feat: add per-proposal timeoutMinutes and configurable sandbox timeout

sakshiep1 · sakshiep1 · commit 0468de852602 · 2026-06-13T21:16:24.000+05:30
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,6 @@
 # Binaries and local tool installs (Makefile uses ./bin for controller-gen, kustomize, etc.)
 /bin/
+/oc-agentic
 
 # IDE / OS
 .idea/
diff --git a/api/v1alpha1/proposal_types.go b/api/v1alpha1/proposal_types.go
@@ -373,6 +373,16 @@ type ProposalSpec struct {
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:MaxLength=32768
 	RevisionFeedback string `json:"revisionFeedback,omitempty"`
+
+	// timeoutMinutes overrides the default sandbox operation timeout for
+	// this proposal. When set, all sandbox wait and HTTP client timeouts
+	// use this value instead of the operator default (5 minutes).
+	//
+	// Immutable: timeout policy is fixed at creation.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=120
+	TimeoutMinutes *int32 `json:"timeoutMinutes,omitzero"`
 }
 
 // ProposalStatus defines the observed state of Proposal. All fields are
diff --git a/config/crd/bases/agentic.openshift.io_proposals.yaml b/config/crd/bases/agentic.openshift.io_proposals.yaml
@@ -481,6 +481,28 @@ spec:
                 x-kubernetes-validations:
                 - message: schema is required when mode is Minimal
                   rule: self.mode != 'Minimal' || has(self.schema)
+              dataSource:
+                description: |-
+                  dataSource references a PVC containing pre-populated input data
+                  (e.g., must-gather bundles, diagnostic data). The operator mounts
+                  it read-only at /data/input in the sandbox pod. Skills discover
+                  input data at this standard location.
+
+                  Immutable: input data source is fixed at creation.
+                properties:
+                  claimName:
+                    description: |-
+                      claimName is the name of the PersistentVolumeClaim to mount.
+                      The PVC must exist in the same namespace as the Proposal.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                    x-kubernetes-validations:
+                    - message: must be a valid DNS subdomain
+                      rule: '!format.dns1123Subdomain().validate(self).hasValue()'
+                required:
+                - claimName
+                type: object
               execution:
                 description: |-
                   execution defines per-step configuration for the execution step.
@@ -913,6 +935,19 @@ spec:
                 x-kubernetes-validations:
                 - message: each namespace must be a valid DNS label
                   rule: self.all(ns, !format.dns1123Label().validate(ns).hasValue())
+              timeoutMinutes:
+                description: |-
+                  timeoutMinutes sets the per-step timeout for sandbox agent calls.
+                  This controls how long the operator waits for the sandbox pod to
+                  become ready and for the agent to complete its work. Increase this
+                  for long-running tools (e.g., IntelliAide RCA takes 10-30 minutes).
+                  Defaults to 5 minutes when omitted.
+
+                  Mutable: can be adjusted before approving a step.
+                format: int32
+                maximum: 60
+                minimum: 1
+                type: integer
               tools:
                 description: |-
                   tools defines the default tools for all steps: skills images,
@@ -1684,6 +1719,9 @@ spec:
             - message: verification is immutable once set
               rule: '!has(oldSelf.verification) || (has(self.verification) && self.verification
                 == oldSelf.verification)'
+            - message: dataSource is immutable once set
+              rule: '!has(oldSelf.dataSource) || (has(self.dataSource) && self.dataSource
+                == oldSelf.dataSource)'
           status:
             description: status defines the observed state of Proposal.
             minProperties: 1
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -33,6 +33,14 @@ rules:
   - create
   - delete
   - get
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - agentic.openshift.io
   resources:
diff --git a/controller/proposal/agent.go b/controller/proposal/agent.go
@@ -2,6 +2,7 @@ package proposal
 
 import (
 	"context"
+	"time"
 
 	agenticv1alpha1 "github.com/openshift/lightspeed-agentic-operator/api/v1alpha1"
 )
@@ -42,18 +43,18 @@ type EscalationOutput struct {
 // HTTP implementations POST to /v1/agent/run — a step-agnostic
 // endpoint where all workflow context is in the request payload.
 type AgentCaller interface {
-	Analyze(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string, serviceAccount string) (*AnalysisOutput, error)
-	Execute(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, serviceAccount string) (*ExecutionOutput, error)
-	Verify(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, exec *ExecutionOutput, serviceAccount string) (*VerificationOutput, error)
-	Escalate(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string, serviceAccount string) (*EscalationOutput, error)
+	Analyze(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string, serviceAccount string, timeout time.Duration) (*AnalysisOutput, error)
+	Execute(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, serviceAccount string, timeout time.Duration) (*ExecutionOutput, error)
+	Verify(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, option *agenticv1alpha1.RemediationOption, exec *ExecutionOutput, serviceAccount string, timeout time.Duration) (*VerificationOutput, error)
+	Escalate(ctx context.Context, proposal *agenticv1alpha1.Proposal, step resolvedStep, requestText string, serviceAccount string, timeout time.Duration) (*EscalationOutput, error)
 	ReleaseSandboxes(ctx context.Context, proposal *agenticv1alpha1.Proposal) error
 }
 
 // StubAgentCaller returns canned success results. Wire in a real
 // implementation (sandbox + HTTP) when the agent infrastructure is ready.
 type StubAgentCaller struct{}
 
-func (s *StubAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string) (*AnalysisOutput, error) {
+func (s *StubAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string, _ time.Duration) (*AnalysisOutput, error) {
 	return &AnalysisOutput{
 		Success: true,
 		Options: []agenticv1alpha1.RemediationOption{{
@@ -73,7 +74,7 @@ func (s *StubAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal
 	}, nil
 }
 
-func (s *StubAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ string) (*ExecutionOutput, error) {
+func (s *StubAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ string, _ time.Duration) (*ExecutionOutput, error) {
 	return &ExecutionOutput{
 		Success: true,
 		ActionsTaken: []agenticv1alpha1.ExecutionAction{{
@@ -88,7 +89,7 @@ func (s *StubAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal
 	}, nil
 }
 
-func (s *StubAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string) (*EscalationOutput, error) {
+func (s *StubAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string, _ time.Duration) (*EscalationOutput, error) {
 	return &EscalationOutput{
 		Success: true,
 		Summary: "Stub escalation summary",
@@ -100,7 +101,7 @@ func (s *StubAgentCaller) ReleaseSandboxes(_ context.Context, _ *agenticv1alpha1
 	return nil
 }
 
-func (s *StubAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput, _ string) (*VerificationOutput, error) {
+func (s *StubAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput, _ string, _ time.Duration) (*VerificationOutput, error) {
 	return &VerificationOutput{
 		Success: true,
 		Checks: []agenticv1alpha1.VerifyCheck{{
diff --git a/controller/proposal/client.go b/controller/proposal/client.go
@@ -79,10 +79,13 @@ type AgentHTTPClient struct {
 	endpoint   string
 }
 
-func NewAgentHTTPClient(endpoint string) AgentHTTPClientInterface {
+func NewAgentHTTPClient(endpoint string, timeout time.Duration) AgentHTTPClientInterface {
+	if timeout <= 0 {
+		timeout = defaultSandboxTimeout
+	}
 	return &AgentHTTPClient{
 		httpClient: &http.Client{
-			Timeout: 5 * time.Minute,
+			Timeout: timeout,
 			Transport: &http.Transport{
 				TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // internal cluster traffic
 			},
@@ -92,11 +95,13 @@ func NewAgentHTTPClient(endpoint string) AgentHTTPClientInterface {
 }
 
 func (c *AgentHTTPClient) Run(ctx context.Context, systemPrompt, query string, outputSchema json.RawMessage, agentCtx *agentContext) (*agentRunResponse, error) {
+	timeoutMs := int64(c.httpClient.Timeout / time.Millisecond)
 	req := agentRunRequest{
 		Query:        query,
 		SystemPrompt: systemPrompt,
 		OutputSchema: outputSchema,
 		Context:      agentCtx,
+		TimeoutMs:    &timeoutMs,
 	}
 
 	body, err := json.Marshal(req)
diff --git a/controller/proposal/client_test.go b/controller/proposal/client_test.go
@@ -35,7 +35,7 @@ func TestAgentHTTPClient_RunSuccess(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	resp, err := client.Run(context.Background(), "You are an SRE agent", "check health", nil, nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -52,15 +52,15 @@ func TestAgentHTTPClient_RunHTTPError(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	_, err := client.Run(context.Background(), "", "test", nil, nil)
 	if err == nil {
 		t.Fatal("expected error for HTTP 500")
 	}
 }
 
 func TestAgentHTTPClient_RunConnectionError(t *testing.T) {
-	client := NewAgentHTTPClient("http://127.0.0.1:1")
+	client := NewAgentHTTPClient("http://127.0.0.1:1", 0)
 	_, err := client.Run(context.Background(), "", "test", nil, nil)
 	if err == nil {
 		t.Fatal("expected error for connection failure")
@@ -100,7 +100,7 @@ func TestAgentHTTPClient_RunWithExecutionResult(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	agentCtx := &agentContext{
 		TargetNamespaces: []string{"production"},
 		ExecutionResult: &agentExecutionResult{
@@ -135,7 +135,7 @@ func TestAgentHTTPClient_RunWithoutExecutionResult(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	agentCtx := &agentContext{
 		TargetNamespaces: []string{"production"},
 	}
@@ -169,7 +169,7 @@ func TestAgentHTTPClient_RunWithContext(t *testing.T) {
 	}))
 	defer server.Close()
 
-	client := NewAgentHTTPClient(server.URL)
+	client := NewAgentHTTPClient(server.URL, 0)
 	agentCtx := &agentContext{
 		TargetNamespaces: []string{"production"},
 		PreviousAttempts: []agentPreviousAttempt{{Attempt: 1, FailureReason: "timeout"}},
diff --git a/controller/proposal/handlers.go b/controller/proposal/handlers.go
@@ -85,7 +85,8 @@ func (r *ProposalReconciler) handleAnalysis(
 		return ctrl.Result{}, fmt.Errorf("%s: %w", ErrUpdateToAnalyzing, err)
 	}
 
-	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request, defaultSandboxSA)
+	timeout := proposalTimeout(proposal)
+	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request, defaultSandboxSA, timeout)
 	if err != nil {
 		return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)
 	}
@@ -151,7 +152,8 @@ func (r *ProposalReconciler) handleRevision(
 	revisionSuffix := buildRevisionContext(proposal)
 	requestWithRevision := proposal.Spec.Request + "\n\n" + revisionSuffix
 
-	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision, defaultSandboxSA)
+	timeout := proposalTimeout(proposal)
+	analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision, defaultSandboxSA, timeout)
 	if err != nil {
 		return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)
 	}
@@ -270,7 +272,8 @@ func (r *ProposalReconciler) handleExecution(
 		return ctrl.Result{}, fmt.Errorf("%s: %w", ErrUpdateToExecuting, err)
 	}
 
-	execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption, execSA)
+	timeout := proposalTimeout(proposal)
+	execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption, execSA, timeout)
 	if err != nil {
 		return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionExecuted, err)
 	}
@@ -387,7 +390,8 @@ func (r *ProposalReconciler) handleVerification(
 		}
 	}
 
-	verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput, defaultSandboxSA)
+	timeout := proposalTimeout(proposal)
+	verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput, defaultSandboxSA, timeout)
 	if err != nil {
 		return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionVerified, err)
 	}
@@ -586,7 +590,8 @@ func (r *ProposalReconciler) handleEscalation(
 	}
 
 	escalationText := buildEscalationRequest(proposal)
-	escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText, defaultSandboxSA)
+	timeout := proposalTimeout(proposal)
+	escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText, defaultSandboxSA, timeout)
 	if err != nil {
 		return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionEscalated, err)
 	}
diff --git a/controller/proposal/reconciler_test.go b/controller/proposal/reconciler_test.go
@@ -35,32 +35,32 @@ type testAgentCaller struct {
 
 func newTestAgentCaller() *testAgentCaller {
 	stub := &StubAgentCaller{}
-	a, _ := stub.Analyze(context.Background(), nil, resolvedStep{}, "", "")
-	e, _ := stub.Execute(context.Background(), nil, resolvedStep{}, nil, "")
-	v, _ := stub.Verify(context.Background(), nil, resolvedStep{}, nil, nil, "")
-	esc, _ := stub.Escalate(context.Background(), nil, resolvedStep{}, "", "")
+	a, _ := stub.Analyze(context.Background(), nil, resolvedStep{}, "", "", 0)
+	e, _ := stub.Execute(context.Background(), nil, resolvedStep{}, nil, "", 0)
+	v, _ := stub.Verify(context.Background(), nil, resolvedStep{}, nil, nil, "", 0)
+	esc, _ := stub.Escalate(context.Background(), nil, resolvedStep{}, "", "", 0)
 	return &testAgentCaller{analyzeResult: a, executeResult: e, verifyResult: v, escalateResult: esc}
 }
 
-func (ta *testAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string) (*AnalysisOutput, error) {
+func (ta *testAgentCaller) Analyze(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string, _ time.Duration) (*AnalysisOutput, error) {
 	if ta.analyzeErr != nil {
 		return nil, ta.analyzeErr
 	}
 	return ta.analyzeResult, nil
 }
-func (ta *testAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ string) (*ExecutionOutput, error) {
+func (ta *testAgentCaller) Execute(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ string, _ time.Duration) (*ExecutionOutput, error) {
 	if ta.executeErr != nil {
 		return nil, ta.executeErr
 	}
 	return ta.executeResult, nil
 }
-func (ta *testAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput, _ string) (*VerificationOutput, error) {
+func (ta *testAgentCaller) Verify(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ *agenticv1alpha1.RemediationOption, _ *ExecutionOutput, _ string, _ time.Duration) (*VerificationOutput, error) {
 	if ta.verifyErr != nil {
 		return nil, ta.verifyErr
 	}
 	return ta.verifyResult, nil
 }
-func (ta *testAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string) (*EscalationOutput, error) {
+func (ta *testAgentCaller) Escalate(_ context.Context, _ *agenticv1alpha1.Proposal, _ resolvedStep, _ string, _ string, _ time.Duration) (*EscalationOutput, error) {
 	if ta.escalateErr != nil {
 		return nil, ta.escalateErr
 	}
@@ -247,7 +247,7 @@ func newMockSandboxAgent(analysisJSON, executionJSON, verificationJSON string) (
 	caller := &SandboxAgentCaller{
 		Sandbox:   sandbox,
 		K8sClient: fc,
-		ClientFactory: func(_ string) AgentHTTPClientInterface {
+		ClientFactory: func(_ string, _ time.Duration) AgentHTTPClientInterface {
 			resp := responses[callCount%len(responses)]
 			callCount++
 			httpClient.response = &agentRunResponse{Response: json.RawMessage(resp)}
diff --git a/controller/proposal/sandbox_agent.go b/controller/proposal/sandbox_agent.go
diff --git a/controller/proposal/sandbox_agent_test.go b/controller/proposal/sandbox_agent_test.go

Original file line number	Diff line number	Diff line change
`@@ -85,7 +85,8 @@ func (r *ProposalReconciler) handleAnalysis(`
`85`	`85`	`return ctrl.Result{}, fmt.Errorf("%s: %w", ErrUpdateToAnalyzing, err)`
`86`	`86`	`}`
`87`	`87`
`88`		`- analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request, defaultSandboxSA)`
	`88`	`+ timeout := proposalTimeout(proposal)`
	`89`	`+ analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, proposal.Spec.Request, defaultSandboxSA, timeout)`
`89`	`90`	`if err != nil {`
`90`	`91`	`return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)`
`91`	`92`	`}`
`@@ -151,7 +152,8 @@ func (r *ProposalReconciler) handleRevision(`
`151`	`152`	`revisionSuffix := buildRevisionContext(proposal)`
`152`	`153`	`requestWithRevision := proposal.Spec.Request + "\n\n" + revisionSuffix`
`153`	`154`
`154`		`- analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision, defaultSandboxSA)`
	`155`	`+ timeout := proposalTimeout(proposal)`
	`156`	`+ analysisResult, err := r.Agent.Analyze(ctx, proposal, resolved.Analysis, requestWithRevision, defaultSandboxSA, timeout)`
`155`	`157`	`if err != nil {`
`156`	`158`	`return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionAnalyzed, err)`
`157`	`159`	`}`
`@@ -270,7 +272,8 @@ func (r *ProposalReconciler) handleExecution(`
`270`	`272`	`return ctrl.Result{}, fmt.Errorf("%s: %w", ErrUpdateToExecuting, err)`
`271`	`273`	`}`
`272`	`274`
`273`		`- execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption, execSA)`
	`275`	`+ timeout := proposalTimeout(proposal)`
	`276`	`+ execResult, err := r.Agent.Execute(ctx, proposal, *resolved.Execution, selectedOption, execSA, timeout)`
`274`	`277`	`if err != nil {`
`275`	`278`	`return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionExecuted, err)`
`276`	`279`	`}`
`@@ -387,7 +390,8 @@ func (r *ProposalReconciler) handleVerification(`
`387`	`390`	`}`
`388`	`391`	`}`
`389`	`392`
`390`		`- verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput, defaultSandboxSA)`
	`393`	`+ timeout := proposalTimeout(proposal)`
	`394`	`+ verifyResult, err := r.Agent.Verify(ctx, proposal, *resolved.Verification, selectedOption, execOutput, defaultSandboxSA, timeout)`
`391`	`395`	`if err != nil {`
`392`	`396`	`return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionVerified, err)`
`393`	`397`	`}`
`@@ -586,7 +590,8 @@ func (r *ProposalReconciler) handleEscalation(`
`586`	`590`	`}`
`587`	`591`
`588`	`592`	`escalationText := buildEscalationRequest(proposal)`
`589`		`- escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText, defaultSandboxSA)`
	`593`	`+ timeout := proposalTimeout(proposal)`
	`594`	`+ escalationResult, err := r.Agent.Escalate(ctx, proposal, step, escalationText, defaultSandboxSA, timeout)`
`590`	`595`	`if err != nil {`
`591`	`596`	`return r.failStep(ctx, proposal, agenticv1alpha1.ProposalConditionEscalated, err)`
`592`	`597`	`}`