# syntax=agentrc.agentfile/v0.1

# A code-review agent that extends the canonical "hello" example: inherits a
# hardened base, declares its identity and objective, projects one local tool, a
# remote skill, and an MCP server under /mnt, and asks the platform for a model,
# a tool timeout, and egress to GitHub. Cedar enforcement is entirely
# platform-side; credential resolution is deferred (platform-defined).

FROM ghcr.io/acme/pii-redacted-base:1.4

IDENTITY name=code-reviewer version=1.0 author=acme
IDENTITY description="Reviews pull requests for correctness, security, and clarity"

CAPABILITY text
CAPABILITY streaming
CAPABILITY function-calling

SOP <<EOF
You are a senior code reviewer.
Read the full diff before commenting. Group findings by severity.
Never approve while a required check is failing. Escalate anything ambiguous to a human.
EOF

CMD claude --print

# Tools — a local executable and a remote skill bundle
COPY --chmod=755 ./tools/file_read /mnt/tools/file_read
ADD --remote --cached --fail-if-unavailable \
    https://registry.example.com/skills/code-review:1.2.3 /mnt/skills/code-review

# MCP server, resolved on the target network at bootstrap
ADD --remote --runtime --fail-if-unavailable \
    mcp://registry.internal.acme/servers/github:latest /mnt/mcp/github

# Credentials (e.g. a GitHub token) are DEFERRED: this file names no secret and
# no resolution mechanism. The platform binds any required credential at run
# time (see the spec's "Secrets (deferred)" section).

# Model requests
POLICY model.name        claude-opus-4
POLICY model.min_context 200k
POLICY model.fallback    claude-sonnet-4

# Agent-side operational requests
POLICY agent.idle_timeout 5m
POLICY agent.tool_timeout 30s
POLICY agent.max_retries  3

# Network egress requests
POLICY network dns:api.github.com:443

HEALTHCHECK --interval=60s --timeout=15s --retries=3 CMD /mnt/tools/file_read --agentrc-schema

# ---------------------------------------------------------------------------
# Platform-scoped substrate + invocation auth (COMMENTED — illustrative only).
# Uncomment on a platform that enforces these. Commented lines never affect the
# build; a platform ignores substrate keys scoped to a different platform.
#
# AWS-scoped substrate requests (spec §8.7). Foreign platforms ignore these:
# POLICY substrate.aws.roleArn          arn:aws:iam::123456789012:role/code-reviewer
# POLICY substrate.aws.networkMode      awsvpc
# POLICY substrate.aws.securityGroup    sg-0a1b2c3d
# POLICY substrate.aws.subnet           subnet-0e1f2a3b
# POLICY substrate.aws.deployment.mode  container
#
# Generic, fail-closed invocation authorization (spec §8.8). Not a secret:
# POLICY agent.auth.mode                  jwt
# POLICY agent.auth.jwt.discovery_url     https://issuer.acme.example/.well-known/openid-configuration
# POLICY agent.auth.jwt.allowed_audience  code-reviewer-api
# POLICY agent.auth.jwt.allowed_client    acme-ci
# ---------------------------------------------------------------------------