feat: add Foundry hosted Responses adapter

.dockerignore

@@ -20,6 +20,8 @@
 !examples/harness/
 !examples/harness/echo/
 !examples/harness/echo/*.go
+!examples/harness/foundry-responses/
+!examples/harness/foundry-responses/*.go
 !*.go
 **/*_test.go
 

config/samples/core_v1alpha1_agentruntime_foundry.yaml

@@ -4,26 +4,29 @@ metadata:
   labels:
     app.kubernetes.io/name: orka
     app.kubernetes.io/managed-by: kustomize
-  name: sample-foundry-runtime
+  name: sample-foundry-responses-runtime
 spec:
-  # Namespace-local facade for an operator-deployed Azure AI Foundry hosted-agent adapter.
-  # Foundry credentials belong to the adapter Secret. Orka Tool credentials stay in
-  # Orka-governed credential sources and are used only by brokered execution.
+  # Namespace-local facade for an operator-deployed Foundry hosted Responses
+  # adapter (examples/harness/foundry-responses). Foundry credentials belong to
+  # the adapter Secret. Orka Tool credentials stay in Orka-governed credential
+  # sources and are used only by brokered execution.
   contractVersion: orka.harness.v1
   deployment:
     mode: external-endpoint
-    endpoint: http://sample-foundry-runtime.default.svc.cluster.local:8080
+    endpoint: http://sample-foundry-responses-runtime.default.svc.cluster.local:8080
   clientAuth:
     bearerTokenSecretRef:
-      name: sample-foundry-runtime-token
-      key: token
+      name: sample-foundry-responses-runtime-token
+      key: harness-bearer
   capabilities:
+    # Mirror only classes whose hosted AgentKit deployment statically includes
+    # the matching probe-only conformance_read/conformance_write schema and has
+    # passed live AgentRuntime conformance. Add write only after that gate.
     toolExecutionModes:
     - observed
     - brokered
     brokeredToolClasses:
     - read
-    - write
     supportsCancel: true
     supportsRuntimeSessions: true
     supportsContinuation: true

examples/bring-your-own-agent-runtime-demo/README.md

@@ -90,7 +90,7 @@ examples/fibey-custom-agent-demo/switch-backend.sh http
 examples/fibey-custom-agent-demo/switch-backend.sh foundry
 ```
 
-The workflow, Tool CRDs, approval UX, and task/result APIs remain Orka-owned. Remote backends receive safe tool schemas and scoped turn metadata only; they do not receive downstream Tool credentials.
+The workflow, Tool CRDs, approval UX, and task/result APIs remain Orka-owned. Remote backends receive safe tool schemas and scoped turn metadata only; they do not receive downstream Tool credentials. For Foundry hosted AgentKit Responses, the adapter does not send request-level `tools`; AgentKit schemas must be configured statically and the facade capabilities must match the conformance-tested classes.
 
 ## Troubleshooting
 

examples/fibey-custom-agent-demo/README.md

@@ -2,15 +2,15 @@
 
 This demo exercises the first bring-your-own agent runtime slice: Orka registers a namespace-local `AgentRuntime` facade for a remote execution backend, then an `Agent` routes `type: agent` work to it with `spec.runtime.runtimeRef`.
 
-The checked-in backend is a deterministic generic HTTP harness fixture. It advertises `runtimeName: fibey-http-runtime`, supports `orka.harness.v1`, and runs in `observed` tool mode by default. AgentKit Serve and Foundry should plug in by swapping only the backend Service/adapter endpoint and `AgentRuntime` facade, not the Orka workflow.
+The checked-in backend is a deterministic generic HTTP harness fixture. It advertises `runtimeName: fibey-http-runtime`, supports `orka.harness.v1`, and runs in `observed` tool mode by default. AgentKit Serve, Foundry Assistants, and Foundry hosted AgentKit Responses should plug in by swapping only the backend Service/adapter endpoint and `AgentRuntime` facade, not the Orka workflow.
 
 ## Backend facades
 
 | Facade | Backend | Credentials |
 | --- | --- | --- |
 | `fibey-http-runtime` | Generic mock/self-hosted HTTP runtime | Harness bearer token only |
 | `fibey-agentkit-runtime` | AgentKit Serve adapter | Adapter/runtime config only |
-| `fibey-foundry-runtime` | Foundry adapter | Adapter Secret; no Orka Tool production credentials |
+| `fibey-agentkit-foundry-responses` | Foundry hosted AgentKit Responses adapter | Adapter Secret; no Orka Tool production credentials |
 
 `fibey-agentkit-runtime` is intentionally observed-only in the checked-in demo: it should show `toolExecutionModes: [observed]`, `supportsCancel: true`, and `supportsRuntimeSessions: true`, with no `brokeredToolClasses` or `supportsContinuation`. AgentKit brokered read/write/coordination exist only for deployments that explicitly enable those conformance-gated profiles.
 
@@ -106,12 +106,21 @@ kubectl apply -f examples/fibey-custom-agent-demo/agentruntime-agentkit.yaml
 kubectl apply -f examples/fibey-custom-agent-demo/agent-agentkit.yaml
 kubectl wait --for=condition=Ready agentruntime/fibey-agentkit-runtime --timeout=60s
 
-# Foundry adapter facade; requires a Service named fibey-foundry-runtime.
-# Build/deploy examples/harness/foundry with ORKA_FOUNDRY_* credentials first.
+# Foundry hosted AgentKit Responses facade; requires a Service named fibey-agentkit-foundry-responses.
+# Build/deploy examples/harness/foundry-responses with ORKA_FOUNDRY_RESPONSES_* credentials first.
 kubectl apply -f examples/fibey-custom-agent-demo/secret-foundry.yaml
 kubectl apply -f examples/fibey-custom-agent-demo/agentruntime-foundry.yaml
 kubectl apply -f examples/fibey-custom-agent-demo/agent-foundry.yaml
-kubectl wait --for=condition=Ready agentruntime/fibey-foundry-runtime --timeout=60s
+kubectl wait --for=condition=Ready agentruntime/fibey-agentkit-foundry-responses --timeout=60s
+
+# Optional literal brokered Fibey read/write scenario once downstream services exist.
+kubectl apply -f examples/fibey-custom-agent-demo/tools-foundry-responses.yaml
+kubectl apply -f examples/fibey-custom-agent-demo/task-foundry-responses.yaml
+
+# After the task runs through read, write approval, and completion, verify evidence.
+examples/fibey-custom-agent-demo/verify-foundry-responses.sh \
+  --task fibey-foundry-responses-quincy-north-alert \
+  --namespace default
 ```
 
 Run the same task against another backend by changing only `spec.agentRef.name`, for example:
@@ -125,4 +134,4 @@ examples/fibey-custom-agent-demo/switch-backend.sh http
 The script validates the selected `AgentRuntime` and `Agent`, then patches only
 the Task's `spec.agentRef.name`.
 
-Brokered mode is used only when the selected runtime advertises brokered capabilities and the task/agent exposes allowed tools. Current AgentKit Serve facades do not advertise brokered mode, so AgentKit-owned tools remain internal to AgentKit and Orka observes only lifecycle/output frames. Orka-owned side-effect tools stay behind Orka brokered governance; production tool credentials are not handed to the remote backend.
+Brokered mode is used only when the selected runtime advertises brokered capabilities and the task/agent exposes allowed tools. Current AgentKit Serve facades do not advertise brokered mode, so AgentKit-owned tools remain internal to AgentKit and Orka observes only lifecycle/output frames. The Foundry hosted Responses facade must advertise only the brokered classes statically configured in AgentKit and verified by conformance. Orka-owned side-effect tools stay behind Orka brokered governance; production tool credentials are not handed to the remote backend, and hosted Responses requests do not include request-level `tools`.

examples/fibey-custom-agent-demo/agent-foundry.yaml

@@ -1,12 +1,12 @@
-# Optional Agent that selects the Foundry hosted-agent backend facade.
+# Optional Agent that selects the Foundry hosted AgentKit Responses backend facade.
 apiVersion: core.orka.ai/v1alpha1
 kind: Agent
 metadata:
   name: fibey-remote-foundry
 spec:
   runtime:
     runtimeRef:
-      name: fibey-foundry-runtime
+      name: fibey-agentkit-foundry-responses
   systemPrompt:
     inline: |
-      You are Fibey's Foundry-backed incident scout. Produce a concise dossier and request Orka-brokered tools for evidence or consequential actions.
+      You are Fibey's Foundry-hosted AgentKit incident scout. Use Orka-brokered read tools for evidence and Orka-brokered write tools only when approval is required.

examples/fibey-custom-agent-demo/agentruntime-foundry.yaml

@@ -1,20 +1,25 @@
-# Optional namespace-local facade for a Foundry hosted-agent adapter implementing orka.harness.v1.
-# Apply this with secret-foundry.yaml and point an Agent runtimeRef at fibey-foundry-runtime
-# after deploying the adapter Service named fibey-foundry-runtime.
+# Optional namespace-local facade for a Foundry hosted AgentKit Responses adapter
+# implementing orka.harness.v1. Apply this with secret-foundry.yaml and point an
+# Agent runtimeRef at fibey-agentkit-foundry-responses after deploying the
+# examples/harness/foundry-responses adapter Service with the same name.
 apiVersion: core.orka.ai/v1alpha1
 kind: AgentRuntime
 metadata:
-  name: fibey-foundry-runtime
+  name: fibey-agentkit-foundry-responses
 spec:
   contractVersion: orka.harness.v1
   deployment:
     mode: external-endpoint
-    endpoint: http://fibey-foundry-runtime.default.svc.cluster.local:8080
+    endpoint: http://fibey-agentkit-foundry-responses.default.svc.cluster.local:8080
   clientAuth:
     bearerTokenSecretRef:
-      name: fibey-foundry-runtime-token
+      name: fibey-agentkit-foundry-responses-token
       key: token
   capabilities:
+    # This sample assumes the hosted AgentKit deployment has static Fibey tool
+    # schemas plus probe-only conformance_read/conformance_write schemas, and
+    # has passed live AgentRuntime read/write conformance. Fake-server adapter
+    # tests alone are not sufficient. Narrow this list until each gate passes.
     toolExecutionModes:
     - observed
     - brokered

examples/fibey-custom-agent-demo/secret-foundry.yaml

@@ -1,13 +1,14 @@
-# Optional harness bearer token for the Foundry adapter facade.
-# This authenticates Orka to the adapter endpoint; Foundry credentials stay in the adapter Secret.
+# Optional harness bearer token for the Foundry hosted Responses adapter facade.
+# This authenticates Orka to the adapter endpoint; Foundry credentials stay in
+# the adapter Deployment Secret/env and are never stored in this AgentRuntime.
 apiVersion: v1
 kind: Secret
 metadata:
-  name: fibey-foundry-runtime-token
+  name: fibey-agentkit-foundry-responses-token
   annotations:
-    orka.ai/agent-runtime-endpoint: http://fibey-foundry-runtime.default.svc.cluster.local:8080
+    orka.ai/agent-runtime-endpoint: http://fibey-agentkit-foundry-responses.default.svc.cluster.local:8080
   labels:
     orka.ai/agent-runtime-auth: "true"
-    orka.ai/agent-runtime-name: fibey-foundry-runtime
+    orka.ai/agent-runtime-name: fibey-agentkit-foundry-responses
 stringData:
-  token: mock-token
+  token: REDACTED

examples/fibey-custom-agent-demo/switch-backend.sh

@@ -27,7 +27,7 @@ case "${backend}" in
     ;;
   foundry)
     agent="fibey-remote-foundry"
-    runtime="fibey-foundry-runtime"
+    runtime="fibey-agentkit-foundry-responses"
     ;;
   -h|--help|help|"")
     usage

examples/fibey-custom-agent-demo/task-foundry-responses.yaml

@@ -0,0 +1,20 @@
+# Optional Foundry hosted AgentKit Responses task that exposes the Fibey brokered
+# read/write tools. Apply with tools-foundry-responses.yaml and the Foundry
+# Responses facade manifests after deploying the downstream mock/real services.
+apiVersion: core.orka.ai/v1alpha1
+kind: Task
+metadata:
+  name: fibey-foundry-responses-quincy-north-alert
+spec:
+  type: agent
+  agentRef:
+    name: fibey-remote-foundry
+  agentRuntime:
+    allowedTools:
+    - check-network-telemetry
+    - get-active-incidents
+    - dispatch-work-order
+    - escalate-incident
+  prompt: |
+    Quincy North alert: pump telemetry is anomalous after overnight maintenance.
+    Investigate likely cause with brokered read tools, summarize evidence, and request approval before dispatching any work order.

examples/fibey-custom-agent-demo/testdata/foundry-responses-events-completion-after-terminal.json

@@ -0,0 +1,86 @@
+{
+  "events": [
+    {
+      "seq": 1,
+      "eventType": "ToolCallStarted",
+      "toolName": "check-network-telemetry",
+      "content": {
+        "harness": {
+          "frameType": "ToolCallRequested"
+        }
+      },
+      "toolCallID": "read-call-1"
+    },
+    {
+      "seq": 2,
+      "eventType": "ToolCallCompleted",
+      "toolName": "check-network-telemetry",
+      "toolCallID": "read-call-1",
+      "content": {
+        "approved": true
+      }
+    },
+    {
+      "seq": 3,
+      "eventType": "ToolCallStarted",
+      "toolName": "dispatch-work-order",
+      "content": {
+        "harness": {
+          "frameType": "ToolCallRequested"
+        }
+      },
+      "toolCallID": "write-call-1"
+    },
+    {
+      "seq": 4,
+      "eventType": "ApprovalRequested",
+      "toolName": "dispatch-work-order",
+      "toolCallID": "approval-1",
+      "content": {
+        "approvalID": "approval-1",
+        "targetTool": "dispatch-work-order",
+        "toolCallID": "write-call-1"
+      }
+    },
+    {
+      "seq": 5,
+      "eventType": "ApprovalApproved",
+      "toolCallID": "approval-1",
+      "content": {
+        "approvalID": "approval-1",
+        "decision": "approve"
+      }
+    },
+    {
+      "seq": 6,
+      "eventType": "ToolCallStarted",
+      "toolName": "dispatch-work-order",
+      "content": {
+        "approvalID": "approval-1",
+        "brokeredClass": "write",
+        "executionState": "started",
+        "idempotencyKey": "approval-1",
+        "executionIdempotencyKey": "approval-1"
+      },
+      "toolCallID": "write-call-1"
+    },
+    {
+      "seq": 7,
+      "eventType": "AgentRuntimeCompleted"
+    },
+    {
+      "seq": 8,
+      "eventType": "ToolCallCompleted",
+      "toolName": "dispatch-work-order",
+      "toolCallID": "write-call-1",
+      "content": {
+        "approved": true,
+        "executionIdempotencyKey": "approval-1"
+      }
+    },
+    {
+      "seq": 9,
+      "eventType": "TaskSucceeded"
+    }
+  ]
+}

examples/fibey-custom-agent-demo/testdata/foundry-responses-events-decision-before-request.json

@@ -0,0 +1,66 @@
+{
+  "events": [
+    {
+      "seq": 1,
+      "eventType": "ToolCallStarted",
+      "toolName": "check-network-telemetry",
+      "content": {
+        "harness": {
+          "frameType": "ToolCallRequested"
+        }
+      },
+      "toolCallID": "read-call-1"
+    },
+    {
+      "seq": 2,
+      "eventType": "ApprovalApproved",
+      "toolCallID": "approval-1",
+      "content": {
+        "approvalID": "approval-1",
+        "decision": "approve"
+      }
+    },
+    {
+      "seq": 3,
+      "eventType": "ToolCallStarted",
+      "toolName": "dispatch-work-order",
+      "content": {
+        "harness": {
+          "frameType": "ToolCallRequested"
+        }
+      },
+      "toolCallID": "write-call-1"
+    },
+    {
+      "seq": 4,
+      "eventType": "ApprovalRequested",
+      "toolName": "dispatch-work-order",
+      "toolCallID": "approval-1",
+      "content": {
+        "approvalID": "approval-1",
+        "targetTool": "dispatch-work-order",
+        "toolCallID": "write-call-1"
+      }
+    },
+    {
+      "seq": 5,
+      "eventType": "ToolCallStarted",
+      "toolName": "dispatch-work-order",
+      "content": {
+        "approvalID": "approval-1",
+        "brokeredClass": "write",
+        "executionState": "started",
+        "idempotencyKey": "approval-1"
+      },
+      "toolCallID": "write-call-1"
+    },
+    {
+      "seq": 6,
+      "eventType": "AgentRuntimeCompleted"
+    },
+    {
+      "seq": 7,
+      "eventType": "TaskSucceeded"
+    }
+  ]
+}