version: 1
kind: AgentRunConfig
metadata:
  name: agentrun
manager:
  baseUrl: https://agentrun.74-48-78-17.nip.io/
  timeoutMs: 15000
publicExposure:
  enabled: true
  proxyName: agentrun-v01-frpc
  remotePort: 22880
  publicBaseUrl: https://agentrun.74-48-78-17.nip.io/
  masterBaseUrl: http://127.0.0.1:22880
  masterFrps:
    configPath: /opt/hwlab-frp/frps.dev.toml
    containerName: hwlab-frps-dev
  masterCaddy:
    enabled: true
    domain: agentrun.74-48-78-17.nip.io
    configPath: /etc/caddy/Caddyfile
    serviceName: caddy
    upstreamBaseUrl: http://127.0.0.1:22880
    responseHeaderTimeoutSeconds: 60
auth:
  env: HWLAB_API_KEY
  file: /root/.unidesk/.env/agentrun.env
  header: Authorization
  scheme: Bearer
nativeDevelopment:
  manager:
    workspace: /root/agentrun-v02
    bindHost: 0.0.0.0
    probeHost: 127.0.0.1
    port: 6680
    store: memory
    stateDir: .state
    apiKeySourceRef: hwlab/nc01-v03-admin.env
    apiKeySourceKey: HWLAB_API_KEY
    kubeconfig: /etc/rancher/k3s/k3s.yaml
    kubectlCommand: kubectl
    runtimeNamespace: agentrun-v02
    lane: v0.2
    callbackBaseUrl: http://152.53.229.148:6680
    unideskSshEndpointEnv:
      name: UNIDESK_MAIN_SERVER_IP
      value: 152.53.229.148
    runner:
      image: 127.0.0.1:5000/agentrun/agentrun-mgr-env@sha256:fd1e10dc7a81020aebdbd14f1d29d7c9a92de3e431ca52a17e722f63073bed13
      bootRepoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
      serviceAccount: agentrun-nc01-v02-runner
      jobNamePrefix: agentrun-nc01-v02-l1-runner
      nodeSelector:
        unidesk.ai/node-id: NC01
      apiKeySecretRef:
        name: agentrun-v02-api-key
        key: HWLAB_API_KEY
      idleTimeoutMs: 600000
      backendRetry:
        maxAttempts: 5
        initialBackoffMs: 1000
        maxBackoffMs: 30000
      egressProxyUrl: http://10.42.0.1:10808
      noProxyExtra:
        - localhost
        - 127.0.0.1
        - "::1"
        - .svc
        - .svc.cluster.local
        - .cluster.local
        - hyueapi.com
        - .hyueapi.com
        - api.hwpod.com
        - api.pikapython.com
        - .pikapython.com
    dispatcher:
      intervalMs: 1000
      batchSize: 10
      leaseMs: 120000
      attemptTimeoutMs: 90000
      maxAttempts: 5
      retryBackoffMs: 5000
    reconciler:
      intervalMs: 2000
      batchSize: 20
    startupRetry:
      maxAttempts: 5
      initialBackoffMs: 2000
      maxBackoffMs: 16000
      multiplier: 2
      totalDeadlineMs: 60000
      jitterRatio: 0.2
    kafka:
      bootstrapServers: 10.43.4.158:9092
      dnsServers:
        - 10.43.0.10
      dnsSearchDomains:
        - cluster.local
      eventTopic: agentrun.event.v1
      clientId: agentrun-v02-native-l1-manager
      stdioTopic: codex-stdio.raw.v1
      stdioClientId: agentrun-v02-native-l1-runner
      outboxIntervalMs: 500
      outboxBatchSize: 100
      outboxLeaseMs: 60000
      outboxRetryBackoffMs: 5000
    publicExposure:
      publicBaseUrl: https://agentrun-dev.hwpod.com
      hostname: agentrun-dev.hwpod.com
      expectedA: 152.53.229.148
      upstream: http://127.0.0.1:6680
      healthPath: /health/readiness
client:
  role: render-only
  transport: target-trans
  sessionPolicy:
    tenantId: unidesk
    projectId: default
    providerId: NC01
    backendProfile: codex
    workspaceRef:
      kind: opaque
      path: "."
    executionPolicy:
      sandbox: workspace-write
      approval: never
      timeoutMs: 600000
      network: enabled
      secretScope:
        allowCredentialEcho: false
controlPlane:
  default:
    node: NC01
    lane: nc01-release
  nodes:
    NC01:
      route: NC01
      kubeRoute: NC01:k3s
      unideskWorkspace: /root/unidesk
  lanes:
    nc01-v02:
      status:
        readOnlyCapture:
          timeoutMs: 20000
      deployment:
        format: unidesk-yaml-only
        gitopsRoot: deploy/gitops/node/nc01
        runtimeRenderDir: runtime-v02
        artifactCatalogPath: deploy/artifact-catalog.nc01-v02.json
        argocd:
          project: agentrun-nc01-v02
          applicationFile: application-v02.yaml
        manager:
          serviceAccount: agentrun-nc01-v02-mgr
          apiKeySecretRef:
            name: agentrun-v02-api-key
            key: HWLAB_API_KEY
          env:
            AGENTRUN_POSTGRES_POOL_MAX: "4"
            AGENTRUN_MANAGER_RECONCILER_BATCH_SIZE: "20"
            AGENTRUN_MANAGER_RECONCILER_ENABLED: "true"
            AGENTRUN_MANAGER_RECONCILER_INTERVAL_MS: "2000"
            AGENTRUN_RUNNER_STARTUP_RETRY_MAX_ATTEMPTS: "5"
            AGENTRUN_RUNNER_STARTUP_RETRY_INITIAL_BACKOFF_MS: "2000"
            AGENTRUN_RUNNER_STARTUP_RETRY_MAX_BACKOFF_MS: "16000"
            AGENTRUN_RUNNER_STARTUP_RETRY_MULTIPLIER: "2"
            AGENTRUN_RUNNER_STARTUP_RETRY_TOTAL_DEADLINE_MS: "60000"
            AGENTRUN_RUNNER_STARTUP_RETRY_JITTER_RATIO: "0.2"
            AGENTRUN_RUNNER_DISPATCHER_ENABLED: "true"
            AGENTRUN_RUNNER_DISPATCHER_INTERVAL_MS: "1000"
            AGENTRUN_RUNNER_DISPATCHER_BATCH_SIZE: "10"
            AGENTRUN_RUNNER_DISPATCHER_LEASE_MS: "120000"
            AGENTRUN_RUNNER_DISPATCHER_ATTEMPT_TIMEOUT_MS: "90000"
            AGENTRUN_RUNNER_DISPATCHER_MAX_ATTEMPTS: "5"
            AGENTRUN_RUNNER_DISPATCHER_RETRY_BACKOFF_MS: "5000"
            AGENTRUN_KAFKA_ENABLED: "true"
            AGENTRUN_KAFKA_OUTBOX_INTERVAL_MS: "500"
            AGENTRUN_KAFKA_OUTBOX_BATCH_SIZE: "100"
            AGENTRUN_KAFKA_OUTBOX_LEASE_MS: "60000"
            AGENTRUN_KAFKA_OUTBOX_RETRY_BACKOFF_MS: "5000"
            AGENTRUN_KAFKA_STDIO_PRODUCE_ENABLED: "true"
            AGENTRUN_KAFKA_BOOTSTRAP_SERVERS: platform-infra-kafka-kafka-bootstrap.platform-infra.svc.cluster.local:9092
            AGENTRUN_KAFKA_EVENT_TOPIC: agentrun.event.v1
            AGENTRUN_KAFKA_STDIO_TOPIC: codex-stdio.raw.v1
            AGENTRUN_KAFKA_CLIENT_ID: agentrun-v02-manager
            AGENTRUN_KAFKA_STDIO_CLIENT_ID: agentrun-v02-runner
            OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
            OTEL_SERVICE_NAME: agentrun-manager
            UNIDESK_NODE_ID: NC01
            HWLAB_RUNTIME_LANE: v0.3
          unideskSshEndpointEnv:
            name: UNIDESK_MAIN_SERVER_IP
            value: 152.53.229.148
          bootRepoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
          imageBuild:
            context: "."
            containerfile: deploy/container/Containerfile
            repository: agentrun-mgr-env
            network: host
            buildArgs:
              BUN_IMAGE: oven/bun:1-alpine
            httpProxy: http://127.0.0.1:10808
            httpsProxy: http://127.0.0.1:10808
            noProxy:
              - localhost
              - 127.0.0.1
              - "::1"
              - 127.0.0.1:5000
              - localhost:5000
              - .svc
              - .svc.cluster.local
              - .cluster.local
              - hyueapi.com
              - .hyueapi.com
            buildContainerProxy:
              httpProxy: http://127.0.0.1:10808
              httpsProxy: http://127.0.0.1:10808
              noProxy:
                - localhost
                - 127.0.0.1
                - "::1"
                - 127.0.0.1:5000
                - localhost:5000
                - .svc
                - .svc.cluster.local
                - .cluster.local
                - hyueapi.com
                - .hyueapi.com
            envIdentityFiles:
              - deploy/container/Containerfile
              - deploy/runtime/boot/agentrun-boot.sh
              - deploy/runtime/boot/agentrun-mgr.sh
              - deploy/runtime/boot/agentrun-runner.sh
              - src
              - scripts
              - package.json
              - bun.lock
              - tsconfig.json
            timeoutSeconds: 1800
            pollSeconds: 15
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 800m
              memory: 1Gi
        runner:
          serviceAccount: agentrun-nc01-v02-runner
          jobNamePrefix: agentrun-nc01-v02-runner
          idleTimeoutMs: 600000
          backendRetry:
            maxAttempts: 5
            initialBackoffMs: 1000
            maxBackoffMs: 30000
          apiKeySecretRef:
            name: agentrun-v02-api-key
            key: HWLAB_API_KEY
          egressProxyUrl: http://10.42.0.1:10808
          noProxyExtra:
            - localhost
            - 127.0.0.1
            - "::1"
            - .svc
            - .svc.cluster.local
            - .cluster.local
            - hyueapi.com
            - .hyueapi.com
            - api.hwpod.com
            - api.pikapython.com
            - .pikapython.com
          retention:
            maxRunners: 20
            cleanupOrder: oldest-inactive-last-active-first
            activeHeartbeatMaxAgeMs: 900000
            stalePendingMaxAgeMs: 900000
            selectors:
              matchLabels:
                app.kubernetes.io/part-of: agentrun
                app.kubernetes.io/name: agentrun-runner
                app.kubernetes.io/component: runner
              jobNamePrefixes:
                - agentrun-nc01-v02-runner
                - agentrun-v02-runner
                - agentrun-v01-runner
            ageBasedCleanup:
              enabled: false
              maxAgeHours: 48
            sessionPvcRetention:
              enabled: true
              prefixes:
                - agentrun-v01-session-
                - agentrun-v02-session-
                - agentrun-nc01-v02-session-
              maxDeletePerRun: 1000
          cancelLifecycle:
            deliveryMode: manager-epoch
            gracefulAbortMs: 15000
            killEscalationMs: 30000
            staleHeartbeatFencingMs: 900000
            lateWriteFencing:
              enabled: true
            eventStages:
              - accepted
              - persisted
              - delivered
              - aborting
              - terminalized
              - fenced
              - late-write-rejected
        localPostgres:
          enabled: false
          serviceName: agentrun-v02-postgres
          image: postgres:16-alpine
          storage: 5Gi
          port: 5432
          database: agentrun_v02
          user: agentrun_v02
          passwordSourceRef: agentrun/nc01-v02-local-postgres.env
          passwordSourceKey: POSTGRES_PASSWORD
      gitMirror:
        namespace: devops-infra
        readService: gitea-http
        readDeployment: gitea
        writeService: gitea-http
        writeDeployment: gitea
        resourceBundleBaseUrl: http://gitea-http.devops-infra.svc.cluster.local:3000
        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        cachePvc: hwlab-git-mirror-cache
        cacheHostPath: null
        sshSecretName: git-mirror-github-ssh
        githubProxy:
          host: 127.0.0.1
          port: 10808
        toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
        syncJobPrefix: git-mirror-agentrun-nc01-v02-sync-manual
        flushJobPrefix: git-mirror-agentrun-nc01-v02-flush-manual
        repositoryReconciler:
          enabled: true
          deploymentName: agentrun-nc01-v02-managed-repository-reconciler
          configMapName: agentrun-nc01-v02-managed-repository-reconciler
          serviceAccountName: agentrun-nc01-v02-managed-repository-reconciler
          remoteAuth:
            configRef: config/platform-infra/gitea.yaml#sourceAuthority.credentials.github.gitFetchCredential
          hostNetwork: true
          dnsPolicy: ClusterFirstWithHostNet
          imagePullPolicy: IfNotPresent
          cacheMountPath: /cache
          stateDirectory: .agentrun-managed-repositories/nc01-v02
          reconcileIntervalMs: 30000
          fetchTimeoutMs: 240000
          shutdownGraceMs: 30000
          maxConcurrentRepositories: 2
          retry:
            maxAttempts: 4
            initialDelayMs: 1000
            maxDelayMs: 15000
          freshness:
            maxAgeMs: 180000
          readiness:
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          status:
            defaultRepositoryLimit: 8
          lifecycle:
            undeclaredRepositoryPolicy: retain
            managedRefs: source-branch-only
          resources:
            requests:
              cpu: 50m
              memory: 96Mi
            limits:
              cpu: 500m
              memory: 256Mi
        repositories:
          - key: agentrun
            repository: pikasTech/agentrun
            remote: https://github.com/pikasTech/agentrun.git
            sourceBranch: v0.2
            additionalSourceBranches:
              - release
            gitopsBranch: nc01-v0.2-gitops
          - key: unidesk
            repository: pikasTech/unidesk
            remote: https://github.com/pikasTech/unidesk.git
            sourceBranch: master
          - key: agent_skills
            repository: pikasTech/agent_skills
            remote: https://github.com/pikasTech/agent_skills.git
            sourceBranch: master
      database:
        mode: external-postgres
        provider: NC01
        configRef: config/platform-db/postgres-nc01.yaml
        database: agentrun_v02
        user: agentrun_v02
        sslmode: require
        secretSourceRef: agentrun/nc01-v02-mgr-db.env
        secretRef:
          name: agentrun-v02-mgr-db
          key: DATABASE_URL
        localPostgresExpectedAbsent: true
      toolCredentials:
        - extends: controlPlane.templates.toolCredentials.githubPr
        - extends: controlPlane.templates.toolCredentials.githubRepositoryOverridePikaoa
        - extends: controlPlane.templates.toolCredentials.unideskSsh
        - extends: controlPlane.templates.toolCredentials.githubSsh
      secrets:
        - id: manager-api-key
          sourceRef: hwlab/nc01-v03-admin.env
          sourceKey: HWLAB_API_KEY
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v02-api-key
            key: HWLAB_API_KEY
        - id: provider-codex-auth-json
          sourceMode: file
          sourceRef: /root/.codex/auth.json
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v01-provider-codex
            key: auth.json
          providerCredential:
            profile: codex
        - id: provider-codex-config
          sourceMode: file
          sourceRef: /root/.codex/config.toml
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v01-provider-codex
            key: config.toml
          providerCredential:
            profile: codex
        - id: provider-gpt-pika-auth-json
          sourceMode: file
          sourceRef: /root/.codex/auth.json.pika
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v02-provider-gpt-pika
            key: auth.json
          providerCredential:
            profile: gpt-pika
        - id: provider-gpt-pika-config
          sourceMode: file
          sourceRef: /root/.codex/config.toml.pika
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v02-provider-gpt-pika
            key: config.toml
          providerCredential:
            profile: gpt-pika
        - id: provider-grok-auth-json
          sourceMode: file
          sourceRef: /root/.codex/auth.json.grok
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v02-provider-grok
            key: auth.json
          providerCredential:
            profile: grok
        - id: provider-grok-config
          sourceMode: file
          sourceRef: /root/.codex/config.toml.grok
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v02-provider-grok
            key: config.toml
          providerCredential:
            profile: grok
        - id: provider-dsflash-go-auth-json
          sourceMode: env
          sourceRef: hwlab/nc01-v03-code-agent-provider.env
          sourceKey: OPENCODE_API_KEY
          transform: codex-auth-json-openai-api-key
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v01-provider-dsflash-go
            key: auth.json
          providerCredential:
            profile: dsflash-go
        - id: provider-dsflash-go-config
          sourceMode: codex-config
          sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02.secrets.provider-dsflash-go-config.codexConfig
          codexConfig:
            modelProvider: opencode
            model: deepseek-v4-flash
            reviewModel: deepseek-v4-flash
            modelReasoningEffort: xhigh
            disableResponseStorage: true
            networkAccess: enabled
            modelContextWindow: 1000000
            modelAutoCompactTokenLimit: 900000
            modelCatalogJson: /home/agentrun/.codex-dsflash-go/model-catalog.json
            approvalsReviewer: user
            modelProviders:
              opencode:
                name: Moon Bridge OpenCode Zen Go Flash
                baseUrl: http://hwlab-deepseek-proxy.hwlab-v03.svc.cluster.local:4000/v1
                wireApi: responses
                requiresOpenaiAuth: true
            projects:
              /root:
                trustLevel: trusted
              /home/agentrun/workspaces:
                trustLevel: trusted
            tuiModelAvailabilityNux:
              deepseek-v4-flash: 4
            noticeHideFullAccessWarning: true
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v01-provider-dsflash-go
            key: config.toml
          providerCredential:
            profile: dsflash-go
        - id: provider-dsflash-go-model-catalog
          sourceMode: json
          sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-v02.secrets.provider-dsflash-go-model-catalog.jsonValue
          jsonValue:
            models:
              - slug: deepseek-v4-flash
                display_name: DeepSeek V4 Flash via OpenCode Zen Go
                description: >-
                  DeepSeek V4 Flash exposed to Codex through OpenCode Zen Go and a
                  Responses-compatible Moon Bridge profile.
                default_reasoning_level: xhigh
                supported_reasoning_levels:
                  - effort: low
                    description: Fast responses with lighter reasoning
                  - effort: medium
                    description: Balanced reasoning
                  - effort: high
                    description: Deep reasoning
                  - effort: xhigh
                    description: Maximum reasoning
                shell_type: shell_command
                visibility: list
                supported_in_api: true
                priority: 0
                additional_speed_tiers: []
                service_tiers: []
                availability_nux: null
                upgrade: null
                base_instructions: >-
                  You are Codex, a coding agent based on DeepSeek V4 Flash. You and
                  the user share one workspace, and your job is to collaborate with
                  them until their goal is genuinely handled.
                model_messages: {}
                supports_reasoning_summaries: true
                default_reasoning_summary: auto
                support_verbosity: false
                apply_patch_tool_type: freeform
                web_search_tool_type: text_and_image
                truncation_policy:
                  mode: tokens
                  limit: 10000
                supports_parallel_tool_calls: true
                supports_image_detail_original: false
                context_window: 1000000
                max_context_window: 1000000
                auto_compact_token_limit: 900000
                effective_context_window_percent: 95
                experimental_supported_tools: []
                input_modalities:
                  - text
                supports_search_tool: false
          targetRef:
            namespace: agentrun-v02
            name: agentrun-v01-provider-dsflash-go
            key: model-catalog.json
          providerCredential:
            profile: dsflash-go
        - extends: controlPlane.templates.secrets.githubPrRawToken
        - extends: controlPlane.templates.secrets.githubRepositoryOverridePikaoaToken
        - extends: controlPlane.templates.secrets.unideskSshToken
        - extends: controlPlane.templates.secrets.githubSshPrivateKey
        - extends: controlPlane.templates.secrets.githubSshKnownHosts
      extends: controlPlane.templates.agentrunV02Lane
      variables:
        NODE: NC01
        remote: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        workspace: /root/agentrun-v02
        pipeline: agentrun-nc01-v02-ci-image-publish
        pipelineRunPrefix: agentrun-nc01-v02-ci
        serviceAccountName: agentrun-nc01-v02-tekton-runner
        gitopsBranch: nc01-v0.2-gitops
        gitopsPath: deploy/gitops/node/nc01/runtime-v02
        argoApplication: agentrun-nc01-v02
    nc01-release:
      status:
        readOnlyCapture:
          timeoutMs: 20000
      deployment:
        format: unidesk-yaml-only
        gitopsRoot: deploy/gitops/node/nc01
        runtimeRenderDir: runtime-release
        artifactCatalogPath: deploy/artifact-catalog.nc01-release.json
        argocd:
          project: agentrun-nc01-release
          applicationFile: application-release.yaml
        manager:
          serviceAccount: agentrun-nc01-release-mgr
          apiKeySecretRef:
            name: agentrun-release-api-key
            key: HWLAB_API_KEY
          env:
            AGENTRUN_POSTGRES_POOL_MAX: '4'
            AGENTRUN_MANAGER_RECONCILER_BATCH_SIZE: '20'
            AGENTRUN_MANAGER_RECONCILER_ENABLED: 'true'
            AGENTRUN_MANAGER_RECONCILER_INTERVAL_MS: '2000'
            AGENTRUN_RUNNER_STARTUP_RETRY_MAX_ATTEMPTS: '5'
            AGENTRUN_RUNNER_STARTUP_RETRY_INITIAL_BACKOFF_MS: '2000'
            AGENTRUN_RUNNER_STARTUP_RETRY_MAX_BACKOFF_MS: '16000'
            AGENTRUN_RUNNER_STARTUP_RETRY_MULTIPLIER: '2'
            AGENTRUN_RUNNER_STARTUP_RETRY_TOTAL_DEADLINE_MS: '60000'
            AGENTRUN_RUNNER_STARTUP_RETRY_JITTER_RATIO: '0.2'
            AGENTRUN_RUNNER_DISPATCHER_ENABLED: 'true'
            AGENTRUN_RUNNER_DISPATCHER_INTERVAL_MS: '1000'
            AGENTRUN_RUNNER_DISPATCHER_BATCH_SIZE: '10'
            AGENTRUN_RUNNER_DISPATCHER_LEASE_MS: '120000'
            AGENTRUN_RUNNER_DISPATCHER_ATTEMPT_TIMEOUT_MS: '90000'
            AGENTRUN_RUNNER_DISPATCHER_MAX_ATTEMPTS: '5'
            AGENTRUN_RUNNER_DISPATCHER_RETRY_BACKOFF_MS: '5000'
            AGENTRUN_KAFKA_ENABLED: 'true'
            AGENTRUN_KAFKA_OUTBOX_INTERVAL_MS: '500'
            AGENTRUN_KAFKA_OUTBOX_BATCH_SIZE: '100'
            AGENTRUN_KAFKA_OUTBOX_LEASE_MS: '60000'
            AGENTRUN_KAFKA_OUTBOX_RETRY_BACKOFF_MS: '5000'
            AGENTRUN_KAFKA_STDIO_PRODUCE_ENABLED: 'true'
            AGENTRUN_KAFKA_BOOTSTRAP_SERVERS: platform-infra-kafka-kafka-bootstrap.platform-infra.svc.cluster.local:9092
            AGENTRUN_KAFKA_EVENT_TOPIC: agentrun.event.v1
            AGENTRUN_KAFKA_STDIO_TOPIC: codex-stdio.raw.v1
            AGENTRUN_KAFKA_CLIENT_ID: agentrun-release-manager
            AGENTRUN_KAFKA_STDIO_CLIENT_ID: agentrun-release-runner
            OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
            OTEL_SERVICE_NAME: agentrun-manager
            UNIDESK_NODE_ID: NC01
            HWLAB_RUNTIME_LANE: release
          unideskSshEndpointEnv:
            name: UNIDESK_MAIN_SERVER_IP
            value: 152.53.229.148
          bootRepoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
          imageBuild:
            context: .
            containerfile: deploy/container/Containerfile
            repository: agentrun-mgr-env
            network: host
            buildArgs:
              BUN_IMAGE: oven/bun:1-alpine
            httpProxy: http://127.0.0.1:10808
            httpsProxy: http://127.0.0.1:10808
            noProxy:
              - localhost
              - 127.0.0.1
              - ::1
              - 127.0.0.1:5000
              - localhost:5000
              - .svc
              - .svc.cluster.local
              - .cluster.local
              - hyueapi.com
              - .hyueapi.com
            buildContainerProxy:
              httpProxy: http://127.0.0.1:10808
              httpsProxy: http://127.0.0.1:10808
              noProxy:
                - localhost
                - 127.0.0.1
                - ::1
                - 127.0.0.1:5000
                - localhost:5000
                - .svc
                - .svc.cluster.local
                - .cluster.local
                - hyueapi.com
                - .hyueapi.com
            envIdentityFiles:
              - deploy/container/Containerfile
              - deploy/runtime/boot/agentrun-boot.sh
              - deploy/runtime/boot/agentrun-mgr.sh
              - deploy/runtime/boot/agentrun-runner.sh
              - src
              - scripts
              - package.json
              - bun.lock
              - tsconfig.json
            timeoutSeconds: 1800
            pollSeconds: 15
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 800m
              memory: 1Gi
        runner:
          serviceAccount: agentrun-nc01-release-runner
          jobNamePrefix: agentrun-nc01-release-runner
          idleTimeoutMs: 600000
          backendRetry:
            maxAttempts: 5
            initialBackoffMs: 1000
            maxBackoffMs: 30000
          apiKeySecretRef:
            name: agentrun-release-api-key
            key: HWLAB_API_KEY
          egressProxyUrl: http://10.42.0.1:10808
          noProxyExtra:
            - localhost
            - 127.0.0.1
            - ::1
            - .svc
            - .svc.cluster.local
            - .cluster.local
            - hyueapi.com
            - .hyueapi.com
            - api.hwpod.com
            - api.pikapython.com
            - .pikapython.com
          retention:
            maxRunners: 10
            cleanupOrder: oldest-inactive-last-active-first
            activeHeartbeatMaxAgeMs: 900000
            stalePendingMaxAgeMs: 900000
            selectors:
              matchLabels:
                app.kubernetes.io/part-of: agentrun
                app.kubernetes.io/name: agentrun-runner
                app.kubernetes.io/component: runner
              jobNamePrefixes:
                - agentrun-nc01-release-runner
                - agentrun-release-runner
            ageBasedCleanup:
              enabled: false
              maxAgeHours: 48
            sessionPvcRetention:
              enabled: true
              prefixes:
                - agentrun-v01-session-
                - agentrun-release-session-
                - agentrun-nc01-release-session-
              maxDeletePerRun: 1000
          cancelLifecycle:
            deliveryMode: manager-epoch
            gracefulAbortMs: 15000
            killEscalationMs: 30000
            staleHeartbeatFencingMs: 900000
            lateWriteFencing:
              enabled: true
            eventStages:
              - accepted
              - persisted
              - delivered
              - aborting
              - terminalized
              - fenced
              - late-write-rejected
        localPostgres:
          enabled: false
          serviceName: agentrun-release-postgres
          image: postgres:16-alpine
          storage: 5Gi
          port: 5432
          database: agentrun_release
          user: agentrun_release
          passwordSourceRef: agentrun/nc01-release-local-postgres.env
          passwordSourceKey: POSTGRES_PASSWORD
      gitMirror:
        namespace: devops-infra
        readService: gitea-http
        readDeployment: gitea
        writeService: gitea-http
        writeDeployment: gitea
        resourceBundleBaseUrl: http://gitea-http.devops-infra.svc.cluster.local:3000
        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        cachePvc: hwlab-git-mirror-cache
        cacheHostPath: null
        sshSecretName: git-mirror-github-ssh
        githubProxy:
          host: 127.0.0.1
          port: 10808
        toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
        syncJobPrefix: git-mirror-agentrun-nc01-release-sync-manual
        flushJobPrefix: git-mirror-agentrun-nc01-release-flush-manual
        repositoryReconciler:
          enabled: false
          deploymentName: agentrun-nc01-release-managed-repository-reconciler
          configMapName: agentrun-nc01-release-managed-repository-reconciler
          serviceAccountName: agentrun-nc01-release-managed-repository-reconciler
          remoteAuth:
            configRef: config/platform-infra/gitea.yaml#sourceAuthority.credentials.github.gitFetchCredential
          hostNetwork: true
          dnsPolicy: ClusterFirstWithHostNet
          imagePullPolicy: IfNotPresent
          cacheMountPath: /cache
          stateDirectory: .agentrun-managed-repositories/nc01-release
          reconcileIntervalMs: 30000
          fetchTimeoutMs: 240000
          shutdownGraceMs: 30000
          maxConcurrentRepositories: 2
          retry:
            maxAttempts: 4
            initialDelayMs: 1000
            maxDelayMs: 15000
          freshness:
            maxAgeMs: 180000
          readiness:
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          status:
            defaultRepositoryLimit: 8
          lifecycle:
            undeclaredRepositoryPolicy: retain
            managedRefs: source-branch-only
          resources:
            requests:
              cpu: 50m
              memory: 96Mi
            limits:
              cpu: 500m
              memory: 256Mi
        repositories:
          - key: agentrun
            repository: pikasTech/agentrun
            remote: https://github.com/pikasTech/agentrun.git
            sourceBranch: release
            gitopsBranch: nc01-release-gitops
          - key: unidesk
            repository: pikasTech/unidesk
            remote: https://github.com/pikasTech/unidesk.git
            sourceBranch: master
          - key: agent_skills
            repository: pikasTech/agent_skills
            remote: https://github.com/pikasTech/agent_skills.git
            sourceBranch: master
      database:
        mode: external-postgres
        provider: NC01
        configRef: config/platform-db/postgres-nc01.yaml
        database: agentrun_release
        user: agentrun_release
        sslmode: require
        secretSourceRef: agentrun/nc01-release-mgr-db.env
        secretRef:
          name: agentrun-release-mgr-db
          key: DATABASE_URL
        localPostgresExpectedAbsent: true
      toolCredentials:
        - id: github-pr
          tool: github
          purpose: github-pr
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-pr
            keys:
              - GH_TOKEN
          projection:
            kind: env
            envName: GH_TOKEN
            secretKey: GH_TOKEN
        - id: github-repository-override-pikaoa
          tool: github
          purpose: repository-override-pikainc-pikaoa
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-repository-overrides
            keys:
              - PIKAINC_PIKAOA_GH_TOKEN
          projection:
            kind: env
            envName: UNIDESK_GH_TOKEN_PIKAINC_PIKAOA
            secretKey: PIKAINC_PIKAOA_GH_TOKEN
        - id: unidesk-ssh
          tool: unidesk-ssh
          purpose: ssh-passthrough
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-unidesk-ssh
            keys:
              - UNIDESK_SSH_CLIENT_TOKEN
          projection:
            kind: env
            envName: UNIDESK_SSH_CLIENT_TOKEN
            secretKey: UNIDESK_SSH_CLIENT_TOKEN
        - id: github-ssh
          tool: github
          purpose: github-ssh
          secretRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-ssh
            keys:
              - id_ed25519
              - known_hosts
          projection:
            kind: volume
            mountPath: /home/agentrun/.ssh
      secrets:
        - id: manager-api-key
          sourceRef: hwlab/nc01-v03-admin.env
          sourceKey: HWLAB_API_KEY
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-api-key
            key: HWLAB_API_KEY
        - id: provider-codex-auth-json
          sourceMode: file
          sourceRef: /root/.codex/auth.json
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-codex
            key: auth.json
          providerCredential:
            profile: codex
        - id: provider-codex-config
          sourceMode: file
          sourceRef: /root/.codex/config.toml
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-codex
            key: config.toml
          providerCredential:
            profile: codex
        - id: provider-gpt-pika-auth-json
          sourceMode: file
          sourceRef: /root/.codex/auth.json.pika
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-gpt-pika
            key: auth.json
          providerCredential:
            profile: gpt-pika
        - id: provider-gpt-pika-config
          sourceMode: file
          sourceRef: /root/.codex/config.toml.pika
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-gpt-pika
            key: config.toml
          providerCredential:
            profile: gpt-pika
        - id: provider-grok-auth-json
          sourceMode: file
          sourceRef: /root/.codex/auth.json.grok
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-grok
            key: auth.json
          providerCredential:
            profile: grok
        - id: provider-grok-config
          sourceMode: file
          sourceRef: /root/.codex/config.toml.grok
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-grok
            key: config.toml
          providerCredential:
            profile: grok
        - id: provider-dsflash-go-auth-json
          sourceMode: env
          sourceRef: hwlab/nc01-v03-code-agent-provider.env
          sourceKey: OPENCODE_API_KEY
          transform: codex-auth-json-openai-api-key
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-dsflash-go
            key: auth.json
          providerCredential:
            profile: dsflash-go
        - id: provider-dsflash-go-config
          sourceMode: codex-config
          sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-release.secrets.provider-dsflash-go-config.codexConfig
          codexConfig:
            modelProvider: opencode
            model: deepseek-v4-flash
            reviewModel: deepseek-v4-flash
            modelReasoningEffort: xhigh
            disableResponseStorage: true
            networkAccess: enabled
            modelContextWindow: 1000000
            modelAutoCompactTokenLimit: 900000
            modelCatalogJson: /home/agentrun/.codex-dsflash-go/model-catalog.json
            approvalsReviewer: user
            modelProviders:
              opencode:
                name: Moon Bridge OpenCode Zen Go Flash
                baseUrl: http://hwlab-deepseek-proxy.hwlab-v03.svc.cluster.local:4000/v1
                wireApi: responses
                requiresOpenaiAuth: true
            projects:
              /root:
                trustLevel: trusted
              /home/agentrun/workspaces:
                trustLevel: trusted
            tuiModelAvailabilityNux:
              deepseek-v4-flash: 4
            noticeHideFullAccessWarning: true
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-dsflash-go
            key: config.toml
          providerCredential:
            profile: dsflash-go
        - id: provider-dsflash-go-model-catalog
          sourceMode: json
          sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-release.secrets.provider-dsflash-go-model-catalog.jsonValue
          jsonValue:
            models:
              - slug: deepseek-v4-flash
                display_name: DeepSeek V4 Flash via OpenCode Zen Go
                description: DeepSeek V4 Flash exposed to Codex through OpenCode Zen Go and a Responses-compatible Moon Bridge profile.
                default_reasoning_level: xhigh
                supported_reasoning_levels:
                  - effort: low
                    description: Fast responses with lighter reasoning
                  - effort: medium
                    description: Balanced reasoning
                  - effort: high
                    description: Deep reasoning
                  - effort: xhigh
                    description: Maximum reasoning
                shell_type: shell_command
                visibility: list
                supported_in_api: true
                priority: 0
                additional_speed_tiers: []
                service_tiers: []
                availability_nux: null
                upgrade: null
                base_instructions: You are Codex, a coding agent based on DeepSeek V4 Flash. You and the user share one workspace, and your job is
                  to collaborate with them until their goal is genuinely handled.
                model_messages: {}
                supports_reasoning_summaries: true
                default_reasoning_summary: auto
                support_verbosity: false
                apply_patch_tool_type: freeform
                web_search_tool_type: text_and_image
                truncation_policy:
                  mode: tokens
                  limit: 10000
                supports_parallel_tool_calls: true
                supports_image_detail_original: false
                context_window: 1000000
                max_context_window: 1000000
                auto_compact_token_limit: 900000
                effective_context_window_percent: 95
                experimental_supported_tools: []
                input_modalities:
                  - text
                supports_search_tool: false
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-provider-dsflash-go
            key: model-catalog.json
          providerCredential:
            profile: dsflash-go
        - extends: controlPlane.templates.secrets.githubPrRawToken
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-pr
            key: GH_TOKEN
        - extends: controlPlane.templates.secrets.githubRepositoryOverridePikaoaToken
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-repository-overrides
            key: PIKAINC_PIKAOA_GH_TOKEN
        - extends: controlPlane.templates.secrets.unideskSshToken
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-tool-unidesk-ssh
            key: UNIDESK_SSH_CLIENT_TOKEN
        - extends: controlPlane.templates.secrets.githubSshPrivateKey
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-ssh
            key: id_ed25519
        - extends: controlPlane.templates.secrets.githubSshKnownHosts
          targetRef:
            namespace: agentrun-release
            name: agentrun-release-tool-github-ssh
            key: known_hosts
      extends: controlPlane.templates.agentrunV02Lane
      variables:
        NODE: NC01
        remote: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
        workspace: /root/agentrun-release
        pipeline: agentrun-nc01-release-ci-image-publish
        pipelineRunPrefix: agentrun-nc01-release-ci
        serviceAccountName: agentrun-nc01-release-tekton-runner
        gitopsBranch: nc01-release-gitops
        gitopsPath: deploy/gitops/node/nc01/runtime-release
        argoApplication: agentrun-nc01-release
      overrides:
        version: release
        source:
          branch: release
          bootstrapFromBranch: v0.2
          workspace: /root/agentrun-release
        runtime:
          namespace: agentrun-release
          managerDeployment: agentrun-mgr
          managerService: agentrun-mgr
          managerPort: 8080
          internalBaseUrl: http://agentrun-mgr.agentrun-release.svc.cluster.local:8080
        ci:
          pipeline: agentrun-nc01-release-ci-image-publish
          pipelineRunPrefix: agentrun-nc01-release-ci
          serviceAccountName: agentrun-nc01-release-tekton-runner
        gitops:
          branch: nc01-release-gitops
          path: deploy/gitops/node/nc01/runtime-release
          argoApplication: agentrun-nc01-release

  templates:
    agentrunV02Lane:
      version: v0.2
      node: "${NODE}"
      source:
        statusMode: k3s-git-mirror
        repository: pikasTech/agentrun
        worktreeRemote: git@github.com:pikasTech/agentrun.git
        branch: v0.2
        sourceAuthority:
          mode: gitMirrorSnapshot
          resolver: k8s-git-mirror
          allowHostGit: false
          allowHostWorkspace: false
          allowGithubDirectInPipeline: false
        sourceSnapshot:
          stageRefPrefix: "refs/unidesk/snapshots/agentrun-yaml-lane/{branch}"
          missingObjectPolicy: fail-fast
          refreshPolicy: sync-before-snapshot
        bootstrapFromBranch: v0.1
        bootstrapTimeoutSeconds: 900
        bootstrapPollSeconds: 15
        remote: "${remote}"
        workspace: "${workspace}"
      runtime:
        namespace: agentrun-v02
        managerDeployment: agentrun-mgr
        managerService: agentrun-mgr
        managerPort: 8080
        internalBaseUrl: http://agentrun-mgr.agentrun-v02.svc.cluster.local:8080
      ci:
        namespace: agentrun-ci
        pipeline: "${pipeline}"
        pipelineRunPrefix: "${pipelineRunPrefix}"
        serviceAccountName: "${serviceAccountName}"
        registryPrefix: 127.0.0.1:5000/agentrun
        toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
        buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
      gitops:
        branch: "${gitopsBranch}"
        path: "${gitopsPath}"
        argoNamespace: argocd
        argoApplication: "${argoApplication}"
        repoURL: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
    toolCredentials:
      githubPr:
        id: github-pr
        tool: github
        purpose: github-pr
        secretRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-github-pr
          keys:
            - GH_TOKEN
        projection:
          kind: env
          envName: GH_TOKEN
          secretKey: GH_TOKEN
      githubRepositoryOverridePikaoa:
        id: github-repository-override-pikaoa
        tool: github
        purpose: repository-override-pikainc-pikaoa
        secretRef:
          namespace: agentrun-v02
          name: agentrun-v02-tool-github-repository-overrides
          keys:
            - PIKAINC_PIKAOA_GH_TOKEN
        projection:
          kind: env
          envName: UNIDESK_GH_TOKEN_PIKAINC_PIKAOA
          secretKey: PIKAINC_PIKAOA_GH_TOKEN
      unideskSsh:
        id: unidesk-ssh
        tool: unidesk-ssh
        purpose: ssh-passthrough
        secretRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-unidesk-ssh
          keys:
            - UNIDESK_SSH_CLIENT_TOKEN
        projection:
          kind: env
          envName: UNIDESK_SSH_CLIENT_TOKEN
          secretKey: UNIDESK_SSH_CLIENT_TOKEN
      githubSsh:
        id: github-ssh
        tool: github
        purpose: github-ssh
        secretRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-github-ssh
          keys:
            - id_ed25519
            - known_hosts
        projection:
          kind: volume
          mountPath: /home/agentrun/.ssh
    secrets:
      githubPrRawToken:
        id: tool-github-pr-token
        sourceRef: /root/.unidesk/.env/gh_token.txt
        sourceKey: GH_TOKEN
        sourceFormat: raw-token
        targetRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-github-pr
          key: GH_TOKEN
      githubRepositoryOverridePikaoaToken:
        id: tool-github-repository-override-pikaoa-token
        sourceRef: /root/.unidesk/.env/pikainc-selfmedia-gh-token.txt
        sourceKey: GH_TOKEN
        sourceFormat: raw-token
        targetRef:
          namespace: agentrun-v02
          name: agentrun-v02-tool-github-repository-overrides
          key: PIKAINC_PIKAOA_GH_TOKEN
      unideskSshToken:
        id: tool-unidesk-ssh-token
        sourceRef: /root/.unidesk/.state/docker-compose.env
        sourceKey: UNIDESK_SSH_CLIENT_TOKEN
        targetRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-unidesk-ssh
          key: UNIDESK_SSH_CLIENT_TOKEN
      githubSshPrivateKey:
        id: tool-github-ssh-private-key
        sourceMode: file
        sourceRef: deploy-ssh/github.com/id_ed25519
        targetRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-github-ssh
          key: id_ed25519
      githubSshKnownHosts:
        id: tool-github-ssh-known-hosts
        sourceMode: file
        sourceRef: deploy-ssh/github.com/known_hosts
        targetRef:
          namespace: agentrun-v02
          name: agentrun-v01-tool-github-ssh
          key: known_hosts
