Fail-closed prediction gate
A plan's blast radius is predicted and committed before any approval. An unpredicted mutating action is denied, not logged-and-allowed.
Governed-autonomy SRE platform · self-hosted · Apache-2.0
The agent is not allowed to act on a belief it has not checked.
— and the check is not run by the model that made the claim.
Territory Grounder lets an LLM agent triage and autonomously remediate infrastructure incidents — Kubernetes, hypervisors, network, storage — behind a fail-closed prediction gate, mechanical verdicts, and a tamper-evident ledger. Autonomous remediation, grounded: it has a territory, a ledger, and a leash.
One governed action
map prediction · territory observed
The loopOne loop, kept honest
The same loop runs the whole platform. What keeps it honest is an error channel the model does not control — evidence that can fail differently than the claim it is testing.
- PredictThe consequence prediction is committed before acting, keyed to an immutable action hash.
- ActBounded to its territory: argv-only actuation, no shell, every route authenticated.
- Be surprisedDeterministic code — never the acting model — scores the outcome: match, partial, deviation.
- UpdateA deviation can never auto-resolve again. Every decision lands in a hash-chained ledger.
What makes it differentGoverned autonomous action
Most AI-SRE tools stop at diagnose-and-suggest, or ship blind auto-remediation. Territory Grounder is built so that trust is mechanical, not asserted:
Mechanical verdicts
After execution, deterministic code writes the only match / partial / deviation verdict. The model never grades its own work.
A falsifiability control
Every prediction must beat a degree-preserving shuffled-graph control — “the model was right” has to beat chance on a graph of the same shape.
Three-band autonomy
AUTO · AUTO_NOTICE · POLL_PAUSE, with a non-configurable never-auto floor for anything irreversible, and a one-file kill-switch.
Tamper-evident ledger
Every decision in a SHA-256 hash-chained log, verifiable end to end. The audit trail is the product, not an afterthought.
Sovereign by design
Self-hosted, no SaaS dependency, no phone-home. Built for regulated and air-gapped estates — every decision reconstructable from your own database.
from the manifesto — the map is not the territoryA system that stops exposing its map to correction does not become wiser. It becomes an ideology, a hallucination, or a model confidently describing a world it has never touched.
A look at itThe operator console
The human's window onto the governed loop. Representative fixture data, the real interface — seven views, each answering a question an operator actually asks. Click any shot for full resolution.
DEVIATION.
AI, HUMAN and SYSTEM on the same spine.
How it worksA deterministic spine drives an untrusted model
A Go control-plane owns the effect channel; Temporal makes every workflow durable; PostgreSQL + pgvector hold state, memory, and the ledger. Model-agnostic through a bundled LiteLLM gateway — one OpenAI-compatible endpoint, an automatic multi-provider fallback ladder. The agent is a native Go loop; pluggable modules cover alert-sources, chat, ticketing, CMDB, actuation, and observability.
Flow: an alert, chat message, or ticket enters through an adapter into a durable Temporal workflow. The model predicts and commits that prediction — the gate — then acts, bounded to its territory. Independent verification writes the verdict into the hash-chained ledger. Every action carries an autonomy band: AUTO, AUTO_NOTICE, or POLL_PAUSE.
RoadmapAutonomy is earned in phases
Mutation stays globally disabled until the Phase-2 gate self-tests green — the platform runs the entire loop read-only, proving it could act, before it may.
| Phase | What | Status |
|---|---|---|
| 0 · Secure foundation | Mandatory-auth router, argv-only actuation, DML-only runtime DB role, secrets-as-references, the fail-closed mutation gate | done |
| 1 · Typed spine | Ingest → risk classifier → agent loop → prediction gate → mechanical verdict → ledger; ~31 connector modules; the operator console; the live estate graph | live · read-only |
| 2 · Governed autonomy | The actuation interceptor chain, the human vote-consuming approval loop, and turning the mutation key behind the proven gate | built · gated OFF |
| 3 · Anti-drift | Single-source-of-truth reconciliation, drift correction, safe decommission | planned |
| 4 · Adversarial assurance | Adversarial boundary-coverage, sealed-holdout evals, the orchestration-invariant benchmark | planned |
“A system whose beliefs are never checked against independent evidence will, given enough autonomy and time, drift into confident and internally consistent fiction faster than one that is checked.” That is the experiment worth running — and this platform is the instrument being built to run it.
Get itRun it on your own metal
One compose stack: control-plane, worker, Temporal, PostgreSQL, the LiteLLM gateway, and the console. Mutation ships OFF — it starts as a read-only observer of your estate.
# clone + bring the stack up git clone https://github.com/territory-grounder/grounder.git cd grounder/deploy cp .env.example .env # set your DSNs, tokens & model keys (references only) docker compose up -d