Agent onboarding

once your agent runs successfully in bridge dev mode with all mcp tool calls returning 200 ok, llm working, and audit logging active you are ready to onboard the agent image to the bridge platform important canonical reference the complete, authoritative guide with every detail, yaml snippet, and parameter table is here this page is a summary if anything below seems incomplete, refer to the full guide above — it is the source of truth prerequisites (all must be green) before starting onboarding, confirm checkpoint how to verify agent runs end to end in bridge dev python main py completes with "status" "success" mcp tool calls return 200 ok logs show http/1 1 200 ok for every mcp call llm calls succeed logs show 200 ok on /chat/completions audit records created logs show 201 created on /api/audit/v4/records agent registered in catalog agent catalog registration json submitted via /kaif/v3/agent catalog/agents deployment created deployment registration json submitted via /kaif/v3/deployment/agentic governance signoffs complete all 4 files in governance/ set to approved true the 7 step onboarding process onboarding is fully self service — no tickets, no cli, just github issues and approvals quick summary of each step step 1 create repo from template browse templates in kyndryl agentic ai https //github com/kyndryl agentic ai org → click "use this template" → name it bdg sw agents your agent → keep private step 2 add required teams team role bdg sw agents admin admin — provisions secrets, creates release branches bdg sw agents read write write — developers who push code bdg sw agents read only read — stakeholders and reviewers without these teams, onboarding and release cut will fail step 3 ci/cd — build & security orchestrator ( required) create github/workflows/build and security yml using the reusable orchestrator input parameters parameter required default description python version no "3 12" python version for unit tests and quality checks test framework no "pytest" "pytest" or "unittest" test directory no "tests" directory where test files are located use private registry no false set true if requirements txt has private packages from jfrog requires pyinstall sh in repo root docker build args no "" docker build arguments ( build arg key format) when using pyinstall sh, pass " build arg devops artifactory user build arg devops artifactory apikey" codeql language no "python" language for codeql static analysis secrets (required) secret purpose security token github pat for security scanning afaas user jfrog artifactory username afaas token jfrog artifactory access token these secrets are provisioned automatically during onboarding (step 4) you do not need to create them manually four gates enforced in sequence gate what 🧪 quality unit tests with ≥85% code coverage enforced 🔍 codeql static security analysis 🔒 security dependency + code + secret scanning 🐳 docker build → jfrog xray cve scan → push to artifactory note do not call individual workflows (e g docker build yml) directly — the orchestrator is the only supported entry point direct calls will be blocked step 4 request onboarding open issue at bdg sw agents images onboarding → new issue https //github com/kyndryl agentic ai/bdg sw agents images onboarding/issues/new/choose select "repo onboarding configure docker credentials" enter repo name only (e g bdg sw agents my agent, not kyndryl agentic ai/bdg sw agents my agent) a technical owner and business owner comment /approve bot provisions secrets (security token, afaas user, afaas token) automatically step 5 develop & push your repo comes pre configured with what where agent logic src/agents/ tools tools py configuration settings py, config py docker build dockerfile ci/cd pipeline github/workflows/build and security yml (set up in step 3) unit tests tests/ push code → ci/cd triggers automatically on pushes and pull requests to main, master, and release branches all security and quality gates are enforced centrally — individual repos cannot skip any gate unit tests are mandatory the ci/cd pipeline enforces ≥85% code coverage your tests/ directory must contain meaningful test cases for the build to pass teams can use github copilot to help write test cases for their agent workflows, tools, and nodes step 6 governance signoffs (before release) complete all 4 files in governance/ file what to review security signoff yaml secrets management, authentication, data protection, ai security ossc legal signoff yaml open source compliance, license review business functional signoff yaml business requirements, functional validation technical signoff yaml architecture review, technical approval for each file set approved true fill in the approver block yaml approver name your name email your email\@kyndryl com date "2026 03 06" set all checklist items to true fill in agent name and version commit and push to main note if any signoff is incomplete, the release cut request will be automatically rejected with a detailed report of what's missing step 7 request release cut go to bdg sw agents images onboarding → new issue https //github com/kyndryl agentic ai/bdg sw agents images onboarding/issues/new/choose select "release cut create release branch" enter your repo name only submit the issue what happens next step automated action 1 bot validates your repo exists 2 bot checks if a release branch already exists (duplicate guard) 3 bot clones your repo and validates all 4 governance signoff files 4 if governance passes → 🤖 copilot reviews your repo's structure and security 5 bot posts the copilot review findings and rm approval instructions 6 a release manager (rm) reviews the copilot analysis and comments /approve 7 bot creates a release yyyy mm dd branch (targeting next wednesday) 8 issue is closed with the branch details and deployment payload copilot review after governance passes, the platform runs an ai powered review review what it checks structure review project layout, dockerfile, dependencies, ci/cd readiness security review hardcoded secrets, dependency security, docker security, input validation the review is informational only — it does not block approval, but gives the rm context it runs within your copilot business licence boundary — code is not retained after release cut a release yyyy mm dd branch is created on your repo the ci/cd pipeline auto triggers for the release branch docker image is built, scanned, and pushed to jfrog artifactory step 8 get the image tag and complete registration after the ci/cd pipeline finishes on the release branch go to your repo → actions → click the latest build run open the docker build and push job logs find the success line notice ✅ pushed kyndryl jfrog io/kyn cto kaif docker local/bdg sw agents your agent\ release yyyy mm dd \<sha> \<ts> copy the full image tag (e g kyndryl jfrog io/kyn cto kaif docker local/bdg sw agents your agent\ release 2026 03 27 5d45dd2 1774525017) update your catalog registration — set the image field in your agent catalog registration json to the new image tag, then call the put or patch api create a fresh deployment registration — submit a new deployment via /kaif/v3/deployment/agentic with the updated agent catalog id the platform will now run your agent from this docker image this same flow applies for updates — every time you cut a new release, grab the new image tag from the build logs, update the catalog registration, and create a fresh deployment complete checklist \[ ] created repo from a template (step 1) \[ ] added bdg sw agents admin (admin), bdg sw agents read write (write), and bdg sw agents read only (read) teams (step 2) \[ ] created github/workflows/build and security yml using the orchestrator (step 3) \[ ] submitted \[onboard] issue and got secrets provisioned (step 4) \[ ] pushed code and ci/cd pipeline is passing (step 5) \[ ] completed all 4 governance signoff files with approved true (step 6) \[ ] submitted \[release cut] issue and got release branch created (step 7) issue labels reference label meaning onboarded 🔵 secrets provisioned release cut done 🟢 release branch created invalid request 🔴 repo doesn't exist governance failed 🔴 signoffs incomplete duplicate release 🟠 release branch already exists troubleshooting problem cause fix "repository does not exist" repo name typo or teams not added verify repo name ensure bdg sw agents admin team is added as admin (step 2) onboarding issue closed immediately repo not found check the repo name — enter only the repo name, not the full org/repo path governance validation failed signoff files incomplete open the issue's failure comment — it lists exactly which fields are missing fix in governance/ and open a new issue "branch already exists" release branch already created a release for this week was already cut wait for next week or contact the platform team ci/cd pipeline not running secrets not provisioned complete the onboarding step first (step 4) /approve not working not in required github team only members of the required teams (to, bo, rm) can approve contact the platform team to be added to the appropriate team