feat(qwenpaw): adapt worker runtime to QwenPaw 2.0

.github/workflows/test-integration.yml

@@ -13,7 +13,10 @@ on:
       - 'install/**'
       - 'shared/**'
       - 'copaw/**'
+      - 'qwenpaw/**'
       - 'hermes/**'
+      - 'plugins/teamharness/adapters/qwenpaw/**'
+      - 'plugins/workerflow/adapters/qwenpaw/**'
       - 'Makefile'
       - '.github/workflows/test-integration.yml'
   push:
@@ -30,7 +33,10 @@ on:
       - 'install/**'
       - 'shared/**'
       - 'copaw/**'
+      - 'qwenpaw/**'
       - 'hermes/**'
+      - 'plugins/teamharness/adapters/qwenpaw/**'
+      - 'plugins/workerflow/adapters/qwenpaw/**'
       - 'Makefile'
   workflow_dispatch:
     inputs:
@@ -50,6 +56,7 @@ on:
           - both
           - openclaw
           - copaw
+          - qwenpaw
           - hermes
         default: 'both'
       model:
@@ -72,6 +79,7 @@ env:
   SHARD_B_TESTS: "14"
   SHARD_C_TESTS: "15 17 18 19 20 22 23 24 25 100"
   SHARD_D_TESTS: "21"
+  SHARD_QWENPAW_TESTS: "26"
   NON_GITHUB_TESTS: "01 02 03 04 05 06 14 15 17 18 19 20 21 22 23 24 25 100"
 
 jobs:
@@ -125,6 +133,10 @@ jobs:
             {"shard":"llm-interaction-2","filter_env":"SHARD_B_TESTS","manager_runtime":"copaw","worker_runtime":"copaw","requires_secret":true},
             {"shard":"controller-cr","filter_env":"SHARD_C_TESTS","manager_runtime":"copaw","worker_runtime":"copaw","requires_secret":false},
             {"shard":"controller-cr-2","filter_env":"SHARD_D_TESTS","manager_runtime":"copaw","worker_runtime":"copaw","requires_secret":false},
+            {"shard":"llm-interaction","filter_env":"SHARD_A_TESTS","manager_runtime":"copaw","worker_runtime":"qwenpaw","requires_secret":true},
+            {"shard":"llm-interaction-2","filter_env":"SHARD_B_TESTS","manager_runtime":"copaw","worker_runtime":"qwenpaw","requires_secret":true},
+            {"shard":"controller-cr","filter_env":"SHARD_C_TESTS","manager_runtime":"copaw","worker_runtime":"qwenpaw","requires_secret":false},
+            {"shard":"qwenpaw-teamharness","filter_env":"SHARD_QWENPAW_TESTS","manager_runtime":"copaw","worker_runtime":"qwenpaw","requires_secret":true},
             {"shard":"llm-interaction","filter_env":"SHARD_A_TESTS","manager_runtime":"copaw","worker_runtime":"hermes","requires_secret":true},
             {"shard":"llm-interaction-2","filter_env":"SHARD_B_TESTS","manager_runtime":"copaw","worker_runtime":"hermes","requires_secret":true},
             {"shard":"controller-cr","filter_env":"SHARD_C_TESTS","manager_runtime":"copaw","worker_runtime":"hermes","requires_secret":false}
@@ -230,7 +242,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [embedded, manager, manager-copaw, worker, copaw-worker, hermes-worker]
+        target: [embedded, manager, manager-copaw, worker, copaw-worker, qwenpaw-worker, hermes-worker]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

Makefile

@@ -673,7 +673,7 @@ uninstall: ## Stop and remove Manager + all Worker containers
 
 install-embedded: ## Install in embedded mode (dual-container: controller + agent)
 ifndef SKIP_BUILD
-	$(MAKE) build-embedded build-manager build-manager-copaw build-worker build-copaw-worker build-hermes-worker
+	$(MAKE) build-embedded build-manager build-manager-copaw build-worker build-copaw-worker build-qwenpaw-worker build-hermes-worker
 endif
 	@echo "==> Installing AgentTeams (embedded mode)..."
 	AGENTTEAMS_NON_INTERACTIVE=1 \
@@ -682,6 +682,7 @@ endif
 		AGENTTEAMS_INSTALL_MANAGER_COPAW_IMAGE=$(LOCAL_MANAGER_COPAW) \
 		AGENTTEAMS_INSTALL_WORKER_IMAGE=$(LOCAL_WORKER) \
 		AGENTTEAMS_INSTALL_COPAW_WORKER_IMAGE=$(LOCAL_COPAW_WORKER) \
+		AGENTTEAMS_INSTALL_QWENPAW_WORKER_IMAGE=$(LOCAL_QWENPAW_WORKER) \
 		AGENTTEAMS_INSTALL_HERMES_WORKER_IMAGE=$(LOCAL_HERMES_WORKER) \
 		AGENTTEAMS_INSTALL_OPENHUMAN_WORKER_IMAGE=$(LOCAL_OPENHUMAN_WORKER) \
 		AGENTTEAMS_MATRIX_E2EE=0 \

agentteams-controller/api/v1beta1/types.go

@@ -43,6 +43,10 @@ const LabelWorkerEdgeUUID = "agentteams.io/worker-edge-uuid"
 // re-issues credentials and updates the annotation to match.
 const AnnotationEdgeAppliedUUID = "agentteams.io/edge-applied-uuid"
 
+// AnnotationWorkerTeamName records the effective Team identity for a referenced
+// Worker so independent Worker reconciles preserve its scoped team storage access.
+const AnnotationWorkerTeamName = "agentteams.io/team-name"
+
 // AccessEntry declares one cloud-permission grant under a logical
 // service. v1 supported services: "object-storage", "ai-gateway", "ai-registry", "schedulerx3".
 //

agentteams-controller/internal/accessresolver/defaults.go

@@ -26,7 +26,8 @@ import (
 // applied when a Worker CR omits spec.accessEntries. Mirrors the
 // embedded-mode MinIO policy produced by oss.MinIOAdminClient.buildWorkerPolicy
 // (for a standalone worker): read/write/list/delete on the worker's own
-// agent prefix and on the shared prefix, scoped to the workspace bucket.
+// agent prefix and on the shared prefix, plus read/list on centrally uploaded
+// AgentSpec packages, scoped to the workspace bucket.
 //
 // The returned entries still contain the ${self.name} template — they
 // are resolved by Resolver.ResolveForCaller before leaving the
@@ -46,6 +47,17 @@ func DefaultEntriesForWorker() []v1beta1.AccessEntry {
 				},
 			}),
 		},
+		{
+			Service:     credprovider.ServiceObjectStorage,
+			Permissions: []string{"read", "list"},
+			Scope: jsonObj(map[string]any{
+				"bucketRef": "workspace",
+				"prefixes": []any{
+					"agentteams-config/packages/",
+					"agentteams-config/packages/*",
+				},
+			}),
+		},
 	}
 }
 
@@ -54,7 +66,8 @@ func DefaultEntriesForWorker() []v1beta1.AccessEntry {
 // Mirrors the embedded-mode policy produced by
 // oss.MinIOAdminClient.buildWorkerPolicy when teamName != "": read/
 // write/list/delete on the member's own agent prefix, on the shared
-// prefix, and on the team-scoped prefix.
+// prefix, and on the team-scoped prefix, plus read/list on centrally uploaded
+// AgentSpec packages.
 //
 // Leader and team workers share the same default scope — the leader is
 // not elevated with cross-member access. Cross-member collaboration is
@@ -80,6 +93,17 @@ func DefaultEntriesForTeamMember() []v1beta1.AccessEntry {
 				},
 			}),
 		},
+		{
+			Service:     credprovider.ServiceObjectStorage,
+			Permissions: []string{"read", "list"},
+			Scope: jsonObj(map[string]any{
+				"bucketRef": "workspace",
+				"prefixes": []any{
+					"agentteams-config/packages/",
+					"agentteams-config/packages/*",
+				},
+			}),
+		},
 	}
 }
 

agentteams-controller/internal/accessresolver/resolver_test.go

@@ -52,12 +52,8 @@ func TestResolveWorker_DefaultEntries(t *testing.T) {
 	if session != "agentteams-worker-alice" {
 		t.Fatalf("session = %q", session)
 	}
-	// Standalone workers now default to a single object-storage entry
-	// that folds agents/<name>/ + agents/<name>/* + shared/ + shared/*
-	// together, mirroring the
-	// embedded MinIO policy which grants both prefixes RW.
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 default entry, got %d", len(entries))
+	if len(entries) != 2 {
+		t.Fatalf("expected RW workspace and read-only package entries, got %d", len(entries))
 	}
 	e := entries[0]
 	if e.Service != credprovider.ServiceObjectStorage {
@@ -74,6 +70,15 @@ func TestResolveWorker_DefaultEntries(t *testing.T) {
 	if !hasAllPerms(e.Permissions, "read", "write", "list", "delete") {
 		t.Fatalf("expected RW shared/* permissions, got %+v", e.Permissions)
 	}
+	packageEntry := entries[1]
+	if !hasPrefix(packageEntry.Scope.Prefixes, "agentteams-config/packages/*") {
+		t.Fatalf("expected AgentSpec package prefix, got %+v", packageEntry.Scope.Prefixes)
+	}
+	if !hasAllPerms(packageEntry.Permissions, "read", "list") ||
+		hasAllPerms(packageEntry.Permissions, "write") ||
+		hasAllPerms(packageEntry.Permissions, "delete") {
+		t.Fatalf("AgentSpec package permissions must be read/list only, got %+v", packageEntry.Permissions)
+	}
 }
 
 func hasPrefix(prefixes []string, want string) bool {
@@ -235,7 +240,7 @@ func TestResolve_AIGatewayHappyPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("resolve: %v", err)
 	}
-	if len(entries) != 2 {
+	if len(entries) != 3 {
 		t.Fatalf("got %d entries", len(entries))
 	}
 	if entryForService(entries, credprovider.ServiceObjectStorage) == nil {
@@ -276,7 +281,7 @@ func TestResolve_AIRegistryDefaultResources(t *testing.T) {
 	if err != nil {
 		t.Fatalf("resolve: %v", err)
 	}
-	if len(entries) != 2 {
+	if len(entries) != 3 {
 		t.Fatalf("got %d entries", len(entries))
 	}
 	if entryForService(entries, credprovider.ServiceObjectStorage) == nil {
@@ -575,8 +580,8 @@ func TestResolveTeamLeader_DefaultEntries(t *testing.T) {
 	if session != "agentteams-worker-lead" {
 		t.Fatalf("session = %q, want agentteams-worker-lead", session)
 	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 default entry, got %d", len(entries))
+	if len(entries) != 2 {
+		t.Fatalf("expected 2 default entries, got %d", len(entries))
 	}
 	e := entries[0]
 	if e.Scope.Bucket != "agentteams-test" {
@@ -613,8 +618,8 @@ func TestResolveTeamLeader_DefaultEntriesUseRuntimeWorkerName(t *testing.T) {
 	if session != "agentteams-worker-lead" {
 		t.Fatalf("session = %q, want agentteams-worker-lead", session)
 	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 default entry, got %d", len(entries))
+	if len(entries) != 2 {
+		t.Fatalf("expected 2 default entries, got %d", len(entries))
 	}
 	got := entries[0].Scope.Prefixes
 	if !hasPrefix(got, "agents/runtime-lead/") {
@@ -672,8 +677,8 @@ func TestResolveTeamWorker_DefaultEntries(t *testing.T) {
 	if session != "agentteams-worker-w1" {
 		t.Fatalf("session = %q", session)
 	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 default entry, got %d", len(entries))
+	if len(entries) != 2 {
+		t.Fatalf("expected 2 default entries, got %d", len(entries))
 	}
 	e := entries[0]
 	for _, want := range []string{"agents/w1/", "agents/w1/*", "shared/", "shared/*", "teams/alpha/", "teams/alpha/*"} {
@@ -710,8 +715,8 @@ func TestResolveTeamWorker_DefaultEntriesUseRuntimeWorkerName(t *testing.T) {
 	if session != "agentteams-worker-w1" {
 		t.Fatalf("session = %q, want agentteams-worker-w1", session)
 	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 default entry, got %d", len(entries))
+	if len(entries) != 2 {
+		t.Fatalf("expected 2 default entries, got %d", len(entries))
 	}
 	got := entries[0].Scope.Prefixes
 	if !hasPrefix(got, "agents/runtime-w1/*") {
@@ -777,8 +782,8 @@ func TestResolveTeamMember_TeamCRMissing(t *testing.T) {
 	if err != nil {
 		t.Fatalf("resolve: %v", err)
 	}
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 default entry, got %d", len(entries))
+	if len(entries) != 2 {
+		t.Fatalf("expected 2 default entries, got %d", len(entries))
 	}
 	got := entries[0].Scope.Prefixes
 	for _, want := range []string{"agents/ghost-worker/*", "shared/*", "teams/ghost/*"} {

agentteams-controller/internal/app/app.go

@@ -643,6 +643,8 @@ func (a *App) initHTTPServer(_ context.Context) error {
 		SocketPath:     a.cfg.SocketPath,
 		MatrixConfig:   a.cfg.MatrixConfig(),
 		Provisioner:    a.provisioner,
+
+		DefaultWorkerRuntime: a.cfg.DefaultWorkerRuntime,
 	})
 	return nil
 }

agentteams-controller/internal/config/config.go

@@ -513,6 +513,7 @@ func (c *Config) DockerConfig() backend.DockerConfig {
 		CopawWorkerImage:     envOrDefault("AGENTTEAMS_COPAW_WORKER_IMAGE", "agentteams/agentteams-copaw-worker:latest"),
 		HermesWorkerImage:    envOrDefault("AGENTTEAMS_HERMES_WORKER_IMAGE", "agentteams/agentteams-hermes-worker:latest"),
 		OpenHumanWorkerImage: envOrDefault("AGENTTEAMS_OPENHUMAN_WORKER_IMAGE", "agentteams/agentteams-openhuman-worker:latest"),
+		QwenPawWorkerImage:   envOrDefault("AGENTTEAMS_QWENPAW_WORKER_IMAGE", "agentteams/agentteams-qwenpaw-worker:latest"),
 		DefaultNetwork:       envOrDefault("AGENTTEAMS_DOCKER_NETWORK", "agentteams-net"),
 	}
 }
@@ -555,6 +556,7 @@ func (c *Config) K8sConfig() backend.K8sConfig {
 		CopawWorkerImage:     envOrDefault("AGENTTEAMS_COPAW_WORKER_IMAGE", "agentteams/agentteams-copaw-worker:latest"),
 		HermesWorkerImage:    envOrDefault("AGENTTEAMS_HERMES_WORKER_IMAGE", "agentteams/agentteams-hermes-worker:latest"),
 		OpenHumanWorkerImage: envOrDefault("AGENTTEAMS_OPENHUMAN_WORKER_IMAGE", "agentteams/agentteams-openhuman-worker:latest"),
+		QwenPawWorkerImage:   envOrDefault("AGENTTEAMS_QWENPAW_WORKER_IMAGE", "agentteams/agentteams-qwenpaw-worker:latest"),
 		WorkerCPU:            c.K8sWorkerCPU,
 		WorkerMemory:         c.K8sWorkerMemory,
 		ControllerName:       c.ControllerName,
@@ -571,6 +573,7 @@ func (c *Config) SandboxConfig() backend.SandboxConfig {
 		CopawWorkerImage:             envOrDefault("AGENTTEAMS_COPAW_WORKER_IMAGE", "agentteams/agentteams-copaw-worker:latest"),
 		HermesWorkerImage:            envOrDefault("AGENTTEAMS_HERMES_WORKER_IMAGE", "agentteams/agentteams-hermes-worker:latest"),
 		OpenHumanWorkerImage:         envOrDefault("AGENTTEAMS_OPENHUMAN_WORKER_IMAGE", "agentteams/agentteams-openhuman-worker:latest"),
+		QwenPawWorkerImage:           envOrDefault("AGENTTEAMS_QWENPAW_WORKER_IMAGE", "agentteams/agentteams-qwenpaw-worker:latest"),
 		WorkerCPU:                    c.K8sWorkerCPU,
 		WorkerMemory:                 c.K8sWorkerMemory,
 		SandboxPrewarmSize:           c.SandboxPrewarmSize,

agentteams-controller/internal/config/config_test.go

@@ -130,6 +130,22 @@ func TestLoadConfigUsesManagerEnvFallback(t *testing.T) {
 	}
 }
 
+func TestBackendConfigsIncludeQwenPawWorkerImage(t *testing.T) {
+	t.Setenv("AGENTTEAMS_QWENPAW_WORKER_IMAGE", "agentteams/qwenpaw-worker:test")
+
+	cfg := LoadConfig()
+
+	for name, got := range map[string]string{
+		"docker":  cfg.DockerConfig().QwenPawWorkerImage,
+		"k8s":     cfg.K8sConfig().QwenPawWorkerImage,
+		"sandbox": cfg.SandboxConfig().QwenPawWorkerImage,
+	} {
+		if want := "agentteams/qwenpaw-worker:test"; got != want {
+			t.Fatalf("%s QwenPawWorkerImage = %q, want %q", name, got, want)
+		}
+	}
+}
+
 func TestLoadConfigPanicsOnInvalidManagerSpec(t *testing.T) {
 	t.Setenv("AGENTTEAMS_MANAGER_SPEC", "{")
 

agentteams-controller/internal/controller/member_reconcile.go

@@ -80,6 +80,7 @@ func (r MemberRole) String() string { return string(r) }
 type MemberContext struct {
 	Name        string // Kubernetes resource identity (CR/Pod/SA key)
 	RuntimeName string // business/runtime identity (Matrix/OSS/room alias key)
+	TeamName    string // effective Team identity used for scoped storage access
 	Namespace   string
 	Role        MemberRole
 	Spec        v1beta1.WorkerSpec
@@ -286,7 +287,7 @@ func ValidateMemberDeployment(m MemberContext) error {
 // RoomID, and ProvResult into state.
 func ReconcileMemberInfra(ctx context.Context, d MemberDeps, m MemberContext, state *MemberState) (reconcile.Result, error) {
 	if m.ExistingMatrixUserID != "" {
-		refreshResult, err := d.Provisioner.RefreshWorkerCredentials(ctx, m.Name, m.RuntimeName, "")
+		refreshResult, err := d.Provisioner.RefreshWorkerCredentials(ctx, m.Name, m.RuntimeName, m.TeamName)
 		if err != nil {
 			return reconcile.Result{}, fmt.Errorf("refresh credentials: %w", err)
 		}
@@ -689,7 +690,7 @@ func createMemberContainer(ctx context.Context, d MemberDeps, m MemberContext, s
 
 	prov := state.ProvResult
 	if prov == nil || prov.MatrixToken == "" {
-		refreshResult, err := d.Provisioner.RefreshWorkerCredentials(ctx, m.Name, m.RuntimeName, "")
+		refreshResult, err := d.Provisioner.RefreshWorkerCredentials(ctx, m.Name, m.RuntimeName, m.TeamName)
 		if err != nil {
 			return reconcile.Result{}, fmt.Errorf("refresh credentials for container: %w", err)
 		}
@@ -753,7 +754,15 @@ func createMemberContainer(ctx context.Context, d MemberDeps, m MemberContext, s
 		}
 		createReq.AuthToken = token
 
-		if err := waitForScopedWorkerConfig(ctx, m.Name, workerEnv); err != nil {
+		configOwner := m.Name
+		configKey := "agents/" + configOwner + "/openclaw.json"
+		if backend.ResolveRuntime(m.Spec.Runtime, d.DefaultRuntime) == backend.RuntimeQwenPaw {
+			if m.RuntimeName != "" {
+				configOwner = m.RuntimeName
+			}
+			configKey = "agents/" + configOwner + "/runtime/runtime.yaml"
+		}
+		if err := waitForScopedWorkerConfig(ctx, m.Name, configKey, workerEnv); err != nil {
 			return reconcile.Result{}, fmt.Errorf("worker scoped storage config is not readable: %w", err)
 		}
 	}
@@ -767,7 +776,7 @@ func createMemberContainer(ctx context.Context, d MemberDeps, m MemberContext, s
 	return reconcile.Result{}, nil
 }
 
-func waitForScopedWorkerConfig(ctx context.Context, workerName string, workerEnv map[string]string) error {
+func waitForScopedWorkerConfig(ctx context.Context, workerName, key string, workerEnv map[string]string) error {
 	accessKey := strings.TrimSpace(workerEnv["AGENTTEAMS_FS_ACCESS_KEY"])
 	secretKey := strings.TrimSpace(workerEnv["AGENTTEAMS_FS_SECRET_KEY"])
 	if accessKey == "" || secretKey == "" {
@@ -793,7 +802,6 @@ func waitForScopedWorkerConfig(ctx context.Context, workerName string, workerEnv
 		StoragePrefix: storagePrefix,
 	})
 
-	key := "agents/" + workerName + "/openclaw.json"
 	var lastErr error
 	deadline := time.Now().Add(2 * time.Minute)
 	for {