Directories
¶
| Path | Synopsis |
|---|---|
|
Package action gates proposed remediations against the autonomy-ladder policy (config.actions: off | suggest | approve | auto).
|
Package action gates proposed remediations against the autonomy-ladder policy (config.actions: off | suggest | approve | auto). |
|
Package app holds the dependency-injection builders and config predicates that assemble the RunLore agent.
|
Package app holds the dependency-injection builders and config predicates that assemble the RunLore agent. |
|
Package audit provides an append-only, tamper-evident record of every action the agent attempts — the accountability backbone for the autonomy ladder.
|
Package audit provides an append-only, tamper-evident record of every action the agent attempts — the accountability backbone for the autonomy ladder. |
|
Package catalog loads and searches an OKF knowledge catalog (a directory of markdown files with YAML frontmatter) — the read half of RunLore's Learn pillar.
|
Package catalog loads and searches an OKF knowledge catalog (a directory of markdown files with YAML frontmatter) — the read half of RunLore's Learn pillar. |
|
Package coalesce folds correlated Alertmanager incidents into a single investigation, suppressing the redundant per-alert investigations a storm would otherwise spawn.
|
Package coalesce folds correlated Alertmanager incidents into a single investigation, suppressing the redundant per-alert investigations a storm would otherwise spawn. |
|
Package config defines RunLore's configuration, including provider wiring and the trigger policy that decides which incidents start an investigation.
|
Package config defines RunLore's configuration, including provider wiring and the trigger policy that decides which incidents start an investigation. |
|
Package curate is the Phase-2 grooming agent: it dedups the KB backlog, gates the decision-ready queue on incident resolution, surfaces recurring blind spots as knowledge-gap issues, and drives lifecycle/decay.
|
Package curate is the Phase-2 grooming agent: it dedups the KB backlog, gates the decision-ready queue on incident resolution, surfaces recurring blind spots as knowledge-gap issues, and drives lifecycle/decay. |
|
Package curator is the file-time learning gate: it dedups a finding against the catalog and open PRs, gates on quality, and drafts a merge-ready PR for novel, quality findings.
|
Package curator is the file-time learning gate: it dedups a finding against the catalog and open PRs, gates on quality, and drafts a merge-ready PR for novel, quality findings. |
|
Package embed provides an OpenAI-compatible embeddings client and the similarity + fusion primitives for hybrid (BM25 + vector) catalog retrieval.
|
Package embed provides an OpenAI-compatible embeddings client and the similarity + fusion primitives for hybrid (BM25 + vector) catalog retrieval. |
|
Package eval replays recorded incident cases through the investigation loop and scores whether the agent identifies the root cause — a reproducible RCA benchmark (cf.
|
Package eval replays recorded incident cases through the investigation loop and scores whether the agent identifies the root cause — a reproducible RCA benchmark (cf. |
|
executor
|
|
|
flux
Package flux executes safe, reversible Flux operations (suspend / resume / reconcile) on the cluster — the executable half of the autonomy ladder.
|
Package flux executes safe, reversible Flux operations (suspend / resume / reconcile) on the cluster — the executable half of the autonomy ladder. |
|
forge
|
|
|
github
Package github is RunLore's GitHub forge client (curation + re-investigation) over the GitHub REST API, authenticated with short-lived GitHub App installation tokens.
|
Package github is RunLore's GitHub forge client (curation + re-investigation) over the GitHub REST API, authenticated with short-lived GitHub App installation tokens. |
|
Package httpx provides small HTTP helpers shared across providers.
|
Package httpx provides small HTTP helpers shared across providers. |
|
Package investigate routes triggers (incident alerts, GitOps failures) into a single async investigation queue.
|
Package investigate routes triggers (incident alerts, GitOps failures) into a single async investigation queue. |
|
Package kbvalidate provides deterministic structural validation of OKF knowledge-base entries (the merge gate) and an LLM-assisted semantic advisory.
|
Package kbvalidate provides deterministic structural validation of OKF knowledge-base entries (the merge gate) and an LLM-assisted semantic advisory. |
|
Package logging builds RunLore's slog logger with a configurable output format (human-readable text or structured JSON) and verbosity level.
|
Package logging builds RunLore's slog logger with a configurable output format (human-readable text or structured JSON) and verbosity level. |
|
logs
|
|
|
victorialogs
Package victorialogs implements providers.LogsProvider against VictoriaLogs, querying with LogsQL and normalizing the NDJSON response into log lines.
|
Package victorialogs implements providers.LogsProvider against VictoriaLogs, querying with LogsQL and normalizing the NDJSON response into log lines. |
|
Package mcp is a minimal Model Context Protocol server over the stdio transport (newline-delimited JSON-RPC 2.0) — enough to expose RunLore tools to MCP clients such as HolmesGPT, kagent, or Claude Desktop.
|
Package mcp is a minimal Model Context Protocol server over the stdio transport (newline-delimited JSON-RPC 2.0) — enough to expose RunLore tools to MCP clients such as HolmesGPT, kagent, or Claude Desktop. |
|
metrics
|
|
|
prometheus
Package prometheus implements providers.MetricsProvider against the Prometheus HTTP API — also spoken by VictoriaMetrics — for instant and range PromQL queries.
|
Package prometheus implements providers.MetricsProvider against the Prometheus HTTP API — also spoken by VictoriaMetrics — for instant and range PromQL queries. |
|
model
|
|
|
anthropic
Package anthropic implements providers.ModelProvider against the Anthropic Messages API (native tool use).
|
Package anthropic implements providers.ModelProvider against the Anthropic Messages API (native tool use). |
|
gemini
Package gemini implements providers.ModelProvider against the Gemini API (generateContent with native function calling).
|
Package gemini implements providers.ModelProvider against the Gemini API (generateContent with native function calling). |
|
openai
Package openai implements providers.ModelProvider against an OpenAI-compatible /chat/completions endpoint (OpenAI, in-cluster vLLM, Ollama, OpenRouter).
|
Package openai implements providers.ModelProvider against an OpenAI-compatible /chat/completions endpoint (OpenAI, in-cluster vLLM, Ollama, OpenRouter). |
|
network
|
|
|
awsvpc
Package awsvpc implements providers.NetworkProvider against AWS VPC Flow Logs delivered to a CloudWatch Logs group, surfacing REJECT (denied) flows for an investigation.
|
Package awsvpc implements providers.NetworkProvider against AWS VPC Flow Logs delivered to a CloudWatch Logs group, surfacing REJECT (denied) flows for an investigation. |
|
gcpfirewall
Package gcpfirewall implements providers.NetworkProvider against GCP Firewall Rules Logging, surfacing DENIED connections for an investigation.
|
Package gcpfirewall implements providers.NetworkProvider against GCP Firewall Rules Logging, surfacing DENIED connections for an investigation. |
|
hubble
Package hubble implements providers.NetworkProvider against Cilium Hubble Relay (the observer gRPC API), surfacing dropped flows for an investigation.
|
Package hubble implements providers.NetworkProvider against Cilium Hubble Relay (the observer gRPC API), surfacing dropped flows for an investigation. |
|
Package notify delivers completed investigations to chat (Slack, Matrix).
|
Package notify delivers completed investigations to chat (Slack, Matrix). |
|
webhook
Package webhook is a generic outgoing-webhook notifier: it POSTs each investigation's findings as JSON to an operator-configured URL.
|
Package webhook is a generic outgoing-webhook notifier: it POSTs each investigation's findings as JSON to an operator-configured URL. |
|
Package outcome records, in an append-only JSONL ledger, whether an investigated incident later resolved and which answer was used for it — the "did it actually work?" signal the learning loop reads.
|
Package outcome records, in an append-only JSONL ledger, whether an investigated incident later resolved and which answer was used for it — the "did it actually work?" signal the learning loop reads. |
|
Package providers defines the pluggable backend contracts RunLore is built on.
|
Package providers defines the pluggable backend contracts RunLore is built on. |
|
cloud/aws
Package aws implements providers.CloudProvider against AWS using aws-sdk-go-v2 and in-cluster identity (EKS Pod Identity / IRSA, resolved by the SDK's default credential chain).
|
Package aws implements providers.CloudProvider against AWS using aws-sdk-go-v2 and in-cluster identity (EKS Pod Identity / IRSA, resolved by the SDK's default credential chain). |
|
cluster
Package cluster reads Kubernetes pod logs for investigation (read-only) via the client-go CoreV1 GetLogs API.
|
Package cluster reads Kubernetes pod logs for investigation (read-only) via the client-go CoreV1 GetLogs API. |
|
gitops/argocd
Package argocd implements providers.GitOpsProvider for Argo CD: it reads Argo CD Applications from the cluster and emits engine-agnostic Changes (diffable via whatchanged.Differ) and failure events — the same contract as the flux package.
|
Package argocd implements providers.GitOpsProvider for Argo CD: it reads Argo CD Applications from the cluster and emits engine-agnostic Changes (diffable via whatchanged.Differ) and failure events — the same contract as the flux package. |
|
gitops/flux
Package flux implements providers.GitOpsProvider for Flux: it reads Flux Kustomizations and their GitRepository sources from the cluster and emits engine-agnostic Changes, each diffable through whatchanged.Differ.
|
Package flux implements providers.GitOpsProvider for Flux: it reads Flux Kustomizations and their GitRepository sources from the cluster and emits engine-agnostic Changes, each diffable through whatchanged.Differ. |
|
Package ratelimit provides a sliding-window start limiter — the windowed timestamp pattern from internal/action/auto.go:reserve(), reusable.
|
Package ratelimit provides a sliding-window start limiter — the windowed timestamp pattern from internal/action/auto.go:reserve(), reusable. |
|
Package redact masks secret-shaped values in free text before it crosses a trust boundary — specifically before tool output (pod/controller logs, git diffs, status/event messages) is fed to the LLM provider, from where the model's quoted evidence would otherwise flow on into a (possibly public) KB pull request and chat.
|
Package redact masks secret-shaped values in free text before it crosses a trust boundary — specifically before tool output (pod/controller logs, git diffs, status/event messages) is fed to the LLM provider, from where the model's quoted evidence would otherwise flow on into a (possibly public) KB pull request and chat. |
|
Package server exposes RunLore's HTTP endpoints (incident webhooks).
|
Package server exposes RunLore's HTTP endpoints (incident webhooks). |
|
Package source registers event-source adapters and runs their core-owned transports.
|
Package source registers event-source adapters and runs their core-owned transports. |
|
alertmanager
Package alertmanager is the Alertmanager/VMAlert webhook source adapter.
|
Package alertmanager is the Alertmanager/VMAlert webhook source adapter. |
|
gitops
Package gitops is the GitOps-failure watcher source adapter (Flux/Argo CD).
|
Package gitops is the GitOps-failure watcher source adapter (Flux/Argo CD). |
|
Package telemetry provides RunLore's self-instrumentation: an OpenTelemetry metric set plus a Prometheus-exporter HTTP handler.
|
Package telemetry provides RunLore's self-instrumentation: an OpenTelemetry metric set plus a Prometheus-exporter HTTP handler. |
|
Package trigger ingests incidents (Alertmanager/VMAlert webhooks) and decides, per the configured policy, which ones start an investigation.
|
Package trigger ingests incidents (Alertmanager/VMAlert webhooks) and decides, per the configured policy, which ones start an investigation. |
|
Package whatchanged produces the "what changed" delta between two GitOps revisions: a path-scoped unified diff (the actual landed change).
|
Package whatchanged produces the "what changed" delta between two GitOps revisions: a path-scoped unified diff (the actual landed change). |
Click to show internal directories.
Click to hide internal directories.