# Known deviations

This file tracks where existing agents in `cjot-backstage-az/agents/` deviate from the [SPEC](../SPEC.md). Each row is a tracked debt; deviations should converge over time.

| Agent | Deviation | Spec clause | Notes |
|---|---|---|---|
| `agent-registry` | Uses FastAPI, not Starlette | §3.2 | Grandfathered — registry pre-dates the spec. |
| `support-intake-agent` | Uses FastAPI, not Starlette | §3.2 | Grandfathered. |
| `agent-factory` | Uses `agent-factory-sa` ServiceAccount | §9.3 | Has its own Key Vault binding (`agent-factory-kv-spc`) for build-time credentials. |
| `sonarqube-mcp` | Uses `sonarqube-mcp-kv-spc` SecretProviderClass | §9 (Mandatory cross-references) | Domain-specific Key Vault for SonarQube tokens. |
| `golden-path` | Listens on port 8000 (not 8080) | §3.5 (allowed) | Port 8000 is permitted; flagged here only for awareness. |
| `modernization-factory-v2` | Runs in namespace `modernization-factory` | §9.2 | Namespace separation by domain; `service.namespace` and `AGENT_SELF_URL` are correctly aligned. |
| `documentor-agent` | Skeleton only (no `app/` shipped) | All | Placeholder; not yet a deployable agent. |

## How to add a row

When you knowingly merge an agent that violates a spec clause, add a row here with:

- The agent's directory name.
- A one-line description of the deviation.
- The clause number(s) in `SPEC.md`.
- A short rationale or follow-up plan.

When you fix a deviation, remove the row in the same PR that closes it.