionEventResponse converts an aggregated store event to a session DTO.

type StreamOptions

type StreamOptions struct {
	IncludeUsage bool `json:"include_usage,omitempty"`
}

StreamOptions holds stream-specific options.

type SubmitExecutionEventRequest

type SubmitExecutionEventRequest struct {
	Type        string                           `json:"type"`
	Severity    string                           `json:"severity,omitempty"`
	TaskName    string                           `json:"taskName,omitempty"`
	SessionName string                           `json:"sessionName,omitempty"`
	AgentName   string                           `json:"agentName,omitempty"`
	ToolName    string                           `json:"toolName,omitempty"`
	ToolCallID  string                           `json:"toolCallID,omitempty"`
	Summary     string                           `json:"summary,omitempty"`
	Content     json.RawMessage                  `json:"content,omitempty"`
	ContentText string                           `json:"contentText,omitempty"`
	Truncation  *events.ExecutionEventTruncation `json:"truncation,omitempty"`
}

SubmitExecutionEventRequest is the internal worker submission DTO. Unknown JSON fields are ignored by Go's standard decoder; route handlers can opt into strict decoding later by using json.Decoder.DisallowUnknownFields.

func (SubmitExecutionEventRequest) ToStoreEvent

func (r SubmitExecutionEventRequest) ToStoreEvent(namespace, streamType, streamID string) (*store.ExecutionEvent, error)

ToStoreEvent converts a submission DTO to the store-facing event contract.

type SubmitExecutionEventResponse

type SubmitExecutionEventResponse struct {
	ID        string    `json:"id"`
	Seq       int64     `json:"seq"`
	CreatedAt time.Time `json:"createdAt"`
}

SubmitExecutionEventResponse is returned after an event append succeeds.

type SystemPromptBuilder

type SystemPromptBuilder struct {
	// contains filtered or unexported fields
}

SystemPromptBuilder constructs the orchestrator system prompt with dynamic context from the cluster (agents, tools).

func NewSystemPromptBuilder

func NewSystemPromptBuilder(c client.Client, namespace string, availability ACPRuntimeAvailability) *SystemPromptBuilder

NewSystemPromptBuilder creates a new SystemPromptBuilder.

func (*SystemPromptBuilder) BuildSystemPrompt

func (b *SystemPromptBuilder) BuildSystemPrompt(ctx context.Context, userSystemPrompt string) (string, error)

BuildSystemPrompt assembles the full system prompt with dynamic context.

type TokenHeaderConfig

type TokenHeaderConfig struct {
	Name   string
	Scheme string
}

TokenHeaderConfig describes one HTTP header location from which a token can be extracted.

type ToolCallInfo

type ToolCallInfo struct {
	Name   string          `json:"name"`
	Args   json.RawMessage `json:"args"`
	Result json.RawMessage `json:"result"`
}

ToolCallInfo describes a tool invocation and its result.

type ToolExecutor

type ToolExecutor struct {
	// contains filtered or unexported fields
}

ToolExecutor executes orchestrator LLM tool calls by creating and managing Kubernetes resources (Tasks, Agents, Tools, Sessions).

func NewToolExecutor

func NewToolExecutor(c client.Client, sm *controller.SessionManager, namespace, sessionID, watchNamespace string, enforceNS bool, maxTasks int, toolTimeout time.Duration, rs store.ResultStore, kubeClientOpt ...kubernetes.Interface) *ToolExecutor

NewToolExecutor creates a new ToolExecutor.

func (*ToolExecutor) Execute

func (e *ToolExecutor) Execute(ctx context.Context, toolCall llm.ToolCall) (string, error)

Execute dispatches a tool call to the appropriate handler and returns the JSON-serialized result.

func (*ToolExecutor) SetAgentCreateAuthorizer

func (e *ToolExecutor) SetAgentCreateAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)

SetAgentCreateAuthorizer installs an authorization hook for tools that create Agents.

func (*ToolExecutor) SetAgentDeleteAuthorizer

func (e *ToolExecutor) SetAgentDeleteAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)

SetAgentDeleteAuthorizer installs an authorization hook for tools that delete Agents.

func (*ToolExecutor) SetAgentUpdateAuthorizer

func (e *ToolExecutor) SetAgentUpdateAuthorizer(authorize func(context.Context, *corev1alpha1.Agent) error)

SetAgentUpdateAuthorizer installs an authorization hook for tools that update Agents.

func (*ToolExecutor) SetAllowedTools

func (e *ToolExecutor) SetAllowedTools(allowedTools []llm.Tool)

SetAllowedTools restricts execution to the tools exposed and authorized for the current request. When SetAllowedTools is not called, execution is unrestricted; an empty allowlist intentionally denies all tool calls.

func (*ToolExecutor) SetExecutionMode added in v0.2.0

func (e *ToolExecutor) SetExecutionMode(mode executionmode.Mode)

SetExecutionMode supplies the immutable installation mode used by trusted Agent-producing chat tools.

func (*ToolExecutor) SetPolicyReader added in v0.2.0

func (e *ToolExecutor) SetPolicyReader(reader client.Reader)

SetPolicyReader supplies the authoritative reader used by coordination tools.

func (*ToolExecutor) SetSecretReadAuthorizer

func (e *ToolExecutor) SetSecretReadAuthorizer(authorize func(context.Context, string, string) error)

SetSecretReadAuthorizer installs an authorization hook for tools that read Secrets.

func (*ToolExecutor) SetTaskCreateAuthorizer

func (e *ToolExecutor) SetTaskCreateAuthorizer(authorize func(context.Context, *corev1alpha1.Task) error)

SetTaskCreateAuthorizer installs an authorization hook for tools that create Tasks.

func (*ToolExecutor) SetTaskDeleteAuthorizer

func (e *ToolExecutor) SetTaskDeleteAuthorizer(authorize func(context.Context, *corev1alpha1.Task) error)

SetTaskDeleteAuthorizer installs an authorization hook for tools that delete Tasks.

type ToolResult

type ToolResult struct {
	Success    bool   `json:"success"`
	Data       any    `json:"data,omitempty"`
	Error      string `json:"error,omitempty"`
	ErrorType  string `json:"errorType,omitempty"`
	Suggestion string `json:"suggestion,omitempty"`
}

ToolResult represents the result of a tool execution.

type UpdateAgentRequest

type UpdateAgentRequest struct {
	Spec corev1alpha1.AgentSpec `json:"spec"`
}

UpdateAgentRequest is the request body for updating an agent

type UpdateProviderRequest

type UpdateProviderRequest struct {
	Spec corev1alpha1.ProviderSpec `json:"spec"`
}

type UpdateRepositoryMonitorRequest

type UpdateRepositoryMonitorRequest struct {
	Spec corev1alpha1.RepositoryMonitorSpec `json:"spec"`
}

type UpdateRepositoryScanRequest

type UpdateRepositoryScanRequest struct {
	Spec corev1alpha1.RepositoryScanSpec `json:"spec"`
}

type UpdateSkillRequest

type UpdateSkillRequest struct {
	Spec corev1alpha1.SkillSpec `json:"spec"`
}

UpdateSkillRequest is the request body for updating a skill

type UpdateSubstrateActorPoolRequest

type UpdateSubstrateActorPoolRequest struct {
	Spec corev1alpha1.SubstrateActorPoolSpec `json:"spec"`
}

type UpdateThreatModelRequest

type UpdateThreatModelRequest struct {
	Content string `json:"content"`
	Source  string `json:"source,omitempty"`
}

type UpdateToolRequest

type UpdateToolRequest struct {
	Spec corev1alpha1.ToolSpec `json:"spec"`
}

type UserInfo

type UserInfo struct {
	Username  string
	UID       string
	Groups    []string
	Extra     map[string]authenticationv1.ExtraValue
	Namespace string // Extracted from ServiceAccount username (system:serviceaccount:<ns>:<name>)

	AuthType     string
	Subject      string
	Email        string
	Issuer       string
	Roles        []string
	ContextToken *ContextToken
}

UserInfo contains information about the authenticated user.

func GetUserInfo

func GetUserInfo(ctx fiber.Ctx) *UserInfo

GetUserInfo retrieves user info from the context

Source Files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL