toki
31fada5d08
공식 리뷰가 지적한 두 가지 승인 경계 결함을 고친다. `plan_file`/`review_file`은
edge.yaml 디렉터리 기준 상대 경로만 허용하고 절대/빈 경로는 파일 접근 전에 거부한다.
필수 heading과 Review `PASS`는 부분 문자열이 아니라 정확한 단독 줄로 검증하며,
문서화된 placeholder를 제거한 뒤 남는 `{{`/`}}`를 거부해 문법을 닫는다.
리뷰가 존재한다고 기술했지만 실제로는 없던 회귀 근거를 추가한다. admission 시
고정된 effective 템플릿 쌍이 clone과 workspace 재검증을 통과하는지, refresh가
이미 승인된 요청이 아니라 새 요청에만 적용되는지, custom Review 템플릿이 내부
artifact만 바꾸고 caller 최종 출력은 그대로인지를 각각 확정 검증한다.
현재 문서도 실제 동작에 맞춘다. Edge 실행 spec의 낡은 Plan JSON Schema 서술을
direct PlanMD 검증으로 고치고, outer Anthropic 계약과 input spec에 템플릿이
Edge 내부 stage 입력일 뿐 caller 요청/응답 계약을 바꾸지 않음을 명시한다.
Refs: agent-task/single_request_plan_review_templates/PLAN-cloud-G08.md
27 lines
5.6 KiB
Markdown
27 lines
5.6 KiB
Markdown
# Agent Contract Index
|
|
|
|
## 읽기 규칙
|
|
|
|
- 현재 작업이 API, wire protocol, 런타임 호출, event/config schema, 프로젝트 간 또는 내부 프로세스/컴포넌트 간 요청/응답 계약에 닿을 때만 이 문서를 사용한다.
|
|
- 매칭되는 계약 문서만 읽는다.
|
|
- 계약 문서 경로가 없으면 계약을 추정하지 않고 사용자에게 확인한다.
|
|
- 계약 원문은 `agent-contract/outer/**` 또는 `agent-contract/inner/**` 한 곳에 둔다.
|
|
- `docs/`, `README`, `rules.md`에는 계약 원문을 복제하지 않고 계약 원문 경로만 둔다.
|
|
|
|
## Outer Contracts
|
|
|
|
| id | 읽는 조건 | 원본 경로 | path |
|
|
|----|-----------|-----------|------|
|
|
| `iop.openai-compatible-api` | OpenAI-compatible API, Responses API, Chat Completions, legacy Completions, error envelope/SSE terminal error, `model` route, managed projection principal auth and slot-route binding, managed-versus-legacy provider credential selection, model-driven passthrough/normalized routing, provider-pool admission/unavailable error, safe credential-slot attribution, standard metadata, and provider-native extension fields such as `chat_template_kwargs` | `apps/edge/internal/openai/*`, `apps/edge/internal/authprojection/*`, `apps/edge/internal/service/provider_tunnel.go`, `packages/go/config/config.go`, `configs/edge.yaml` | `agent-contract/outer/openai-compatible-api.md` |
|
|
| `iop.anthropic-compatible-api` | Anthropic Messages API, count_tokens, models list, bearer or `X-Api-Key` principal auth, active managed projection auth and slot-route binding, `anthropic-version` routing, native Anthropic tunnel, Chat bridge, provider-pool-only admission, profile capability checks, managed-versus-legacy provider credentials, marked-preset single-request admission with Edge-owned internal Plan/Review template customization that leaves caller I/O unchanged, and current no-OpenAI-metric status | `apps/edge/internal/openai/anthropic_handler.go`, `apps/edge/internal/openai/anthropic_native.go`, `apps/edge/internal/openai/anthropic_bridge.go`, `apps/edge/internal/openai/anthropic_stream.go`, `apps/edge/internal/openai/anthropic_types.go`, `apps/edge/internal/openai/routes.go`, `apps/edge/internal/openai/principal.go`, `apps/edge/internal/authprojection/*`, `apps/edge/internal/openai/provider_tunnel.go`, `apps/edge/internal/openai/provider_model_rewrite.go`, `apps/edge/internal/openai/single_request_preset_binding.go`, `apps/edge/internal/openai/single_request_plan_stage.go`, `apps/edge/internal/openai/single_request_review_stage.go`, `packages/go/singlerequesttemplate/template.go`, `packages/go/config/protocol_profile.go` | `agent-contract/outer/anthropic-compatible-api.md` |
|
|
| `iop.a2a-json-rpc-api` | A2A JSON-RPC API, `message/send`, `tasks/get`, `tasks/cancel`, A2A task state, agent card, `a2a.bearer_token`, Edge A2A input surface | `apps/edge/internal/input/a2a/*`, `packages/go/config/config.go`, `configs/edge.yaml` | `agent-contract/outer/a2a-json-rpc-api.md` |
|
|
|
|
## Inner Contracts
|
|
|
|
| id | 읽는 조건 | 원본 경로 | path |
|
|
|----|-----------|-----------|------|
|
|
| `iop.edge-node-runtime-wire` | Edge-Node mTLS/protobuf, workload identity, Node initial/reconnect supervision, connection generation fencing, `RegisterRequest`, `NodeReadyRequest`, `RunRequest`, `RunEvent`, signed/sealed `CredentialLease`, `CredentialLeaseBinding`, `ProviderTunnelRequest`, `ProviderTunnelFrame`, cancel, command, and config payload/refresh | `proto/iop/runtime.proto`, `apps/edge/internal/transport/*`, `apps/node/internal/transport/*`, `apps/node/internal/bootstrap/runtime_supervisor.go`, `apps/node/internal/node/tunnel_handler.go`, `apps/edge/internal/node/mapper.go`, `apps/node/internal/adapters/config_set.go` | `agent-contract/inner/edge-node-runtime-wire.md` |
|
|
| `iop.control-plane-edge-wire` | Control Plane-Edge mTLS wire, authenticated workload identity, `EdgeHello*`, active `PrincipalProjection*` hello/refresh, authenticated `AcquireLease*`, status/command/event relay, Edge connection registry, and configured offline Node/provider snapshot | `proto/iop/control.proto`, `apps/control-plane/internal/wire/*`, `apps/control-plane/internal/credentialstore/projection.go`, `apps/control-plane/internal/credentiallease/*`, `apps/edge/internal/authprojection/*`, `apps/edge/internal/controlplane/*` | `agent-contract/inner/control-plane-edge-wire.md` |
|
|
| `iop.client-control-plane-wire` | Client-Control Plane `/client` WebSocket hello plus the adjacent server-authenticated credential HTTPS, principal bearer authorization, host-local bootstrap, and slot/route lifecycle boundary | `proto/iop/control.proto`, `apps/control-plane/internal/wire/client.go`, `apps/control-plane/cmd/control-plane/credential_http_handlers.go`, `apps/client/lib/iop_wire/*` | `agent-contract/inner/client-control-plane-wire.md` |
|
|
| `iop.edge-config-runtime-refresh` | Edge config schema, provider pool, protocol profiles, `credential_plane`, managed-versus-legacy auth exclusivity, required TLS/key material, `models[]`, `nodes[].providers[]`, `openai.model_routes`, and restart/applied refresh classification | `packages/go/config/edge_types.go`, `packages/go/config/provider_types.go`, `packages/go/config/load.go`, `packages/go/config/validate.go`, `configs/edge.yaml`, `apps/edge/internal/configrefresh/*`, `proto/iop/runtime.proto` | `agent-contract/inner/edge-config-runtime-refresh.md` |
|
|
| `iop.execution-runtime` | Host-neutral provider lifecycle, execution events, typed failures, cancellation, usage, registry, tunnel, and closed provider commands | `packages/go/execution/*`, `apps/node/internal/node/runtime_bridge.go` | `agent-contract/inner/execution-runtime.md` |
|