Skip to content

feat(agents): govern implement with the mctl-api approvals backend #2105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mashkovd merged 1 commit into from
Oct 23, 2026
Merged

feat(agents): govern implement with the mctl-api approvals backend #2105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-implement.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@
echo "✓ gitops cloned"
resources:
requests: { cpu: 50m, memory: 64Mi, ephemeral-storage: 10Gi }
limits: { cpu: 500m, memory: 256Mi, ephemeral-storage: 11Gi }

Check warning on line 398 in platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-implement.yaml

View workflow job for this annotation

GitHub Actions / yamllint 

398:22 [colons] too many spaces after colon
volumeMounts:
- name: workdir
mountPath: /workdir
Expand Down Expand Up @@ -714,6 +714,16 @@
name: mctl-agents-secrets
key: mctl-token
optional: true
# Policy checkpoint approvals backend (ADR 014; mctlhq/.github#181,
# mctl-gitops#1980), as on investigate: a non-read mcp__mctl__* call
# creates or redeems a durable approval request in mctl-api instead
# of being blocked outright. Authenticates with MCTL_TOKEN; needs
# mctl-agents >= 1.86.1. Must stay a literal (see
# platform-gitops/governance/policy-checkpoint-coverage.yaml).
# Rollback: remove it (REQUIRE_APPROVAL then blocks) and mark the
# manifest entry governed: false with a tracked_by.
- name: MCTL_POLICY_APPROVALS
value: mctl-api
# Usage-writer token (mctlhq/.github#50): the only credential the
# usage producer may use to append this run's model-usage records
# to mctl-api. It may do nothing else there. Optional: absent (the
Expand Down Expand Up @@ -817,7 +827,7 @@
# the realistic level, not the peak; the 8Gi limit stays, it is what
# keeps a `go build` run from being OOMKilled.
requests: { cpu: 200m, memory: 3Gi, ephemeral-storage: 10Gi }
limits: { cpu: 3000m, memory: 8Gi, ephemeral-storage: 11Gi }

Check warning on line 830 in platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-implement.yaml

View workflow job for this annotation

GitHub Actions / yamllint 

830:20 [colons] too many spaces after colon
volumeMounts:
- name: workdir
mountPath: /workdir
Expand Down
1 change: 0 additions & 1 deletion platform-gitops/governance/policy-checkpoint-coverage.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,6 @@ surfaces:
path: argo-workflows/cluster-templates/cwft-mctl-agents-implement.yaml
template: run-implementer
governed: true
rollout: staged
- id: shepherd
kind: cwft
path: argo-workflows/cluster-templates/cwft-mctl-agents-shepherd.yaml
Expand Down
Loading