mupot-plugin/plugin.yaml at master · Mumega-com/mupot-plugin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# Mupot Hermes Plugin v0.3 — separated provisioner and restricted operator modes.
# Production agents must use operator mode with an agent-bound MUPOT_AGENT_TOKEN.

name: mupot
version: "0.3.0"
kind: backend
description: >
  Integrate Hermes with Mupot in one of two isolated modes. Provisioner mode exposes
  human-controlled Cloudflare setup tools. Operator mode exposes only a narrow,
  agent-bound task, finding, presence and approval-request surface. A separately
  authorized, explicitly enabled manager extension can manage member agents only
  within the configured squad.

provides_tools:
  - name: mupot_provision
    description: Plan or provision a human-owned Mupot Cloudflare deployment.
  - name: mupot_status
    description: Probe a live Mupot deployment health endpoint.
  - name: mupot_brain_enable
    description: Plan a Mupot DMN brain profile and schedule.
  - name: mupot_operator_status
    description: Verify the configured restricted Mupot identity.
  - name: mupot_operator_check_in
    description: Record on-demand Hermes presence.
  - name: mupot_operator_task_board
    description: Read the configured squad task board.
  - name: mupot_operator_task_create
    description: Create a scoped task assigned to this Hermes identity.
  - name: mupot_operator_task_claim
    description: Claim a permitted task for this Hermes identity.
  - name: mupot_operator_record_finding
    description: Record evidence or findings without completing or approving work.
  - name: mupot_operator_request_approval
    description: Route findings to the configured human approval owner.
  - name: mupot_operator_complete_task
    description: Complete an ungated task; Mupot enforces unresolved gates.
  - name: mupot_operator_send
    description: Send a durable message to an explicitly allowlisted peer agent.
  - name: mupot_operator_inbox
    description: Peek or explicitly consume this agent's durable Mupot inbox.
  - name: mupot_agent_manager_list
    description: List agents and non-secret token metadata in the configured squad.
  - name: mupot_agent_manager_create
    description: Create an active member agent in the configured squad.
  - name: mupot_agent_manager_set_status
    description: Pause or resume a member agent in the configured squad.
  - name: mupot_agent_manager_mint_token
    description: Mint a show-once member credential welded to a configured-squad agent.
  - name: mupot_agent_manager_revoke_token
    description: Revoke a credential welded to a configured-squad agent.

provides_hooks:
  - name: on_session_start
    description: Provisioner-mode configuration reminder only.

# No credential is globally required because operator and provisioner profiles use
# different credentials. Each mode validates its own requirements at registration.
optional_env:
  - name: MUPOT_AGENT_TOKEN
    description: Agent-bound Mupot bearer token required in operator mode.
    secret: true
  - name: MUPOT_CF_ACCOUNT_ID
    description: Cloudflare account ID used only in provisioner mode.
  - name: MUPOT_CF_API_TOKEN
    description: Scoped Cloudflare API token used only in provisioner mode.
    secret: true
  - name: MUPOT_PLUGIN_MODE
    description: Compatibility override; prefer plugins.entries.mupot.settings.mode.
  - name: MUPOT_SLUG
    description: Default pot slug for provisioner workflows.
  - name: MUPOT_BRAND
    description: Default display brand for provisioner workflows.
  - name: MUPOT_OAUTH_PROVIDER
    description: OAuth identity provider used during provisioning.
    default: google