Agents CLI Aqua

AQuA with agents-cli

AQuA watches one deployed agent, reviews its production conversations, and records each distinct defect it finds as an insight. With the AQuA extension, agents-cli infra single-project --apply-aqua and agents-cli deploy --deploy-aqua also provision and deploy AQuA, and agents-cli aqua queries it. Without those two flags, both commands work on the agent alone. Alternatively, agents-cli aqua attach connects the agent to an AQuA deployed elsewhere (see Attach).

Run every command from the agent's project root, the directory with agents-cli-manifest.yaml, or from AQuA's checkout if AQuA was deployed from there. Query subcommands print one JSON document on stdout and progress on stderr, so pipe stdout into jq.

When you start using this skill, always run agents-cli aqua -- --help to discover AQuA's commands, and agents-cli aqua <command> -- --help for a command's flags and the fields of its JSON output. Without the --, agents-cli prints its own help instead. Two commands are missing from that list: agents-cli aqua info (the deployment record and dashboard URL, or one value with --resource, --region, --ui-service or --ui-url) and agents-cli aqua ui-proxy (see Dashboard).

Vocabulary

• Investigation (run): samples conversations from a telemetry window, reviews them, and groups the failures into insights. It runs daily (12:00 UTC by default), about 15 minutes after each redeploy of an agent on Agent Runtime, and on demand.
• Trajectory: one sampled conversation, with one trace per turn. Its trajectory_id is the session id, or the turn id when AQuA scores turns one at a time.
• Insight: one deduplicated defect with a stable insight_id and status NEW, RECURRING or RESOLVED. An insight unseen for 14 days (by default) resolves, and a later recurrence gets a new insight.
• Occurrence: one investigation's sighting of an insight, with evidence for up to 10 of its trajectories.
• Root cause: a diagnosis of an insight, with proposed edits against a snapshot of the agent's source.

Deploy AQuA

If agents-cli aqua info --resource prints projects/…/reasoningEngines/…, AQuA is deployed. Otherwise, pick one of two ways:

• Augment the agent (the default): deploy AQuA beside the agent in this agents-cli based project. Each agent deploy then publishes the source snapshot AQuA diagnoses from.
• Attach the agent when AQuA is already deployed elsewhere, or the user wants one AQuA kept separate from the agent. See Attach an agent to AQuA deployed elsewhere.

Augment your agents-cli agent with AQuA

1. Check the agent name. AQuA selects telemetry by the root agent's ADK name, the one passed to Agent(name=...). agents-cli derives it from the project name unless create_params.root_agent_name in agents-cli-manifest.yaml sets it. Compare "Root agent name" in agents-cli info with the code, and fix the manifest if they differ. A mismatch raises no error: every investigation reviews an empty window.

2. Provision and deploy. --apply and deploy create billable resources, so show the plan and get the user's go-ahead first. Before the first --apply, decide how the dashboard is reached (see Dashboard).

   agents-cli infra single-project --project="$GOOGLE_CLOUD_PROJECT" --apply-aqua          # plan
   agents-cli infra single-project --project="$GOOGLE_CLOUD_PROJECT" --apply-aqua --apply
   agents-cli deploy --project="$GOOGLE_CLOUD_PROJECT" --deploy-aqua

   Export the same TF_VAR_* values for the plan and the apply. The variables are defined in extensions/aqua/terraform/examples/single-project/variables.tf. If the agent's Agent Runtime engine did not exist at the first --apply, run --apply-aqua --apply again after the first deploy. Until then, redeploys trigger no investigation.

3. Confirm that AQuA sees traffic. Send the agent some traffic, for example with agents-cli run "<prompt>" --url <endpoint> --mode adk. Telemetry reaches BigQuery several minutes after a turn ends. Read telemetry_dataset, telemetry_table and observed_agent_name from agents-cli aqua show-config | jq .config, then check that agent below equals observed_agent_name:

   bq --project_id="$GOOGLE_CLOUD_PROJECT" query --nouse_legacy_sql \
     'SELECT labels.gen_ai_agent_name AS agent,
             COUNT(DISTINCT labels.gen_ai_conversation_id) AS sessions
      FROM `<telemetry_dataset>.<telemetry_table>`
      WHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 HOUR)
      GROUP BY agent'

   Then run agents-cli aqua schedule-investigation --wait and expect exit 0 with counters.traces_scanned above zero.

Attach an agent to AQuA deployed elsewhere

1. Deploy AQuA on its own, if needed and the user wants to, from a checkout of AQuA's repository and with no --observed-* flags. Its engine is aqua-solo-aqua, which agents-cli aqua info --resource prints there; it investigates nothing until an agent is attached.

   agents-cli infra single-project --project="$GOOGLE_CLOUD_PROJECT"          # plan
   agents-cli infra single-project --project="$GOOGLE_CLOUD_PROJECT" --apply
   agents-cli deploy --project="$GOOGLE_CLOUD_PROJECT"

2. Attach the agent from one of the places below. Run the --dry-run command first: it shows the plan and stores or grants nothing. --apply changes IAM, so get the user's go-ahead before running it. It grants each read AQuA's service account is denied, using your credentials, and applies the agent's Cloud Scheduler job and update trigger with Terraform (state in ./.aqua/attach-<agent>.tfstate).

   From AQuA's checkout (clone the AQuA repository first if not already cloned), naming the agent's engine. Attach reads the agent's name, deployment name and telemetry table from it:

   agents-cli aqua attach --dry-run \
     --observed-agent-resource projects/<project>/locations/<region>/reasoningEngines/<id>
   agents-cli aqua attach --apply \
     --observed-agent-resource projects/<project>/locations/<region>/reasoningEngines/<id>

   A Cloud Run or GKE agent has no engine, so name it and its telemetry, then repeat with --apply. agents-cli infra show in the agent's project prints telemetry_dataset_id:

   agents-cli aqua attach <agent_name> --dry-run \
     --deployment-name <deployment> \
     --telemetry-source cloud_logging \
     --telemetry-dataset <telemetry_dataset_id> \
     --telemetry-table gen_ai_client_inference_operation_details \
     --telemetry-location <region>

   From the agent's project, naming AQuA's engine. The project's files supply the agent's settings, and AQuA's engine is recorded in .aqua/attached_aqua.json, so later agents-cli aqua commands here reach it with no flag:

   agents-cli aqua attach --dry-run \
     --aqua-resource projects/<project>/locations/<region>/reasoningEngines/<aqua-id>
   agents-cli aqua attach --apply \
     --aqua-resource projects/<project>/locations/<region>/reasoningEngines/<aqua-id>

   From any other directory, name both:

   agents-cli aqua attach --dry-run \
     --aqua-resource projects/<project>/locations/<region>/reasoningEngines/<aqua-id> \
     --observed-agent-resource projects/<project>/locations/<region>/reasoningEngines/<id>
   agents-cli aqua attach --apply \
     --aqua-resource projects/<project>/locations/<region>/reasoningEngines/<aqua-id> \
     --observed-agent-resource projects/<project>/locations/<region>/reasoningEngines/<id>

3. Confirm that AQuA lists the agent and reads its settings back, then run the traffic check in step 3 of Augment your agents-cli agent with AQuA:

   agents-cli aqua list-agents
   agents-cli aqua show-config

• agents-cli aqua detach <agent> --apply deletes the attachment, revokes the grants attach --apply recorded and destroys the triggers. Run it from the directory you ran attach --apply in, which holds the Terraform state.
• The agent may run in another Cloud project than AQuA. attach reads that project from --observed-agent-resource; for a Cloud Run or GKE agent, pass --observed-project. attach --apply then needs rights to grant access to that project's telemetry dataset and bucket, and to create a log sink there.
• Without --apply-aqua and --deploy-aqua, infra single-project and deploy in the agent's project leave AQuA out, which is what an attached agent uses.
• attach from the agent's project, and each later agents-cli deploy there, publish the source snapshot root-cause analysis reads. To publish one by hand, run agents-cli aqua publish-source.

Dashboard

The dashboard shows runs, insights with their evidence, metrics and the configuration. It also has a chat. agents-cli deploy --deploy-aqua deploys it to a private Cloud Run service as its last step; --skip-aqua-ui skips that step. Users reach it in one of two ways, and the project decides which: gcloud projects get-ancestors "$GOOGLE_CLOUD_PROJECT" lists an organization when the project has one.

• With Identity-Aware Proxy (IAP), the default, which needs an organization. Users open the run.app URL from agents-cli aqua info --ui-url and sign in with Google. Only principals with roles/iap.httpsResourceAccessor get in, and by default nobody has it, the deployer included. Grant it with TF_VAR_ui_iap_members before the apply. It takes any IAM principal from the project's organization:

  export TF_VAR_ui_iap_members='["user:you@example.com", "group:team@example.com"]'

  To grant access later, add the principal to TF_VAR_ui_iap_members and re-apply, or run the command below. A 403 means the account has no grant.

  gcloud iap web add-iam-policy-binding --resource-type=cloud-run \
    --service="$(agents-cli aqua info --ui-service)" \
    --region="$(agents-cli aqua info --region)" \
    --member="user:you@example.com" --role="roles/iap.httpsResourceAccessor"

• Without IAP, for a project with no organization. Set TF_VAR_ui_iap_enabled=false before the apply. The run.app URL stays private, and agents-cli aqua ui-proxy tunnels to it on localhost with gcloud run services proxy until Ctrl-C. Your gcloud account needs permission to invoke the service (roles/run.invoker). Extra flags, such as --port, pass through to gcloud. The command blocks, so run it in the background or ask the user to run it.

The two modes are alternatives: while IAP is on, it intercepts the tunnel too. To switch modes, change TF_VAR_ui_iap_enabled and run agents-cli infra single-project --apply-aqua --apply again.