diff --git a/README.md b/README.md
index ae81c6e..28695fe 100644
--- a/README.md
+++ b/README.md
@@ -138,7 +138,8 @@ spec:
   apiKeyFrom:
     secretKeyRef:
       name: openai
-      key: OPENAI_API_KEY' | kubectl apply -f -
+      key: OPENAI_API_KEY
+' | kubectl apply -f -
 ```
 
 ```mermaid
@@ -230,7 +231,8 @@ spec:
   llmRef:
     name: gpt-4o
   system: |
-    You are a helpful assistant. Your job is to help the user with their tasks.' | kubectl apply -f -
+    You are a helpful assistant. Your job is to help the user with their tasks.
+' | kubectl apply -f -
 ```
 
 ```mermaid
@@ -328,7 +330,8 @@ metadata:
 spec:
   agentRef:
     name: my-assistant
-  userMessage: "What is the capital of the moon?"' | kubectl apply -f -
+  userMessage: "What is the capital of the moon?"
+' | kubectl apply -f -
 ```
 
 ```mermaid
@@ -524,7 +527,8 @@ metadata:
 spec:
   transport: "stdio"
   command: "uvx"
-  args: ["mcp-server-fetch"]' | kubectl apply -f -
+  args: ["mcp-server-fetch"]
+' | kubectl apply -f -
 ```
 
 ```bash
@@ -602,7 +606,8 @@ spec:
   system: |
     You are a helpful assistant. Your job is to help the user with their tasks.
   mcpServers:
-    - name: fetch' | kubectl apply -f -
+    - name: fetch
+' | kubectl apply -f -
 ```
 
 ```mermaid
@@ -644,7 +649,8 @@ metadata:
 spec:
   agentRef:
     name: my-assistant
-  userMessage: "what is the data at https://lotrapi.co/api/v1/characters/1? "' | kubectl apply -f -
+  userMessage: "what is the data at https://lotrapi.co/api/v1/characters/1? "
+' | kubectl apply -f -
 ```
 
 You should see some events in the output of
@@ -858,7 +864,8 @@ spec:
   apiKeyFrom:
     secretKeyRef:
       name: anthropic
-      key: ANTHROPIC_API_KEY' | kubectl apply -f -
+      key: ANTHROPIC_API_KEY
+' | kubectl apply -f -
 ```
 
 fetch the LLM to verify it was created:
@@ -883,7 +890,8 @@ spec:
   llmRef:
     name: claude-3-5-sonnet
   system: |
-    You are a helpful assistant. Your job is to help the user with their tasks.' | kubectl apply -f -
+    You are a helpful assistant. Your job is to help the user with their tasks.
+' | kubectl apply -f -
 ```
 
 ```bash
@@ -894,7 +902,8 @@ metadata:
 spec:
   agentRef:
     name: claude
-  userMessage: "What is your name and primary directive?"' | kubectl apply -f -
+  userMessage: "What is your name and primary directive?"
+' | kubectl apply -f -
 ```
 
 After a few seconds, running 
@@ -916,7 +925,7 @@ We can compose agents together to create more complex behaviors and make longer
 Let's create a web search agent that can use the fetch tool we created in the previous example.
 
 ```bash
-cat <<EOF | kubectl apply -f -
+echo '
 apiVersion: acp.humanlayer.dev/v1alpha1
 kind: Agent
 metadata:
@@ -928,13 +937,13 @@ spec:
     You are a helpful assistant. Your job is to help the user with their tasks.
   mcpServers:
     - name: fetch
-EOF
+' | kubectl apply -f -
 ```
 
 next, we can create a router agent that can delegate to the web search agent.
 
 ```bash
-cat <<EOF | kubectl apply -f -
+echo '
 apiVersion: acp.humanlayer.dev/v1alpha1
 kind: Agent
 metadata:
@@ -946,13 +955,13 @@ spec:
     You are a helpful assistant. Your job is to help the user with their tasks.
   subAgents:
     - name: web-search
-EOF
+' | kubectl apply -f -
 ```
 
 From here, let's create a task that uses the manager agent.
 
 ```bash
-cat <<EOF | kubectl apply -f -
+echo '
 apiVersion: acp.humanlayer.dev/v1alpha1
 kind: Task
 metadata:
@@ -961,7 +970,7 @@ spec:
   agentRef:
     name: manager
   userMessage: "what is the data at https://lotrapi.co/api/v1/characters/2?"
-EOF
+' | kubectl apply -f -
 ```
 
 While this is running, you can run the following a few times to see how the parent agent calls a `delegate` tool which then spawns a new task that uses the `web-fetch` agent
@@ -1064,7 +1073,8 @@ spec:
   # When an approvalContactChannel is specified,
   # all tools on this MCP server will wait for human approval prior executing.
   approvalContactChannel:
-    name: approval-channel' | kubectl apply -f -
+    name: approval-channel
+' | kubectl apply -f -
 ```
 
 Be sure you have an agent that references the above `MCPServer` by running `kubectl describe agent` or create a fresh `agent` with:
@@ -1080,7 +1090,8 @@ spec:
   system: |
     You are a helpful assistant. Your job is to help the user with their tasks.
   mcpServers:
-    - name: fetch' | kubectl apply -f -
+    - name: fetch
+' | kubectl apply -f -
 ```
 
 The fun part: Create a new task that uses the `fetch` tool to test the human approval workflow.
@@ -1093,7 +1104,8 @@ metadata:
 spec:
   agentRef:
     name: agent-with-fetch
-  userMessage: "Write me a haiku about the character found at https://swapi.dev/api/people/2?"' | kubectl apply -f -
+  userMessage: "Write me a haiku about the character found at https://swapi.dev/api/people/2?"
+' | kubectl apply -f -
 ```
 
 Once this hits the tool call, we can check out the tool calls to see the human approval workflow in action:
@@ -1177,7 +1189,8 @@ spec:
   email:
     address: "$MY_EMAIL"
     subject: "Request for Expertise" 
-    contextAboutUser: "A human expert that can provide a wide-range answers on a variety of topics"' | kubectl apply -f -
+    contextAboutUser: "A human expert that can provide a wide-range answers on a variety of topics"
+' | kubectl apply -f -
 ```
 
 Alright, we're ready for a brand new agent:
@@ -1195,7 +1208,8 @@ spec:
   mcpServers:
     - name: fetch
   humanContactChannels:
-    - name: human-expert' | kubectl apply -f -
+    - name: human-expert
+' | kubectl apply -f -
 ```
 
 Note the inclusion of `humanContactChannels` here, which now incorporates the `ContactChannel` we just made. Moving forward, any `Task` calls made against this `Agent` will attempt to make use of a human contact where appropriate. As an example, the following Task, _should_ (remember, "non-deterministic") reach out to our Luke Skywalker expert for more information before wrapping up the final output:
@@ -1208,7 +1222,8 @@ metadata:
 spec:
   agentRef:
     name: agent-with-human-tool
-  userMessage: "Ask an expert what the fastest animal on the planet is."' | kubectl apply -f -
+  userMessage: "Ask an expert what the fastest animal on the planet is."
+' | kubectl apply -f -
 ```
 
 Provided, you've setup your `ContactChannel` correctly, you should receive an email requesting your expertise. Feel free to respond when ready and keep an eye on how your `Task` and `ToolCall` statuses changes as the answer is picked up.
diff --git a/acp/config/manager/kustomization.yaml b/acp/config/manager/kustomization.yaml
index 5f1a4f5..725b844 100644
--- a/acp/config/manager/kustomization.yaml
+++ b/acp/config/manager/kustomization.yaml
@@ -6,5 +6,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: ghcr.io/humanlayer/agentcontrolplane
-  newTag: v0.5.1
-
+  newTag: v0.6.0
diff --git a/acp/config/release/latest.yaml b/acp/config/release/latest.yaml
index ffcadac..5f53aaf 100644
--- a/acp/config/release/latest.yaml
+++ b/acp/config/release/latest.yaml
@@ -1565,6 +1565,25 @@ subjects:
 ---
 apiVersion: v1
 kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-controller-manager-api-service
+  namespace: default
+spec:
+  ports:
+  - name: api
+    port: 8082
+    protocol: TCP
+    targetPort: api
+  selector:
+    app.kubernetes.io/name: acp
+    control-plane: controller-manager
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
 metadata:
   labels:
     app.kubernetes.io/managed-by: kustomize
@@ -1612,7 +1631,7 @@ spec:
         - --health-probe-bind-address=:8081
         command:
         - /manager
-        image: ghcr.io/humanlayer/agentcontrolplane:v0.5.1
+        image: ghcr.io/humanlayer/agentcontrolplane:v0.6.0
         livenessProbe:
           httpGet:
             path: /healthz
@@ -1620,7 +1639,9 @@ spec:
           initialDelaySeconds: 15
           periodSeconds: 20
         name: manager
-        ports: []
+        ports:
+        - containerPort: 8082
+          name: api
         readinessProbe:
           httpGet:
             path: /readyz
diff --git a/acp/config/release/v0.6.0-crd.yaml b/acp/config/release/v0.6.0-crd.yaml
new file mode 100644
index 0000000..b1c4718
--- /dev/null
+++ b/acp/config/release/v0.6.0-crd.yaml
@@ -0,0 +1,1231 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: agents.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: Agent
+    listKind: AgentList
+    plural: agents
+    singular: agent
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Agent is the Schema for the agents API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: AgentSpec defines the desired state of Agent
+            properties:
+              humanContactChannels:
+                description: HumanContactChannels is a list of ContactChannel resources
+                  that can be used for human interactions
+                items:
+                  description: LocalObjectReference contains enough information to
+                    locate the referenced resource in the same namespace
+                  properties:
+                    name:
+                      description: Name of the referent
+                      minLength: 1
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+              llmRef:
+                description: LLMRef references the LLM to use for this agent
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              mcpServers:
+                description: MCPServers is a list of MCP servers this agent can use
+                items:
+                  description: LocalObjectReference contains enough information to
+                    locate the referenced resource in the same namespace
+                  properties:
+                    name:
+                      description: Name of the referent
+                      minLength: 1
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+              system:
+                description: System is the system prompt for the agent
+                minLength: 1
+                type: string
+            required:
+            - llmRef
+            - system
+            type: object
+          status:
+            description: AgentStatus defines the observed state of Agent
+            properties:
+              ready:
+                description: Ready indicates if the agent's dependencies (LLM and
+                  Tools) are valid and ready
+                type: boolean
+              status:
+                description: Status indicates the current status of the agent
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+              validHumanContactChannels:
+                description: ValidHumanContactChannels is the list of human contact
+                  channels that were successfully validated
+                items:
+                  properties:
+                    name:
+                      description: Name of the contact channel
+                      type: string
+                    type:
+                      description: Type of the contact channel (e.g., "slack", "email")
+                      type: string
+                  required:
+                  - name
+                  - type
+                  type: object
+                type: array
+              validMCPServers:
+                description: ValidMCPServers is the list of MCP servers that were
+                  successfully validated
+                items:
+                  properties:
+                    name:
+                      description: Name of the MCP server
+                      type: string
+                    tools:
+                      description: Tools available from this MCP server
+                      items:
+                        type: string
+                      type: array
+                  required:
+                  - name
+                  type: object
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: contactchannels.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: ContactChannel
+    listKind: ContactChannelList
+    plural: contactchannels
+    singular: contactchannel
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.type
+      name: Type
+      type: string
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ContactChannel is the Schema for the contactchannels API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ContactChannelSpec defines the desired state of ContactChannel.
+            properties:
+              apiKeyFrom:
+                description: APIKeyFrom references the secret containing the API key
+                  or token
+                properties:
+                  secretKeyRef:
+                    description: SecretKeyRef references a key in a secret
+                    properties:
+                      key:
+                        description: Key is the key in the secret
+                        type: string
+                      name:
+                        description: Name is the name of the secret
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
+                required:
+                - secretKeyRef
+                type: object
+              email:
+                description: Email holds configuration specific to Email channels
+                properties:
+                  address:
+                    description: Address is the recipient email address
+                    pattern: .+@.+\..+
+                    type: string
+                  contextAboutUser:
+                    description: ContextAboutUser provides context for the LLM about
+                      the recipient
+                    type: string
+                  subject:
+                    description: Subject is the custom subject line
+                    type: string
+                required:
+                - address
+                type: object
+              slack:
+                description: Slack holds configuration specific to Slack channels
+                properties:
+                  allowedResponderIDs:
+                    description: AllowedResponderIDs restricts who can respond (Slack
+                      user IDs)
+                    items:
+                      type: string
+                    type: array
+                  channelOrUserID:
+                    description: ChannelOrUserID is the Slack channel ID (C...) or
+                      user ID (U...)
+                    pattern: ^[CU][A-Z0-9]+$
+                    type: string
+                  contextAboutChannelOrUser:
+                    description: ContextAboutChannelOrUser provides context for the
+                      LLM about the channel or user
+                    type: string
+                required:
+                - channelOrUserID
+                type: object
+              type:
+                description: Type is the type of channel (e.g. "slack", "email")
+                enum:
+                - slack
+                - email
+                type: string
+            required:
+            - apiKeyFrom
+            - type
+            type: object
+          status:
+            description: ContactChannelStatus defines the observed state of ContactChannel.
+            properties:
+              humanLayerProject:
+                description: HumanLayerProject is the project ID from HumanLayer API
+                type: string
+              ready:
+                description: Ready indicates if the ContactChannel is ready to be
+                  used
+                type: boolean
+              status:
+                description: Status indicates the current status of the ContactChannel
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: llms.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: LLM
+    listKind: LLMList
+    plural: llms
+    singular: llm
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.provider
+      name: Provider
+      type: string
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: LLM is the Schema for the llms API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: LLMSpec defines the desired state of LLM
+            properties:
+              anthropic:
+                description: Anthropic provider-specific configuration
+                properties:
+                  anthropicBetaHeader:
+                    description: |-
+                      AnthropicBetaHeader adds the Anthropic Beta header to support extended options
+                      Common values include "max-tokens-3-5-sonnet-2024-07-15" for extended token limits
+                    type: string
+                type: object
+              apiKeyFrom:
+                description: APIKeyFrom references the secret containing the API key
+                  or credentials
+                properties:
+                  secretKeyRef:
+                    description: SecretKeyRef references a key in a secret
+                    properties:
+                      key:
+                        description: Key is the key in the secret
+                        type: string
+                      name:
+                        description: Name is the name of the secret
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
+                required:
+                - secretKeyRef
+                type: object
+              google:
+                description: Google provider-specific configuration
+                properties:
+                  cloudLocation:
+                    description: CloudLocation is the Google Cloud region
+                    type: string
+                  cloudProject:
+                    description: CloudProject is the Google Cloud project ID
+                    type: string
+                type: object
+              mistral:
+                description: Mistral provider-specific configuration
+                properties:
+                  maxRetries:
+                    description: MaxRetries sets the maximum number of retries for
+                      API calls
+                    minimum: 0
+                    type: integer
+                  randomSeed:
+                    description: RandomSeed provides a seed for deterministic sampling
+                    type: integer
+                  timeout:
+                    description: Timeout specifies the timeout duration for API calls
+                      (in seconds)
+                    minimum: 1
+                    type: integer
+                type: object
+              openai:
+                description: OpenAI provider-specific configuration
+                properties:
+                  apiType:
+                    default: OPEN_AI
+                    description: APIType specifies which OpenAI API type to use
+                    enum:
+                    - OPEN_AI
+                    - AZURE
+                    - AZURE_AD
+                    type: string
+                  apiVersion:
+                    description: |-
+                      APIVersion is required when using Azure API types
+                      Example: "2023-05-15"
+                    type: string
+                  organization:
+                    description: Organization is the OpenAI organization ID
+                    type: string
+                type: object
+              parameters:
+                description: Parameters holds common configuration options across
+                  providers
+                properties:
+                  baseUrl:
+                    description: BaseURL for API endpoints (used by many providers)
+                    type: string
+                  frequencyPenalty:
+                    description: FrequencyPenalty reduces repetition by penalizing
+                      frequent tokens
+                    pattern: ^-?[0-2](\.[0-9]+)?$
+                    type: string
+                  maxTokens:
+                    description: MaxTokens defines the maximum number of tokens for
+                      the LLM
+                    minimum: 1
+                    type: integer
+                  model:
+                    description: Model name to use
+                    type: string
+                  presencePenalty:
+                    description: PresencePenalty reduces repetition by penalizing
+                      tokens that appear at all
+                    pattern: ^-?[0-2](\.[0-9]+)?$
+                    type: string
+                  temperature:
+                    description: Temperature adjusts the LLM response randomness (0.0
+                      to 1.0)
+                    pattern: ^0(\.[0-9]+)?|1(\.0+)?$
+                    type: string
+                  topK:
+                    description: TopK controls diversity by limiting the top K tokens
+                      to sample from
+                    minimum: 1
+                    type: integer
+                  topP:
+                    description: TopP controls diversity via nucleus sampling (0.0
+                      to 1.0)
+                    pattern: ^(0(\.[0-9]+)?|1(\.0+)?)$
+                    type: string
+                type: object
+              provider:
+                description: Provider is the LLM provider name
+                enum:
+                - openai
+                - anthropic
+                - mistral
+                - google
+                - vertex
+                type: string
+              vertex:
+                description: Vertex provider-specific configuration
+                properties:
+                  cloudLocation:
+                    description: CloudLocation is the Google Cloud region
+                    type: string
+                  cloudProject:
+                    description: CloudProject is the Google Cloud project ID
+                    type: string
+                required:
+                - cloudLocation
+                - cloudProject
+                type: object
+            required:
+            - provider
+            type: object
+          status:
+            description: LLMStatus defines the observed state of LLM
+            properties:
+              ready:
+                description: Ready indicates if the LLM is ready to be used
+                type: boolean
+              status:
+                description: Status indicates the current status of the LLM
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: mcpservers.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: MCPServer
+    listKind: MCPServerList
+    plural: mcpservers
+    singular: mcpserver
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.connected
+      name: Connected
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: MCPServer is the Schema for the mcpservers API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MCPServerSpec defines the desired state of MCPServer
+            properties:
+              approvalContactChannel:
+                description: ApprovalContactChannel is the contact channel for approval
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              args:
+                description: Args are the arguments to pass to the command for stdio
+                  MCP servers
+                items:
+                  type: string
+                type: array
+              command:
+                description: Command is the command to run for stdio MCP servers
+                type: string
+              env:
+                description: Env are environment variables to set for stdio MCP servers
+                items:
+                  description: EnvVar represents an environment variable
+                  properties:
+                    name:
+                      description: Name of the environment variable
+                      type: string
+                    value:
+                      description: Value of the environment variable (direct literal
+                        value)
+                      type: string
+                    valueFrom:
+                      description: ValueFrom represents a source for the value of
+                        an environment variable
+                      properties:
+                        secretKeyRef:
+                          description: SecretKeyRef selects a key of a secret in the
+                            pod's namespace
+                          properties:
+                            key:
+                              description: Key is the key in the secret
+                              type: string
+                            name:
+                              description: Name is the name of the secret
+                              type: string
+                          required:
+                          - key
+                          - name
+                          type: object
+                      type: object
+                  required:
+                  - name
+                  type: object
+                type: array
+              resources:
+                description: ResourceRequirements defines CPU/Memory resources requests/limits
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: Limits describes the maximum amount of compute resources
+                      allowed
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: Requests describes the minimum amount of compute
+                      resources required
+                    type: object
+                type: object
+              transport:
+                description: Transport specifies the transport type for the MCP server
+                enum:
+                - stdio
+                - http
+                type: string
+              url:
+                description: URL is the endpoint for HTTP MCP servers
+                type: string
+            required:
+            - transport
+            type: object
+          status:
+            description: MCPServerStatus defines the observed state of MCPServer
+            properties:
+              connected:
+                description: Connected indicates if the MCP server is currently connected
+                  and operational
+                type: boolean
+              status:
+                description: Status indicates the current status of the MCP server
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+              tools:
+                description: Tools is the list of tools provided by this MCP server
+                items:
+                  description: MCPTool represents a tool provided by an MCP server
+                  properties:
+                    description:
+                      description: Description of the tool
+                      type: string
+                    inputSchema:
+                      description: InputSchema is the JSON schema for the tool's input
+                        parameters
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    name:
+                      description: Name of the tool
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: tasks.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: Task
+    listKind: TaskList
+    plural: tasks
+    singular: task
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    - jsonPath: .status.phase
+      name: Phase
+      type: string
+    - jsonPath: .status.userMsgPreview
+      name: Preview
+      type: string
+    - jsonPath: .status.output
+      name: Output
+      type: string
+    - jsonPath: .status.error
+      name: Error
+      priority: 1
+      type: string
+    - jsonPath: .status.startTime
+      name: Started
+      priority: 1
+      type: date
+    - jsonPath: .status.completionTime
+      name: Completed
+      priority: 1
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Task is the Schema for the tasks API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TaskSpec defines the desired state of Task
+            properties:
+              agentRef:
+                description: AgentRef references the agent that will execute this
+                  Task.
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              userMessage:
+                description: UserMessage is the message to send to the agent.
+                minLength: 1
+                type: string
+            required:
+            - agentRef
+            - userMessage
+            type: object
+          status:
+            description: TaskStatus defines the observed state of Task
+            properties:
+              completionTime:
+                description: CompletionTime is when the Task completed
+                format: date-time
+                type: string
+              contextWindow:
+                description: ContextWindow maintains the conversation history as a
+                  sequence of messages
+                items:
+                  description: Message represents a single message in the conversation
+                  properties:
+                    content:
+                      description: Content is the message content
+                      type: string
+                    name:
+                      description: Name is the name of the tool that was called
+                      type: string
+                    role:
+                      description: Role is the role of the message sender (system,
+                        user, assistant, tool)
+                      enum:
+                      - system
+                      - user
+                      - assistant
+                      - tool
+                      type: string
+                    toolCallId:
+                      description: ToolCallID is the unique identifier for this tool
+                        call
+                      type: string
+                    toolCalls:
+                      description: ToolCalls contains any tool calls requested by
+                        this message
+                      items:
+                        description: ToolCall represents a request to call a tool
+                        properties:
+                          function:
+                            description: Function contains the details of the function
+                              to call
+                            properties:
+                              arguments:
+                                description: Arguments contains the arguments to pass
+                                  to the function in JSON format
+                                type: string
+                              name:
+                                description: Name is the name of the function to call
+                                type: string
+                            required:
+                            - arguments
+                            - name
+                            type: object
+                          id:
+                            description: ID is the unique identifier for this tool
+                              call
+                            type: string
+                          type:
+                            description: Type indicates the type of tool call. Currently
+                              only "function" is supported.
+                            type: string
+                        required:
+                        - function
+                        - id
+                        - type
+                        type: object
+                      type: array
+                  required:
+                  - content
+                  - role
+                  type: object
+                type: array
+              error:
+                description: Error message if the task failed
+                type: string
+              messageCount:
+                description: MessageCount contains the number of messages in the context
+                  window
+                type: integer
+              output:
+                description: Output contains the result of the task execution
+                type: string
+              phase:
+                description: Phase indicates the current phase of the Task
+                enum:
+                - Initializing
+                - Pending
+                - ReadyForLLM
+                - SendContextWindowToLLM
+                - ToolCallsPending
+                - CheckingToolCalls
+                - FinalAnswer
+                - ErrorBackoff
+                - Failed
+                type: string
+              ready:
+                description: Ready indicates if the Task is ready to be executed
+                type: boolean
+              spanContext:
+                description: SpanContext contains OpenTelemetry span context information
+                properties:
+                  spanID:
+                    description: SpanID is the span ID
+                    type: string
+                  traceID:
+                    description: TraceID is the trace ID for the span
+                    type: string
+                type: object
+              startTime:
+                description: StartTime is when the Task started
+                format: date-time
+                type: string
+              status:
+                description: Status indicates the current status of the task
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+              toolCallRequestId:
+                description: ToolCallRequestID uniquely identifies a set of tool calls
+                  from a single LLM response
+                type: string
+              userMsgPreview:
+                description: UserMsgPreview stores the first 50 characters of the
+                  user's message
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: toolcalls.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: ToolCall
+    listKind: ToolCallList
+    plural: toolcalls
+    singular: toolcall
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.phase
+      name: Phase
+      type: string
+    - jsonPath: .spec.taskRef.name
+      name: Task
+      type: string
+    - jsonPath: .spec.toolRef.name
+      name: Tool
+      type: string
+    - jsonPath: .status.startTime
+      name: Started
+      priority: 1
+      type: date
+    - jsonPath: .status.completionTime
+      name: Completed
+      priority: 1
+      type: date
+    - jsonPath: .status.error
+      name: Error
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ToolCall is the Schema for the toolcalls API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ToolCallSpec defines the desired state of ToolCall
+            properties:
+              arguments:
+                description: Arguments contains the arguments for the tool call
+                type: string
+              taskRef:
+                description: TaskRef references the parent Task
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              toolCallId:
+                description: ToolCallID is the unique identifier for this tool call
+                type: string
+              toolRef:
+                description: ToolRef references the tool to execute
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              toolType:
+                description: ToolType identifies the type of the tool (MCP, HumanContact)
+                type: string
+            required:
+            - arguments
+            - taskRef
+            - toolCallId
+            - toolRef
+            type: object
+          status:
+            description: ToolCallStatus defines the observed state of ToolCall
+            properties:
+              completionTime:
+                description: CompletionTime is when the tool call completed
+                format: date-time
+                type: string
+              error:
+                description: Error message if the tool call failed
+                type: string
+              externalCallID:
+                description: ExternalCallID is the unique identifier for this function
+                  call in external services
+                type: string
+              phase:
+                description: Phase indicates the current phase of the tool call
+                enum:
+                - Pending
+                - Running
+                - Succeeded
+                - Failed
+                - AwaitingHumanInput
+                - AwaitingSubAgent
+                - AwaitingHumanApproval
+                - ReadyToExecuteApprovedTool
+                - ErrorRequestingHumanApproval
+                - ErrorRequestingHumanInput
+                - ToolCallRejected
+                type: string
+              ready:
+                description: Ready indicates if the tool call is ready to be executed
+                type: boolean
+              result:
+                description: Result contains the result of the tool call if completed
+                type: string
+              spanContext:
+                description: SpanContext contains OpenTelemetry span context information
+                properties:
+                  spanID:
+                    description: SpanID is the span ID
+                    type: string
+                  traceID:
+                    description: TraceID is the trace ID for the span
+                    type: string
+                type: object
+              startTime:
+                description: StartTime is when the tool call started
+                format: date-time
+                type: string
+              status:
+                description: Status indicates the current status of the tool call
+                enum:
+                - Ready
+                - Error
+                - Pending
+                - Succeeded
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            required:
+            - externalCallID
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: tools.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: Tool
+    listKind: ToolList
+    plural: tools
+    singular: tool
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Tool is the Schema for the tools API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ToolSpec defines the desired state of Tool
+            properties:
+              agentRef:
+                description: AgentRef is used for delegation-type tools.
+                properties:
+                  name:
+                    type: string
+                required:
+                - name
+                type: object
+              arguments:
+                description: Arguments defines the JSON schema for the tool's arguments.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              description:
+                description: Description provides a description of the tool.
+                type: string
+              execute:
+                description: Execute defines how the tool should be executed.
+                properties:
+                  builtin:
+                    description: Builtin represents an inline (builtin) tool.
+                    properties:
+                      name:
+                        description: Name is the identifier of the builtin function
+                          to run. Today, supports simple math operations
+                        enum:
+                        - add
+                        - subtract
+                        - multiply
+                        - divide
+                        type: string
+                    type: object
+                type: object
+              name:
+                description: Name is used for inline/function tools (optional if the
+                  object name is used).
+                type: string
+              parameters:
+                description: Parameters defines the JSON schema for the tool's parameters.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              toolType:
+                description: ToolType represents the type of tool; e.g. "function",
+                  "delegateToAgent", "externalAPI" etc.
+                enum:
+                - function
+                - delegateToAgent
+                - externalAPI
+                type: string
+            type: object
+          status:
+            description: ToolStatus defines the observed state of Tool
+            properties:
+              ready:
+                description: Ready indicates if the tool is ready to be used
+                type: boolean
+              status:
+                description: Status indicates the current status of the tool
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/acp/config/release/v0.6.0.yaml b/acp/config/release/v0.6.0.yaml
new file mode 100644
index 0000000..5f53aaf
--- /dev/null
+++ b/acp/config/release/v0.6.0.yaml
@@ -0,0 +1,1670 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+    control-plane: controller-manager
+  name: default
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: agents.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: Agent
+    listKind: AgentList
+    plural: agents
+    singular: agent
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Agent is the Schema for the agents API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: AgentSpec defines the desired state of Agent
+            properties:
+              humanContactChannels:
+                description: HumanContactChannels is a list of ContactChannel resources
+                  that can be used for human interactions
+                items:
+                  description: LocalObjectReference contains enough information to
+                    locate the referenced resource in the same namespace
+                  properties:
+                    name:
+                      description: Name of the referent
+                      minLength: 1
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+              llmRef:
+                description: LLMRef references the LLM to use for this agent
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              mcpServers:
+                description: MCPServers is a list of MCP servers this agent can use
+                items:
+                  description: LocalObjectReference contains enough information to
+                    locate the referenced resource in the same namespace
+                  properties:
+                    name:
+                      description: Name of the referent
+                      minLength: 1
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+              system:
+                description: System is the system prompt for the agent
+                minLength: 1
+                type: string
+            required:
+            - llmRef
+            - system
+            type: object
+          status:
+            description: AgentStatus defines the observed state of Agent
+            properties:
+              ready:
+                description: Ready indicates if the agent's dependencies (LLM and
+                  Tools) are valid and ready
+                type: boolean
+              status:
+                description: Status indicates the current status of the agent
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+              validHumanContactChannels:
+                description: ValidHumanContactChannels is the list of human contact
+                  channels that were successfully validated
+                items:
+                  properties:
+                    name:
+                      description: Name of the contact channel
+                      type: string
+                    type:
+                      description: Type of the contact channel (e.g., "slack", "email")
+                      type: string
+                  required:
+                  - name
+                  - type
+                  type: object
+                type: array
+              validMCPServers:
+                description: ValidMCPServers is the list of MCP servers that were
+                  successfully validated
+                items:
+                  properties:
+                    name:
+                      description: Name of the MCP server
+                      type: string
+                    tools:
+                      description: Tools available from this MCP server
+                      items:
+                        type: string
+                      type: array
+                  required:
+                  - name
+                  type: object
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: contactchannels.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: ContactChannel
+    listKind: ContactChannelList
+    plural: contactchannels
+    singular: contactchannel
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.type
+      name: Type
+      type: string
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ContactChannel is the Schema for the contactchannels API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ContactChannelSpec defines the desired state of ContactChannel.
+            properties:
+              apiKeyFrom:
+                description: APIKeyFrom references the secret containing the API key
+                  or token
+                properties:
+                  secretKeyRef:
+                    description: SecretKeyRef references a key in a secret
+                    properties:
+                      key:
+                        description: Key is the key in the secret
+                        type: string
+                      name:
+                        description: Name is the name of the secret
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
+                required:
+                - secretKeyRef
+                type: object
+              email:
+                description: Email holds configuration specific to Email channels
+                properties:
+                  address:
+                    description: Address is the recipient email address
+                    pattern: .+@.+\..+
+                    type: string
+                  contextAboutUser:
+                    description: ContextAboutUser provides context for the LLM about
+                      the recipient
+                    type: string
+                  subject:
+                    description: Subject is the custom subject line
+                    type: string
+                required:
+                - address
+                type: object
+              slack:
+                description: Slack holds configuration specific to Slack channels
+                properties:
+                  allowedResponderIDs:
+                    description: AllowedResponderIDs restricts who can respond (Slack
+                      user IDs)
+                    items:
+                      type: string
+                    type: array
+                  channelOrUserID:
+                    description: ChannelOrUserID is the Slack channel ID (C...) or
+                      user ID (U...)
+                    pattern: ^[CU][A-Z0-9]+$
+                    type: string
+                  contextAboutChannelOrUser:
+                    description: ContextAboutChannelOrUser provides context for the
+                      LLM about the channel or user
+                    type: string
+                required:
+                - channelOrUserID
+                type: object
+              type:
+                description: Type is the type of channel (e.g. "slack", "email")
+                enum:
+                - slack
+                - email
+                type: string
+            required:
+            - apiKeyFrom
+            - type
+            type: object
+          status:
+            description: ContactChannelStatus defines the observed state of ContactChannel.
+            properties:
+              humanLayerProject:
+                description: HumanLayerProject is the project ID from HumanLayer API
+                type: string
+              ready:
+                description: Ready indicates if the ContactChannel is ready to be
+                  used
+                type: boolean
+              status:
+                description: Status indicates the current status of the ContactChannel
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: llms.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: LLM
+    listKind: LLMList
+    plural: llms
+    singular: llm
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.provider
+      name: Provider
+      type: string
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: LLM is the Schema for the llms API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: LLMSpec defines the desired state of LLM
+            properties:
+              anthropic:
+                description: Anthropic provider-specific configuration
+                properties:
+                  anthropicBetaHeader:
+                    description: |-
+                      AnthropicBetaHeader adds the Anthropic Beta header to support extended options
+                      Common values include "max-tokens-3-5-sonnet-2024-07-15" for extended token limits
+                    type: string
+                type: object
+              apiKeyFrom:
+                description: APIKeyFrom references the secret containing the API key
+                  or credentials
+                properties:
+                  secretKeyRef:
+                    description: SecretKeyRef references a key in a secret
+                    properties:
+                      key:
+                        description: Key is the key in the secret
+                        type: string
+                      name:
+                        description: Name is the name of the secret
+                        type: string
+                    required:
+                    - key
+                    - name
+                    type: object
+                required:
+                - secretKeyRef
+                type: object
+              google:
+                description: Google provider-specific configuration
+                properties:
+                  cloudLocation:
+                    description: CloudLocation is the Google Cloud region
+                    type: string
+                  cloudProject:
+                    description: CloudProject is the Google Cloud project ID
+                    type: string
+                type: object
+              mistral:
+                description: Mistral provider-specific configuration
+                properties:
+                  maxRetries:
+                    description: MaxRetries sets the maximum number of retries for
+                      API calls
+                    minimum: 0
+                    type: integer
+                  randomSeed:
+                    description: RandomSeed provides a seed for deterministic sampling
+                    type: integer
+                  timeout:
+                    description: Timeout specifies the timeout duration for API calls
+                      (in seconds)
+                    minimum: 1
+                    type: integer
+                type: object
+              openai:
+                description: OpenAI provider-specific configuration
+                properties:
+                  apiType:
+                    default: OPEN_AI
+                    description: APIType specifies which OpenAI API type to use
+                    enum:
+                    - OPEN_AI
+                    - AZURE
+                    - AZURE_AD
+                    type: string
+                  apiVersion:
+                    description: |-
+                      APIVersion is required when using Azure API types
+                      Example: "2023-05-15"
+                    type: string
+                  organization:
+                    description: Organization is the OpenAI organization ID
+                    type: string
+                type: object
+              parameters:
+                description: Parameters holds common configuration options across
+                  providers
+                properties:
+                  baseUrl:
+                    description: BaseURL for API endpoints (used by many providers)
+                    type: string
+                  frequencyPenalty:
+                    description: FrequencyPenalty reduces repetition by penalizing
+                      frequent tokens
+                    pattern: ^-?[0-2](\.[0-9]+)?$
+                    type: string
+                  maxTokens:
+                    description: MaxTokens defines the maximum number of tokens for
+                      the LLM
+                    minimum: 1
+                    type: integer
+                  model:
+                    description: Model name to use
+                    type: string
+                  presencePenalty:
+                    description: PresencePenalty reduces repetition by penalizing
+                      tokens that appear at all
+                    pattern: ^-?[0-2](\.[0-9]+)?$
+                    type: string
+                  temperature:
+                    description: Temperature adjusts the LLM response randomness (0.0
+                      to 1.0)
+                    pattern: ^0(\.[0-9]+)?|1(\.0+)?$
+                    type: string
+                  topK:
+                    description: TopK controls diversity by limiting the top K tokens
+                      to sample from
+                    minimum: 1
+                    type: integer
+                  topP:
+                    description: TopP controls diversity via nucleus sampling (0.0
+                      to 1.0)
+                    pattern: ^(0(\.[0-9]+)?|1(\.0+)?)$
+                    type: string
+                type: object
+              provider:
+                description: Provider is the LLM provider name
+                enum:
+                - openai
+                - anthropic
+                - mistral
+                - google
+                - vertex
+                type: string
+              vertex:
+                description: Vertex provider-specific configuration
+                properties:
+                  cloudLocation:
+                    description: CloudLocation is the Google Cloud region
+                    type: string
+                  cloudProject:
+                    description: CloudProject is the Google Cloud project ID
+                    type: string
+                required:
+                - cloudLocation
+                - cloudProject
+                type: object
+            required:
+            - provider
+            type: object
+          status:
+            description: LLMStatus defines the observed state of LLM
+            properties:
+              ready:
+                description: Ready indicates if the LLM is ready to be used
+                type: boolean
+              status:
+                description: Status indicates the current status of the LLM
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: mcpservers.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: MCPServer
+    listKind: MCPServerList
+    plural: mcpservers
+    singular: mcpserver
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.connected
+      name: Connected
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: MCPServer is the Schema for the mcpservers API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: MCPServerSpec defines the desired state of MCPServer
+            properties:
+              approvalContactChannel:
+                description: ApprovalContactChannel is the contact channel for approval
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              args:
+                description: Args are the arguments to pass to the command for stdio
+                  MCP servers
+                items:
+                  type: string
+                type: array
+              command:
+                description: Command is the command to run for stdio MCP servers
+                type: string
+              env:
+                description: Env are environment variables to set for stdio MCP servers
+                items:
+                  description: EnvVar represents an environment variable
+                  properties:
+                    name:
+                      description: Name of the environment variable
+                      type: string
+                    value:
+                      description: Value of the environment variable (direct literal
+                        value)
+                      type: string
+                    valueFrom:
+                      description: ValueFrom represents a source for the value of
+                        an environment variable
+                      properties:
+                        secretKeyRef:
+                          description: SecretKeyRef selects a key of a secret in the
+                            pod's namespace
+                          properties:
+                            key:
+                              description: Key is the key in the secret
+                              type: string
+                            name:
+                              description: Name is the name of the secret
+                              type: string
+                          required:
+                          - key
+                          - name
+                          type: object
+                      type: object
+                  required:
+                  - name
+                  type: object
+                type: array
+              resources:
+                description: ResourceRequirements defines CPU/Memory resources requests/limits
+                properties:
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: Limits describes the maximum amount of compute resources
+                      allowed
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: Requests describes the minimum amount of compute
+                      resources required
+                    type: object
+                type: object
+              transport:
+                description: Transport specifies the transport type for the MCP server
+                enum:
+                - stdio
+                - http
+                type: string
+              url:
+                description: URL is the endpoint for HTTP MCP servers
+                type: string
+            required:
+            - transport
+            type: object
+          status:
+            description: MCPServerStatus defines the observed state of MCPServer
+            properties:
+              connected:
+                description: Connected indicates if the MCP server is currently connected
+                  and operational
+                type: boolean
+              status:
+                description: Status indicates the current status of the MCP server
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+              tools:
+                description: Tools is the list of tools provided by this MCP server
+                items:
+                  description: MCPTool represents a tool provided by an MCP server
+                  properties:
+                    description:
+                      description: Description of the tool
+                      type: string
+                    inputSchema:
+                      description: InputSchema is the JSON schema for the tool's input
+                        parameters
+                      type: object
+                      x-kubernetes-preserve-unknown-fields: true
+                    name:
+                      description: Name of the tool
+                      type: string
+                  required:
+                  - name
+                  type: object
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: tasks.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: Task
+    listKind: TaskList
+    plural: tasks
+    singular: task
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    - jsonPath: .status.phase
+      name: Phase
+      type: string
+    - jsonPath: .status.userMsgPreview
+      name: Preview
+      type: string
+    - jsonPath: .status.output
+      name: Output
+      type: string
+    - jsonPath: .status.error
+      name: Error
+      priority: 1
+      type: string
+    - jsonPath: .status.startTime
+      name: Started
+      priority: 1
+      type: date
+    - jsonPath: .status.completionTime
+      name: Completed
+      priority: 1
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Task is the Schema for the tasks API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: TaskSpec defines the desired state of Task
+            properties:
+              agentRef:
+                description: AgentRef references the agent that will execute this
+                  Task.
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              userMessage:
+                description: UserMessage is the message to send to the agent.
+                minLength: 1
+                type: string
+            required:
+            - agentRef
+            - userMessage
+            type: object
+          status:
+            description: TaskStatus defines the observed state of Task
+            properties:
+              completionTime:
+                description: CompletionTime is when the Task completed
+                format: date-time
+                type: string
+              contextWindow:
+                description: ContextWindow maintains the conversation history as a
+                  sequence of messages
+                items:
+                  description: Message represents a single message in the conversation
+                  properties:
+                    content:
+                      description: Content is the message content
+                      type: string
+                    name:
+                      description: Name is the name of the tool that was called
+                      type: string
+                    role:
+                      description: Role is the role of the message sender (system,
+                        user, assistant, tool)
+                      enum:
+                      - system
+                      - user
+                      - assistant
+                      - tool
+                      type: string
+                    toolCallId:
+                      description: ToolCallID is the unique identifier for this tool
+                        call
+                      type: string
+                    toolCalls:
+                      description: ToolCalls contains any tool calls requested by
+                        this message
+                      items:
+                        description: ToolCall represents a request to call a tool
+                        properties:
+                          function:
+                            description: Function contains the details of the function
+                              to call
+                            properties:
+                              arguments:
+                                description: Arguments contains the arguments to pass
+                                  to the function in JSON format
+                                type: string
+                              name:
+                                description: Name is the name of the function to call
+                                type: string
+                            required:
+                            - arguments
+                            - name
+                            type: object
+                          id:
+                            description: ID is the unique identifier for this tool
+                              call
+                            type: string
+                          type:
+                            description: Type indicates the type of tool call. Currently
+                              only "function" is supported.
+                            type: string
+                        required:
+                        - function
+                        - id
+                        - type
+                        type: object
+                      type: array
+                  required:
+                  - content
+                  - role
+                  type: object
+                type: array
+              error:
+                description: Error message if the task failed
+                type: string
+              messageCount:
+                description: MessageCount contains the number of messages in the context
+                  window
+                type: integer
+              output:
+                description: Output contains the result of the task execution
+                type: string
+              phase:
+                description: Phase indicates the current phase of the Task
+                enum:
+                - Initializing
+                - Pending
+                - ReadyForLLM
+                - SendContextWindowToLLM
+                - ToolCallsPending
+                - CheckingToolCalls
+                - FinalAnswer
+                - ErrorBackoff
+                - Failed
+                type: string
+              ready:
+                description: Ready indicates if the Task is ready to be executed
+                type: boolean
+              spanContext:
+                description: SpanContext contains OpenTelemetry span context information
+                properties:
+                  spanID:
+                    description: SpanID is the span ID
+                    type: string
+                  traceID:
+                    description: TraceID is the trace ID for the span
+                    type: string
+                type: object
+              startTime:
+                description: StartTime is when the Task started
+                format: date-time
+                type: string
+              status:
+                description: Status indicates the current status of the task
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+              toolCallRequestId:
+                description: ToolCallRequestID uniquely identifies a set of tool calls
+                  from a single LLM response
+                type: string
+              userMsgPreview:
+                description: UserMsgPreview stores the first 50 characters of the
+                  user's message
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: toolcalls.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: ToolCall
+    listKind: ToolCallList
+    plural: toolcalls
+    singular: toolcall
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.phase
+      name: Phase
+      type: string
+    - jsonPath: .spec.taskRef.name
+      name: Task
+      type: string
+    - jsonPath: .spec.toolRef.name
+      name: Tool
+      type: string
+    - jsonPath: .status.startTime
+      name: Started
+      priority: 1
+      type: date
+    - jsonPath: .status.completionTime
+      name: Completed
+      priority: 1
+      type: date
+    - jsonPath: .status.error
+      name: Error
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ToolCall is the Schema for the toolcalls API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ToolCallSpec defines the desired state of ToolCall
+            properties:
+              arguments:
+                description: Arguments contains the arguments for the tool call
+                type: string
+              taskRef:
+                description: TaskRef references the parent Task
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              toolCallId:
+                description: ToolCallID is the unique identifier for this tool call
+                type: string
+              toolRef:
+                description: ToolRef references the tool to execute
+                properties:
+                  name:
+                    description: Name of the referent
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                type: object
+              toolType:
+                description: ToolType identifies the type of the tool (MCP, HumanContact)
+                type: string
+            required:
+            - arguments
+            - taskRef
+            - toolCallId
+            - toolRef
+            type: object
+          status:
+            description: ToolCallStatus defines the observed state of ToolCall
+            properties:
+              completionTime:
+                description: CompletionTime is when the tool call completed
+                format: date-time
+                type: string
+              error:
+                description: Error message if the tool call failed
+                type: string
+              externalCallID:
+                description: ExternalCallID is the unique identifier for this function
+                  call in external services
+                type: string
+              phase:
+                description: Phase indicates the current phase of the tool call
+                enum:
+                - Pending
+                - Running
+                - Succeeded
+                - Failed
+                - AwaitingHumanInput
+                - AwaitingSubAgent
+                - AwaitingHumanApproval
+                - ReadyToExecuteApprovedTool
+                - ErrorRequestingHumanApproval
+                - ErrorRequestingHumanInput
+                - ToolCallRejected
+                type: string
+              ready:
+                description: Ready indicates if the tool call is ready to be executed
+                type: boolean
+              result:
+                description: Result contains the result of the tool call if completed
+                type: string
+              spanContext:
+                description: SpanContext contains OpenTelemetry span context information
+                properties:
+                  spanID:
+                    description: SpanID is the span ID
+                    type: string
+                  traceID:
+                    description: TraceID is the trace ID for the span
+                    type: string
+                type: object
+              startTime:
+                description: StartTime is when the tool call started
+                format: date-time
+                type: string
+              status:
+                description: Status indicates the current status of the tool call
+                enum:
+                - Ready
+                - Error
+                - Pending
+                - Succeeded
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            required:
+            - externalCallID
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: tools.acp.humanlayer.dev
+spec:
+  group: acp.humanlayer.dev
+  names:
+    kind: Tool
+    listKind: ToolList
+    plural: tools
+    singular: tool
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.ready
+      name: Ready
+      type: boolean
+    - jsonPath: .status.status
+      name: Status
+      type: string
+    - jsonPath: .status.statusDetail
+      name: Detail
+      priority: 1
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Tool is the Schema for the tools API
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ToolSpec defines the desired state of Tool
+            properties:
+              agentRef:
+                description: AgentRef is used for delegation-type tools.
+                properties:
+                  name:
+                    type: string
+                required:
+                - name
+                type: object
+              arguments:
+                description: Arguments defines the JSON schema for the tool's arguments.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              description:
+                description: Description provides a description of the tool.
+                type: string
+              execute:
+                description: Execute defines how the tool should be executed.
+                properties:
+                  builtin:
+                    description: Builtin represents an inline (builtin) tool.
+                    properties:
+                      name:
+                        description: Name is the identifier of the builtin function
+                          to run. Today, supports simple math operations
+                        enum:
+                        - add
+                        - subtract
+                        - multiply
+                        - divide
+                        type: string
+                    type: object
+                type: object
+              name:
+                description: Name is used for inline/function tools (optional if the
+                  object name is used).
+                type: string
+              parameters:
+                description: Parameters defines the JSON schema for the tool's parameters.
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
+              toolType:
+                description: ToolType represents the type of tool; e.g. "function",
+                  "delegateToAgent", "externalAPI" etc.
+                enum:
+                - function
+                - delegateToAgent
+                - externalAPI
+                type: string
+            type: object
+          status:
+            description: ToolStatus defines the observed state of Tool
+            properties:
+              ready:
+                description: Ready indicates if the tool is ready to be used
+                type: boolean
+              status:
+                description: Status indicates the current status of the tool
+                enum:
+                - Ready
+                - Error
+                - Pending
+                type: string
+              statusDetail:
+                description: StatusDetail provides additional details about the current
+                  status
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-controller-manager
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-leader-election-role
+  namespace: default
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-contactchannel-admin-role
+rules:
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels
+  verbs:
+  - '*'
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-contactchannel-editor-role
+rules:
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-contactchannel-viewer-role
+rules:
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-llm-admin-role
+rules:
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - llms
+  verbs:
+  - '*'
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - llms/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-llm-editor-role
+rules:
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - llms
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - llms/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-llm-viewer-role
+rules:
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - llms
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - llms/status
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: acp-manager-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - agents
+  - contactchannels
+  - llms
+  - mcpservers
+  - tasks
+  - toolcalls
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - agents/status
+  - contactchannels/status
+  - llms/status
+  - mcpservers/status
+  - tasks/status
+  - toolcalls/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - contactchannels/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - acp.humanlayer.dev
+  resources:
+  - tools
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: acp-metrics-auth-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: acp-metrics-reader
+rules:
+- nonResourceURLs:
+  - /metrics
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-leader-election-rolebinding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: acp-leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: acp-controller-manager
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: acp-manager-role
+subjects:
+- kind: ServiceAccount
+  name: acp-controller-manager
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: acp-metrics-auth-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: acp-metrics-auth-role
+subjects:
+- kind: ServiceAccount
+  name: acp-controller-manager
+  namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+  name: acp-controller-manager-api-service
+  namespace: default
+spec:
+  ports:
+  - name: api
+    port: 8082
+    protocol: TCP
+    targetPort: api
+  selector:
+    app.kubernetes.io/name: acp
+    control-plane: controller-manager
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+    control-plane: controller-manager
+  name: acp-controller-manager-metrics-service
+  namespace: default
+spec:
+  ports:
+  - name: https
+    port: 8443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    app.kubernetes.io/name: acp
+    control-plane: controller-manager
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: acp
+    control-plane: controller-manager
+  name: acp-controller-manager
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: acp
+      control-plane: controller-manager
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
+      labels:
+        app.kubernetes.io/name: acp
+        control-plane: controller-manager
+    spec:
+      containers:
+      - args:
+        - --metrics-bind-address=:8443
+        - --leader-elect
+        - --health-probe-bind-address=:8081
+        command:
+        - /manager
+        image: ghcr.io/humanlayer/agentcontrolplane:v0.6.0
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        name: manager
+        ports:
+        - containerPort: 8082
+          name: api
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 512Mi
+          requests:
+            cpu: 100m
+            memory: 256Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        volumeMounts: []
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: acp-controller-manager
+      terminationGracePeriodSeconds: 10
+      volumes: []