Skip to content

F14.5: Local advisory Investigation Brain (R1–R6 over reachable lenses) #48

Description

@gnanirahulnutakki

Part of epic #46 (E14 — Investigation Brain) — feature F14.5. Milestone: Phase L (day-0 adoption wedge). Ships the local advisory subset of the brain over the locally-reachable lenses.

Spec. docs/specs/E2-readfed-brain-integrations.md §3.6 (one brain, two modes) + §3.4 (rules) + §5 (local/hub line) (PR #43).

What it is

The advisory face of the Investigation Brain in the local wedge: run the deterministic rule pipeline over the fleet model built from kubeconfig contexts, and render each verdict as a suggested command / PR diff the user runs themselves — no governed dispatch, no PEP, no autonomy (it is the user's own kubeconfig identity). Same rules, same schema, same pipeline, same graph as the hub brain; only the plan renderer and the gating differ (advisory vs governed).

Scope (Phase-L subset)

  • Rule engine + the six canonical rules R1–R6 running over the locally-reachable lenses:
    • LIVE / DESIRED / TIMELINE from kubeconfig-reachable K8s API + in-cluster Argo/Helm CRDs + Events/rollout history.
    • TELEMETRY query-through to reachable in-cluster Prometheus/Loki (port-forward / API proxy) when available; abstain cleanly when not (spec §3.6, §7.2 decision 2).
  • Advisory plan renderer — emits e.g. kubectl rollout undo deploy/web -n prod or a suggested PR diff; never dispatches a typed intent or routes through any PEP/intent path (asserted by test — advisory output must not touch a write code path).
  • Coverage gate / abstention (F2.5): missing/stale required lens ⇒ report the finding unconfirmed with the missing lens named.

Depends on

Honest Phase-L limit. Without a server-side telemetry connector, R2/R6 often reach only a detect (not confident) verdict locally, and R3 needs a reachable log store for confidence. That is expected and surfaced via abstention, not hidden — the coverage map is in the E2 spec §4.3.

Acceptance criteria

  • sith surfaces a brain verdict for a Degraded/crashing workload: top hypothesis + cited signals + a suggested command/PR (advisory), on a seeded local fixture, for at least R1–R4.
  • The advisory output never dispatches a typed intent or routes through any intent/PEP path (code-level boundary test).
  • With a required lens made stale/unreachable, the finding is reported unconfirmed with the missing lens named (abstention, never a false-confident verdict).
  • Telemetry-dependent variants (R2 leak-vs-spike, R6 quantify) abstain cleanly when no reachable Prom/Loki, while still reporting the LIVE-confirmed detection (OOMKill / node pressure).
  • Fleet correlation: when the same image digest is unhealthy across ≥ 2 local contexts, the fleet-wide hypothesis is surfaced ahead of any per-cluster one.

Advances the bar. The wedge ships "k9s for your whole fleet that also tells you why payments is down" — the deterministic, offline differentiator the AI-SRE wave structurally cannot occupy (research T2). The same rules, in the hub, become governed remediation (F14.6).


Source: docs/specs/E2-readfed-brain-integrations.md §3.6/§5 (PR #43) · docs/research/MARKET-RESEARCH-2026-07.md (T2). Related: E14 epic, #38/#32 (Slice 1), #33 (Slice 2), #20 (E2 graph).

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureFeature / child issueinvestigation-brainDeterministic, rule-based, abstaining root-cause (E14)local-modeLocal fleet client / adoption wedgephase-LPhase L: local mode (day 0 adoption wedge)

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions