Feat/mpa agent oneclick provision

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "veadk-python",
+  "interface": {
+    "displayName": "VeADK Python"
+  },
+  "plugins": [
+    {
+      "name": "agentkit-studio",
+      "source": {
+        "source": "local",
+        "path": "./plugins/agentkit-studio"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.github
+.venv
+.pytest_cache
+.ruff_cache
+**/__pycache__
+**/*.pyc
+.env
+.env.*
+frontend/node_modules
+frontend/coverage
+frontend/.vite
+dist
+build

.gitattributes

@@ -0,0 +1,3 @@
+# Minified build artifacts can contain semantic whitespace inside template literals.
+veadk/webui/assets/**/*.js -whitespace
+*.sh text eol=lf

.github/workflows/deploy-docs.yaml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - main
-      - feat/docs
+      - feat/new-docs
     paths:
       - 'docs/**'
       - '.github/workflows/deploy-docs.yaml'
@@ -16,33 +16,60 @@ permissions:
   pages: write
   id-token: write
 
+# Allow one concurrent deployment; cancel in-progress runs.
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: docs
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup Node.js
+      - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: 22
 
-      - name: Install dependencies
+      # pnpm via corepack (bundled with Node) — avoids third-party setup actions
+      # that are blocked by the org's allowed-actions policy.
+      - name: Enable pnpm
         run: |
-          cd docs
-          npm install
+          corepack enable
+          corepack prepare pnpm@10.16.1 --activate
 
-      - name: Build documentation
-        run: |
-          cd docs
-          npm run docs:build
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build static site (Fumadocs)
+        run: pnpm build:static
+        env:
+          # GitHub Pages project site is served from /<repo>. Without this base
+          # path, assets and routes 404 under the sub-path. (The pitfall.)
+          NEXT_PUBLIC_BASE_PATH: /${{ github.event.repository.name }}
+          # Optional: external Ask-AI endpoint (e.g. a VeFaaS function).
+          NEXT_PUBLIC_AI_CHAT_URL: ${{ vars.AI_CHAT_URL }}
 
       - name: Upload artifact for GitHub Pages
         uses: actions/upload-pages-artifact@v3
         with:
-          path: docs/docs/.vuepress/dist
+          path: docs/out
 
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    # The github-pages environment restricts deployments to the default branch.
+    # Branches/PRs run the build job above to validate; deploy happens on main.
+    if: github.ref == 'refs/heads/main'
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
       - name: Deploy to GitHub Pages
         id: deploy
         uses: actions/deploy-pages@v4

.github/workflows/harness-sidecar-release-gate.yaml

@@ -0,0 +1,152 @@
+name: Harness Sidecar Release Gate
+
+on:
+  workflow_call:
+  push:
+    paths:
+      - '.github/workflows/harness-sidecar-release-gate.yaml'
+      - 'frontend/**'
+      - 'tests/cli/test_generated_agent_harness_sidecar.py'
+      - 'tests/cli/test_managed_sidecar_source.py'
+      - 'tests/cli/test_legacy_runtime_recovery.py'
+      - 'tests/cli/test_generated_agent_backend_codegen_extended.py'
+      - 'tests/cli/test_generated_agent_mcp.py'
+      - 'tests/cli/test_studio_rbac.py'
+      - 'tests/extensions/harness/**'
+      - 'tests/integrations/agentkit/test_app.py'
+      - 'veadk/cli/generated_agent_codegen.py'
+      - 'veadk/cli/generated_agent_mcp.py'
+      - 'veadk/cli/cli_frontend.py'
+      - 'veadk/cli/managed_sidecar_source.py'
+      - 'veadk/cli/legacy_runtime_recovery.py'
+      - 'veadk/extensions/harness/**'
+      - 'veadk/integrations/agentkit/app.py'
+      - 'pyproject.toml'
+  pull_request:
+    paths:
+      - '.github/workflows/harness-sidecar-release-gate.yaml'
+      - 'frontend/**'
+      - 'tests/cli/test_generated_agent_harness_sidecar.py'
+      - 'tests/cli/test_managed_sidecar_source.py'
+      - 'tests/cli/test_legacy_runtime_recovery.py'
+      - 'tests/cli/test_generated_agent_backend_codegen_extended.py'
+      - 'tests/cli/test_generated_agent_mcp.py'
+      - 'tests/cli/test_studio_rbac.py'
+      - 'tests/extensions/harness/**'
+      - 'tests/integrations/agentkit/test_app.py'
+      - 'veadk/cli/generated_agent_codegen.py'
+      - 'veadk/cli/generated_agent_mcp.py'
+      - 'veadk/cli/cli_frontend.py'
+      - 'veadk/cli/managed_sidecar_source.py'
+      - 'veadk/cli/legacy_runtime_recovery.py'
+      - 'veadk/extensions/harness/**'
+      - 'veadk/integrations/agentkit/app.py'
+      - 'pyproject.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            uv.lock
+
+      - name: Install Python test dependencies
+        run: python -m pip install -e '.[dev]'
+
+      - name: Run Python Sidecar checks in parallel
+        shell: bash
+        run: |
+          set -euo pipefail
+          checks=(coverage lifecycle credentials)
+          pids=()
+          (
+            python -m pytest -q \
+              tests/extensions/harness/test_studio_sidecar.py \
+              tests/extensions/harness/test_sidecar_public_api.py \
+              tests/extensions/harness/test_extension.py \
+              tests/cli/test_generated_agent_harness_sidecar.py \
+              tests/cli/test_managed_sidecar_source.py \
+              tests/integrations/agentkit/test_app.py \
+              tests/cli/test_studio_rbac.py::test_sidecar_deployment_uses_agentkit_cli_structured_release \
+              tests/cli/test_generated_agent_backend_codegen_extended.py::test_generated_agent_sidecar_debug_uses_runtime_apig_and_active_plan \
+              --cov=. --cov-branch --cov-report= --cov-fail-under=0
+            python -m coverage report \
+              --include='*/veadk/extensions/harness/sidecar.py' \
+              --fail-under=91 --show-missing
+          ) > "$RUNNER_TEMP/sidecar-coverage.log" 2>&1 &
+          pids+=("$!")
+          (
+            python -m pytest -q \
+              tests/cli/test_legacy_runtime_recovery.py -k 'six_case_ or changed_unnamed_mcp_url'
+          ) > "$RUNNER_TEMP/sidecar-lifecycle.log" 2>&1 &
+          pids+=("$!")
+          (
+            python -m pytest -q \
+              tests/cli/test_generated_agent_mcp.py \
+              tests/cli/test_generated_agent_backend_codegen_extended.py::test_generated_debug_applies_published_mcp_credential_contract_before_discovery \
+              tests/cli/test_studio_rbac.py::test_new_deployment_only_updates_non_default_instance_range \
+              tests/cli/test_studio_rbac.py::test_sidecar_deployment_uses_agentkit_cli_structured_release \
+              tests/cli/test_studio_rbac.py::test_application_owned_mcp_update_routes_cover_reuse_and_additions \
+              tests/cli/test_studio_rbac.py::test_sidecar_update_resolves_or_explicitly_reuses_stored_mcp_credentials
+          ) > "$RUNNER_TEMP/sidecar-credentials.log" 2>&1 &
+          pids+=("$!")
+
+          status=0
+          for index in "${!pids[@]}"; do
+            if ! wait "${pids[$index]}"; then
+              status=1
+            fi
+            echo "::group::Python Sidecar ${checks[$index]}"
+            cat "$RUNNER_TEMP/sidecar-${checks[$index]}.log"
+            echo "::endgroup::"
+          done
+          exit "$status"
+
+  frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.17.0
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci --ignore-scripts
+
+      - name: Enforce public Studio Sidecar coverage above 90 percent
+        working-directory: frontend
+        run: npm run test:harness-sidecar-coverage
+
+      - name: Verify frontend Sidecar integration
+        working-directory: frontend
+        run: npm test
+
+  gate:
+    if: always()
+    needs: [python, frontend]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every Sidecar check to pass
+        env:
+          PYTHON_RESULT: ${{ needs.python.result }}
+          FRONTEND_RESULT: ${{ needs.frontend.result }}
+        run: |
+          test "$PYTHON_RESULT" = success
+          test "$FRONTEND_RESULT" = success