apiVersion: agentrun.pikastech.local/v0.1
kind: AipodSpec
metadata:
  name: Artificer
  displayName: Artificer
  description: UniDesk distributed development agent assembled for the AgentRun release lane.
  labels:
    agentrun.pikastech.local/lane: release
    agentrun.pikastech.local/purpose: distributed-development
spec:
  tenantId: unidesk
  projectId: pikasTech/unidesk
  queue: commander
  lane: release
  priority: 50
  providerId: NC01
  upstreams:
    pika:
      backendProfile: gpt-pika
      providerCredential:
        secretRef:
          namespace: agentrun-release
          name: agentrun-release-provider-gpt-pika
          keys:
            - auth.json
            - config.toml
    grok:
      backendProfile: grok
      providerCredential:
        secretRef:
          namespace: agentrun-release
          name: agentrun-release-provider-grok
          keys:
            - auth.json
            - config.toml
  modelRouting:
    default:
      upstream: pika
      model: gpt-5.6-sol
      reasoningEffort: medium
    exact:
      gpt-5.6-sol:
        upstream: pika
      grok:
        upstream: grok
        reasoningEffort: xhigh
  imageRef:
    kind: env-image-dockerfile
    repoUrl: git@github.com:pikasTech/agentrun.git
    commitId: 6601b4afb4870ecec62f14459e14202e5ccca7ec
    dockerfilePath: deploy/container/Containerfile
  workspaceRef:
    kind: opaque
    path: .
  executionPolicy:
    sandbox: workspace-write
    approval: never
    timeoutMs: 7200000
    network: enabled
    gitIdentity:
      name: AgentRun Codex
      email: agentrun-codex@users.noreply.github.com
    secretScope:
      allowCredentialEcho: false
      toolCredentials:
        - tool: github
          purpose: github-pr
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-pr
            keys:
              - GH_TOKEN
          projection:
            kind: env
            envName: GH_TOKEN
            secretKey: GH_TOKEN
        - tool: github
          purpose: repository-override-pikainc-pikaoa
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-repository-overrides
            keys:
              - PIKAINC_PIKAOA_GH_TOKEN
          projection:
            kind: env
            envName: UNIDESK_GH_TOKEN_PIKAINC_PIKAOA
            secretKey: PIKAINC_PIKAOA_GH_TOKEN
        - tool: unidesk-ssh
          purpose: ssh-passthrough
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-unidesk-ssh
            keys:
              - UNIDESK_SSH_CLIENT_TOKEN
          projection:
            kind: env
            envName: UNIDESK_SSH_CLIENT_TOKEN
            secretKey: UNIDESK_SSH_CLIENT_TOKEN
        - tool: github
          purpose: github-ssh
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-ssh
            keys:
              - id_ed25519
              - known_hosts
          projection:
            kind: volume
            mountPath: /home/agentrun/.ssh
  resourceBundleRef:
    kind: gitbundle
    repoUrl: git@github.com:pikasTech/unidesk.git
    ref: master
    bundles:
      - name: unidesk-skills
        subpath: .agents/skills
        targetPath: .agents/skills
      - name: agentrun-runner-tools
        repoUrl: git@github.com:pikasTech/agentrun.git
        ref: release
        subpath: tools
        targetPath: tools
      - name: dad-dev-skill
        repoUrl: git@github.com:pikasTech/agent_skills.git
        ref: master
        subpath: dad-dev
        targetPath: .agents/skills/dad-dev
      - name: cli-spec-skill
        repoUrl: git@github.com:pikasTech/agent_skills.git
        ref: master
        subpath: cli-spec
        targetPath: .agents/skills/cli-spec
      - name: docs-spec-skill
        repoUrl: git@github.com:pikasTech/agent_skills.git
        ref: master
        subpath: docs-spec
        targetPath: .agents/skills/docs-spec
      - name: git-spec-skill
        repoUrl: git@github.com:pikasTech/agent_skills.git
        ref: master
        subpath: git-spec
        targetPath: .agents/skills/git-spec
      - name: post-task-skill
        repoUrl: git@github.com:pikasTech/agent_skills.git
        ref: master
        subpath: post-task
        targetPath: .agents/skills/post-task
    requiredSkills:
      - name: dad-dev
      - name: cli-spec
      - name: docs-spec
      - name: git-spec
      - name: post-task
      - name: unidesk-trans
      - name: unidesk-gh
      - name: unidesk-agentrun
      - name: unidesk-cicd
      - name: unidesk-subagent
      - name: unidesk-decision
      - name: unidesk-ops
      - name: unidesk-sub2api
    submodules: false
    lfs: false
  payloadDefaults:
    title: Artificer 分布式开发任务
    prompt: |-
      你就是当前已派发任务的 Artificer 执行者，必须按任务要求直接完成工作；仅在任务需要源码修改时，才在 primary workspace 完成修改、测试和 PR。
      禁止通过 `agentrun create`、`agentrun apply`、`agentrun dispatch`、Code Queue 或任何等价入口创建或派发另一个 Artificer 来完成当前任务。
      允许只读查询 AgentRun task、session 和 run 状态；只读查询不属于二次派单。
      派单 prompt 必须提供“任务目标上下文”，其中包含 MDTODO ID、Target、targetWorkspace、repository 和 ref；这些字段是目标操作的唯一定位事实，缺失时必须在写入前返回可操作错误，禁止猜测运行位置。
      primary workspace 只用于读取随资源包提供的工具与 skill，以及完成任务明确授权的本地轻量准备；不得把 runner 容器本地执行冒充 Target 原入口验证。
      凡面向任务 Target 的现场探测、命令执行、验证、远端文本修改、Git 操作和运行面观察，都必须使用 `trans <Target>:<targetWorkspace> <operation>` 或对应 k3s route；`targetWorkspace` 必须是绝对路径，目标文本修改使用 `trans <route> apply-patch`。
      Target、targetWorkspace、repository 和 ref 必须来自任务上下文，不得把 NC01、目标绝对路径或第二条执行路径硬编码到实现中。
      最终报告必须回链任务上下文中的 MDTODO ID，并区分 primary workspace 轻量准备与 Target 原入口证据。
      遵循随资源包提供的 dad-dev 与 UniDesk skills；执行高风险或长时间操作前，先向相关 GitHub issue 报告进展。
  references: []
  metadata:
    aipod: Artificer
    source: config/aipods/artificer.yaml
  dispatchDefaults:
    runnerJob:
      namespace: agentrun-release