“The useful question isn’t whether every light is green. It’s whether you understand what your systems are telling you.”
Our design principle
A calmer kind of operations
Keep shipping. Know what needs attention—and why.
A reliability partner being built to trace a signal back to its evidence, tell you what it couldn’t see, and hand a clear next step to the people who own the service.
- Observe with care
- Explain with evidence
- Protect what’s running
01 The reliability ledger
One accountable record,
from first signal to measured outcome.
Every link of the reliability loop exists somewhere. We’re joining them into one record you can audit: what fired, what the evidence said, who acted, whether the fix held, and what it cost your team.
Direction This is the loop we’re building toward, from v1 through v2. Parts are in preview today; each step below says which. All numbers are synthetic.
Ledger entry LE-0042Illustrative
- 01Objective burn6.1× fast burn
- 02Evidence4 of 6 sources
- 03Authorityask first
- 04Fix adoptedPR merged
- 05Recurrence0 of 5 · watching
- 06Owner time · cost35m · $0.84
Owner minutes, this loop35mNet human time arrives with v1.5. Until then, only what v1 can count.
-
It starts with an objective you agreed to.
In v1, burn alerts will compare a short and a long window against an objective you set. Paging stays deterministic: no model decides whether a page fires.
Error budget · 28-day windowIllustrative 1h window6.1×6h window2.4×Decided byRule, not model -
Evidence, with a map of what it couldn’t see.
Findings cite their evidence today. In v1, each will also show which sources were consulted, which were stale or missing, and how the conclusion could change, and “not enough evidence” becomes a valid answer, with the cheapest way to get more.
Coverage mapIllustrative - Deploy historyfresh · 2m
- Metricsfresh · 1m
- Runbooksread
- Past incidents3 similar
- Logsstale · 47m
- Tracesnot connected
If traces were connected: the pool-exhaustion finding could be confirmed per request instead of inferred from timing.
-
Authority is earned per action, and revocable.
Each action class will carry its own track record, promotion threshold and instant revocation, enforced outside the model. Confidence, silence or a stale approval will never grant authority.
Action classesIllustrative -
A fix your team adopts, in your repository.
The proposed change lands as a draft pull request in the owning repository, with a regression test that fails before and passes after. A human reviews and merges; the deploy is linked back to the record.
Draft pull requestIllustrative Mergedfix(pool): bound connection pool after deploy 418
- Regression test on the old code fails, as expected
- Regression test with the fix passes
- Reviewed and merged by a human owner
- Deploy linked to ledger entry LE-0042
-
Recurrence, measured over weeks.
We compare equal windows before and after the fix. One quiet window isn’t proof, so the watch stays open and the record says so.
Recurrences · equal 28-day windowsIllustrative Before fix5After fix · day 19 of 280 so far -
Owner time and cost, counted honestly.
In v1, each loop records the owner minutes and inference cost it actually took, from timestamps rather than surveys. Net human time (time saved minus setup, review, correction and false leads, reported per role) arrives with design partners in v1.5. If it comes out negative, you’ll see that too.
Owner time and cost · this entryIllustrative - Owner review of the finding25m
- Owner merge and deploy check10m
- Owner minutes, this loop35m
- Inference cost, this loop$0.84
- Net human timev1.5
Not yet measured: time saved needs comparable incidents from design partners, so this record shows only what v1 can actually count.
02 Partner, not replacement
Your team stays in command.
We do the legwork and show our work.
The principles every version is held to. Each card says where it stands today.
Paging stays deterministic v1
No model output decides whether a page fires. The investigator will annotate pages; grouping or suppressing them will need your explicit policy.
Abstains out loud v1
“Insufficient evidence” becomes a valid answer in v1, with what’s missing and the cheapest way to get it.
Shows its work Preview
Findings cite their evidence today; listing the alternatives considered, and why each was set aside, comes with v1.
Read-only by default Preview
It reads your systems and changes nothing without your merge. Handoffs will go to the people and agents who own a service. No surprise interventions.
You can always leave direction
Evidence, policies and lessons will stay exportable, and lessons will land as tests in your own CI, so they outlive us.
03 The journey
Honest about what’s shipped.
And clear about what’s direction.
- v0Shipped
Your fleet, in view
Dated health, unknowns and history in a private workspace.
- v0.1Preview
Investigations that cite
Findings with citations, cost and corrections.
- v1In progress
The accountable loop
One real SLO burn followed through an adopted fix, with recurrence and net cost measured.
- v1.5Direction
Design partners
Aim: a first cited finding within a day, without reshaping your workflow.
- v2Direction
Earned action
Delegate specific reversible actions, with instant revocation.
- GADirection
Open to everyone
Adopt, pay, operate and leave predictably.
Each version has a finite gate, and we aim to claim only what we’ve measured.
Build something great.
Keep it running with care.
Your infrastructure belongs behind your login.
Enter your workspace