Skip to content

fix(agents): return investigate run tokens to observe #2086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mashkovd merged 1 commit into from
Oct 23, 2026
+4 −4
Merged

fix(agents): return investigate run tokens to observe #2086

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,7 +399,7 @@
echo "✓ gitops cloned"
resources:
requests: { cpu: 50m, memory: 64Mi, ephemeral-storage: 4Gi }
limits: { cpu: 500m, memory: 256Mi, ephemeral-storage: 5Gi }

Check warning on line 402 in platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml

View workflow job for this annotation

GitHub Actions / yamllint 

402:22 [colons] too many spaces after colon
volumeMounts:
- name: workdir
mountPath: /workdir
Expand Down Expand Up @@ -809,11 +809,11 @@
# that mctl-api only counts. enforce connects MCP with the run
# token and fails the run if the exchange fails. Needs mctl-api
# with the exchange enabled and an agent image with run_token.py;
# an older image ignores it. Enforce since observe showed every
# exchange succeed and the shadow scope refuse nothing; the pod's
# REST clients still use MCTL_TOKEN (mctlhq/mctl-agents#752).
# an older image ignores it. Back to observe: investigate runs
# submitted without an execution_id cannot be bound to a run token,
# so enforce failed them (mctlhq/mctl-agents#752).
- name: MCTL_RUN_TOKEN_MODE
value: enforce
value: observe
- name: MCTL_RUN_TOKEN_SA_TOKEN_FILE
value: /var/run/secrets/mctl-api/token
# Usage-writer token (mctlhq/.github#50): the only credential the
Expand Down Expand Up @@ -895,7 +895,7 @@
# (container_memory_working_set_bytes, 2026-10-10), so 4Gi keeps ~5x
# headroom. cwft-mctl-agents-implement keeps 8Gi: it does use it.
requests: { cpu: 200m, memory: 1Gi, ephemeral-storage: 4Gi }
limits: { cpu: 2000m, memory: 4Gi, ephemeral-storage: 5Gi }

Check warning on line 898 in platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml

View workflow job for this annotation

GitHub Actions / yamllint 

898:20 [colons] too many spaces after colon
volumeMounts:
- name: workdir
mountPath: /workdir
Expand Down Expand Up @@ -994,7 +994,7 @@
echo "✓ gitops cloned (fresh checkout, never touched by the agent)"
resources:
requests: { cpu: 50m, memory: 64Mi, ephemeral-storage: 4Gi }
limits: { cpu: 500m, memory: 256Mi, ephemeral-storage: 5Gi }

Check warning on line 997 in platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml

View workflow job for this annotation

GitHub Actions / yamllint 

997:22 [colons] too many spaces after colon
volumeMounts:
- name: workdir
mountPath: /workdir
Expand Down Expand Up @@ -1194,7 +1194,7 @@
# push it into DiskPressure.
resources:
requests: { cpu: 50m, memory: 64Mi, ephemeral-storage: 4Gi }
limits: { cpu: 500m, memory: 256Mi, ephemeral-storage: 5Gi }

Check warning on line 1197 in platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml

View workflow job for this annotation

GitHub Actions / yamllint 

1197:20 [colons] too many spaces after colon
volumeMounts:
- name: workdir
mountPath: /workdir
Expand Down
Loading