kars-sre demo + agent — Slices 0-4: autonomous incident triage + typed apply-fix + Telegram#397

Draft

pallakatos wants to merge 62 commits into

mainfrom

kars-sre/demo-and-agent

Commits on Jun 9, 2026

demo(act2): S0 — infra-tier ResourceQuota incident harness for Agent A

Pal Lakatos-Toth
and
Copilot
committed
sre(s1): MVP — Helm template + 5 read-only kars-CR tools + CLI + plugin containment

Pal Lakatos-Toth
and
Copilot
committed
sre(s2): K8s diagnostic toolset — describe_resource, what_changed, endpoints, image_probe, top

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): resolve helm chart path from repo root, not CWD

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): use --reset-then-reuse-values for kars sre install

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): create kars-sre namespace explicitly in the chart

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): add --force-conflicts to helm upgrade (helm 4 SSA)

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): ToolPolicy must live in KarsSandbox's namespace (kars-system), not kars-sre

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): rename gate env KARS_SRE_ENABLED → SRE_ENABLED + indent fix

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): default contentSafety.requirePromptShields=false

Pal Lakatos-Toth
and
Copilot
committed
sre: default model gpt-4.1 → gpt-5.4

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): declare sre_* tools in plugin.yaml provides_tools

Pal Lakatos-Toth
and
Copilot
committed
sre: wire SRE-mode SOUL.md system prompt + fix register_tool kwargs

Pal Lakatos-Toth
and
Copilot
committed
sre: apiserver-bypass for role=sre sandboxes (controller egress-guard)

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): correct AGT profile schema (version 1.0 + agent: name + policies)

Pal Lakatos-Toth
and
Copilot
committed
fix(sre): trailing-colon glob in AGT allow rules — match real action shape

Pal Lakatos-Toth
and
Copilot
committed
sre: NetworkPolicy egress allow for apiserver (cluster-portable)

Pal Lakatos-Toth
and
Copilot
committed
fix(demo): agent-a-research.yaml passes CRD admission

Pal Lakatos-Toth
and
Copilot
committed
fix(demo): break.sh uses kars.azure.com/component selector

Pal Lakatos-Toth
and
Copilot
committed

Commits on Jun 10, 2026

kars-sre: Slice 3 (typed apply-fix) + Slice 4 (proactive watcher + Telegram)

Pal Lakatos-Toth
and
Copilot
committed
kars-sre: Headlamp SRE Console + Chat (Slice 4 primary UX)

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: fix browser-ESM require() crash + add 'SRE not installed' CTA

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: stub Active Incidents — pluginLib.K8s.event isn't host-exposed

Pal Lakatos-Toth
and
Copilot
committed
headlamp: bump plugin to v0.6.0 to bust Headlamp's plugin cache
Pal Lakatos-Toth
committed
cli: kars sre install handles 3 cluster shapes (helm release / kars dev / fresh)

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: derive cluster name from URL for apiserver-proxy chat tab

Pal Lakatos-Toth
and
Copilot
committed
controller: expose Hermes gateway port (18789) on per-sandbox Service
Pal Lakatos-Toth
committed
headlamp/sre: replace iframe Chat tab with terminal-attach instructions

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: replace internal Link with plain anchor + bump to 0.6.3

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: embed hermes dashboard PTY chat in browser

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: fix dashboard iframe — fetch HTML + rewrite asset URLs

Pal Lakatos-Toth
and
Copilot
committed
headlamp/sre: dashboard wrapper strips proxy prefix to dodge /api/* collision

Pal Lakatos-Toth
and
Copilot
committed

Commits on Jun 11, 2026

sre: end-to-end embedded Hermes chat in Headlamp plugin

Pal Lakatos-Toth
and
Copilot
committed
fix: ACR-name typo + workload-aware SRE Cluster Health card

Pal Lakatos-Toth
and
Copilot
committed
fix(monitoring): include kars-ops dashboard in Grafana sidecar configmap

Pal Lakatos-Toth
and
Copilot
committed
hermes: pre-warm AGT mesh registration in idle-gateway mode

Pal Lakatos-Toth
and
Copilot
committed
hermes: persistent mesh-keepalive (replaces short-lived pre-warm)

Pal Lakatos-Toth
and
Copilot
committed
hermes: enable AUTO_RESPONDER on the mesh keepalive process

Pal Lakatos-Toth
and
Copilot
committed
demo: bump dailyTokens cap to 2M for research + sre

Pal Lakatos-Toth
and
Copilot
committed
plugin: workload-aware Phase column on Overview + Sandboxes pages

Pal Lakatos-Toth
and
Copilot
committed
sre-action: workload-aware recovery observer (no false Recovered)

Pal Lakatos-Toth
and
Copilot
committed
demo: 3 commented sandbox CRDs for the Act-I walkthrough
Pal Lakatos-Toth
committed
controller: stop spamming LimitedSupport event on every McpServer reconcile

Pal Lakatos-Toth
and
Copilot
committed
sre: phase-changes-only watcher mode (Telegram pager, not event firehose)

Pal Lakatos-Toth
and
Copilot
committed
sre: overlay workload availability on synthetic phase

Pal Lakatos-Toth
and
Copilot
committed
sre-action: bump recovery window 5m→10m + late-recovery healer

Pal Lakatos-Toth
and
Copilot
committed
docs(security): audit for kars-sre demo-and-agent slice (Slices 0-4 + recovery healer)

Pal Lakatos-Toth
and
Copilot
committed
fmt: cargo fmt --all

Pal Lakatos-Toth
and
Copilot
committed
ci(loc-budget): bump controller/src/reconciler/mod.rs phase0 cap 3450 → 3700

Pal Lakatos-Toth
and
Copilot
committed
fix(lint): ruff + no-stubs gates

Pal Lakatos-Toth
and
Copilot
committed
fix(clippy): drop dead phase_reporter field after McpServer cleanup

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): seed internal blog series — 4 of 7 posts drafted

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): drafts 5/6/7 + bump README status table

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): rewrite post 1 as a position paper

Pal Lakatos-Toth
and
Copilot
committed
docs: replace 🔱 emoji with actual logo in README header

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): revise post 1 — corrections after rubber-duck critique

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): address the 'sidecars are out of favor' objection

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): split SIG alignment into explicit overlay + upstream modes

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): SIG section — replace fabricated 'upstream-compatible mode' with the actual four-mode field, verified against upstream repo + reconciler

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): SIG section — honest 'governance overlay vs hardening overlay' gap + 4 integration paths

Pal Lakatos-Toth
and
Copilot
committed
docs(blog): SIG section — cite the actual in-flight upstream PRs and disambiguate 'router' name collision

Pal Lakatos-Toth
and
Copilot
committed

Commits on Jun 14, 2026

docs(strategy): competitive positioning + leadership plan + corrected blog framing

Pal Lakatos-Toth
and
Copilot
committed