Stéphane Tailland
8051b78647
Closes the last item on this agent's backlog. A reference about to be reordered is not a reference to discontinue, and the catalog's own quantity field does not say whether it is — that is the supply agent's decision, and it answers rather than handing back its stock table. One narrow tool, not a generic call_agent(name, text): a generic one lets the model reach any peer with any prompt, which is how an agent becomes a proxy onto its neighbours. The peer's token is minted per call for that peer alone, so an injection that talks this agent into consulting the wrong one fails at the realm. A peer ending in any state but completed is reported as such, never smoothed over: a specialist that escalated has not answered, and presenting its escalation as an answer is how a refusal turns into a fact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
77 lines
2.5 KiB
YAML
77 lines
2.5 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: catalogue-agent
|
|
namespace: agents
|
|
spec:
|
|
# One replica, and that is a constraint rather than a default. Conversation
|
|
# history — which the confirm-before-writing flow depends on — lives in the
|
|
# process, keyed by A2A contextId. A second replica would route the user's
|
|
# "yes" to a pod that never saw the question. Scaling out needs sticky routing
|
|
# on contextId or a shared store first.
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: catalogue-agent
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: catalogue-agent
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: agent
|
|
# gitea's own registry, not ghcr: the image sits beside the source it
|
|
# was built from, and the package inherits the repo's visibility. The
|
|
# repo is public, so the pull needs no credentials — which removes an
|
|
# imagePullSecret that would otherwise have to be created by hand in
|
|
# this namespace and kept in step with a GitHub token.
|
|
image: gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.3.0
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
envFrom:
|
|
- configMapRef:
|
|
name: catalogue-agent-config
|
|
- secretRef:
|
|
name: catalogue-agent-secrets
|
|
volumeMounts:
|
|
- name: sttlab-ca
|
|
mountPath: /etc/sttlab-ca
|
|
readOnly: true
|
|
# The Agent Card needs no auth and is served by the same app, so a 200
|
|
# means the A2A routes are genuinely mounted — not merely that the
|
|
# process is alive.
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /.well-known/agent-card.json
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /.well-known/agent-card.json
|
|
port: http
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 192Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumes:
|
|
- name: sttlab-ca
|
|
configMap:
|
|
name: sttlab-ca
|