| name | agent-workflow-operate |
| description | Use when verifying that a bootstrapped NPA agent VM can create, validate, plan, provision for, or run npa.workflow YAMLs. |
Agent Workflow Operation
Operating Model
- Dev/operator VM is the source of truth for NPA lifecycle, auth, SSH keys,
and agent records. Run
npa agent fresh-setup, bootstrap, status, and
verify-live there.
- NPA agent VM is the autonomous workbench execution surface. After
bootstrap, it must have staged
~/.npa/config.yaml, ~/.npa/credentials.yaml,
Nebius CLI/profile or token material, and the NPA checkout needed to validate,
plan, provision, and run workflow YAMLs.
- Do not use the dev VM full pytest suite as the acceptance test for agent
autonomy. The relevant check is whether the agent VM can operate workflows
with its bootstrapped config.
Test Framework
Run the framework by SSHing from the dev VM into the active agent VM using the
agent record SSH key. Do not print credential files or secret values.
-
On the dev VM, resolve the active agent:
npa/.venv/bin/npa agent status --project <project> --name <name> --json
-
From the dev VM, SSH to the agent public IP with the recorded key and create
a temporary apiVersion: npa.workflow/v0.0.1 YAML. Use a known catalog
toolRef such as workbench.vlm_eval.run and include all config tokens
required by the tool template, including vlm_backend.
-
On the agent VM or through the agent API, validate and plan:
npa/.venv/bin/npa workbench workflow validate-spec /tmp/spec.yaml --json
npa/.venv/bin/npa workbench workflow plan-spec /tmp/spec.yaml --run-id agent-smoke --json
npa/.venv/bin/npa workbench workflow run-spec /tmp/spec.yaml \
--run-id agent-smoke --plan-only --scheduler-plan --json
Equivalent API checks:
GET /api/infra/k8s
POST /api/infra/provision
POST /api/workflows/validate
POST /api/workflows/plan
POST /api/workflows/submit
-
Check K8s provisioning readiness from the agent VM:
npa/.venv/bin/npa provision-if-absent --project <project> --dry-run \
--output-format json
-
If the operator explicitly requests live execution, let the agent use
POST /api/workflows/submit or POST /api/infra/provision so NPA provisions
Kubernetes as needed through normal NPA commands. Do not manually create,
delete, or mutate cloud resources outside NPA.
Pass Criteria
- Agent VM SSH works from the dev VM with the recorded key.
- Agent VM has non-empty bootstrapped
~/.npa/config.yaml and
~/.npa/credentials.yaml; do not print contents.
validate-spec returns JSON with status: valid.
plan-spec returns at least one planned step with the expected tool_ref.
run-spec --plan-only --scheduler-plan returns scheduler output without
requiring real workload execution.
provision-if-absent --dry-run --output-format json resolves the project and
reports intended or existing K8s/storage actions without credential errors.
GET /api/infra/k8s reports configured and locally cached Kubernetes
backends. If none are present, chat should say no infra is specified and offer
options: deploy minimal infra with the agent, configure an existing backend, or
submit with explicit project/cluster target.
POST /api/workflows/submit validates YAML, provisions minimal Kubernetes
when allowed and needed, and records a scheduler plan/run record.