4.1: Harness

[djzager]

4.1 Harness

Part of Stream 4: Base Image (#8) | Parent: #1

The harness is the Go binary entrypoint in the base image that manages git lifecycle and launches the agent runtime.

Tasks

• Git credential isolation (read from mounted Secret, configure remote without creds)
• Launch goose serve --port 4000 (POC)
• ACP session setup (session/new with MCP servers, workspace dir)
• On agent exit: commit .konveyor/ files, push using credentials
• Update AgentRun CR status with push result (single k8s API write)

Key Design Principle

Git credentials stay in the harness. The agent does not receive push credentials in its env vars or git config.

References

• Base image enhancement: Add agent base image composition enhancement enhancements#296

Acceptance Criteria

• Harness clones repo using mounted Secret credentials without exposing them to the agent
• Goose agent is launched and ACP session is established
• On agent exit, harness commits .konveyor/ files and pushes results
• AgentRun CR status is updated with push result