[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93174":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":13,"lastSyncTime":25,"discoverSource":26},93174,"luxy-aisre","CoscoAI\u002Fluxy-aisre","CoscoAI","AISRE for Cosco",null,"Python",395,11,2,0,242,53.24,"Other",false,"main",true,[],"2026-07-23 04:02:09","# luxy-aisre\n\n[![Python](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPython-3.14+-3776AB?logo=python&logoColor=white)](#quick-start)\n[![TypeScript](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FTypeScript-5.x-3178C6?logo=typescript&logoColor=white)](#development)\n[![Kubernetes](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FKubernetes-ready-326CE5?logo=kubernetes&logoColor=white)](#kubernetes-deployment)\n[![Docker](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FDocker-luxy--aisre-2496ED?logo=docker&logoColor=white)](#docker)\n[![Langfuse](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLangfuse-optional-111827)](#langfuse)\n[![License](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-PolyForm%20Noncommercial-red)](#license)\n\nAgenticOps for Kubernetes and cloud infrastructure.  \n`luxy-aisre` turns alerts, events, logs, topology, runbooks, model calls, and human approvals into one SRE workflow: discover, diagnose, preview, approve, execute, verify, and learn.\n\nCurrent release: **3.1.0**.\n\nCreated by **陆宣宇**.\n\n![Architecture](docs\u002FCOSCOAI-AIOps-平台架构与运行拓扑.png)\n\n## Product Preview\n\nThe screenshots below are captured from the actual console.\n\n### SRE Chat: problems find the operator\n\n![SRE Chat home](docs\u002Fassets\u002Fscreenshots\u002Fsre-chat-home.png)\n\n### Evidence-driven remediation plan\n\n![SRE remediation plan](docs\u002Fassets\u002Fscreenshots\u002Fsre-remediation-plan.png)\n\n### Human-approved execution and recovery verification\n\n![SRE recovery verification](docs\u002Fassets\u002Fscreenshots\u002Fsre-recovery-verification.png)\n\n### Topology impact and blast-radius analysis\n\n![Topology impact](docs\u002Fassets\u002Fscreenshots\u002Ftopology-impact.png)\n\n### Scheduled inspection and risk queue\n\n![AI inspection queue](docs\u002Fassets\u002Fscreenshots\u002Fai-inspection.png)\n\n## Why This Exists\n\nModern cloud systems fail in ways that are hard to reason about from a single log line:\n\n- a Pod restart can hide a PVC, image, scheduling, network, quota, or rollout issue;\n- a small workload change can affect services, data pipelines, middleware, and downstream users;\n- repeated human firefighting leaves valuable operational knowledge outside the platform;\n- model output is useful only when it is constrained by evidence, policy, permissions, and rollback.\n\n`luxy-aisre` is built as an SRE control plane. It uses a model as a planner and explainer, but the platform keeps the execution boundary: RBAC, action catalog, dry-run, approval, audit, and recovery verification.\n\n## Core Features\n\n- **SRE Chat**: ChatGPT-style operations console with cluster, namespace, workload, and risk context.\n- **Inspection Queue**: scheduled or manual scans across Rancher\u002FKubernetes scopes with severity ranking.\n- **Controlled Remediation**: evidence collection, change preview, human approval, execution, post-change verification, and evidence-driven replanning when the first strategy fails.\n- **Topology Impact**: 2D\u002F3D topology, CMDB-style dependencies, eBPF\u002Fdata-flow adapters, blast-radius analysis.\n- **Release Governance**: SLO, error budget, canary\u002Frisk gate, emergency fix path, and release audit chain.\n- **Skills Library**: portable operation skills that encode expert knowledge and can be reused by other agents.\n- **Knowledge Base**: upload text, Markdown, PDF, Word, Excel, logs, YAML, and runbooks for operations RAG.\n- **Model Lab**: configure multiple OpenAI-compatible or OAuth-protected model gateways and compare outcomes.\n- **Observability**: Prometheus metrics, Loki logs, Tempo traces, Grafana links, and optional Langfuse traces.\n- **Extensible Infrastructure**: adapters for Kubernetes, Rancher, databases, virtual machines, storage, and middleware.\n\n## Architecture\n\n```text\nFrontend Console\n  ├─ SRE Chat \u002F Inspection \u002F Topology \u002F Release \u002F Skills \u002F Models\n  │\n  ▼\nControl Plane API\n  ├─ Evidence pipeline\n  ├─ Remediation job state machine\n  ├─ Release gate and SLO budget\n  ├─ Knowledge and model registries\n  ├─ Observability store\n  └─ Integration health checks\n  │\n  ├─ MCP Kubernetes tools\n  ├─ A2A healing \u002F incident \u002F postmortem agents\n  ├─ Rancher \u002F Prometheus \u002F CMDB \u002F eBPF flow adapters\n  ├─ Langfuse \u002F Loki \u002F Tempo \u002F Grafana adapters\n  └─ Optional private algorithm extension\n```\n\n## Quick Start\n\n### 1. Clone\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FCoscoAI\u002Fluxy-aisre.git\ncd luxy-aisre\n```\n\n### 2. Configure\n\n```bash\ncp .env.example .env\n```\n\nFor a simple local OpenAI-compatible endpoint:\n\n```env\nLLM_API_BASE=http:\u002F\u002Flocalhost:11434\u002Fv1\nLLM_API_KEY=ollama\nLLM_MODEL=qwen2.5:7b\nLLM_AUTH_TYPE=api_key\n```\n\nFor an OAuth client-credentials gateway:\n\n```env\nLLM_AUTH_TYPE=oauth_client_credentials\nOAUTH_TOKEN_URL=https:\u002F\u002Fyour-iam\u002Frealms\u002Fmain\u002Fprotocol\u002Fopenid-connect\u002Ftoken\nOAUTH_CLIENT_ID=your-client\nOAUTH_CLIENT_SECRET=your-secret\nLLM_API_BASE=https:\u002F\u002Fyour-llm-gateway\u002Fengines\u002Fdefault\nLLM_MODEL=your-model\nLLM_VERIFY_SSL=true\n```\n\n### 3. Build the Console\n\n```bash\ncd frontend\u002Fmodern\nnpm install\nnpm run build\ncd ..\u002F..\n```\n\nThe build outputs to `frontend\u002Fdist`, which is served by the Python control plane.\n\n### 4. Run Locally\n\n```bash\npython -m venv .venv\nsource .venv\u002Fbin\u002Factivate\npip install -r requirements.txt\n\nuvicorn backend.app.main:app --host 0.0.0.0 --port 8080\n```\n\nOpen `http:\u002F\u002Flocalhost:8080`.\n\nFor local agent compatibility ports:\n\n```bash\nuvicorn agents.observability_agent:app --host 0.0.0.0 --port 8100 &\nuvicorn agents.healing_agent:app --host 0.0.0.0 --port 8101 &\nuvicorn agents.incident_agent:app --host 0.0.0.0 --port 8102 &\nuvicorn agents.postmortem_agent:app --host 0.0.0.0 --port 8103 &\nuvicorn mcp_servers.mcp_http_server:app --host 0.0.0.0 --port 8105 &\nuvicorn openwebui.openwebui_adapter:app --host 0.0.0.0 --port 8200 &\n```\n\n## Docker\n\nBuild the all-in-one backend image:\n\n```bash\ndocker build --target backend-runtime -t luxy-aisre:latest .\n```\n\nRun it locally:\n\n```bash\ndocker run --rm \\\n  --env-file .env \\\n  -p 8080:8080 \\\n  luxy-aisre:latest \\\n  python -m uvicorn backend.app.main:app --host 0.0.0.0 --port 8080\n```\n\nPush to GHCR or an internal registry:\n\n```bash\nIMAGE=ghcr.io\u002Fcoscoai\u002Fluxy-aisre:latest .\u002Fscripts\u002Fbuild-push.sh\n```\n\nFor air-gapped or China mainland networks, the `Dockerfile` and `scripts\u002Fbuild-push.sh` already expose mirror build args:\n\n```bash\nNODE_IMAGE=docker.m.daocloud.io\u002Flibrary\u002Fnode:24-slim \\\nPYTHON_IMAGE=docker.m.daocloud.io\u002Flibrary\u002Fpython:3.14.6-slim \\\nNPM_REGISTRY=https:\u002F\u002Fregistry.npmmirror.com \\\nPIP_INDEX_URL=https:\u002F\u002Fmirrors.aliyun.com\u002Fpypi\u002Fsimple \\\nIMAGE=your-registry\u002Fluxy-aisre:latest \\\n.\u002Fscripts\u002Fbuild-push.sh\n```\n\n## Kubernetes Deployment\n\n### Recommended: Helm\n\nThe chart installs the control plane, six agent services, controlled cluster-wide\nRBAC, Huawei NAS persistence, NodePort access, optional Ingress, and Secret hooks:\n\n```bash\nkubectl create namespace k8s-agent\n\nhelm upgrade --install coscoai-sre .\u002Fcharts\u002Fcoscoai-sre \\\n  --namespace k8s-agent \\\n  --set image.repository='\u003Cinternal-registry>\u002Fcoscoai\u002Fluxy-aisre' \\\n  --set image.tag='\u003Crelease-tag>' \\\n  --set persistence.storageClass=huawei-storageclass-k8snas\n```\n\nUse `rbac.mode=controlled` in production. `rbac.mode=cluster-admin` exists only\nfor isolated validation environments and should require a security exception.\n\nRender and review before deployment:\n\n```bash\nhelm lint .\u002Fcharts\u002Fcoscoai-sre --strict\nhelm template coscoai-sre .\u002Fcharts\u002Fcoscoai-sre -n k8s-agent > rendered.yaml\n```\n\n### Raw Manifests\n\n#### 1. Create Namespace\n\n```bash\nkubectl create namespace k8s-agent\n```\n\n#### 2. Create Secrets\n\nDo not commit real secrets. Create them from your terminal or secret manager:\n\n```bash\nkubectl -n k8s-agent create secret generic k8s-agent-oauth \\\n  --from-literal=OAUTH_CLIENT_ID='\u003Cclient-id>' \\\n  --from-literal=OAUTH_CLIENT_SECRET='\u003Cclient-secret>' \\\n  --from-literal=RANCHER_TOKEN='\u003Coptional-rancher-token>'\n```\n\nFor Langfuse:\n\n```bash\nkubectl -n k8s-agent create secret generic k8s-agent-langfuse \\\n  --from-literal=public-key='\u003Cpk-lf-...>' \\\n  --from-literal=secret-key='\u003Csk-lf-...>'\n```\n\nAdministrator configuration is disabled by default. The password must never be\nstored in `values.yaml`, a ConfigMap, or the repository:\n\n```bash\nkubectl -n k8s-agent create secret generic luxy-aisre-console-auth \\\n  --from-literal=CONSOLE_BASIC_AUTH_USERNAME='admin' \\\n  --from-literal=CONSOLE_BASIC_AUTH_PASSWORD='\u003Cpassword-from-vault>'\n\nhelm upgrade --install coscoai-sre .\u002Fcharts\u002Fcoscoai-sre \\\n  -n k8s-agent \\\n  --reuse-values \\\n  --set admin.enabled=true\n```\n\nWhen admin mode is off, the console remains readable and operational approvals\ncontinue to work, but model, knowledge, and Skill writes are blocked. When it is\non, those three write surfaces require the Secret-backed administrator identity.\n\n#### 3. Configure Runtime\n\nEdit `manifests\u002Fdeployment.yaml`:\n\n- `LLM_AUTH_TYPE`\n- `OAUTH_TOKEN_URL`\n- `LLM_API_BASE` \u002F `LLM_GATEWAY_BASE`\n- `LLM_MODEL`\n- `PROMETHEUS_URL`\n- `CMDB_URL`\n- `RANCHER_URL`\n- `RANCHER_CLUSTER_IDS`\n- `ALLOWED_NAMESPACES`\n- `OPS_MUTATION_ENABLED`\n- `AUTO_HEALING_ENABLED`\n\n#### 4. Apply Manifests\n\n```bash\nkubectl apply -f manifests\u002Frbac.yaml\nkubectl apply -f manifests\u002Fdeployment.yaml\nkubectl apply -f manifests\u002Ffrontend.yaml\n```\n\nThe default service exposes the console through NodePort `30080`:\n\n```bash\nkubectl get svc -n k8s-agent\n```\n\nFor production, use your company Ingress\u002FGateway with TLS and identity middleware instead of exposing an unauthenticated public NodePort.\n\n## Model Configuration\n\n`luxy-aisre` supports two common model access patterns.\n\n### OAuth Token URL + Base URL\n\nUse this when your gateway requires a dynamic bearer token:\n\n```json\n[\n  {\n    \"id\": \"primary\",\n    \"provider\": \"oauth-gateway\",\n    \"model\": \"your-model\",\n    \"base_url\": \"https:\u002F\u002Fyour-gateway\u002Fengines\u002Fdefault\",\n    \"auth_type\": \"oauth_client_credentials\",\n    \"token_url\": \"https:\u002F\u002Fyour-iam\u002Ftoken\",\n    \"client_id\": \"your-client\",\n    \"client_secret\": \"from-secret\",\n    \"role\": \"primary\",\n    \"max_tokens\": 4096,\n    \"verify_ssl\": true\n  }\n]\n```\n\n### Base URL + API Key\n\nUse this for OpenAI-compatible providers:\n\n```json\n[\n  {\n    \"id\": \"openai-compatible\",\n    \"provider\": \"openai-compatible\",\n    \"model\": \"your-model\",\n    \"base_url\": \"https:\u002F\u002Fapi.example.com\u002Fv1\",\n    \"auth_type\": \"api_key\",\n    \"api_key\": \"from-secret\",\n    \"role\": \"candidate\",\n    \"max_tokens\": 4096\n  }\n]\n```\n\nSet the JSON in `MODEL_PROFILES_JSON` or add models from the **Model Lab** page. Secrets should come from Kubernetes Secret or your enterprise secret platform.\n\n## Langfuse\n\nLangfuse is optional. When configured, the platform records model calls, latency, token usage, cost estimates, tool spans, quality scores, and trace IDs.\n\nEnvironment variables:\n\n```env\nLANGFUSE_ENABLED=true\nLANGFUSE_HOST=http:\u002F\u002Flangfuse-web.langfuse.svc.cluster.local:3000\nLANGFUSE_PUBLIC_KEY=pk-lf-...\nLANGFUSE_SECRET_KEY=sk-lf-...\n```\n\nDeployment references:\n\n- Docker Compose: https:\u002F\u002Flangfuse.com\u002Fself-hosting\u002Fdeployment\u002Fdocker-compose\n- Kubernetes Helm: https:\u002F\u002Flangfuse.com\u002Fself-hosting\u002Fdeployment\u002Fkubernetes-helm\n\nThis repository also contains `manifests\u002Flangfuse-local.yaml` as a local reference manifest. It is ignored by Git by default because production Langfuse credentials and storage settings should be managed separately.\n\n## Private Algorithm Extension\n\nThe public repository includes a runnable baseline algorithm module at `agents\u002Faiops_algorithms.py`.\n\nIf you have a private scoring implementation, keep it outside the repository and load it at runtime:\n\n```bash\nexport COSCOAI_PRIVATE_ALGORITHM_PATH=.local\u002Fprivate_algorithms\u002Faiops_algorithms_private.py\nuvicorn backend.app.main:app --host 0.0.0.0 --port 8080\n```\n\nDocker:\n\n```bash\ndocker run --rm \\\n  --env-file .env \\\n  -e COSCOAI_PRIVATE_ALGORITHM_PATH=\u002Fvar\u002Flib\u002Fcoscoai-private\u002Faiops_algorithms_private.py \\\n  -v \"$PWD\u002F.local\u002Fprivate_algorithms:\u002Fvar\u002Flib\u002Fcoscoai-private:ro\" \\\n  -p 8080:8080 \\\n  luxy-aisre:latest \\\n  python -m uvicorn backend.app.main:app --host 0.0.0.0 --port 8080\n```\n\nKubernetes:\n\n```bash\nkubectl -n k8s-agent create secret generic luxy-aisre-private-algorithms \\\n  --from-file=aiops_algorithms_private.py=.local\u002Fprivate_algorithms\u002Faiops_algorithms_private.py\nkubectl rollout restart deploy\u002Fluxy-aisre -n k8s-agent\nkubectl rollout restart deploy\u002Fk8s-agent-api -n k8s-agent\n```\n\nIf the secret is absent, the platform still runs with the open baseline.\n\nTo explicitly test the open baseline path:\n\n```bash\nCOSCOAI_DISABLE_PRIVATE_ALGORITHMS=1 uvicorn backend.app.main:app --host 0.0.0.0 --port 8080\n```\n\n## Skills\n\nSkills are portable operational knowledge packages. They describe:\n\n- symptoms and trigger conditions;\n- required evidence;\n- allowed objects;\n- allowed actions;\n- recovery criteria;\n- rollback guidance;\n- optional references and runbooks.\n\nSkills are stored under `OPS_SKILL_ROOT` and can be created from the console. They are intentionally portable so they can be reused by other agents or moved between environments.\n\nEach Skill is persisted as an independent package directory, rather than being\ncompiled into the application. This keeps the Skill repository separately\nversionable, reviewable, exportable, and reusable by other compatible agents.\n\n## Unified Resource API\n\n`GET \u002Fapi\u002Fresources` exposes Kubernetes, databases, virtual machines,\nmiddleware, storage, and cloud resources through one stable contract:\n\n```text\nGET \u002Fapi\u002Fresources?resource_type=pod&cluster=prod&namespace=orders&limit=200\n```\n\nThe response uses contract `coscoai.resource.v1`, includes source and health\nsummaries, and supports cursor pagination. New infrastructure teams should add\nan adapter and normalize into this contract instead of introducing a parallel\nresource API.\n\n## Safety Model\n\nThe platform is designed around least privilege:\n\n- no browser-side shell or arbitrary command execution;\n- no mutation unless server switches allow it;\n- high-risk actions require explicit operator confirmation;\n- action catalog limits what the model can request;\n- namespace\u002Fworkload scope is controlled by RBAC and allowlists;\n- every change records preview, actor, diff, result, and verification status;\n- secrets are never committed and should be supplied through Kubernetes Secret or a secret manager.\n\n## Repository Layout\n\n```text\nluxy-aisre\u002F\n├── agents\u002F                  # SRE workflow agents and execution engines\n├── backend\u002Fapp\u002F             # Control plane API, schemas, services, domain logic\n├── mcp_servers\u002F             # Kubernetes MCP tools\n├── cmdb\u002F                    # Local CMDB\u002Ftopology service\n├── cloud\u002F                   # Cloud and infrastructure adapter contracts\n├── frontend\u002Fmodern\u002F         # React + TypeScript + Vite console\n├── charts\u002Fcoscoai-sre\u002F      # Production Helm chart\n├── manifests\u002F               # Kubernetes manifests\n├── scripts\u002F                 # Build and image helper scripts\n├── docs\u002F                    # Architecture and maintainer documentation\n├── examples\u002F                # Sample alerts\n└── tests\u002F                   # Backend and workflow tests\n```\n\n## Development\n\n```bash\npython -m compileall -q backend agents mcp_servers cmdb cloud a2a openwebui\npython -m unittest discover -s tests -v\ncd frontend\u002Fmodern && npm run build\n```\n\nRun the security gate locally:\n\n```bash\npython -m pip install pip-audit\npip-audit -r requirements.lock --no-deps --disable-pip\n```\n\n## GitHub\n\nThe public engineering baseline lives at\n[`CoscoAI\u002Fluxy-aisre`](https:\u002F\u002Fgithub.com\u002FCoscoAI\u002Fluxy-aisre). Private algorithm\nextensions, credentials, production topology, and company data are loaded at\nruntime and are intentionally excluded from the public repository.\n\n## Roadmap\n\n`luxy-aisre` is designed to grow from a Kubernetes SRE console into an AgenticOps operating system for modern infrastructure.\n\n- **Kubernetes Autopilot**: cover the full lifecycle from alert, evidence, root-cause analysis, remediation preview, approval, execution, rollback, and recovery verification.\n- **Rancher Multi-Cluster Fleet**: make every cluster, namespace, workload, event, metric, and operation record searchable and governable from one control plane.\n- **Full-Stack Infrastructure Operations**: extend the same evidence-to-action loop to databases, virtual machines, storage, middleware, ingress, service mesh, and hybrid-cloud resources.\n- **Runtime Data-Flow Intelligence**: fuse Kubernetes inventory, CMDB, Prometheus, Loki, Tempo, and eBPF flow data into a living dependency graph that explains impact, blast radius, and traffic direction.\n- **Release Governance Control Plane**: turn SLO, error budget, canary scope, image risk, YAML policy, topology risk, and emergency repair paths into a programmable release gate.\n- **Operations Skills Network**: let engineers package hard-won troubleshooting experience as portable Skills, so the platform becomes stronger every time an incident is solved.\n- **Model Benchmark Arena**: evaluate different models by remediation success rate, MTTR reduction, safety score, evidence quality, token cost, and rollback correctness.\n- **Digital Twin for Change Risk**: simulate changes against topology, historical incidents, dependency paths, and SLO budgets before production is touched.\n- **100k-Node Scale Architecture**: move heavy discovery to event-driven collectors, sharded caches, async job queues, streaming evidence pipelines, and pluggable stores.\n- **Enterprise Trust Layer**: ship production Helm charts, air-gapped packages, OIDC\u002FSSO, RBAC presets, audit retention, policy-as-code, secret-manager integration, and compliance reports.\n- **Cloud & Edge Expansion**: add first-class adapters for Alibaba Cloud, Huawei Cloud, Tencent Cloud, AWS, Azure, private cloud, edge clusters, and cross-region disaster recovery.\n- **Self-Healing Platform Runtime**: let the platform inspect and repair its own agents, collectors, queues, stores, and integrations under strict approval and audit boundaries.\n\n## License\n\nThis project is released under the standardized\n[PolyForm Noncommercial License 1.0.0](LICENSE).\n\nYou may use, study, modify, and redistribute the source code for non-commercial purposes. Commercial use, hosted commercial services, resale, enterprise product bundling, paid support services, and removal of author attribution require prior written authorization from **陆宣宇**.\n\nThis is a standardized source-available non-commercial license, not an\nOSI-approved open-source license. Commercial authorization: **陆宣宇**,\ntelephone `18616350794`, WeChat `Lxylxy_-`.\n","luxy-aisre 是一个面向云原生环境的智能SRE控制平台，将告警、日志、拓扑、运行手册与大模型能力整合为闭环式运维工作流（发现→诊断→预演→审批→执行→验证→学习）。核心功能包括SRE聊天式操作控制台、证据驱动的可控修复流程、拓扑影响与爆炸半径分析、发布治理（SLO\u002F错误预算\u002F灰度门禁）及可移植运维技能库；技术上深度集成Kubernetes生态，支持Docker部署与Langfuse可观测性扩展。适用于中大型企业云平台团队开展自动化故障响应、变更风控与运维知识沉淀。","2026-07-12 02:30:05","CREATED_QUERY"]