-
Notifications
You must be signed in to change notification settings - Fork 10
RFC 0001: autonomous agent self-service provisioning (+ Phase 0 create_project) - #352
RFC 0001: autonomous agent self-service provisioning (+ Phase 0 create_project) #352padak wants to merge 2 commits into
Conversation
Decomposes 'an AI agent creates and pays for a Keboola project with no humans' into four independent layers (provisioning, root of trust, identity/legal, payment) and proposes a sponsor-mandate model (AP2 Intent Mandate / Human-Not-Present). Documents the verified Manage API surface. Key finding: the gating blocker is the missing platform-side account/org-creation API, not the CLI.
Wrap POST /manage/organizations/{orgId}/projects in ManageClient. Pass-through body with only 'name' explicit, mirroring the official kbc-manage-api-php-client; does not guess the Manage API schema. Adds TestCreateProject (success, payload-only-name, extra_params merge, 403).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Devin Review found 1 potential issue.
View 3 additional findings in Devin Review.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 extra_params can silently override the explicit name argument
In create_project(), the payload is built as {"name": name} and then extra_params is merged via payload.update(extra_params) at manage_client.py:142. If extra_params contains a "name" key, it silently overwrites the value passed as the explicit name argument. The caller sees name as a required, first-class parameter and would reasonably expect it to always be the project name used — but extra_params takes precedence due to the merge order. The fix is to reverse the merge order so name always wins, e.g. payload = {**(extra_params or {}), "name": name}.
Was this helpful? React with 👍 or 👎 to provide feedback.
Uh oh!
There was an error while loading. Please reload this page.
What
Adds RFC 0001 — Autonomous Agent Self-Service Project Provisioning plus the first, fully self-contained slice of its Phase 0 implementation (
ManageClient.create_project).Started from the question: "how can an AI agent download the CLI, create a Keboola project, and — over time — pay for it, with no humans?"
Why
The "no humans" framing conflates four independent layers. The RFC separates them so the genuinely hard parts become visible:
Core conclusion: "no humans" is achievable only as "no humans in the loop" — a sponsor (a legal entity) signs a one-time mandate (AP2 Intent Mandate / Human-Not-Present) and the agent then operates autonomously within it. The decisive blocker is not in this repo: it is the missing Keboola platform-side account/organization-creation API (signup is web-UI only today). The verified Manage API surface (incl.
giveProjectCreditsand a marketplace-token → project path) is documented in the RFC.What's in this PR
docs/rfc/0001-autonomous-agent-self-service-provisioning.md— the RFC. Status: Draft / Proposed — request for comments, nothing accepted, follows the existingdocs/adr/style.ManageClient.create_project(organization_id, name, extra_params=None)→POST /manage/organizations/{orgId}/projects. Endpoint confirmed against the officialkeboola/kbc-manage-api-php-client(src/Client.php). Pass-through body with onlynameexplicit — it does not guess the Manage API schema, mirroring the PHP client'sarray $params.TestCreateProject— 4 tests (success, payload-only-name,extra_paramsmerge, 403 access denied).What's deliberately NOT here (scope)
Phase 0 is split intentionally; this PR is the API layer only. Not included, pending a product decision on command shape (
org provisionvsproject create):OrgService.provision_project()(create → token → register)kbagentCLI command + E2E test (convention Close must-have gaps in explorer command #16 ) + plugin/SKILL/changelog sync (convention v0.6.0: Branch lifecycle management + security hardening #17 )No changelog entry:
create_projectis not yet reachable from any CLI command, so there is no user-facing change to announce.Testing
uv run pytest tests/test_manage_client.py→ 34 passed.ruff check+ruff format --checkclean.For the reviewer
create_projectis safe to merge independently: a thin, tested client wrapper consistent with the existingcreate_project_token. It requires an organization-admin Manage token, exactly likeorg setup.