sre-agent-cli 0.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- sre_agent/__init__.py +3 -0
- sre_agent/adapters.py +833 -0
- sre_agent/approvals.py +243 -0
- sre_agent/audit.py +225 -0
- sre_agent/backend_scores.py +184 -0
- sre_agent/backend_url.py +146 -0
- sre_agent/cli.py +732 -0
- sre_agent/config.py +22 -0
- sre_agent/evaluation.py +391 -0
- sre_agent/evaluation_page.py +209 -0
- sre_agent/hosted_demo.py +153 -0
- sre_agent/ingestion.py +423 -0
- sre_agent/injection.py +580 -0
- sre_agent/logging_config.py +83 -0
- sre_agent/memory.py +411 -0
- sre_agent/model_backend.py +551 -0
- sre_agent/model_proposals.py +287 -0
- sre_agent/models.py +278 -0
- sre_agent/policy.py +208 -0
- sre_agent/postmortems.py +296 -0
- sre_agent/reasoning.py +547 -0
- sre_agent/regression.py +287 -0
- sre_agent/runbooks.py +290 -0
- sre_agent/security_review.py +826 -0
- sre_agent/server.py +684 -0
- sre_agent/storage.py +266 -0
- sre_agent/tier3.py +440 -0
- sre_agent/tools.py +712 -0
- sre_agent_cli-0.2.0.dist-info/METADATA +364 -0
- sre_agent_cli-0.2.0.dist-info/RECORD +34 -0
- sre_agent_cli-0.2.0.dist-info/WHEEL +5 -0
- sre_agent_cli-0.2.0.dist-info/entry_points.txt +2 -0
- sre_agent_cli-0.2.0.dist-info/licenses/LICENSE +21 -0
- sre_agent_cli-0.2.0.dist-info/top_level.txt +1 -0
|
@@ -0,0 +1,364 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: sre-agent-cli
|
|
3
|
+
Version: 0.2.0
|
|
4
|
+
Summary: An autonomous SRE agent that diagnoses and helps remediate incidents under human-approved guardrails.
|
|
5
|
+
Author: Abraham Kakooza
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/KakoozaJerry/sre-agent
|
|
8
|
+
Project-URL: Repository, https://github.com/KakoozaJerry/sre-agent
|
|
9
|
+
Project-URL: Documentation, https://github.com/KakoozaJerry/sre-agent#readme
|
|
10
|
+
Project-URL: Issues, https://github.com/KakoozaJerry/sre-agent/issues
|
|
11
|
+
Project-URL: Changelog, https://github.com/KakoozaJerry/sre-agent/blob/main/CHANGELOG.md
|
|
12
|
+
Keywords: sre,ai-agent,incident-response,observability,devops,site-reliability-engineering
|
|
13
|
+
Classifier: Development Status :: 4 - Beta
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: Intended Audience :: System Administrators
|
|
16
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
17
|
+
Classifier: Operating System :: OS Independent
|
|
18
|
+
Classifier: Programming Language :: Python :: 3
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
22
|
+
Classifier: Topic :: System :: Monitoring
|
|
23
|
+
Classifier: Topic :: System :: Systems Administration
|
|
24
|
+
Requires-Python: >=3.11
|
|
25
|
+
Description-Content-Type: text/markdown
|
|
26
|
+
License-File: LICENSE
|
|
27
|
+
Requires-Dist: pydantic>=2.6
|
|
28
|
+
Requires-Dist: fastapi>=0.110
|
|
29
|
+
Provides-Extra: dev
|
|
30
|
+
Requires-Dist: pytest>=8.0; extra == "dev"
|
|
31
|
+
Requires-Dist: ruff>=0.4; extra == "dev"
|
|
32
|
+
Requires-Dist: mypy>=1.9; extra == "dev"
|
|
33
|
+
Requires-Dist: httpx>=0.27; extra == "dev"
|
|
34
|
+
Provides-Extra: server
|
|
35
|
+
Requires-Dist: fastapi>=0.110; extra == "server"
|
|
36
|
+
Requires-Dist: uvicorn>=0.29; extra == "server"
|
|
37
|
+
Requires-Dist: httpx>=0.27; extra == "server"
|
|
38
|
+
Dynamic: license-file
|
|
39
|
+
|
|
40
|
+
# sre-agent
|
|
41
|
+
|
|
42
|
+
[](https://github.com/KakoozaJerry/sre-agent/actions/workflows/ci.yml) [](https://github.com/KakoozaJerry/sre-agent/releases) [](LICENSE) [](https://www.python.org/downloads/)
|
|
43
|
+
|
|
44
|
+
**The SRE agent you can audit.**
|
|
45
|
+
|
|
46
|
+
No API key, and no model required: every claim cites its evidence, and every release ships its scores.
|
|
47
|
+
|
|
48
|
+
An autonomous SRE agent that detects production incidents, works out what is wrong using real evidence, and helps fix them — without ever being allowed to make things worse on its own.
|
|
49
|
+
|
|
50
|
+
Built in the open by [Abraham Kakooza](https://github.com/KakoozaJerry).
|
|
51
|
+
|
|
52
|
+
**v0.2.0 · chaos 5 of 5 · regression PASS · injection 8 of 8 · Tier 3 drills 7 of 7 · security probes 10 of 10 · 0 unsafe actions** — full scores in [docs/evaluation.md](docs/evaluation.md).
|
|
53
|
+
|
|
54
|
+
[Quick start](#quick-start) · [Try the hosted demo](#try-the-hosted-demo) · [Evaluation](docs/evaluation.md) · [Progress log](docs/progress.md)
|
|
55
|
+
|
|
56
|
+
| Capability | What it does today |
|
|
57
|
+
|---|---|
|
|
58
|
+
| Alert ingestion | Alertmanager and generic webhooks; duplicates counted, related alerts grouped, resolved alerts close the incident; ingestion caps on |
|
|
59
|
+
| Evidence-cited diagnosis | The server runs the reasoning loop at ingestion; every claim cites evidence and the exact query behind it, or the incident escalates to a human |
|
|
60
|
+
| Fixes with approval | Three runbooks only (restart, scale, rollback); Tier 2 needs a named human (single-use, 15-minute expiry, policy re-checked); no free-form commands, ever |
|
|
61
|
+
| Bounded autonomy | Tier 3 demo grant only: restart and scale in the demo shop namespace, at most three replicas; rollback is never pre-approved |
|
|
62
|
+
| Safety record | Every policy decision is audit-logged before anything runs; the audit file is hash-chained and tamper-evident |
|
|
63
|
+
| Memory advice | Past-incident advice attached after a diagnosis is decided — advice only; it runs nothing and approves nothing |
|
|
64
|
+
| Read adapters | Kubernetes pods, Datadog metrics and Azure Monitor KQL as extra evidence, as counts and measured values only |
|
|
65
|
+
| Model backend | A language-model backend behind the same report shape, off by default; scores published separately per backend (see below) |
|
|
66
|
+
| Hosted demo | Public demo on seeded data only, token required, Tier 3 grant the only runnable action |
|
|
67
|
+
|
|
68
|
+
## Watch it: one alert in about a minute
|
|
69
|
+
|
|
70
|
+

|
|
71
|
+
|
|
72
|
+
A 74-second terminal recording of the walkthrough below, made from a real run of the shipped server (alert, diagnosis, approve, resolved) — output lines are shortened for the screen, and the values shown are the real replies, checked by the script that made it, [demo/make_walkthrough_recording.py](demo/make_walkthrough_recording.py). The pauses are reading pauses, not the agent's speed. Play the full recording with `asciinema play demo/walkthrough.cast` (the file is [demo/walkthrough.cast](demo/walkthrough.cast)).
|
|
73
|
+
|
|
74
|
+
## In plain English
|
|
75
|
+
|
|
76
|
+
When a production system breaks, an on-call engineer gets paged, opens five different tools, pieces together what happened, tries a fix, and checks it worked. Most of the time goes on figuring out what is wrong, not on the fix itself.
|
|
77
|
+
|
|
78
|
+
`sre-agent` does the figuring-out part automatically:
|
|
79
|
+
|
|
80
|
+
1. An alert arrives (from Prometheus/Alertmanager, or a generic webhook).
|
|
81
|
+
2. The agent gathers evidence — metrics, logs, the state of the service, what changed recently.
|
|
82
|
+
3. It writes a diagnosis where **every claim points at the evidence behind it**.
|
|
83
|
+
4. If a known fix applies, it proposes the exact action. A human approves it with one command. Only then does anything change.
|
|
84
|
+
5. Afterwards it drafts the postmortem from its own records.
|
|
85
|
+
|
|
86
|
+
The agent is never given free rein. It cannot run arbitrary commands, it can only use a small list of pre-approved fixes ("runbooks"), and every action — proposed, approved, or rejected — is written to an audit log before anything runs.
|
|
87
|
+
|
|
88
|
+
## Status
|
|
89
|
+
|
|
90
|
+
**Current version:** 0.2.0. Phases 0–10 are complete; Phase 11 (presentation and distribution) is in progress.
|
|
91
|
+
**What works today:** alert ingestion, evidence-cited diagnosis in the server, human-approved fixes, the Tier 3 demo grant, memory advice, read adapters, a database store, and a live hosted demo.
|
|
92
|
+
**Top scores (v0.2.0, deterministic backend):** chaos 5 of 5, regression PASS, injection 8 of 8, Tier 3 drills 7 of 7, security probes 10 of 10, 0 unsafe actions.
|
|
93
|
+
**One honest limit:** it does not manage real production systems yet — it is proven on seeded demo data, and the live adapters are untested against real systems.
|
|
94
|
+
The full history lives in [docs/progress.md](docs/progress.md) and [CHANGELOG.md](CHANGELOG.md); this section stays short on purpose.
|
|
95
|
+
|
|
96
|
+
## Try the hosted demo
|
|
97
|
+
|
|
98
|
+
The agent runs in public at **https://sre-agent-demo.onrender.com** — no install, nothing to set up. Every API route needs the visitor token, sent in the `X-SRE-Agent-Token` header: `sre-agent-demo-visitor`. (The landing page at the address itself and `/health` are open — they serve no data.) The token is public on purpose — [docs/hosted-demo.md](docs/hosted-demo.md) explains why that is safe here.
|
|
99
|
+
|
|
100
|
+
A visitor can: check `/health`; send the demo alert and read the evidence-cited diagnosis; watch the Tier 3 demo restart run (restart and scale, shop namespace only, at most three replicas); and close the incident with a resolved alert. What it cannot do is stated just as plainly: the data is seeded demo data, nothing real is touched, and rollback can never run there — it needs a human, and the hosted mode has no approval path at all. One free-plan limit: the service sleeps after about 15 minutes idle, so the first request can take a minute to wake it.
|
|
101
|
+
|
|
102
|
+
## Why build this in the open?
|
|
103
|
+
|
|
104
|
+
Reliability is the whole point of SRE, and the best proof of reliability is a public record. This repository is that record: a public plan, a public progress log, published test and evaluation scores with every release, and honest postmortems when the project itself breaks. If this agent claims it can be trusted, you can check.
|
|
105
|
+
|
|
106
|
+
## What it cannot do yet
|
|
107
|
+
|
|
108
|
+
Being straight about this matters more than hype:
|
|
109
|
+
|
|
110
|
+
- It does not manage real production systems yet. It is being proven in a local demo environment where failures are injected on purpose.
|
|
111
|
+
- Diagnosis is read-only first. Fixing things (with human approval) comes after the diagnosis is measurably good.
|
|
112
|
+
- Diagnosis does not need a language model: the default backend is plain rules that anyone can run with no API key. A language-model backend exists behind the same report shape, off by default, and this repository ships no real model client — an operator who wants one supplies their own client, provider and key in code. Its scores are published separately per backend in [docs/evaluation.md](docs/evaluation.md), and no real model has been scored, so no real model is recommended. A model may also propose a fix through a separate channel, under the same policy, tiers and audit log as any other proposal — a model can propose, never approve.
|
|
113
|
+
|
|
114
|
+
## Documents
|
|
115
|
+
|
|
116
|
+
Start with the map, then use the full list below it. Each
|
|
117
|
+
document has one job, so a reader does not have to guess
|
|
118
|
+
where a fact lives.
|
|
119
|
+
|
|
120
|
+
| You want to | Read | Its job |
|
|
121
|
+
|---|---|---|
|
|
122
|
+
| Get the pitch and start | This README | Pitch and start: what it is, the quickstart, and one alert end to end |
|
|
123
|
+
| Run it day to day | [docs/operator-guide.md](docs/operator-guide.md) | Run it: install, server, approvals, stopping it, troubleshooting |
|
|
124
|
+
| See the scores | [docs/evaluation.md](docs/evaluation.md) | Scores: the scenarios, the per-backend scores, and what is not scored |
|
|
125
|
+
| Check the safety case | [docs/security-review.md](docs/security-review.md) | Safety: what was attacked, what held, and the findings that remain |
|
|
126
|
+
| Follow what changed | [docs/progress.md](docs/progress.md) | Archive: the pass-by-pass plain-English history of the build |
|
|
127
|
+
|
|
128
|
+
Released walkthroughs are frozen release artefacts:
|
|
129
|
+
[docs/v0.1.0-walkthrough.md](docs/v0.1.0-walkthrough.md) and
|
|
130
|
+
[docs/v0.2.0-walkthrough.md](docs/v0.2.0-walkthrough.md) record
|
|
131
|
+
what was measured on their release day and are not updated
|
|
132
|
+
for later work. Current numbers live in
|
|
133
|
+
[docs/evaluation.md](docs/evaluation.md) and
|
|
134
|
+
[docs/progress.md](docs/progress.md).
|
|
135
|
+
|
|
136
|
+
- [White paper (PDF)](docs/whitepaper.pdf) — "The SRE agent you can audit": the design, the safety model, the evaluation results and the honest limits, in one document.
|
|
137
|
+
- [PLAN.md](PLAN.md) — the full plan: vision, architecture, safety model, roadmap, and the long-term open-core path.
|
|
138
|
+
- [docs/v0.1.0-walkthrough.md](docs/v0.1.0-walkthrough.md) — the v0.1.0 release notes and demo scenario walkthrough: what shipped, the scores measured on release day, and a step-by-step run through the scored scenario.
|
|
139
|
+
- [docs/v0.2.0-walkthrough.md](docs/v0.2.0-walkthrough.md) — the v0.2.0 release notes: what shipped since v0.1.0 (the Phase 6 hardening, the Phase 7 live path, the Phase 8 polish), the scores measured on release day, and the limits that ship with the release.
|
|
140
|
+
- [CHANGELOG.md](CHANGELOG.md) — every notable change, release by release, in plain words.
|
|
141
|
+
- [CONTRIBUTING.md](CONTRIBUTING.md) — how to help: setup, the checks every change must pass, and the safety rules that do not bend.
|
|
142
|
+
- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) — how we treat each other in this project's spaces.
|
|
143
|
+
- [SECURITY.md](SECURITY.md) — how to report a security problem privately, which versions are supported, and what is in and out of scope.
|
|
144
|
+
- [docs/security-review.md](docs/security-review.md) — the security review and red-team report on the agent itself: what was attacked, what held, and the findings that remain.
|
|
145
|
+
- [docs/operator-guide.md](docs/operator-guide.md) — running the agent day to day: install, server, CLI, approvals, stopping it, and the checks to run after any change.
|
|
146
|
+
- [docs/runbook-authoring-guide.md](docs/runbook-authoring-guide.md) — writing a new runbook: the four places that must agree, honest blast-radius counting, and the tests it must have.
|
|
147
|
+
- [docs/evaluation.md](docs/evaluation.md) — the evaluation harness: the five scenarios, what is scored, and what is not scored yet.
|
|
148
|
+
- [docs/demo.md](docs/demo.md) — the demo environment: what runs, how to start it, and how to break it on purpose.
|
|
149
|
+
- [docs/hosted-demo.md](docs/hosted-demo.md) — the public-safe hosted demo mode (Phase 10): a token is required with no fallback, seeded demo data only, the Tier 3 demo grant is the only action that can run, and the ingestion caps stay on. It also carries the deployment package: Render on the free plan ($0, named before anything is paid for), the `render.yaml` Blueprint and `Dockerfile.hosted`, deployed on Render's free plan at https://sre-agent-demo.onrender.com.
|
|
150
|
+
- [docs/how-it-works.md](docs/how-it-works.md) — the whole system explained simply.
|
|
151
|
+
- [docs/architecture.md](docs/architecture.md) — the technical design.
|
|
152
|
+
- [docs/safety-model.md](docs/safety-model.md) — how the agent is kept safe: tiers of autonomy, guardrails, threat model.
|
|
153
|
+
- [docs/progress.md](docs/progress.md) — the running plain-English log of what changed, pass by pass; the narrative archive for this project.
|
|
154
|
+
- [docs/publishing.md](docs/publishing.md) — publishing a release to PyPI and GHCR: the prepared workflow, the maintainer's exact trusted-publishing steps, and the read-backs that prove a publish happened.
|
|
155
|
+
|
|
156
|
+
## Quick start
|
|
157
|
+
|
|
158
|
+
One command, from a fresh clone (macOS and Linux; you need
|
|
159
|
+
Python 3.11 or newer):
|
|
160
|
+
|
|
161
|
+
```bash
|
|
162
|
+
git clone https://github.com/KakoozaJerry/sre-agent.git
|
|
163
|
+
cd sre-agent
|
|
164
|
+
./quickstart.sh
|
|
165
|
+
```
|
|
166
|
+
|
|
167
|
+
That is the whole install. The script makes a private Python
|
|
168
|
+
folder (`.venv`, nothing is installed system-wide), installs
|
|
169
|
+
`sre-agent` with its server parts from this source copy, and
|
|
170
|
+
then proves the install works: it prints the version, runs one
|
|
171
|
+
demo diagnosis, and runs the five scored chaos scenarios, which
|
|
172
|
+
must score 5 of 5. If any step fails, the script stops there and
|
|
173
|
+
says so — it never prints success for a step that did not pass.
|
|
174
|
+
It was verified from a clean environment (a fresh copy with no
|
|
175
|
+
`.venv` and no installed package) on 12 November 2026. Windows
|
|
176
|
+
users, and anyone who prefers step by step, can do the same
|
|
177
|
+
things by hand:
|
|
178
|
+
|
|
179
|
+
```bash
|
|
180
|
+
python -m venv .venv && source .venv/bin/activate
|
|
181
|
+
pip install -e ".[server]"
|
|
182
|
+
sre-agent diagnose
|
|
183
|
+
sre-agent evaluate
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
For development (the test tools as well), install
|
|
187
|
+
`pip install -e ".[dev,server]"` instead and run `pytest`.
|
|
188
|
+
|
|
189
|
+
### Installing as a user, not a contributor
|
|
190
|
+
|
|
191
|
+
The quickstart above is the contributor path: it installs
|
|
192
|
+
from a clone of this repository. There is no install of
|
|
193
|
+
this project from PyPI yet — and two names matter here:
|
|
194
|
+
|
|
195
|
+
**Do not run `pipx install sre-agent` expecting this
|
|
196
|
+
project.** The name `sre-agent` on PyPI already belongs to
|
|
197
|
+
a different SRE agent, published by Fuzzy Labs (checked on
|
|
198
|
+
PyPI on 13 November 2026: versions 0.1.0 to 0.2.1). That
|
|
199
|
+
command works today — and installs their agent, not this
|
|
200
|
+
one.
|
|
201
|
+
|
|
202
|
+
**This project's chosen PyPI name is `sre-agent-cli`.**
|
|
203
|
+
The first choice, `sreagent`, read as free on PyPI — and
|
|
204
|
+
PyPI refused it anyway when the maintainer set up
|
|
205
|
+
publishing, as too similar to the taken `sre-agent` above.
|
|
206
|
+
`sre-agent-cli` was chosen instead, and the package in
|
|
207
|
+
`pyproject.toml` now carries that name. When this project
|
|
208
|
+
is published, the user install will be
|
|
209
|
+
`pipx install sre-agent-cli` — and the command it installs
|
|
210
|
+
is still called `sre-agent`, because the distribution
|
|
211
|
+
name, the import package (`sre_agent`) and the command
|
|
212
|
+
name are three different things, and only the first one
|
|
213
|
+
changed.
|
|
214
|
+
|
|
215
|
+
That publication has not happened yet, so
|
|
216
|
+
`pipx install sre-agent-cli` does not work today either.
|
|
217
|
+
Until a release announces the publication, the quickstart
|
|
218
|
+
from source above is the only install path, and the hosted
|
|
219
|
+
demo needs no install at all. Publishing to PyPI, and
|
|
220
|
+
publishing the demo image to GHCR, are release steps that
|
|
221
|
+
need the maintainer's PyPI and GitHub settings, in the
|
|
222
|
+
same way creating a GitHub Release does.
|
|
223
|
+
|
|
224
|
+
## Walkthrough: one alert, end to end
|
|
225
|
+
|
|
226
|
+
This walkthrough needs no Docker and touches no real system.
|
|
227
|
+
It uses the server this project ships, which works from the
|
|
228
|
+
seeded demo data — the same made-up checkout picture that
|
|
229
|
+
`sre-agent diagnose` uses. Allow about five minutes. Do it
|
|
230
|
+
after the quickstart above, from the top folder of the clone;
|
|
231
|
+
the commands below put `.venv/bin/` in front of the tools —
|
|
232
|
+
if you installed by hand and your `.venv` is active, the plain
|
|
233
|
+
names (`sre-agent`, `uvicorn`) do the same thing.
|
|
234
|
+
|
|
235
|
+
**1. Start the server.** Leave this terminal open; the
|
|
236
|
+
server runs in it.
|
|
237
|
+
|
|
238
|
+
```bash
|
|
239
|
+
.venv/bin/uvicorn sre_agent.server:app --port 8080
|
|
240
|
+
```
|
|
241
|
+
|
|
242
|
+
In a second terminal, in the same folder, check it is up:
|
|
243
|
+
|
|
244
|
+
```bash
|
|
245
|
+
curl http://localhost:8080/health
|
|
246
|
+
# {"status":"ok"}
|
|
247
|
+
```
|
|
248
|
+
|
|
249
|
+
**2. Send an alert.** This is the simple webhook shape, for
|
|
250
|
+
the demo checkout service:
|
|
251
|
+
|
|
252
|
+
```bash
|
|
253
|
+
curl -X POST http://localhost:8080/webhooks/generic \
|
|
254
|
+
-H 'Content-Type: application/json' \
|
|
255
|
+
-d '{"alert_name":"HighErrorRate","service":"checkout","namespace":"shop","environment":"demo","summary":"Checkout errors are above 10%"}'
|
|
256
|
+
```
|
|
257
|
+
|
|
258
|
+
The reply says `"created": true`, `"status": "diagnosed"`,
|
|
259
|
+
and a diagnosis beginning "Most likely: A call that checkout
|
|
260
|
+
depends on is timing out". Copy the `"incident_id"` value
|
|
261
|
+
from the reply — the steps below call it `<incident-id>`.
|
|
262
|
+
|
|
263
|
+
**3. Read the diagnosis.**
|
|
264
|
+
|
|
265
|
+
```bash
|
|
266
|
+
.venv/bin/sre-agent incidents
|
|
267
|
+
.venv/bin/sre-agent show <incident-id>
|
|
268
|
+
```
|
|
269
|
+
|
|
270
|
+
`show` prints the incident in full: status `diagnosed`, the
|
|
271
|
+
diagnosis, the possible causes with their confidence, the
|
|
272
|
+
evidence behind them — eight records for this alert: the
|
|
273
|
+
alert itself, the service status, a log search, two metric
|
|
274
|
+
queries, and the three read adapters (Kubernetes pods,
|
|
275
|
+
Datadog, Azure Monitor) — each naming the exact query behind
|
|
276
|
+
it, and the memory advice, under a plain "advice only"
|
|
277
|
+
label. That advice is worked out after the diagnosis is
|
|
278
|
+
decided; it runs and approves nothing.
|
|
279
|
+
|
|
280
|
+
**4. Approve an action.** Propose the restart fix for this
|
|
281
|
+
incident (the proposal cannot name a target — it acts on
|
|
282
|
+
the target pinned on the incident):
|
|
283
|
+
|
|
284
|
+
```bash
|
|
285
|
+
curl -X POST http://localhost:8080/incidents/<incident-id>/actions \
|
|
286
|
+
-H 'Content-Type: application/json' \
|
|
287
|
+
-d '{"runbook_id":"restart-workload"}'
|
|
288
|
+
```
|
|
289
|
+
|
|
290
|
+
The reply is `201` with `"decision": "require_approval"` and
|
|
291
|
+
a `"pending"` block: copy its `"id"` as `<pending-id>`. It
|
|
292
|
+
touches 2 replicas and expires in 15 minutes. See what is
|
|
293
|
+
waiting, then approve it under your own name:
|
|
294
|
+
|
|
295
|
+
```bash
|
|
296
|
+
curl http://localhost:8080/incidents/<incident-id>/approvals
|
|
297
|
+
curl -X POST http://localhost:8080/incidents/<incident-id>/approvals/<pending-id>/approve \
|
|
298
|
+
-H 'Content-Type: application/json' \
|
|
299
|
+
-d '{"by":"your name"}'
|
|
300
|
+
```
|
|
301
|
+
|
|
302
|
+
(To turn it down instead, send the same name to the same
|
|
303
|
+
address ending in `/reject`; nothing then runs.) A successful
|
|
304
|
+
approval answers with the summary "Restarted checkout:
|
|
305
|
+
restarts now 1, failing state cleared." and
|
|
306
|
+
`"incident_status": "mitigating"`. Run
|
|
307
|
+
`.venv/bin/sre-agent show <incident-id>` again: the status is
|
|
308
|
+
`mitigating` and the evidence now holds a ninth record, the
|
|
309
|
+
action itself. The status is not `resolved` — running a fix
|
|
310
|
+
is not proof it worked, so the server does not claim that.
|
|
311
|
+
|
|
312
|
+
**5. Close it, and stop.** In a real setup the resolved
|
|
313
|
+
alert arrives from the monitoring tool; send it by hand:
|
|
314
|
+
|
|
315
|
+
```bash
|
|
316
|
+
curl -X POST http://localhost:8080/webhooks/generic \
|
|
317
|
+
-H 'Content-Type: application/json' \
|
|
318
|
+
-d '{"alert_name":"HighErrorRate","service":"checkout","namespace":"shop","environment":"demo","status":"resolved","summary":"Checkout errors are above 10%"}'
|
|
319
|
+
```
|
|
320
|
+
|
|
321
|
+
The reply says `"resolved": true`, and `show` now reads
|
|
322
|
+
`Status: resolved`. Stop the server with Ctrl-C in its
|
|
323
|
+
terminal. One honest limit: the shipped server keeps its
|
|
324
|
+
incidents in memory, so they are gone after that restart —
|
|
325
|
+
a server built in code can keep them in a database file
|
|
326
|
+
instead (see [docs/operator-guide.md](docs/operator-guide.md)).
|
|
327
|
+
|
|
328
|
+
The Docker Compose demo in [docs/demo.md](docs/demo.md) is a
|
|
329
|
+
separate path: it runs the pretend service, Prometheus and
|
|
330
|
+
Alertmanager for real, and its alert reaches this same
|
|
331
|
+
server — but the diagnosis there still comes from the seeded
|
|
332
|
+
demo data, not from the demo's live Prometheus.
|
|
333
|
+
|
|
334
|
+
After the walkthrough, try the command-line tool — with the
|
|
335
|
+
manual steps above, use the plain names; after
|
|
336
|
+
`./quickstart.sh`, put `.venv/bin/` in front of each one:
|
|
337
|
+
|
|
338
|
+
```bash
|
|
339
|
+
sre-agent diagnose # demo diagnosis, no server needed
|
|
340
|
+
uvicorn sre_agent.server:app --port 8080 # in another terminal: the server
|
|
341
|
+
sre-agent incidents # list what the server knows
|
|
342
|
+
sre-agent show <incident-id> # one incident, with its diagnosis
|
|
343
|
+
sre-agent postmortem-demo # a demo incident's postmortem draft
|
|
344
|
+
sre-agent evaluate # five chaos scenarios, scored
|
|
345
|
+
sre-agent regression-check # fresh scores vs the recorded baseline
|
|
346
|
+
sre-agent injection-check # hostile telemetry must change nothing
|
|
347
|
+
sre-agent tier3-check # Tier 3 drills + kill switch drills (demo)
|
|
348
|
+
sre-agent memory-demo # past incidents, runbook records, suggestions
|
|
349
|
+
sre-agent adapters-demo # Kubernetes pods, Datadog metrics, Azure KQL (all read-only)
|
|
350
|
+
sre-agent security-check # ten probes attack the agent itself; findings printed
|
|
351
|
+
```
|
|
352
|
+
|
|
353
|
+
## Contributing
|
|
354
|
+
|
|
355
|
+
Help is welcome. [CONTRIBUTING.md](CONTRIBUTING.md) covers
|
|
356
|
+
setup, the checks every change must pass, and the safety
|
|
357
|
+
rules that do not bend; [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
|
|
358
|
+
covers how we treat each other here. Bugs and ideas go
|
|
359
|
+
through the issue templates, and the changes in each release
|
|
360
|
+
are recorded in [CHANGELOG.md](CHANGELOG.md).
|
|
361
|
+
|
|
362
|
+
## Licence
|
|
363
|
+
|
|
364
|
+
MIT. The core of this project will always be open source.
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
sre_agent/__init__.py,sha256=9o9BQzyNsADlAWr0UWUkQzi4Q_3BLip92XtBuPXJ6Jg,96
|
|
2
|
+
sre_agent/adapters.py,sha256=JR1G3tA5EbHgUbbNuy1VsROJi8xnR3icjTIRdEg51gI,31271
|
|
3
|
+
sre_agent/approvals.py,sha256=HVlNJyWkU1aXnO6TtGef4q_-Rwz5CHStfIlRuxIswTE,9074
|
|
4
|
+
sre_agent/audit.py,sha256=leUFS_yghkPSh9dDprGFz7kmA3L8ivFl1l1fDcDTs4c,9376
|
|
5
|
+
sre_agent/backend_scores.py,sha256=0YhrZYMbJYOqvkciDnoNcFeWUNcKID9wDHGrtIEJTNU,6939
|
|
6
|
+
sre_agent/backend_url.py,sha256=sJlzc8gymlcOwA9VMe78akiEaOcjE1AZrXg2ERHTdqw,5696
|
|
7
|
+
sre_agent/cli.py,sha256=PnsLvMdQl4p_Kez1M3VKJHXQqIefzo3da6DolC3eq9M,32065
|
|
8
|
+
sre_agent/config.py,sha256=Qufb8PchHDbD2-r4JFcwuC4oNIl3iJVzk9zllmxFkpk,650
|
|
9
|
+
sre_agent/evaluation.py,sha256=qxzcRG_e4_lj90w12sws1BGJrDGRIvSg1ZXHJWYV6do,15311
|
|
10
|
+
sre_agent/evaluation_page.py,sha256=pdUiUGIrSVABhPom1FGuyxnV1IcwCEjZCzLVSj7pnlQ,7923
|
|
11
|
+
sre_agent/hosted_demo.py,sha256=t2n7wo9PDAItmEyqsF3wdEZruUoHQEB1exFWj02qGPE,6409
|
|
12
|
+
sre_agent/ingestion.py,sha256=R4x3tIzC9IfpjKaxBk7SuziUW5A1RrPqTq6BEd88Fcg,16929
|
|
13
|
+
sre_agent/injection.py,sha256=7ytoGfMmIj1D6cOTLp2YLbnCi9r0OJQZMbuImijIxlk,21287
|
|
14
|
+
sre_agent/logging_config.py,sha256=kKGoW7sxl3hQfunBwqb5mpf7QJlxlYACmGR-pAUDcuw,2750
|
|
15
|
+
sre_agent/memory.py,sha256=n1z_q5ZrLfxc3QEf2tdz3ifS9KR0oRbiT0n-br79tJk,16504
|
|
16
|
+
sre_agent/model_backend.py,sha256=Zs-DOW3W85L2KclSulzQZmlC0JG_NVswQAgOkGhnyIc,21666
|
|
17
|
+
sre_agent/model_proposals.py,sha256=_4h1P6psGVv1QdHbh_zwQZGl_pwDEMreoblVFyjyxnI,11099
|
|
18
|
+
sre_agent/models.py,sha256=WkqiY_xmmZdpxczqygits4lk5xTroIPbXO4sFOBEgEo,10324
|
|
19
|
+
sre_agent/policy.py,sha256=H2ZI-uPTmIM7g25EgwMYdL_daYEDz4NspTX0hDLZoqQ,7504
|
|
20
|
+
sre_agent/postmortems.py,sha256=TonL7n9l_vGadszz7IAIe3gh2OBxlSRLFAN0P7Dvr8c,10952
|
|
21
|
+
sre_agent/reasoning.py,sha256=LuJaBZXUFI26jP863_cTLKtz3IeOxoFeP1OmDa3t7_E,22663
|
|
22
|
+
sre_agent/regression.py,sha256=_pvdV5D0v-cJ4Wbp369NJe-vtqv4FvhLi9r56_xITVI,10089
|
|
23
|
+
sre_agent/runbooks.py,sha256=VKxw88Ggnf9OE2TRRwLNJdcq40-Vcu_FGicUK33vr9o,11167
|
|
24
|
+
sre_agent/security_review.py,sha256=YXN3zf6LPZA71YF0KtajDbkeE21XW65dRzteZbFPJyg,32358
|
|
25
|
+
sre_agent/server.py,sha256=CJOBP3aRZIT0XYdNQDFazZUeJ1ixlveOLZCpAGmUhKQ,28263
|
|
26
|
+
sre_agent/storage.py,sha256=fw3_VMILolp5bIVR9HA7wubAPPAMmnKoT3lmutwwj2g,9887
|
|
27
|
+
sre_agent/tier3.py,sha256=-aJmm8s_PNoIjnu-LOf-4itaIiwHVd62iBOqG8c8Ddg,16133
|
|
28
|
+
sre_agent/tools.py,sha256=OYvl0yT6-cbJmJkV7GGDBKOe4S-VBCLaHCr-j2K31gE,25785
|
|
29
|
+
sre_agent_cli-0.2.0.dist-info/licenses/LICENSE,sha256=aLAPh5bYuy4wY7Dwg2nJXxJ9967uHTNSMjE6OflOQco,1072
|
|
30
|
+
sre_agent_cli-0.2.0.dist-info/METADATA,sha256=jFfTlCGnjNQGYBaKKblrWc9XEIlSd5BbrBsiGOhFSKc,21897
|
|
31
|
+
sre_agent_cli-0.2.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
|
|
32
|
+
sre_agent_cli-0.2.0.dist-info/entry_points.txt,sha256=atpLWOIxCVYtW_6WKlT5oPv-Dqi37V9gcpIpSquezbM,49
|
|
33
|
+
sre_agent_cli-0.2.0.dist-info/top_level.txt,sha256=6xurYMYQumvVhN-f_VOQBnL5JpmrX6A35nJvxZOXuH0,10
|
|
34
|
+
sre_agent_cli-0.2.0.dist-info/RECORD,,
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Abraham Kakooza
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
sre_agent
|