SREBrain

Building the ultimate SRE agent

SREBrain is built to become the ultimate SRE agent: a system that can move from an observable infrastructure failure to a verified correction across platforms without making a language model, paid CLI, or graphical interface the security boundary.

Here, ultimate is not a claim of present completeness. It is a public, testable engineering contract:

Criterion	Definition	Current status
Platform-agnostic core	Policy, evidence, and verification do not depend on one operating system	Implemented
Model-agnostic operation	Diagnosis and authorization work without an LLM	Implemented
Diagnose before repair	Read-only checks identify the failed layer before mutation is considered	Initial Windows and Linux catalogs
Allowlisted execution	Every action must be a named, reviewed operation	Interface defined; mutation disabled
Postcondition verification	An action cannot succeed without checking the intended outcome	Planned
Rollback on failed verification	A failed or missing verifier restores the previous state	Planned
Immutable evidence	Diagnostic output receives a content hash and timestamped receipt	Implemented
Candidate versus verified knowledge	New claims remain candidates until explicitly promoted	Planned
Windows and Linux backends	Both implement the same operational contract	Read-only diagnostics
No paid CLI or GUI dependency	The system builds and runs from source using standard OS tools	Implemented

Why

Traditional repair tools execute isolated commands. Generic AI assistants can produce plausible instructions, but plausibility is not operational evidence. SREBrain is designed around a stricter loop:

detect -> diagnose -> plan -> authorize -> apply -> verify -> record

The verifier is part of the operation. A successful process exit is not enough if the original incident remains.

Current release

The first release establishes the cross-platform boundary:

• a shared Go contract for diagnostics, plans, application, rollback, and evidence;
• fixed, read-only diagnostic catalogs for Windows and Linux;
• no shell construction from user or model text;
• SHA-256 receipts for exact diagnostic output;
• explicit failure for every mutation request;
• CI on Windows and Linux.

No automatic repair ships yet. Mutation will be added one named action at a time, together with fixtures, an allowlist entry, a postcondition check, and a rollback implementation.

Quick start

Requires Go 1.26.5 or later.

go test ./...
go build ./cmd/srebrain
.\srebrain.exe list
.\srebrain.exe diagnose os

On Linux:

go test ./...
go build ./cmd/srebrain
./srebrain list
./srebrain diagnose os

Available checks depend on the current backend. Run srebrain list for the authoritative catalog.

Security boundary

Diagnostic names select fixed executable-and-argument definitions compiled into the backend. Arbitrary command strings are not accepted. The current implementation exposes no mutating operation.

Future mutation support must require all of the following:

1. a checked-in allowlist entry;
2. explicit operator reasoning;
3. an authenticated authorization decision;
4. a previewable plan;
5. a bounded apply operation;
6. a postcondition verifier;
7. a rollback path;
8. an append-only receipt.

See SECURITY.md and ARCHITECTURE.md.

Platform status

Backend	Diagnose	Plan	Apply	Verify and rollback
Windows	Read-only catalog	Disabled	Disabled	Not yet implemented
Linux	Read-only catalog	Disabled	Disabled	Not yet implemented

Linux remediation will remain disabled until each action has deterministic fixtures and a verifier. The first candidates will be bounded service, DNS, and package-state corrections rather than broad repair scripts.

Origin

SREBrain is a clean-history, recruiter-safe evolution of the verifier-first architecture developed in GodBrain. GodBrain remains the Windows research lab. SREBrain generalizes the operational contract for enterprise Windows and Linux environments without copying the private-host orchestration, model experiments, market tooling, or product language from that repository.

License

Licensed under Apache-2.0. The initial implementation has no vendored runtime dependencies. Provenance is recorded in NOTICE.