graywatch 1.0.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,190 @@
1
+ Apache License
2
+ Version 2.0, January 2004
3
+ http://www.apache.org/licenses/
4
+
5
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+ 1. Definitions.
8
+
9
+ "License" shall mean the terms and conditions for use, reproduction,
10
+ and distribution as defined by Sections 1 through 9 of this document.
11
+
12
+ "Licensor" shall mean the copyright owner or entity authorized by
13
+ the copyright owner that is granting the License.
14
+
15
+ "Legal Entity" shall mean the union of the acting entity and all
16
+ other entities that control, are controlled by, or are under common
17
+ control with that entity. For the purposes of this definition,
18
+ "control" means (i) the power, direct or indirect, to cause the
19
+ direction or management of such entity, whether by contract or
20
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
21
+ outstanding shares, or (iii) beneficial ownership of such entity.
22
+
23
+ "You" (or "Your") shall mean an individual or Legal Entity
24
+ exercising permissions granted by this License.
25
+
26
+ "Source" form shall mean the preferred form for making modifications,
27
+ including but not limited to software source code, documentation
28
+ source, and configuration files.
29
+
30
+ "Object" form shall mean any form resulting from mechanical
31
+ transformation or translation of a Source form, including but
32
+ not limited to compiled object code, generated documentation,
33
+ and conversions to other media types.
34
+
35
+ "Work" shall mean the work of authorship, whether in Source or
36
+ Object form, made available under the License, as indicated by a
37
+ copyright notice that is included in or attached to the work
38
+ (an example is provided in the Appendix below).
39
+
40
+ "Derivative Works" shall mean any work, whether in Source or Object
41
+ form, that is based on (or derived from) the Work and for which the
42
+ editorial revisions, annotations, elaborations, or other modifications
43
+ represent, as a whole, an original work of authorship. For the purposes
44
+ of this License, Derivative Works shall not include works that remain
45
+ separable from, or merely link (or bind by name) to the interfaces of,
46
+ the Work and Derivative Works thereof.
47
+
48
+ "Contribution" shall mean any work of authorship, including
49
+ the original version of the Work and any modifications or additions
50
+ to that Work or Derivative Works thereof, that is intentionally
51
+ submitted to Licensor for inclusion in the Work by the copyright owner
52
+ or by an individual or Legal Entity authorized to submit on behalf of
53
+ the copyright owner. For the purposes of this definition, "submitted"
54
+ means any form of electronic, verbal, or written communication sent
55
+ to the Licensor or its representatives, including but not limited to
56
+ communication on electronic mailing lists, source code control systems,
57
+ and issue tracking systems that are managed by, or on behalf of, the
58
+ Licensor for the purpose of discussing and improving the Work, but
59
+ excluding communication that is conspicuously marked or otherwise
60
+ designated in writing by the copyright owner as "Not a Contribution."
61
+
62
+ "Contributor" shall mean Licensor and any individual or Legal Entity
63
+ on behalf of whom a Contribution has been received by Licensor and
64
+ subsequently incorporated within the Work.
65
+
66
+ 2. Grant of Copyright License. Subject to the terms and conditions of
67
+ this License, each Contributor hereby grants to You a perpetual,
68
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69
+ copyright license to reproduce, prepare Derivative Works of,
70
+ publicly display, publicly perform, sublicense, and distribute the
71
+ Work and such Derivative Works in Source or Object form.
72
+
73
+ 3. Grant of Patent License. Subject to the terms and conditions of
74
+ this License, each Contributor hereby grants to You a perpetual,
75
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76
+ (except as stated in this section) patent license to make, have made,
77
+ use, offer to sell, sell, import, and otherwise transfer the Work,
78
+ where such license applies only to those patent claims licensable
79
+ by such Contributor that are necessarily infringed by their
80
+ Contribution(s) alone or by combination of their Contribution(s)
81
+ with the Work to which such Contribution(s) was submitted. If You
82
+ institute patent litigation against any entity (including a
83
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
84
+ or a Contribution incorporated within the Work constitutes direct
85
+ or contributory patent infringement, then any patent licenses
86
+ granted to You under this License for that Work shall terminate
87
+ as of the date such litigation is filed.
88
+
89
+ 4. Redistribution. You may reproduce and distribute copies of the
90
+ Work or Derivative Works thereof in any medium, with or without
91
+ modifications, and in Source or Object form, provided that You
92
+ meet the following conditions:
93
+
94
+ (a) You must give any other recipients of the Work or
95
+ Derivative Works a copy of this License; and
96
+
97
+ (b) You must cause any modified files to carry prominent notices
98
+ stating that You changed the files; and
99
+
100
+ (c) You must retain, in the Source form of any Derivative Works
101
+ that You distribute, all copyright, patent, trademark, and
102
+ attribution notices from the Source form of the Work,
103
+ excluding those notices that do not pertain to any part of
104
+ the Derivative Works; and
105
+
106
+ (d) If the Work includes a "NOTICE" text file as part of its
107
+ distribution, then any Derivative Works that You distribute must
108
+ include a readable copy of the attribution notices contained
109
+ within such NOTICE file, excluding those notices that do not
110
+ pertain to any part of the Derivative Works, in at least one
111
+ of the following places: within a NOTICE text file distributed
112
+ as part of the Derivative Works; within the Source form or
113
+ documentation, if provided along with the Derivative Works; or,
114
+ within a display generated by the Derivative Works, if and
115
+ wherever such third-party notices normally appear. The contents
116
+ of the NOTICE file are for informational purposes only and
117
+ do not modify the License. You may add Your own attribution
118
+ notices within Derivative Works that You distribute, alongside
119
+ or as an addendum to the NOTICE text from the Work, provided
120
+ that such additional attribution notices cannot be construed
121
+ as modifying the License.
122
+
123
+ You may add Your own copyright statement to Your modifications and
124
+ may provide additional or different license terms and conditions
125
+ for use, reproduction, or distribution of Your modifications, or
126
+ for any such Derivative Works as a whole, provided Your use,
127
+ reproduction, and distribution of the Work otherwise complies with
128
+ the conditions stated in this License.
129
+
130
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
131
+ any Contribution intentionally submitted for inclusion in the Work
132
+ by You to the Licensor shall be under the terms and conditions of
133
+ this License, without any additional terms or conditions.
134
+ Notwithstanding the above, nothing herein shall supersede or modify
135
+ the terms of any separate license agreement you may have executed
136
+ with Licensor regarding such Contributions.
137
+
138
+ 6. Trademarks. This License does not grant permission to use the trade
139
+ names, trademarks, service marks, or product names of the Licensor,
140
+ except as required for reasonable and customary use in describing the
141
+ origin of the Work and reproducing the content of the NOTICE file.
142
+
143
+ 7. Disclaimer of Warranty. Unless required by applicable law or
144
+ agreed to in writing, Licensor provides the Work (and each
145
+ Contributor provides its Contributions) on an "AS IS" BASIS,
146
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147
+ implied, including, without limitation, any warranties or conditions
148
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149
+ PARTICULAR PURPOSE. You are solely responsible for determining the
150
+ appropriateness of using or redistributing the Work and assume any
151
+ risks associated with Your exercise of permissions under this License.
152
+
153
+ 8. Limitation of Liability. In no event and under no legal theory,
154
+ whether in tort (including negligence), contract, or otherwise,
155
+ unless required by applicable law (such as deliberate and grossly
156
+ negligent acts) or agreed to in writing, shall any Contributor be
157
+ liable to You for damages, including any direct, indirect, special,
158
+ incidental, or consequential damages of any character arising as a
159
+ result of this License or out of the use or inability to use the
160
+ Work (including but not limited to damages for loss of goodwill,
161
+ work stoppage, computer failure or malfunction, or any and all
162
+ other commercial damages or losses), even if such Contributor
163
+ has been advised of the possibility of such damages.
164
+
165
+ 9. Accepting Warranty or Additional Liability. While redistributing
166
+ the Work or Derivative Works thereof, You may choose to offer,
167
+ and charge a fee for, acceptance of support, warranty, indemnity,
168
+ or other liability obligations and/or rights consistent with this
169
+ License. However, in accepting such obligations, You may act only
170
+ on Your own behalf and on Your sole responsibility, not on behalf
171
+ of any other Contributor, and only if You agree to indemnify,
172
+ defend, and hold each Contributor harmless for any liability
173
+ incurred by, or claims asserted against, such Contributor by reason
174
+ of your accepting any such warranty or additional liability.
175
+
176
+ END OF TERMS AND CONDITIONS
177
+
178
+ Copyright 2026 Sriharsha Viyyala
179
+
180
+ Licensed under the Apache License, Version 2.0 (the "License");
181
+ you may not use this file except in compliance with the License.
182
+ You may obtain a copy of the License at
183
+
184
+ http://www.apache.org/licenses/LICENSE-2.0
185
+
186
+ Unless required by applicable law or agreed to in writing, software
187
+ distributed under the License is distributed on an "AS IS" BASIS,
188
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
189
+ See the License for the specific language governing permissions and
190
+ limitations under the License.
@@ -0,0 +1,294 @@
1
+ Metadata-Version: 2.4
2
+ Name: graywatch
3
+ Version: 1.0.0
4
+ Summary: Find the network device that's lying to you — gray-failure triangulation from path-aware probe data. Zero dependencies, read-only.
5
+ Author: Sriharsha Viyyala
6
+ License: Apache License
7
+ Version 2.0, January 2004
8
+ http://www.apache.org/licenses/
9
+
10
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
11
+
12
+ 1. Definitions.
13
+
14
+ "License" shall mean the terms and conditions for use, reproduction,
15
+ and distribution as defined by Sections 1 through 9 of this document.
16
+
17
+ "Licensor" shall mean the copyright owner or entity authorized by
18
+ the copyright owner that is granting the License.
19
+
20
+ "Legal Entity" shall mean the union of the acting entity and all
21
+ other entities that control, are controlled by, or are under common
22
+ control with that entity. For the purposes of this definition,
23
+ "control" means (i) the power, direct or indirect, to cause the
24
+ direction or management of such entity, whether by contract or
25
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
26
+ outstanding shares, or (iii) beneficial ownership of such entity.
27
+
28
+ "You" (or "Your") shall mean an individual or Legal Entity
29
+ exercising permissions granted by this License.
30
+
31
+ "Source" form shall mean the preferred form for making modifications,
32
+ including but not limited to software source code, documentation
33
+ source, and configuration files.
34
+
35
+ "Object" form shall mean any form resulting from mechanical
36
+ transformation or translation of a Source form, including but
37
+ not limited to compiled object code, generated documentation,
38
+ and conversions to other media types.
39
+
40
+ "Work" shall mean the work of authorship, whether in Source or
41
+ Object form, made available under the License, as indicated by a
42
+ copyright notice that is included in or attached to the work
43
+ (an example is provided in the Appendix below).
44
+
45
+ "Derivative Works" shall mean any work, whether in Source or Object
46
+ form, that is based on (or derived from) the Work and for which the
47
+ editorial revisions, annotations, elaborations, or other modifications
48
+ represent, as a whole, an original work of authorship. For the purposes
49
+ of this License, Derivative Works shall not include works that remain
50
+ separable from, or merely link (or bind by name) to the interfaces of,
51
+ the Work and Derivative Works thereof.
52
+
53
+ "Contribution" shall mean any work of authorship, including
54
+ the original version of the Work and any modifications or additions
55
+ to that Work or Derivative Works thereof, that is intentionally
56
+ submitted to Licensor for inclusion in the Work by the copyright owner
57
+ or by an individual or Legal Entity authorized to submit on behalf of
58
+ the copyright owner. For the purposes of this definition, "submitted"
59
+ means any form of electronic, verbal, or written communication sent
60
+ to the Licensor or its representatives, including but not limited to
61
+ communication on electronic mailing lists, source code control systems,
62
+ and issue tracking systems that are managed by, or on behalf of, the
63
+ Licensor for the purpose of discussing and improving the Work, but
64
+ excluding communication that is conspicuously marked or otherwise
65
+ designated in writing by the copyright owner as "Not a Contribution."
66
+
67
+ "Contributor" shall mean Licensor and any individual or Legal Entity
68
+ on behalf of whom a Contribution has been received by Licensor and
69
+ subsequently incorporated within the Work.
70
+
71
+ 2. Grant of Copyright License. Subject to the terms and conditions of
72
+ this License, each Contributor hereby grants to You a perpetual,
73
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
74
+ copyright license to reproduce, prepare Derivative Works of,
75
+ publicly display, publicly perform, sublicense, and distribute the
76
+ Work and such Derivative Works in Source or Object form.
77
+
78
+ 3. Grant of Patent License. Subject to the terms and conditions of
79
+ this License, each Contributor hereby grants to You a perpetual,
80
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
81
+ (except as stated in this section) patent license to make, have made,
82
+ use, offer to sell, sell, import, and otherwise transfer the Work,
83
+ where such license applies only to those patent claims licensable
84
+ by such Contributor that are necessarily infringed by their
85
+ Contribution(s) alone or by combination of their Contribution(s)
86
+ with the Work to which such Contribution(s) was submitted. If You
87
+ institute patent litigation against any entity (including a
88
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
89
+ or a Contribution incorporated within the Work constitutes direct
90
+ or contributory patent infringement, then any patent licenses
91
+ granted to You under this License for that Work shall terminate
92
+ as of the date such litigation is filed.
93
+
94
+ 4. Redistribution. You may reproduce and distribute copies of the
95
+ Work or Derivative Works thereof in any medium, with or without
96
+ modifications, and in Source or Object form, provided that You
97
+ meet the following conditions:
98
+
99
+ (a) You must give any other recipients of the Work or
100
+ Derivative Works a copy of this License; and
101
+
102
+ (b) You must cause any modified files to carry prominent notices
103
+ stating that You changed the files; and
104
+
105
+ (c) You must retain, in the Source form of any Derivative Works
106
+ that You distribute, all copyright, patent, trademark, and
107
+ attribution notices from the Source form of the Work,
108
+ excluding those notices that do not pertain to any part of
109
+ the Derivative Works; and
110
+
111
+ (d) If the Work includes a "NOTICE" text file as part of its
112
+ distribution, then any Derivative Works that You distribute must
113
+ include a readable copy of the attribution notices contained
114
+ within such NOTICE file, excluding those notices that do not
115
+ pertain to any part of the Derivative Works, in at least one
116
+ of the following places: within a NOTICE text file distributed
117
+ as part of the Derivative Works; within the Source form or
118
+ documentation, if provided along with the Derivative Works; or,
119
+ within a display generated by the Derivative Works, if and
120
+ wherever such third-party notices normally appear. The contents
121
+ of the NOTICE file are for informational purposes only and
122
+ do not modify the License. You may add Your own attribution
123
+ notices within Derivative Works that You distribute, alongside
124
+ or as an addendum to the NOTICE text from the Work, provided
125
+ that such additional attribution notices cannot be construed
126
+ as modifying the License.
127
+
128
+ You may add Your own copyright statement to Your modifications and
129
+ may provide additional or different license terms and conditions
130
+ for use, reproduction, or distribution of Your modifications, or
131
+ for any such Derivative Works as a whole, provided Your use,
132
+ reproduction, and distribution of the Work otherwise complies with
133
+ the conditions stated in this License.
134
+
135
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
136
+ any Contribution intentionally submitted for inclusion in the Work
137
+ by You to the Licensor shall be under the terms and conditions of
138
+ this License, without any additional terms or conditions.
139
+ Notwithstanding the above, nothing herein shall supersede or modify
140
+ the terms of any separate license agreement you may have executed
141
+ with Licensor regarding such Contributions.
142
+
143
+ 6. Trademarks. This License does not grant permission to use the trade
144
+ names, trademarks, service marks, or product names of the Licensor,
145
+ except as required for reasonable and customary use in describing the
146
+ origin of the Work and reproducing the content of the NOTICE file.
147
+
148
+ 7. Disclaimer of Warranty. Unless required by applicable law or
149
+ agreed to in writing, Licensor provides the Work (and each
150
+ Contributor provides its Contributions) on an "AS IS" BASIS,
151
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
152
+ implied, including, without limitation, any warranties or conditions
153
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
154
+ PARTICULAR PURPOSE. You are solely responsible for determining the
155
+ appropriateness of using or redistributing the Work and assume any
156
+ risks associated with Your exercise of permissions under this License.
157
+
158
+ 8. Limitation of Liability. In no event and under no legal theory,
159
+ whether in tort (including negligence), contract, or otherwise,
160
+ unless required by applicable law (such as deliberate and grossly
161
+ negligent acts) or agreed to in writing, shall any Contributor be
162
+ liable to You for damages, including any direct, indirect, special,
163
+ incidental, or consequential damages of any character arising as a
164
+ result of this License or out of the use or inability to use the
165
+ Work (including but not limited to damages for loss of goodwill,
166
+ work stoppage, computer failure or malfunction, or any and all
167
+ other commercial damages or losses), even if such Contributor
168
+ has been advised of the possibility of such damages.
169
+
170
+ 9. Accepting Warranty or Additional Liability. While redistributing
171
+ the Work or Derivative Works thereof, You may choose to offer,
172
+ and charge a fee for, acceptance of support, warranty, indemnity,
173
+ or other liability obligations and/or rights consistent with this
174
+ License. However, in accepting such obligations, You may act only
175
+ on Your own behalf and on Your sole responsibility, not on behalf
176
+ of any other Contributor, and only if You agree to indemnify,
177
+ defend, and hold each Contributor harmless for any liability
178
+ incurred by, or claims asserted against, such Contributor by reason
179
+ of your accepting any such warranty or additional liability.
180
+
181
+ END OF TERMS AND CONDITIONS
182
+
183
+ Copyright 2026 Sriharsha Viyyala
184
+
185
+ Licensed under the Apache License, Version 2.0 (the "License");
186
+ you may not use this file except in compliance with the License.
187
+ You may obtain a copy of the License at
188
+
189
+ http://www.apache.org/licenses/LICENSE-2.0
190
+
191
+ Unless required by applicable law or agreed to in writing, software
192
+ distributed under the License is distributed on an "AS IS" BASIS,
193
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
194
+ See the License for the specific language governing permissions and
195
+ limitations under the License.
196
+
197
+ Project-URL: Homepage, https://github.com/sriharshaviyyala/graywatch
198
+ Keywords: networking,gray-failure,packet-loss,monitoring,triangulation,pingmesh,noc,sre
199
+ Classifier: Development Status :: 4 - Beta
200
+ Classifier: Intended Audience :: System Administrators
201
+ Classifier: License :: OSI Approved :: Apache Software License
202
+ Classifier: Programming Language :: Python :: 3
203
+ Classifier: Topic :: System :: Networking :: Monitoring
204
+ Requires-Python: >=3.10
205
+ Description-Content-Type: text/markdown
206
+ License-File: LICENSE
207
+ Dynamic: license-file
208
+
209
+ # GrayWatch
210
+
211
+ [![ci](https://github.com/sriharshaviyyala/graywatch/actions/workflows/ci.yml/badge.svg)](https://github.com/sriharshaviyyala/graywatch/actions)
212
+ [![license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
213
+ [![python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](pyproject.toml)
214
+
215
+ **Find the network device that's lying to you.**
216
+
217
+ Every dashboard is green. Interfaces up, zero CRC errors, no syslog. And your
218
+ payments team is screaming about timeouts. That's a **gray failure** — a
219
+ device silently dropping traffic while its own counters read clean — and it's
220
+ the most feared failure mode in modern fabrics, because every monitoring tool
221
+ you own consumes telemetry *from the liar itself*.
222
+
223
+ Hyperscalers solved this internally a decade ago (Microsoft's Pingmesh, the
224
+ 007 paper). GrayWatch brings the technique to everyone else: one file, zero
225
+ dependencies, read-only.
226
+
227
+ ```
228
+ ⚠ GRAY FAILURE: spine1 (99.9% confidence, chance odds 1 in 16,807)
229
+ in 5 lossy paths, 0 clean paths; self-report clean=True
230
+ → drain from ECMP, re-probe, service the hardware
231
+
232
+ ✓ exonerated: gpufab1, leaf1, leaf2, leaf3, leaf4, spine2
233
+ ```
234
+
235
+ ## Quick start
236
+
237
+ ```bash
238
+ python graywatch.py demo # 30 seconds to a verdict
239
+ python graywatch.py analyze your-probes.json # your fabric
240
+ ```
241
+
242
+ Output: a terminal verdict plus a board-ready HTML report with the full
243
+ disagreement matrix, corroborating paths, and the recommended drain procedure.
244
+
245
+ ## How it works
246
+
247
+ **Never ask a device about itself.** Feed GrayWatch probe results that record
248
+ the *path* each probe transited — from TWAMP, a ping-mesh cron job,
249
+ SR-steered probes, whatever you already run:
250
+
251
+ ```json
252
+ [{"src": "leaf1", "dst": "leaf3", "path": ["leaf1", "spine2", "leaf3"], "loss_pct": 2.4}]
253
+ ```
254
+
255
+ The conviction invariant: a device present in **≥ N lossy paths and zero
256
+ clean paths**, while self-reporting healthy, is convicted by the
257
+ disagreement itself. In an ECMP fabric, innocent devices necessarily appear
258
+ on clean paths via the healthy spine — so the same matrix that convicts the
259
+ culprit explicitly **exonerates** everyone else. An exclusivity rule
260
+ localizes multiple simultaneous gray devices without smearing blame.
261
+
262
+ Confidence is an **exact binomial probability**, not a heuristic: the chance
263
+ an innocent device would show this lossy/clean split at the fabric's
264
+ measured background loss rate. The demo's "1 in 16,807" is (1/7)⁵ — simple
265
+ enough to check by hand, which is the point.
266
+
267
+ When loss is present but not localizable, GrayWatch says so (distinct exit
268
+ code) and tells you what probe diversity to add. Refusing to guess is a
269
+ feature.
270
+
271
+ ## Guarantees
272
+
273
+ - **Read-only, structurally** — there is no code path that writes to a
274
+ device. ~400 lines; read it before you run it.
275
+ - **Zero dependencies** — Python 3.10+ standard library only.
276
+ - **Deterministic** — same input, same verdict, same odds.
277
+
278
+ ## Probe data requirements
279
+
280
+ Each record needs `src`, `dst`, `path` (ordered device names the probe
281
+ transited), `loss_pct`. Tunables: `--threshold` (lossy cutoff, default 0.5%)
282
+ and `--min-lossy` (corroboration minimum, default 3). More endpoint pairs
283
+ and per-path steering = stronger convictions; the statistics scale
284
+ automatically.
285
+
286
+ ## Roadmap
287
+
288
+ Per-interface conviction (same invariant, finer hops), probe-source
289
+ integrations (TWAMP responders, SR-policy steering), probe diversity against
290
+ flow-selective failures.
291
+
292
+ ## License
293
+
294
+ Apache-2.0 — see [LICENSE](LICENSE).
@@ -0,0 +1,86 @@
1
+ # GrayWatch
2
+
3
+ [![ci](https://github.com/sriharshaviyyala/graywatch/actions/workflows/ci.yml/badge.svg)](https://github.com/sriharshaviyyala/graywatch/actions)
4
+ [![license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
5
+ [![python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](pyproject.toml)
6
+
7
+ **Find the network device that's lying to you.**
8
+
9
+ Every dashboard is green. Interfaces up, zero CRC errors, no syslog. And your
10
+ payments team is screaming about timeouts. That's a **gray failure** — a
11
+ device silently dropping traffic while its own counters read clean — and it's
12
+ the most feared failure mode in modern fabrics, because every monitoring tool
13
+ you own consumes telemetry *from the liar itself*.
14
+
15
+ Hyperscalers solved this internally a decade ago (Microsoft's Pingmesh, the
16
+ 007 paper). GrayWatch brings the technique to everyone else: one file, zero
17
+ dependencies, read-only.
18
+
19
+ ```
20
+ ⚠ GRAY FAILURE: spine1 (99.9% confidence, chance odds 1 in 16,807)
21
+ in 5 lossy paths, 0 clean paths; self-report clean=True
22
+ → drain from ECMP, re-probe, service the hardware
23
+
24
+ ✓ exonerated: gpufab1, leaf1, leaf2, leaf3, leaf4, spine2
25
+ ```
26
+
27
+ ## Quick start
28
+
29
+ ```bash
30
+ python graywatch.py demo # 30 seconds to a verdict
31
+ python graywatch.py analyze your-probes.json # your fabric
32
+ ```
33
+
34
+ Output: a terminal verdict plus a board-ready HTML report with the full
35
+ disagreement matrix, corroborating paths, and the recommended drain procedure.
36
+
37
+ ## How it works
38
+
39
+ **Never ask a device about itself.** Feed GrayWatch probe results that record
40
+ the *path* each probe transited — from TWAMP, a ping-mesh cron job,
41
+ SR-steered probes, whatever you already run:
42
+
43
+ ```json
44
+ [{"src": "leaf1", "dst": "leaf3", "path": ["leaf1", "spine2", "leaf3"], "loss_pct": 2.4}]
45
+ ```
46
+
47
+ The conviction invariant: a device present in **≥ N lossy paths and zero
48
+ clean paths**, while self-reporting healthy, is convicted by the
49
+ disagreement itself. In an ECMP fabric, innocent devices necessarily appear
50
+ on clean paths via the healthy spine — so the same matrix that convicts the
51
+ culprit explicitly **exonerates** everyone else. An exclusivity rule
52
+ localizes multiple simultaneous gray devices without smearing blame.
53
+
54
+ Confidence is an **exact binomial probability**, not a heuristic: the chance
55
+ an innocent device would show this lossy/clean split at the fabric's
56
+ measured background loss rate. The demo's "1 in 16,807" is (1/7)⁵ — simple
57
+ enough to check by hand, which is the point.
58
+
59
+ When loss is present but not localizable, GrayWatch says so (distinct exit
60
+ code) and tells you what probe diversity to add. Refusing to guess is a
61
+ feature.
62
+
63
+ ## Guarantees
64
+
65
+ - **Read-only, structurally** — there is no code path that writes to a
66
+ device. ~400 lines; read it before you run it.
67
+ - **Zero dependencies** — Python 3.10+ standard library only.
68
+ - **Deterministic** — same input, same verdict, same odds.
69
+
70
+ ## Probe data requirements
71
+
72
+ Each record needs `src`, `dst`, `path` (ordered device names the probe
73
+ transited), `loss_pct`. Tunables: `--threshold` (lossy cutoff, default 0.5%)
74
+ and `--min-lossy` (corroboration minimum, default 3). More endpoint pairs
75
+ and per-path steering = stronger convictions; the statistics scale
76
+ automatically.
77
+
78
+ ## Roadmap
79
+
80
+ Per-interface conviction (same invariant, finer hops), probe-source
81
+ integrations (TWAMP responders, SR-policy steering), probe diversity against
82
+ flow-selective failures.
83
+
84
+ ## License
85
+
86
+ Apache-2.0 — see [LICENSE](LICENSE).
@@ -0,0 +1,294 @@
1
+ Metadata-Version: 2.4
2
+ Name: graywatch
3
+ Version: 1.0.0
4
+ Summary: Find the network device that's lying to you — gray-failure triangulation from path-aware probe data. Zero dependencies, read-only.
5
+ Author: Sriharsha Viyyala
6
+ License: Apache License
7
+ Version 2.0, January 2004
8
+ http://www.apache.org/licenses/
9
+
10
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
11
+
12
+ 1. Definitions.
13
+
14
+ "License" shall mean the terms and conditions for use, reproduction,
15
+ and distribution as defined by Sections 1 through 9 of this document.
16
+
17
+ "Licensor" shall mean the copyright owner or entity authorized by
18
+ the copyright owner that is granting the License.
19
+
20
+ "Legal Entity" shall mean the union of the acting entity and all
21
+ other entities that control, are controlled by, or are under common
22
+ control with that entity. For the purposes of this definition,
23
+ "control" means (i) the power, direct or indirect, to cause the
24
+ direction or management of such entity, whether by contract or
25
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
26
+ outstanding shares, or (iii) beneficial ownership of such entity.
27
+
28
+ "You" (or "Your") shall mean an individual or Legal Entity
29
+ exercising permissions granted by this License.
30
+
31
+ "Source" form shall mean the preferred form for making modifications,
32
+ including but not limited to software source code, documentation
33
+ source, and configuration files.
34
+
35
+ "Object" form shall mean any form resulting from mechanical
36
+ transformation or translation of a Source form, including but
37
+ not limited to compiled object code, generated documentation,
38
+ and conversions to other media types.
39
+
40
+ "Work" shall mean the work of authorship, whether in Source or
41
+ Object form, made available under the License, as indicated by a
42
+ copyright notice that is included in or attached to the work
43
+ (an example is provided in the Appendix below).
44
+
45
+ "Derivative Works" shall mean any work, whether in Source or Object
46
+ form, that is based on (or derived from) the Work and for which the
47
+ editorial revisions, annotations, elaborations, or other modifications
48
+ represent, as a whole, an original work of authorship. For the purposes
49
+ of this License, Derivative Works shall not include works that remain
50
+ separable from, or merely link (or bind by name) to the interfaces of,
51
+ the Work and Derivative Works thereof.
52
+
53
+ "Contribution" shall mean any work of authorship, including
54
+ the original version of the Work and any modifications or additions
55
+ to that Work or Derivative Works thereof, that is intentionally
56
+ submitted to Licensor for inclusion in the Work by the copyright owner
57
+ or by an individual or Legal Entity authorized to submit on behalf of
58
+ the copyright owner. For the purposes of this definition, "submitted"
59
+ means any form of electronic, verbal, or written communication sent
60
+ to the Licensor or its representatives, including but not limited to
61
+ communication on electronic mailing lists, source code control systems,
62
+ and issue tracking systems that are managed by, or on behalf of, the
63
+ Licensor for the purpose of discussing and improving the Work, but
64
+ excluding communication that is conspicuously marked or otherwise
65
+ designated in writing by the copyright owner as "Not a Contribution."
66
+
67
+ "Contributor" shall mean Licensor and any individual or Legal Entity
68
+ on behalf of whom a Contribution has been received by Licensor and
69
+ subsequently incorporated within the Work.
70
+
71
+ 2. Grant of Copyright License. Subject to the terms and conditions of
72
+ this License, each Contributor hereby grants to You a perpetual,
73
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
74
+ copyright license to reproduce, prepare Derivative Works of,
75
+ publicly display, publicly perform, sublicense, and distribute the
76
+ Work and such Derivative Works in Source or Object form.
77
+
78
+ 3. Grant of Patent License. Subject to the terms and conditions of
79
+ this License, each Contributor hereby grants to You a perpetual,
80
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
81
+ (except as stated in this section) patent license to make, have made,
82
+ use, offer to sell, sell, import, and otherwise transfer the Work,
83
+ where such license applies only to those patent claims licensable
84
+ by such Contributor that are necessarily infringed by their
85
+ Contribution(s) alone or by combination of their Contribution(s)
86
+ with the Work to which such Contribution(s) was submitted. If You
87
+ institute patent litigation against any entity (including a
88
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
89
+ or a Contribution incorporated within the Work constitutes direct
90
+ or contributory patent infringement, then any patent licenses
91
+ granted to You under this License for that Work shall terminate
92
+ as of the date such litigation is filed.
93
+
94
+ 4. Redistribution. You may reproduce and distribute copies of the
95
+ Work or Derivative Works thereof in any medium, with or without
96
+ modifications, and in Source or Object form, provided that You
97
+ meet the following conditions:
98
+
99
+ (a) You must give any other recipients of the Work or
100
+ Derivative Works a copy of this License; and
101
+
102
+ (b) You must cause any modified files to carry prominent notices
103
+ stating that You changed the files; and
104
+
105
+ (c) You must retain, in the Source form of any Derivative Works
106
+ that You distribute, all copyright, patent, trademark, and
107
+ attribution notices from the Source form of the Work,
108
+ excluding those notices that do not pertain to any part of
109
+ the Derivative Works; and
110
+
111
+ (d) If the Work includes a "NOTICE" text file as part of its
112
+ distribution, then any Derivative Works that You distribute must
113
+ include a readable copy of the attribution notices contained
114
+ within such NOTICE file, excluding those notices that do not
115
+ pertain to any part of the Derivative Works, in at least one
116
+ of the following places: within a NOTICE text file distributed
117
+ as part of the Derivative Works; within the Source form or
118
+ documentation, if provided along with the Derivative Works; or,
119
+ within a display generated by the Derivative Works, if and
120
+ wherever such third-party notices normally appear. The contents
121
+ of the NOTICE file are for informational purposes only and
122
+ do not modify the License. You may add Your own attribution
123
+ notices within Derivative Works that You distribute, alongside
124
+ or as an addendum to the NOTICE text from the Work, provided
125
+ that such additional attribution notices cannot be construed
126
+ as modifying the License.
127
+
128
+ You may add Your own copyright statement to Your modifications and
129
+ may provide additional or different license terms and conditions
130
+ for use, reproduction, or distribution of Your modifications, or
131
+ for any such Derivative Works as a whole, provided Your use,
132
+ reproduction, and distribution of the Work otherwise complies with
133
+ the conditions stated in this License.
134
+
135
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
136
+ any Contribution intentionally submitted for inclusion in the Work
137
+ by You to the Licensor shall be under the terms and conditions of
138
+ this License, without any additional terms or conditions.
139
+ Notwithstanding the above, nothing herein shall supersede or modify
140
+ the terms of any separate license agreement you may have executed
141
+ with Licensor regarding such Contributions.
142
+
143
+ 6. Trademarks. This License does not grant permission to use the trade
144
+ names, trademarks, service marks, or product names of the Licensor,
145
+ except as required for reasonable and customary use in describing the
146
+ origin of the Work and reproducing the content of the NOTICE file.
147
+
148
+ 7. Disclaimer of Warranty. Unless required by applicable law or
149
+ agreed to in writing, Licensor provides the Work (and each
150
+ Contributor provides its Contributions) on an "AS IS" BASIS,
151
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
152
+ implied, including, without limitation, any warranties or conditions
153
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
154
+ PARTICULAR PURPOSE. You are solely responsible for determining the
155
+ appropriateness of using or redistributing the Work and assume any
156
+ risks associated with Your exercise of permissions under this License.
157
+
158
+ 8. Limitation of Liability. In no event and under no legal theory,
159
+ whether in tort (including negligence), contract, or otherwise,
160
+ unless required by applicable law (such as deliberate and grossly
161
+ negligent acts) or agreed to in writing, shall any Contributor be
162
+ liable to You for damages, including any direct, indirect, special,
163
+ incidental, or consequential damages of any character arising as a
164
+ result of this License or out of the use or inability to use the
165
+ Work (including but not limited to damages for loss of goodwill,
166
+ work stoppage, computer failure or malfunction, or any and all
167
+ other commercial damages or losses), even if such Contributor
168
+ has been advised of the possibility of such damages.
169
+
170
+ 9. Accepting Warranty or Additional Liability. While redistributing
171
+ the Work or Derivative Works thereof, You may choose to offer,
172
+ and charge a fee for, acceptance of support, warranty, indemnity,
173
+ or other liability obligations and/or rights consistent with this
174
+ License. However, in accepting such obligations, You may act only
175
+ on Your own behalf and on Your sole responsibility, not on behalf
176
+ of any other Contributor, and only if You agree to indemnify,
177
+ defend, and hold each Contributor harmless for any liability
178
+ incurred by, or claims asserted against, such Contributor by reason
179
+ of your accepting any such warranty or additional liability.
180
+
181
+ END OF TERMS AND CONDITIONS
182
+
183
+ Copyright 2026 Sriharsha Viyyala
184
+
185
+ Licensed under the Apache License, Version 2.0 (the "License");
186
+ you may not use this file except in compliance with the License.
187
+ You may obtain a copy of the License at
188
+
189
+ http://www.apache.org/licenses/LICENSE-2.0
190
+
191
+ Unless required by applicable law or agreed to in writing, software
192
+ distributed under the License is distributed on an "AS IS" BASIS,
193
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
194
+ See the License for the specific language governing permissions and
195
+ limitations under the License.
196
+
197
+ Project-URL: Homepage, https://github.com/sriharshaviyyala/graywatch
198
+ Keywords: networking,gray-failure,packet-loss,monitoring,triangulation,pingmesh,noc,sre
199
+ Classifier: Development Status :: 4 - Beta
200
+ Classifier: Intended Audience :: System Administrators
201
+ Classifier: License :: OSI Approved :: Apache Software License
202
+ Classifier: Programming Language :: Python :: 3
203
+ Classifier: Topic :: System :: Networking :: Monitoring
204
+ Requires-Python: >=3.10
205
+ Description-Content-Type: text/markdown
206
+ License-File: LICENSE
207
+ Dynamic: license-file
208
+
209
+ # GrayWatch
210
+
211
+ [![ci](https://github.com/sriharshaviyyala/graywatch/actions/workflows/ci.yml/badge.svg)](https://github.com/sriharshaviyyala/graywatch/actions)
212
+ [![license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
213
+ [![python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](pyproject.toml)
214
+
215
+ **Find the network device that's lying to you.**
216
+
217
+ Every dashboard is green. Interfaces up, zero CRC errors, no syslog. And your
218
+ payments team is screaming about timeouts. That's a **gray failure** — a
219
+ device silently dropping traffic while its own counters read clean — and it's
220
+ the most feared failure mode in modern fabrics, because every monitoring tool
221
+ you own consumes telemetry *from the liar itself*.
222
+
223
+ Hyperscalers solved this internally a decade ago (Microsoft's Pingmesh, the
224
+ 007 paper). GrayWatch brings the technique to everyone else: one file, zero
225
+ dependencies, read-only.
226
+
227
+ ```
228
+ ⚠ GRAY FAILURE: spine1 (99.9% confidence, chance odds 1 in 16,807)
229
+ in 5 lossy paths, 0 clean paths; self-report clean=True
230
+ → drain from ECMP, re-probe, service the hardware
231
+
232
+ ✓ exonerated: gpufab1, leaf1, leaf2, leaf3, leaf4, spine2
233
+ ```
234
+
235
+ ## Quick start
236
+
237
+ ```bash
238
+ python graywatch.py demo # 30 seconds to a verdict
239
+ python graywatch.py analyze your-probes.json # your fabric
240
+ ```
241
+
242
+ Output: a terminal verdict plus a board-ready HTML report with the full
243
+ disagreement matrix, corroborating paths, and the recommended drain procedure.
244
+
245
+ ## How it works
246
+
247
+ **Never ask a device about itself.** Feed GrayWatch probe results that record
248
+ the *path* each probe transited — from TWAMP, a ping-mesh cron job,
249
+ SR-steered probes, whatever you already run:
250
+
251
+ ```json
252
+ [{"src": "leaf1", "dst": "leaf3", "path": ["leaf1", "spine2", "leaf3"], "loss_pct": 2.4}]
253
+ ```
254
+
255
+ The conviction invariant: a device present in **≥ N lossy paths and zero
256
+ clean paths**, while self-reporting healthy, is convicted by the
257
+ disagreement itself. In an ECMP fabric, innocent devices necessarily appear
258
+ on clean paths via the healthy spine — so the same matrix that convicts the
259
+ culprit explicitly **exonerates** everyone else. An exclusivity rule
260
+ localizes multiple simultaneous gray devices without smearing blame.
261
+
262
+ Confidence is an **exact binomial probability**, not a heuristic: the chance
263
+ an innocent device would show this lossy/clean split at the fabric's
264
+ measured background loss rate. The demo's "1 in 16,807" is (1/7)⁵ — simple
265
+ enough to check by hand, which is the point.
266
+
267
+ When loss is present but not localizable, GrayWatch says so (distinct exit
268
+ code) and tells you what probe diversity to add. Refusing to guess is a
269
+ feature.
270
+
271
+ ## Guarantees
272
+
273
+ - **Read-only, structurally** — there is no code path that writes to a
274
+ device. ~400 lines; read it before you run it.
275
+ - **Zero dependencies** — Python 3.10+ standard library only.
276
+ - **Deterministic** — same input, same verdict, same odds.
277
+
278
+ ## Probe data requirements
279
+
280
+ Each record needs `src`, `dst`, `path` (ordered device names the probe
281
+ transited), `loss_pct`. Tunables: `--threshold` (lossy cutoff, default 0.5%)
282
+ and `--min-lossy` (corroboration minimum, default 3). More endpoint pairs
283
+ and per-path steering = stronger convictions; the statistics scale
284
+ automatically.
285
+
286
+ ## Roadmap
287
+
288
+ Per-interface conviction (same invariant, finer hops), probe-source
289
+ integrations (TWAMP responders, SR-policy steering), probe diversity against
290
+ flow-selective failures.
291
+
292
+ ## License
293
+
294
+ Apache-2.0 — see [LICENSE](LICENSE).
@@ -0,0 +1,10 @@
1
+ LICENSE
2
+ README.md
3
+ graywatch.py
4
+ pyproject.toml
5
+ graywatch.egg-info/PKG-INFO
6
+ graywatch.egg-info/SOURCES.txt
7
+ graywatch.egg-info/dependency_links.txt
8
+ graywatch.egg-info/entry_points.txt
9
+ graywatch.egg-info/top_level.txt
10
+ tests/test_graywatch.py
@@ -0,0 +1,2 @@
1
+ [console_scripts]
2
+ graywatch = graywatch:main
@@ -0,0 +1 @@
1
+ graywatch
@@ -0,0 +1,315 @@
1
+ #!/usr/bin/env python3
2
+ # Copyright 2026 Sriharsha Viyyala
3
+ #
4
+ # Licensed under the Apache License, Version 2.0 (the "License");
5
+ # you may not use this file except in compliance with the License.
6
+ # You may obtain a copy of the License at
7
+ #
8
+ # http://www.apache.org/licenses/LICENSE-2.0
9
+ #
10
+ # Unless required by applicable law or agreed to in writing, software
11
+ # distributed under the License is distributed on an "AS IS" BASIS,
12
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+ # See the License for the specific language governing permissions and
14
+ # limitations under the License.
15
+
16
+ """GrayWatch — find the device that's lying to you.
17
+
18
+ A gray failure is a device silently dropping traffic while every one of its
19
+ own counters reads clean. Every dashboard is green; your app teams are
20
+ screaming; the war room lasts six hours. GrayWatch convicts the liar in
21
+ minutes, from probe data you can already collect.
22
+
23
+ Zero dependencies. One file. Read-only. Stdlib only.
24
+
25
+ Usage:
26
+ python graywatch.py demo # self-contained demo fabric
27
+ python graywatch.py analyze probes.json # your own probe results
28
+ python graywatch.py analyze probes.json -o report.html --threshold 0.5
29
+
30
+ Probe record format (JSON list):
31
+ {"src": "leaf1", "dst": "leaf3", "path": ["leaf1","spine2","leaf3"],
32
+ "loss_pct": 2.4}
33
+ Collect with whatever you have — TWAMP, a ping-mesh cron job, SR-policy
34
+ steered probes — as long as each probe records the PATH it transited.
35
+
36
+ The triangulation invariant (never ask a device about itself):
37
+ A device present in >= N lossy paths and ZERO clean paths, while
38
+ self-reporting healthy, is the gray element. The disagreement between
39
+ fabric experience and self-report IS the evidence.
40
+
41
+ GrayWatch finds the liar; what you do about it is up to you. The
42
+ recommended drain procedure is in every report.
43
+ """
44
+ from __future__ import annotations
45
+
46
+ import argparse
47
+ import hashlib
48
+ import json
49
+ import math
50
+ import random
51
+ import sys
52
+ import time
53
+ from dataclasses import dataclass, field
54
+
55
+ __version__ = "1.0.0"
56
+
57
+ DEFAULT_LOSS_THRESHOLD_PCT = 0.5
58
+ DEFAULT_MIN_LOSSY_PATHS = 3
59
+
60
+
61
+ # --------------------------------------------------------------------- model
62
+ @dataclass
63
+ class Probe:
64
+ src: str
65
+ dst: str
66
+ path: list
67
+ loss_pct: float
68
+
69
+ def lossy(self, threshold: float) -> bool:
70
+ return self.loss_pct >= threshold
71
+
72
+
73
+ @dataclass
74
+ class Verdict:
75
+ suspect: str
76
+ confidence: float
77
+ lossy_paths: int
78
+ clean_paths: int
79
+ p_chance: float = 1.0 # probability the pattern arose by chance
80
+ odds: str = "" # human-readable: "1 in 16,800"
81
+ corroborating: list = field(default_factory=list)
82
+ self_report_clean: bool = True
83
+
84
+
85
+ def _binom_tail(n: int, k: int, q: float) -> float:
86
+ """P(X >= k) for X ~ Binomial(n, q) — the chance an INNOCENT device
87
+ would appear in at least k lossy paths out of its n paths, if lossiness
88
+ struck paths at the background rate q. Exact, stdlib-only."""
89
+ q = min(max(q, 1e-9), 1 - 1e-9)
90
+ return sum(math.comb(n, i) * q**i * (1 - q)**(n - i) for i in range(k, n + 1))
91
+
92
+
93
+ @dataclass
94
+ class Analysis:
95
+ verdicts: list
96
+ exonerated: list
97
+ probes_total: int
98
+ lossy_total: int
99
+ threshold: float
100
+ matrix: dict
101
+ ts: float = field(default_factory=time.time)
102
+
103
+ @property
104
+ def clean(self) -> bool:
105
+ return not self.verdicts and self.lossy_total == 0
106
+
107
+
108
+ # ---------------------------------------------------------------- triangulate
109
+ def triangulate(probes: list, threshold: float = DEFAULT_LOSS_THRESHOLD_PCT,
110
+ min_lossy: int = DEFAULT_MIN_LOSSY_PATHS,
111
+ self_reports: dict | None = None) -> Analysis:
112
+ """Conviction requires the gray signature (many lossy paths, ZERO clean
113
+ paths) plus exclusivity: at least one lossy path the suspect cannot blame
114
+ on any co-suspect. This localizes multiple simultaneous gray devices
115
+ without smearing blame across the fabric, and refuses to convict pure
116
+ passengers that merely share paths with the real culprit."""
117
+ self_reports = self_reports or {}
118
+ matrix: dict[str, dict] = {}
119
+ for p in probes:
120
+ for hop in p.path:
121
+ row = matrix.setdefault(hop, {"lossy": 0, "clean": 0})
122
+ row["lossy" if p.lossy(threshold) else "clean"] += 1
123
+
124
+ lossy = [p for p in probes if p.lossy(threshold)]
125
+ candidates = sorted((dev for dev, m in matrix.items()
126
+ if m["lossy"] >= min_lossy and m["clean"] == 0),
127
+ key=lambda d: -matrix[d]["lossy"])
128
+ verdicts: list[Verdict] = []
129
+ for dev in candidates:
130
+ exclusive = [p for p in lossy if dev in p.path and
131
+ not any(o in p.path for o in candidates if o != dev)]
132
+ if not exclusive and len(candidates) > 1:
133
+ continue # passenger, not culprit
134
+ hits = matrix[dev]["lossy"]
135
+ n = hits + matrix[dev]["clean"]
136
+ # background lossiness among paths NOT touching the suspect
137
+ # (Laplace-smoothed so a fully-clean background can't zero out)
138
+ other = [p for p in probes if dev not in p.path]
139
+ q = (sum(1 for p in other if p.lossy(threshold)) + 1) / (len(other) + 2)
140
+ p_chance = _binom_tail(n, hits, q)
141
+ one_in = max(2, round(1 / max(p_chance, 1e-12)))
142
+ verdicts.append(Verdict(
143
+ suspect=dev,
144
+ confidence=min(0.999, 1 - p_chance),
145
+ lossy_paths=hits,
146
+ clean_paths=matrix[dev]["clean"],
147
+ p_chance=p_chance,
148
+ odds=f"1 in {one_in:,}",
149
+ corroborating=[f"{p.src}->{p.dst} ({p.loss_pct}% via {'/'.join(p.path)})"
150
+ for p in lossy if dev in p.path][:10],
151
+ self_report_clean=bool(self_reports.get(dev, {"clean": True}
152
+ ).get("clean", True))))
153
+
154
+ all_lossy = [p for p in probes if p.lossy(threshold)]
155
+ exonerated = sorted({hop for p in probes for hop in p.path}
156
+ - {v.suspect for v in verdicts}
157
+ - {hop for p in all_lossy for hop in p.path
158
+ if matrix[hop]["clean"] == 0})
159
+ return Analysis(verdicts=verdicts, exonerated=exonerated,
160
+ probes_total=len(probes), lossy_total=len(all_lossy),
161
+ threshold=threshold, matrix=matrix)
162
+
163
+
164
+ # ---------------------------------------------------------------------- demo
165
+ def demo_probes(gray_device: str = "spine1", loss_pct: float = 2.5,
166
+ seed: int = 7) -> list:
167
+ """Synthetic 2-spine / 5-leaf ECMP fabric with one silently-lying spine."""
168
+ rng = random.Random(seed)
169
+ endpoints = ["leaf1", "leaf2", "leaf3", "leaf4", "gpufab1"]
170
+ spines = ["spine1", "spine2"]
171
+ probes, i = [], 0
172
+ for a in range(len(endpoints)):
173
+ for b in range(a + 1, len(endpoints)):
174
+ via = spines[i % 2]
175
+ i += 1
176
+ path = [endpoints[a], via, endpoints[b]]
177
+ base = round(rng.uniform(0.0, 0.08), 3) # healthy noise floor
178
+ loss = base + (loss_pct if gray_device in path else 0.0)
179
+ probes.append(Probe(endpoints[a], endpoints[b], path, round(loss, 3)))
180
+ return probes
181
+
182
+
183
+ # --------------------------------------------------------------------- report
184
+ def render_html(analysis: Analysis, title: str = "GrayWatch verdict") -> str:
185
+ v = analysis.verdicts
186
+ status = ("FABRIC CLEAN" if analysis.clean else
187
+ f"{len(v)} GRAY FAILURE(S) TRIANGULATED" if v else
188
+ "LOSS PRESENT — NOT YET LOCALIZED (need more path diversity)")
189
+ color = "#1a7f37" if analysis.clean else ("#d1242f" if v else "#b45309")
190
+ fingerprint = hashlib.sha256(json.dumps(
191
+ [(x.suspect, x.lossy_paths) for x in v]).encode()).hexdigest()[:12]
192
+
193
+ rows = "".join(
194
+ f"<tr><td>{d}</td><td>{m['lossy']}</td><td>{m['clean']}</td>"
195
+ f"<td>{'⚠ suspect' if any(x.suspect == d for x in v) else ('✓ exonerated' if m['clean'] else '—')}</td></tr>"
196
+ for d, m in sorted(analysis.matrix.items(),
197
+ key=lambda kv: -kv[1]['lossy']))
198
+ cards = "".join(f"""
199
+ <div class="verdict">
200
+ <div class="vh"><b>{x.suspect}</b>
201
+ <span class="conf">{x.confidence:.1%} confidence</span></div>
202
+ <p>Present in <b>{x.lossy_paths} lossy paths</b> and
203
+ <b>{x.clean_paths} clean paths</b>, while self-reporting
204
+ {"<b>clean</b> — the definition of a gray failure" if x.self_report_clean
205
+ else "unhealthy"}. Odds this pattern is coincidence:
206
+ <b>{x.odds}</b> (exact binomial vs the fabric's background loss rate).</p>
207
+ <p class="act">Recommended action: drain from ECMP (ISIS overload /
208
+ MED max) — links stay up, traffic routes around — then re-probe
209
+ to verify and swap optics/linecard under calm conditions.</p>
210
+ <details><summary>{len(x.corroborating)} corroborating paths</summary>
211
+ <ul>{''.join(f'<li>{c}</li>' for c in x.corroborating)}</ul></details>
212
+ </div>""" for x in v)
213
+
214
+ return f"""<!DOCTYPE html><html><head><meta charset="utf-8">
215
+ <title>{title}</title><style>
216
+ body{{font:15px/1.6 -apple-system,'Segoe UI',sans-serif;color:#1f2a37;
217
+ background:#f6f8fb;max-width:880px;margin:40px auto;padding:0 20px}}
218
+ .hero{{background:#fff;border:1px solid #e3e9f1;border-radius:14px;
219
+ padding:26px;box-shadow:0 2px 10px rgba(31,42,55,.05)}}
220
+ h1{{margin:0;font-size:22px;letter-spacing:1px}} h1 span{{color:#0969da}}
221
+ .status{{display:inline-block;margin-top:10px;padding:6px 16px;border-radius:18px;
222
+ color:#fff;background:{color};font-weight:600;font-size:13.5px}}
223
+ .meta{{color:#697586;font-size:12.5px;margin-top:10px}}
224
+ .verdict{{background:#fff;border:1px solid #e3e9f1;border-left:4px solid #d1242f;
225
+ border-radius:12px;padding:18px 20px;margin-top:16px}}
226
+ .vh b{{font-size:17px}} .conf{{float:right;color:#0969da;font-weight:600}}
227
+ .act{{background:#f0f6ff;border-radius:8px;padding:10px 12px;font-size:13.5px}}
228
+ table{{width:100%;border-collapse:collapse;margin-top:16px;background:#fff;
229
+ border:1px solid #e3e9f1;border-radius:12px;overflow:hidden}}
230
+ th{{text-align:left;font-size:11px;text-transform:uppercase;letter-spacing:1px;
231
+ color:#697586;padding:10px 14px;border-bottom:1px solid #e3e9f1}}
232
+ td{{padding:8px 14px;border-bottom:1px solid #eef2f7;font-size:13.5px}}
233
+ details{{margin-top:8px;font-size:13px}} summary{{cursor:pointer;color:#0969da}}
234
+ .foot{{margin-top:28px;color:#697586;font-size:12.5px;border-top:1px solid #e3e9f1;
235
+ padding-top:14px}}
236
+ </style></head><body>
237
+ <div class="hero">
238
+ <h1>GRAYWATCH<span>▮</span></h1>
239
+ <div class="status">{status}</div>
240
+ <div class="meta">{analysis.probes_total} probes analyzed ·
241
+ {analysis.lossy_total} lossy (≥{analysis.threshold}%) ·
242
+ {len(analysis.exonerated)} devices exonerated ·
243
+ verdict fingerprint {fingerprint} ·
244
+ {time.strftime('%Y-%m-%d %H:%M UTC', time.gmtime(analysis.ts))}</div>
245
+ </div>
246
+ {cards}
247
+ <table><thead><tr><th>device</th><th>lossy-path appearances</th>
248
+ <th>clean-path appearances</th><th>disposition</th></tr></thead>
249
+ <tbody>{rows}</tbody></table>
250
+ <div class="foot"><b>Method:</b> never ask a device about itself. A device in
251
+ many lossy paths and zero clean paths, while self-reporting healthy, is
252
+ convicted by the disagreement — an exact binomial verdict against the
253
+ fabric's measured background loss rate. Innocent devices are explicitly
254
+ exonerated. GrayWatch is read-only by construction: no code path writes to
255
+ a device.</div>
256
+ </body></html>"""
257
+
258
+
259
+ # ------------------------------------------------------------------------ cli
260
+ def load_probes(path: str) -> list:
261
+ with open(path) as fh:
262
+ data = json.load(fh)
263
+ return [Probe(d["src"], d["dst"], list(d["path"]), float(d["loss_pct"]))
264
+ for d in data]
265
+
266
+
267
+ def print_verdict(analysis: Analysis) -> None:
268
+ print(f"\nGrayWatch v{__version__} — {analysis.probes_total} probes, "
269
+ f"{analysis.lossy_total} lossy (threshold {analysis.threshold}%)")
270
+ if analysis.clean:
271
+ print("✔ FABRIC CLEAN — no loss above threshold.")
272
+ return
273
+ if not analysis.verdicts:
274
+ print("⚠ Loss present but not localizable — add probe path diversity "
275
+ "(more endpoint pairs / per-spine steering).")
276
+ return
277
+ for v in analysis.verdicts:
278
+ print(f"\n⚠ GRAY FAILURE: {v.suspect} ({v.confidence:.1%} confidence, "
279
+ f"chance odds {v.odds})")
280
+ print(f" in {v.lossy_paths} lossy paths, {v.clean_paths} clean paths; "
281
+ f"self-report clean={v.self_report_clean}")
282
+ print(f" → drain from ECMP, re-probe, then service the hardware.")
283
+ if analysis.exonerated:
284
+ print(f"\n✓ exonerated: {', '.join(analysis.exonerated)}")
285
+
286
+
287
+ def main(argv=None) -> int:
288
+ ap = argparse.ArgumentParser(prog="graywatch", description=__doc__)
289
+ sub = ap.add_subparsers(dest="cmd", required=True)
290
+ d = sub.add_parser("demo", help="run the built-in demo fabric")
291
+ d.add_argument("--gray", default="spine1")
292
+ d.add_argument("-o", "--out", default="graywatch-report.html")
293
+ a = sub.add_parser("analyze", help="analyze your probe results (JSON)")
294
+ a.add_argument("probes")
295
+ a.add_argument("--threshold", type=float, default=DEFAULT_LOSS_THRESHOLD_PCT)
296
+ a.add_argument("--min-lossy", type=int, default=DEFAULT_MIN_LOSSY_PATHS)
297
+ a.add_argument("-o", "--out", default="graywatch-report.html")
298
+ args = ap.parse_args(argv)
299
+
300
+ if args.cmd == "demo":
301
+ probes = demo_probes(gray_device=args.gray)
302
+ analysis = triangulate(probes)
303
+ else:
304
+ analysis = triangulate(load_probes(args.probes),
305
+ threshold=args.threshold,
306
+ min_lossy=args.min_lossy)
307
+ print_verdict(analysis)
308
+ with open(args.out, "w") as fh:
309
+ fh.write(render_html(analysis))
310
+ print(f"\nreport → {args.out}")
311
+ return 0 if analysis.clean or analysis.verdicts else 1
312
+
313
+
314
+ if __name__ == "__main__":
315
+ sys.exit(main())
@@ -0,0 +1,33 @@
1
+ [build-system]
2
+ requires = ["setuptools>=68"]
3
+ build-backend = "setuptools.build_meta"
4
+
5
+ [project]
6
+ name = "graywatch"
7
+ version = "1.0.0"
8
+ description = "Find the network device that's lying to you — gray-failure triangulation from path-aware probe data. Zero dependencies, read-only."
9
+ readme = "README.md"
10
+ license = { file = "LICENSE" }
11
+ authors = [{ name = "Sriharsha Viyyala" }]
12
+ requires-python = ">=3.10"
13
+ keywords = ["networking", "gray-failure", "packet-loss", "monitoring",
14
+ "triangulation", "pingmesh", "noc", "sre"]
15
+ classifiers = [
16
+ "Development Status :: 4 - Beta",
17
+ "Intended Audience :: System Administrators",
18
+ "License :: OSI Approved :: Apache Software License",
19
+ "Programming Language :: Python :: 3",
20
+ "Topic :: System :: Networking :: Monitoring",
21
+ ]
22
+
23
+ [project.scripts]
24
+ graywatch = "graywatch:main"
25
+
26
+ [project.urls]
27
+ Homepage = "https://github.com/sriharshaviyyala/graywatch"
28
+
29
+ [tool.setuptools]
30
+ py-modules = ["graywatch"]
31
+
32
+ [tool.pytest.ini_options]
33
+ testpaths = ["tests"]
@@ -0,0 +1,4 @@
1
+ [egg_info]
2
+ tag_build =
3
+ tag_date = 0
4
+
@@ -0,0 +1,73 @@
1
+ # Copyright 2026 Sriharsha Viyyala. Apache-2.0.
2
+ """GrayWatch test suite: conviction, exoneration, multi-culprit handling,
3
+ statistical sanity, and CLI round-trips."""
4
+ import json
5
+ import sys
6
+ from pathlib import Path
7
+
8
+ sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
9
+
10
+ import graywatch as gw
11
+
12
+
13
+ def test_demo_convicts_the_right_device():
14
+ analysis = gw.triangulate(gw.demo_probes(gray_device="spine1"))
15
+ assert len(analysis.verdicts) == 1
16
+ v = analysis.verdicts[0]
17
+ assert v.suspect == "spine1" and v.confidence > 0.99
18
+ assert v.clean_paths == 0 and v.lossy_paths >= 3
19
+ assert "spine2" in analysis.exonerated
20
+
21
+
22
+ def test_verdict_carries_exact_chance_odds():
23
+ v = gw.triangulate(gw.demo_probes(gray_device="spine1")).verdicts[0]
24
+ assert v.p_chance < 0.001
25
+ assert v.odds.startswith("1 in ")
26
+
27
+
28
+ def test_clean_fabric_stays_clean():
29
+ analysis = gw.triangulate(gw.demo_probes(loss_pct=0.0))
30
+ assert analysis.clean and not analysis.verdicts
31
+
32
+
33
+ def test_two_simultaneous_grays_both_localized():
34
+ probes = gw.demo_probes(gray_device="spine1")
35
+ for p in probes:
36
+ if "leaf2" in p.path:
37
+ p.loss_pct = round(p.loss_pct + 3.0, 3)
38
+ analysis = gw.triangulate(probes)
39
+ assert {v.suspect for v in analysis.verdicts} == {"spine1", "leaf2"}
40
+
41
+
42
+ def test_refuses_to_convict_without_corroboration():
43
+ probes = gw.demo_probes(loss_pct=0.0)
44
+ probes[0].loss_pct = 5.0
45
+ analysis = gw.triangulate(probes)
46
+ assert not analysis.verdicts and analysis.lossy_total == 1
47
+
48
+
49
+ def test_binom_tail_sanity():
50
+ assert abs(gw._binom_tail(1, 1, 0.5) - 0.5) < 1e-9
51
+ assert abs(gw._binom_tail(2, 1, 0.5) - 0.75) < 1e-9
52
+ assert gw._binom_tail(10, 10, 0.1) < 1e-9
53
+ assert abs(gw._binom_tail(5, 0, 0.3) - 1.0) < 1e-9
54
+
55
+
56
+ def test_determinism():
57
+ a = gw.triangulate(gw.demo_probes())
58
+ b = gw.triangulate(gw.demo_probes())
59
+ assert [(v.suspect, v.odds) for v in a.verdicts] == \
60
+ [(v.suspect, v.odds) for v in b.verdicts]
61
+
62
+
63
+ def test_cli_demo_and_analyze(tmp_path):
64
+ out = tmp_path / "r.html"
65
+ assert gw.main(["demo", "-o", str(out)]) == 0
66
+ html = out.read_text()
67
+ assert "GRAY FAILURE(S) TRIANGULATED" in html and "spine1" in html
68
+
69
+ pj = tmp_path / "probes.json"
70
+ pj.write_text(json.dumps([{"src": p.src, "dst": p.dst, "path": p.path,
71
+ "loss_pct": p.loss_pct}
72
+ for p in gw.demo_probes()]))
73
+ assert gw.main(["analyze", str(pj), "-o", str(tmp_path / "r2.html")]) == 0