docs(openspec): add agent feature sets native add-on framework proposal #3447
No reviewers
Labels
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
carverauto/serviceradar!3447
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/3425-agent-feature-sets-proposal"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
OpenSpec change add-agent-feature-sets for issue #3425: a signed, discoverable framework for selectable native agent add-ons. Delivery models compiled-in / pushed-artifact / os-package; supervision config-toggle / agent-sidecar / systemd-service / systemd-timer / ephemeral-helper; an Edge Ops selection+targeting UI; and a control-plane catalog, modeled on the WASM plugin DevX.
Defines the contract that bumblebee, host-network-visibility/netprobe, and remote-access are retrofitted onto in follow-ups. Proposal/design/tasks + 18 requirements across new agent-feature-sets and native-addon-builds capabilities plus agent-config, agent-configuration, build-web-ui, agent-registry. Passes openspec validate --strict.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
IMPORTANT: Please sign the Developer Certificate of Origin
Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:
Describe your changes
Issue ticket number and link
Code checklist before requesting a review
Slice 4 (native-addon-builds, bundle core). Adds build/native_addons mirroring build/wasm_plugins: an in-repo inventory (addon_inventory.bzl), a deterministic bundle assembler (assemble_addon_bundle.py), and a declare_native_addon_targets macro that cross-compiles each add-on's go_binary per architecture (rules_go go_cross_binary, linux/amd64 + arm64) and assembles {addon.yaml, config.schema.json, bin/<os>/<arch>/<binary>} into a zip + sha256 + metadata.json carrying a per-arch artifacts[] list. Verified: bazel build //build/native_addons:all_bundles produces sample_addon_bundle.zip (0755 binaries, 0644 manifest) with correct per-arch sha256 metadata. Signing (Cosign + ed25519 upload-signature, reusing the existing WASM key), the serviceradar-native-addon-index.json discovery index, the Forgejo release upload, and the web-ng verify-then-mirror importer reuse the WASM rails and are the follow-up (they need signing keys / a registry / a release runner, not runnable in this sandbox). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>Control-plane + agent review fixes for native add-on assignments: P1 config versioning: stable_addon_assignment no longer drops :binary_path from the config version hash. DependencyCatalog pushes AddonPackage binary/install_path changes, but the hash dropped binary_path, so an executable change kept the same config_version and polling agents got not_modified forever. The whole assignment map (now incl. binary_path, delivery, supervision) joins the hash; add-on assignments carry no per-poll volatile fields to strip (unlike plugins). Approved-capability subset: build_addon_assignment_config now prefers approved_capabilities over the package's full manifest list (new effective_addon_capabilities/1, mirroring plugin effective_capabilities), so an operator-narrowed grant is what reaches the agent. P2 explicit delivery/supervision dispatch: AddonAssignmentConfig gains delivery (8) and supervision (9) string fields (proto + regenerated monitoring.pb.go + hand-maintained monitoring.pb.ex). The generator emits them; the agent's applyAddonAssignments dispatches explicitly — only agent_sidecar runs as a supervised go-plugin; compiled_in/config_toggle/systemd_*/ephemeral_helper are logged ('supervision model not supported by this agent; assignment not applied') instead of silently skipping with a misleading 'no binary path', so desired-vs-observed stays honest. Empty fields default to pushed_artifact/agent_sidecar for older control planes. Also fixes a latent compile break: push_loop_test.go did not pass the addonManager arg added to buildAgentCapabilityGatewayStatus. go build/vet/test + gofmt green; serviceradar_core mix compile --warnings-as-errors green; .pb.ex proto round-trip verified (fields 8/9 stable, empty-default clean). DB-backed generator tests excluded (no Postgres in sandbox). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>The checklist read 0/45 despite the agent-sidecar spine being complete. Reconciled against the implementation (verified by a per-task code audit): 17 tasks marked done; the 28 remaining each carry a — Status note (partial / not-started / done-differently / deferred) pointing at the follow-up change that tracks it (add-native-addon-{build-signing,delivery-models,rust-sdk,edge-ops}). Notable done-differently calls: 5.3 (DependencyCatalog binds AddonAssignment/AddonPackage with :push_affected_agents under config_type :agent — add-ons ride in AgentConfigResponse — not a dedicated :addon type) and 5.4 (targeted delivery via assignment + agent config push). 1.2/1.4 closed by the docs added in this PR. openspec validate add-agent-feature-sets --strict passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>lgtm