feat: the orchestrating agent

Entry point for the estate: understands a request, consults the specialists
that can settle it, composes one answer. LangGraph 1.2.11, a2a-sdk 1.1.2, both
current as of August 2026.

It holds no data, and the realm is what enforces that rather than the prompt.
classic-models-agent-assistant is granted two optional scopes — one per
specialist, plus the inference endpoint — and every domain audience it could
request comes back Invalid scopes. An injection that succeeds here finds no
path to a domain because there is none. "No scopes at all" was too absolute:
the agent has to reason, and inference is not a domain.

The two-hop token chain was the heaviest unproven thing in the design and it
holds: sub stays the end user through all four hops, so their own roles apply
at the far end and the MCP server filters tool discovery for the right human.
azp names the last agent, not the first — Keycloak accepts actor_token and
emits no act claim, so an orchestrator's identity survives only in the traces.

Verified end to end: a routed question answered from the specialist's data; a
question outside every remit refused rather than answered from memory; and a
write proposed through the orchestrator, held by the specialist in
input-required, relayed here unchanged, approved by the user through the same
conversation, and written. The orchestrator never owns that decision.

The graph is plan → delegate → plan, tools described by what a specialist
decides rather than what it holds, delegations in one step run concurrently and
capped at eight counted in calls. Rebuilt per turn, because its tools carry the
user's token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/bootstrap-kustomization.yaml

@@ -0,0 +1,33 @@
+# Watches ./dev, so the GitRepository and the Kustomization below it reconcile
+# from git like any other manifest. It lives in ./dev itself, so it also manages
+# itself — the arrangement `flux bootstrap` sets up, which flux-operator does
+# not create, and the same one the platform repos use.
+#
+# It sits in the agents namespace, not flux-system: a sourceRef resolves in the
+# Kustomization's own namespace, and this is the agent team's to own.
+#
+# Two manual applies, once, to close the loop — nothing can watch ./dev until
+# the source that serves it exists. The `agents` namespace already exists; it is
+# created by the catalogue agent's repo.
+#
+#   kubectl apply -f dev/gitrepository.yaml
+#   kubectl apply -f dev/bootstrap-kustomization.yaml
+#
+# After that every file in this repo, this one included, reconciles from git.
+#
+# Sharp edge: with prune enabled, deleting flux-kustomization.yaml from git
+# deletes the Kustomization it defines, and that Kustomization's own prune then
+# removes the whole deployment. Correct GitOps behaviour, blast radius two
+# levels deep.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: assistant-agent-bootstrap
+  namespace: agents
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: assistant-agent
+  path: ./dev
+  prune: true

dev/flux-kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: assistant-agent
+  namespace: agents
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: assistant-agent
+  path: ./k8s
+  prune: true
+  wait: true
+  timeout: 3m

dev/gitrepository.yaml

@@ -0,0 +1,18 @@
+# HTTPS with no credentials, unlike the platform repos which use SSH and a
+# deploy key from Vault. Deliberate: this repo is already anonymously readable over
+# HTTPS on gitea, so a deploy key would guard nothing while adding a Vault entry
+# and a gitea key to create by hand before anything deploys. TLS still gives
+# integrity and authenticity of the source.
+#
+# If the gitea repos are ever made private, this becomes an SSH sourceRef with
+# an ExternalSecret holding the deploy key — the pattern the platform repos use.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: assistant-agent
+  namespace: agents
+spec:
+  interval: 5m
+  url: https://gitea.sttlab.eu/stt/classic-models-agent-assistant.git
+  ref:
+    branch: main