Built for infrastructure where “just send it to an AI” is not an option.

• DRY
  Draft merge requests only. Proposals arrive as draft MRs. The assistant never has merge rights. Its cluster access is read-only by construction. Nothing reaches your cluster without explicit human approval in your normal review flow.
• LLM
  Your LLM, your boundary. Live For each infrastructure, you choose where the AI model runs. The options are a frontier cloud model, an approved regional provider, or a self-hosted model. A self-hosted model runs on hardware that we or you control, so nothing leaves the building. Different call types can go to different destinations. If a restricted destination is not available, the run stops. It does not silently fall back to a cloud model. See how routing works →
• PSN
  Identifier masking before anything reaches a cloud LLM. Expanding Optional pseudonymisation replaces identifiers with consistent aliases that keep the same shape. This covers customer names, hostnames, cluster IDs, internal IPs, e-mail addresses and Vault paths. The assistant replaces them before it sends content, and restores them in the result. We test each AI model on round-trip fidelity before we switch on a lane. This is live for a first class of calls. The goal is every byte we send to a cloud AI model.
• SCR
  Secret detection and scrubbing, in both directions. The assistant scrubs content that looks like a secret from what the AI model sees. Before a generated diff can become an MR, the assistant scans it for hard-coded passwords, tokens or kubeconfigs. If the scan finds one, the assistant holds back the MR. ExternalSecret references and SOPS-encrypted blocks pass through unchanged.
• VRF
  Verified against your real cluster before you see it. Live The assistant runs three checks. First, it checks the CRD schema with fixed rules. Second, it compares a helm template render at the current and the target version. Third, it runs a server-side dry-run against the live API server. This dry-run uses a dedicated identity that an admission policy limits to dryRun only. As of October 2026, the dry-run runs in observe mode: it records the answer but does not yet hold a proposal back. The goal is that you know the answer to "will the API server accept this?" before you review, not after you merge.
• MTR
  Grounded in measured behaviour. Resource, scaling and monitoring proposals show the Prometheus data behind them in the MR body (avg / p95 / peak, sample count, observation window). The assistant runs alert-rule changes against your metrics backend before it proposes them.
• CLP
  Deterministic guards after the model. Code enforces the numeric rules, not the prompt. Limits cannot go below the observed peak, and requests must be ≤ limits. The assistant escalates or holds back risky proposals. A proposal is risky if it removes large parts of a file, looks truncated or drops a document. It is also risky if its description does not match its diff.
• DIF
  Minimal-patch diffs. A YAML-aware post-processor removes the cosmetic changes that AI models add (reordered keys, dropped comments, quote styles). Diffs show only the change in meaning. So reviews take 30 seconds instead of 5 minutes.
• 2ND
  Independent second review. A second reviewer checks every open MR again. This reviewer does not know how the assistant made the proposal. It uses read-only tools to check each claim against the cluster. Its verdict appears as a label on the MR. Proposals that the assistant held back get a review too, so good fixes are not silently lost.
• POS
  Security posture reports and audits. The assistant does more than fixes. It offers on-demand compliance posture reports mapped to control IDs. It runs Vault policy lint and triages denied requests in the Vault audit log. It also reviews image signature and digest provenance, forge and CI security, and cloud and edge posture. By default, these checks open issues only. You get findings, not surprise changes.
• ISO
  Sealed by construction. Some components handle data classification and third-party repositories. These components cannot import a network client, an LLM SDK or a writer. Tests on the import graph enforce this, not convention. An assessment of new infrastructure is physically unable to send anything out.
• TRC
  Full audit trail. Every run records which agent ran, which AI model and version it used, and every call. It also records why each proposal was sent, bundled, held or dropped. "Why is this MR here?" always has an answer.

Your data, your AI boundary.

Each infrastructure has a declared egress requirement, which says where data may go. The choices are frontier cloud models, an approved provider, or self-hosted open-weight models only. The assistant routes work per call type. So bulk analysis can run on a small local model, and judgement calls use a stronger one. A large share of the agents are rule-based and use no AI model at all.

See how routing works, step by step →