Skip to content

Shadewright

Shadewright

A Kubernetes operator that diagnoses incidents with an LLM and proposes fixes only as reviewed GitOps pull requests.

Read the design Decisions GitHub

Shadewright watches your cluster, groups repeated symptoms into incidents, asks an LLM for a diagnosis, and proposes a fix as a pull request to your GitOps repository. It never changes the cluster directly: your review rules decide what merges, and your GitOps controller delivers it.

Early design

Nothing is implemented yet. This site holds the design and the decisions behind it.

How it works

  • 1. Observe

    Events and object status in the namespaces you choose, deduplicated into incidents.

  • 2. Diagnose

    Rules first, then a model with read-only tools and redacted context. No evidence, no proposal.

  • 3. Propose

    A typed RemediationRequest from a closed catalog of actions, checked by deterministic policy.

  • 4. Open a PR

    On a branch, in the one repository it may write to, with the evidence and a rollback plan.

  • 5. Verify

    After merge, it follows Flux to the applied revision and checks that the symptom is gone.

Principles

  • The model's answer is never authorization.
  • Every change is a reviewed, revertible commit.
  • Everything read from the cluster is untrusted input.
  • Separate, short-lived identities for analysis and for Git.

Repositories