Merge PR #3466: add authorized gateway smoke workflow with failure cleanup

2026-10-16 13:15:36 +02:00 · 2026-10-10 17:39:24 -04:00
parent e53dd0ea05 849456d57e
commit 37752df9e0
13 changed files with 102 additions and 17 deletions
@@ -11,7 +11,7 @@
    {
      "name": "ecc",
      "source": "./",
-      "description": "Harness-native ECC operator layer - 71 agents, 303 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
+      "description": "Harness-native ECC operator layer - 71 agents, 304 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
      "version": "2.2.3",
      "author": {
        "name": "Affaan Mustafa",
@@ -1,7 +1,7 @@
 {
  "name": "ecc",
  "version": "2.2.3",
-  "description": "Harness-native ECC plugin for engineering teams - 71 agents, 303 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
+  "description": "Harness-native ECC plugin for engineering teams - 71 agents, 304 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
  "author": {
    "name": "Affaan Mustafa",
    "url": "https://x.com/affaanmustafa"
@@ -4,7 +4,7 @@ This file provides Gemini CLI with the baseline ECC workflow, review standards,

 ## Overview

-ECC is a cross-harness coding system with 71 specialized agents, 303 skills, and 95 commands.
+ECC is a cross-harness coding system with 71 specialized agents, 304 skills, and 95 commands.

 Gemini support is currently focused on a strong project-local instruction layer via `.gemini/GEMINI.md`, plus the shared MCP catalog and package-manager setup assets shipped by the installer.

@@ -1,6 +1,6 @@
 # ECC — Agent Instructions

-This is a **production-ready AI coding plugin** providing 71 specialized agents, 303 skills, 95 commands, and automated hook workflows for software development.
+This is a **production-ready AI coding plugin** providing 71 specialized agents, 304 skills, 95 commands, and automated hook workflows for software development.

 **Version:** 2.2.3

@@ -202,7 +202,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat

 ```
 agents/          — 71 specialized subagents
-skills/          — 303 workflow skills and domain knowledge
+skills/          — 304 workflow skills and domain knowledge
 commands/        — 95 slash commands
 hooks/           — Trigger-based automations
 rules/           — Always-follow guidelines (common + per-language)
@@ -141,12 +141,12 @@ Instead of rebuilding that process in every prompt, you install it once and make

 ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity.

-Access to 71 agents, 303 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
+Access to 71 agents, 304 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.

 | Included         |       Count | What it gives you                                                                    |
 | ---------------- | ----------: | ------------------------------------------------------------------------------------ |
 | Agents           |   71 agents | Planning, review, build repair, security, architecture, and domain work              |
-| Skills           |  303 skills | TDD, research, security, docs, frontend, data, ML, operations, and more              |
+| Skills           |  304 skills | TDD, research, security, docs, frontend, data, ML, operations, and more              |
 | Commands         | 95 commands | Convenient entry points while ECC moves to a skills-first surface                    |
 | Hooks and memory |     Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls |
 | Rules            |   Selective | Always-loaded standards you choose by language or project                            |
@@ -828,7 +828,7 @@ Stable graduation of the 2.0 line: control-pane substrate, worktree lifecycle se
 ```text
 ECC/
 |-- agents/           # 71 specialized subagents for delegation
-|-- skills/           # 303 reusable workflows loaded on demand
+|-- skills/           # 304 reusable workflows loaded on demand
 |-- commands/         # 95 maintained slash-command shims
 |-- rules/            # opt-in common and language standards
 |-- hooks/            # runtime automation and enforcement
@@ -200,7 +200,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 /plugin list ecc@ecc
 ```

-**完成！** 你现在可以使用 71 个代理、303 个技能和 95 个命令。
+**完成！** 你现在可以使用 71 个代理、304 个技能和 95 个命令。

 ### multi-* 命令需要额外配置

@@ -1,7 +1,7 @@
 # Soul

 ## Core Identity
-ECC is a production-ready AI coding plugin with 71 specialized agents, 303 skills, 95 commands, and automated hook workflows for software development.
+ECC is a production-ready AI coding plugin with 71 specialized agents, 304 skills, 95 commands, and automated hook workflows for software development.

 ## Core Principles
 1. **Agent-First** — route work to the right specialist as early as possible.
@@ -1,6 +1,6 @@
 # ECC — 智能体指令

-这是一个**生产就绪的 AI 编码插件**，提供 71 个专业代理、303 项技能、95 条命令以及自动化钩子工作流，用于软件开发。
+这是一个**生产就绪的 AI 编码插件**，提供 71 个专业代理、304 项技能、95 条命令以及自动化钩子工作流，用于软件开发。

 **版本:** 2.2.3

@@ -147,7 +147,7 @@

 ```
 agents/          — 71 个专业子代理
-skills/          — 303 个工作流技能和领域知识
+skills/          — 304 个工作流技能和领域知识
 commands/        — 95 个斜杠命令
 hooks/           — 基于触发的自动化
 rules/           — 始终遵循的指导方针（通用 + 每种语言）
@@ -264,7 +264,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 /plugin list ecc@ecc
 ```

-**搞定！** 你现在可以使用 71 个智能体、303 项技能和 95 个命令了。
+**搞定！** 你现在可以使用 71 个智能体、304 项技能和 95 个命令了。

 ***

@@ -1178,7 +1178,7 @@ opencode
 |---------|---------------|----------|--------|
 | 智能体 | PASS: 71 个    | PASS: 12 个 | **Claude Code 领先** |
 | 命令 | PASS: 95 个    | PASS: 35 个 | **Claude Code 领先** |
-| 技能 | PASS: 303 项   | PASS: 37 项 | **Claude Code 领先** |
+| 技能 | PASS: 304 项   | PASS: 37 项 | **Claude Code 领先** |
 | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** |
 | 规则 | PASS: 29 条    | PASS: 13 条指令 | **Claude Code 领先** |
 | MCP 服务器 | PASS: 14 个    | PASS: 完整 | **完全对等** |
@@ -1286,7 +1286,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
 |---------|-----------------------|------------|-----------|----------|
 | **智能体** | 71                    | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
 | **命令** | 95                    | 共享 | 基于指令 | 35 |
-| **技能** | 303                   | 共享 | 10 (原生格式) | 37 |
+| **技能** | 304                   | 共享 | 10 (原生格式) | 37 |
 | **钩子事件** | 8 种类型                 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 |
 | **钩子脚本** | 20+ 个脚本               | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 |
 | **规则** | 34 (通用 + 语言)          | 34 (YAML 前页) | 基于指令 | 13 条指令 |
@@ -942,6 +942,7 @@
        "skills/autonomous-agent-harness",
        "skills/gan-style-harness",
        "skills/hermes-imports",
+        "skills/agent-runtime-gateway-smoke-test",
        "skills/openclaw-persona-forge",
        "skills/opensource-pipeline",
        "skills/orch-add-feature",
@@ -475,7 +475,8 @@
    "!**/*.pyd",
    "!**/.pytest_cache/**",
    "skills/conventional-commit-review/",
-    "skills/brownfield-retrospective/"
+    "skills/brownfield-retrospective/",
+    "skills/agent-runtime-gateway-smoke-test/"
  ],
  "bin": {
    "ecc": "scripts/ecc.js",
@@ -0,0 +1,83 @@
+---
+name: agent-runtime-gateway-smoke-test
+description: Verify a local agent API, temporary gateway tunnel, and remote sandbox callback with a tool-free task, then restore the original app connection.
+metadata:
+  origin: ECC
+---
+
+# Agent Runtime Gateway Smoke Test
+
+Use this workflow when an agent task runs in a remote sandbox that calls back to a local API through a gateway. It verifies the whole path without relying on connected tools or private production data.
+
+## When to Activate
+
+- A local agent API needs an end-to-end runtime check.
+- A task stalls after dispatch and the gateway or tunnel may be unreachable.
+- A web app is temporarily pointed at a local API for agent testing.
+- A previous test left the web app pointing at a stopped API.
+
+## Required Inputs
+
+- Repository-relative instructions for starting the API and web app.
+- The gateway route path and its expected anonymous response.
+- An isolated test agent, a tool-free prompt, and its exact expected answer.
+- A way to inspect task status and confirm a callback reached the local API.
+- Provider credentials, supplied through the project's normal secret store. Name the providers in shared documentation; never copy credential values into the skill or test report.
+
+If these inputs are unavailable, report the missing input instead of guessing an endpoint or using a real account.
+
+## Authorization and Cleanup
+
+Confirm authorization to expose the local test API through the selected tunnel provider, dispatch the test task, and temporarily change the web app route. Use an isolated local web app or test deployment; do not switch a shared production app as part of this smoke test. Keep tunnel access scoped to the required authenticated route.
+
+Install cleanup before changing the route: on success, error, timeout, interruption, or cancellation, restore the recorded target and verify health before stopping the API and tunnel. Track only the process IDs or resources created by this test. If restoration fails, report it immediately and keep the evidence needed to recover; do not claim success.
+
+## Smoke Test
+
+1. **Record and check the original route.** Note the web app's current API target and verify it is healthy. Keep this value locally for restoration. Confirm the test agent and data are isolated from real users.
+2. **Start the local API and tunnel.** Use a process manager that will keep both alive for the full test. Verify API health. Probe the gateway route anonymously and confirm the documented authentication response, usually `401` or `403`. Confirm the probe appears in the local API log; an edge response alone does not prove the API was reached.
+3. **Switch the web app only after both checks pass.** Verify a request from the web app reaches the local API. Check the route again after any web server restart or configuration reload.
+4. **Run one tool-free task.** Use a short prompt with an exact expected answer. Confirm the remote sandbox called the local gateway, the task reached a terminal state, and the returned answer matches. A queued or running task is not a pass.
+5. **Restore the original route.** Set the web app back to its recorded API target, verify that target and a representative page load, then stop the test API and tunnel. If restoration fails, report the broken route immediately.
+
+Example checks, with values supplied by the project:
+
+```sh
+curl --silent --show-error --output /dev/null --write-out '%{http_code}\n' "$LOCAL_API_HEALTH_URL"
+curl --silent --show-error --output /dev/null --write-out '%{http_code}\n' "$PUBLIC_GATEWAY_PROBE_URL"
+```
+
+The first command should return the project's healthy status. The second should return the documented anonymous authentication status **and** appear in the local API log. Do not put a credential in either URL.
+
+## Connected Tool Follow-up
+
+Run a separate test only after the tool-free task passes. Use an explicit test connection and grants. Report connection presence and actions granted as different facts. Do not infer that an empty action search means no app is connected. Do not execute a write action against a real account as a smoke test.
+
+## Failure Handling
+
+| Observation | Next check |
+| --- | --- |
+| Web page loads but API requests fail | Compare the configured API target with the listening process and restore the original route. |
+| Gateway probe gets a connection error or `404` | Check tunnel lifetime, route path, and local API health before dispatching a task. |
+| Gateway probe gets `401` or `403`, but no local log entry | The response may come from the tunnel edge; verify the callback path. |
+| Task stays queued or running | Check whether another dispatcher claimed it and whether the sandbox reached the local gateway. |
+| Task finishes with the wrong answer | Capture the task status and redacted error; do not call the smoke test successful. |
+
+## Output Contract
+
+Return a short report with:
+
+- Local API healthy: yes or no
+- Gateway probe status and local log confirmation
+- Remote callback observed: yes or no
+- Tool-free task terminal status and whether the exact answer matched
+- Original web API route restored and healthy: yes or no
+- One unresolved blocker or next action, if any
+
+Keep account details, credential values, personal paths, public tunnel URLs, and raw private logs out of the report. Keep the source operator notes local.
+
+## Related Skills
+
+- `hermes-imports` for sanitizing a local workflow before sharing it.
+- `agent-introspection-debugging` when an agent run fails repeatedly.
+- `verification-loop` after changing runtime code.