Platform-side services for 图灵星球 Agent 军团. Overview: https://github.com/turingplanet/agent-legion
Holds the credentials members must never see (the platform's Anthropic key, the fleet GitHub App), so member CI only ever sends public metadata and the platform acts on its own side.
Live at https://fleet-services.agents.turingplanet.ai — deployed like any member agent, through the registry's deployments.yaml.
POST /api/review — platform-paid on-demand AI review (RFC 002). A member comments /review [security|perf|general|help] on their PR; a trigger workflow in their repo forwards {repo, pr_number, comment_id}. This service then:
- verifies the comment exists, is a
/reviewcommand, and its author is a repo collaborator; - checks the repo is on the fleet roster (
members.yamlin agent-registry, read via the App); - checks the weekly quota (
ai_review.weekly_limit) — counted from hidden markers on past review comments, so GitHub is the database; - caps the diff size;
- runs the platform's Claude with the review persona and posts an advisory comment via the App.
You get feedback immediately: a 👀 reaction plus a "🔍 Review in progress" comment within seconds, which is then edited in place into the final review (~1–2 min) — one comment total, no notification spam. Reviews never block a PR — the member's own gate decides. Help and decline replies carry a different marker so they never consume quota. Any unexpected failure is reported on the PR: silent failure is banned.
POST /api/register — self-service fleet registration (RFC 001 §10). Send {repo} (public metadata); the service verifies the fleet App is installed on that repo (the keys) and that its agent.manifest.yaml says fleet.register: true (the consent), then opens a members.yaml PR on the registry with platform credentials. Merging = admission — nothing happens until an admin decides. Reached from register.yml (fires on pushes to main) or the /register / /join PR comment, which rides the same pipeline as /review. Idempotent against the roster and pending PRs; per-repo cooldown.
POST /api/deregister — the symmetric exit (see scripts/teardown.sh in the template). Consent is verified server-side: the repo's manifest must no longer say fleet.register: true (or the repo is gone — ghost cleanup). One PR removes the repo from members.yaml and deployments.yaml; merging it makes the deploy-fleet reconciler tear down platform hosting automatically.
Runtime knobs live in config.py. Secrets (set as Railway variables, never in a member repo):
| variable | why |
|---|---|
ANTHROPIC_API_KEY |
the platform pays for reviews |
GITHUB_APP_ID / GITHUB_APP_PRIVATE_KEY |
fleet App — reads diffs, posts comments, reads the registry |
MODEL |
pinned review model (quality is fixed; quota is the cost dial) |
REVIEW_WEEKLY_DEFAULT, REVIEW_GLOBAL_WEEKLY_CAP, REVIEW_DIFF_LINE_CAP |
cost guards |
The App needs access to agent-registry (to read the roster) plus each member repo (which members grant themselves).
poetry install && poetry run pytestThe service boots without secrets — /api/review replies not_configured rather than crashing, so the endpoint can ship before its credentials do.