OLS-3462: define system prompt for sandbox agent#279
Conversation
The Claude Code Bash tool requires a writable ~/.claude directory on startup. With readOnlyRootFilesystem: true and no writable volume at /home/agent, executions fail with EACCES when the tool tries to mkdir /home/agent/.claude. Add an emptyDir volume "home" mounted at /home/agent in the bootstrap SandboxTemplate, bare-pod PodSpecBuilder, and e2e test sandbox template. Signed-off-by: Tomáš Remeš <tremes@redhat.com> Assisted-by: Claude Code:claude-opus-4-6
The OpenAI Agents SDK creates a .agents directory inside the read-only skills image volume at runtime to stage loaded skills. Add a skills-workdir emptyDir volume mounted at /app/skills/.agents so the SDK can write there while keeping skill content read-only. Covered by new assertions in podspec_builder and bootstrap tests. Signed-off-by: Tomáš Remeš <tremes@redhat.com> Assisted-by: Claude Code:claude-opus-4-6
…v9.8-1782910875 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Adds agentic-operator child spec for temporary audit log storage: OTLP log emission, templog-cleanup finalizer, and CRD spec.templog. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…v9.8-1782980183 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
…to 925bb5d Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Load a system prompt from templates/system_prompt.tmpl describing the OpenShift SRE role, available CLI tools, investigation protocol, and Prometheus querying instructions. Previously the operator sent an empty system prompt, causing the sandbox to fall back to a generic default. Related to openshift#273 Signed-off-by: Alberto Falossi <afalossi@redhat.com> Assisted-by: Claude Code:claude-opus-4-6
|
@falox: This pull request references OLS-3462 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughAdds templog specification documents (OTLP log emission, Proposal finalizer for PostgreSQL cleanup, CRD field), introduces ChangesTemplog spec and sandbox feature implementation
Build pipeline and dependency updates
Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/hold We're using PR to run experiments, but the global system prompt technique isn't necessarily the final solution. The current goal is to figure out the prompt fragment to give to the sandbox. It will then be integrated into the skills. Finally, we need to determine whether and what to change depending on the phase. |
openshift-ci
Bot
added
the
do-not-merge/hold
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.ai/spec/what/templog.md:
- Around line 1-3: The intro and cross-references in templog.md are
self-referential, which creates a circular parent-spec link. Update the wording
in this document so it points to the actual parent/spec source instead of
referencing itself, and adjust the related cross-reference text in the same
section to remove the “parent spec” loop while keeping the hierarchy clear.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c733f1a0-5a5a-49b0-9af6-8ec61cd99353
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum,!go.sum
📒 Files selected for processing (14)
.ai/spec/what/audit-logging.md.ai/spec/what/crd-api.md.ai/spec/what/templog.md.tekton/lightspeed-agentic-operator-pull-request.yaml.tekton/lightspeed-agentic-operator-push.yamlDockerfilecontroller/proposal/podspec_builder.gocontroller/proposal/podspec_builder_test.gocontroller/proposal/sandbox_agent.gocontroller/proposal/templates/system_prompt.tmplcontroller/sandbox/bootstrap.gocontroller/sandbox/bootstrap_test.gogo.modtest/agent/sandboxtemplate/sandboxtemplate.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift/lightspeed-agentic-sandbox(manual)
| # Temporary Audit Log Storage — Agentic Operator | ||
|
|
||
| Implementation details for the agentic-operator's role in the templog feature. See parent spec `what/templog.md` for requirements and architecture. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Break the self-referential parent-spec links.
This file points readers to what/templog.md as the “parent spec” in both the intro and cross-references, but this file already is what/templog.md. That makes the hierarchy circular and the link unhelpful.
Also applies to: 41-45
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.ai/spec/what/templog.md around lines 1 - 3, The intro and cross-references
in templog.md are self-referential, which creates a circular parent-spec link.
Update the wording in this document so it points to the actual parent/spec
source instead of referencing itself, and adjust the related cross-reference
text in the same section to remove the “parent spec” loop while keeping the
hierarchy clear.
|
@falox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Load a system prompt from templates/system_prompt.tmpl describing the
OpenShift SRE role, available CLI tools, investigation protocol, and
Prometheus querying instructions. Previously the operator sent an empty
system prompt, causing the sandbox to fall back to a generic default.
Related to #273
The focus is currently on the prompt's content, not on the wiring. See #279 (comment).
Assisted-by: Claude Code:claude-opus-4-6