Frequently asked questions.
The short answers to the questions we hear most often. For deeper detail, the docs and the security model page cover everything.
Closed loop & agents
What is the closed loop?+
Eight explicit phases — detected → correlated → investigated → critiqued → approved → recovered → verified → postmortem. Each transition is a guarded event in an append-only ledger. The loop refuses to advance without a satisfied guard.
Do the agents run mutating actions on their own?+
No. Diagnosis is always read-only. Mutating actions require a pending proposal with explicit blast radius, a human approver signature, and exact-match guards on resource, command, and payload hash. Unknown tools and cross-resource targets fail closed.
How many worker roles are there?+
Seven operational roles — alerter, investigator, critic, reviewer, repairer, verifier, reporter — plus five specialist skills (specialist-sre, specialist-network, specialist-compute, specialist-disk, specialist-ops).
Safety & security
What happens if a worker is compromised?+
The safety boundary is enforced at the manager, not the prompt. A compromised worker still cannot bypass tool allowlists, blast-radius guards, or human approval. The append-only event log and SHA256-chained proposal audit preserve a verifiable record of every dispatch.
What is the audit ledger and how is it preserved?+
Every dispatch and completion appends to loop_event_log, which the database enforces as append-only (a trigger rejects UPDATE/DELETE; corrections are new events). On top of that, every mutating-proposal transition appends to chat_proposal_audit — a SHA256 hash chain where hash_n = SHA256(prev_hash || canonical_json(payload) || proposal_id || action). Any tampering invalidates every later hash, and the in-repo verifier walks the chain to report the first break.
Where does the LLM run? Does OpsKeeper send my data to OpenAI?+
LLM calls happen in the worker that needs them. OpsKeeper does not proxy or log LLM traffic. You choose your LLM backend (vLLM, OpenAI, Aliyun DashScope, Anthropic) — multi-LLM backend ships in Q1 2027.
Deployment & operations
What does it take to run OpsKeeper locally?+
Docker 24+, Go 1.25+, Node 20+, pnpm 9+, Python 3.11+. From the repo root, `docker compose up -d --build` brings up the full stack, and seeding the four demo scenarios takes one `go run ./cmd/incident-seed`.
Can it run on Kubernetes?+
Yes — a Helm chart ships under deploy/k8s/charts/opskeeper today. A Kubernetes Operator (CRD for OpsKeeper + plugins) is on the Q1 2027 roadmap.
How do I upgrade?+
Drain active incidents to verified or postmortem, apply the new image, roll control plane instances one at a time, then replay the most recent ledger events to confirm no event was lost. The full runbook lives at docs/deployment/upgrade.md.
Open source
Is OpsKeeper open source?+
Yes — Apache-2.0. Source, plugin code, and reproducible incident fixtures all live in the public repo at github.com/vincent-wuhan/opskeeper.
Can I run a forked version under my own brand?+
You can fork the source code under Apache-2.0. The OpsKeeper name and wordmark are not part of that license — see TRADEMARK.md. For commercial co-branding, open a trademark-tagged issue.
How can I contribute?+
PRs for bug fixes, new skills, new workflow scenarios, and docs are welcome. See CONTRIBUTING.md for the workflow. The site itself is a Next.js app under site/ — docs contributions can be PRs against site/app/docs/.