A language model makes mistakes nobody can predict, so the prompt is not what keeps an agent in line. The rules are: each agent works in its own Git worktree, secrets are scrubbed from its output before anything is saved, a second model reviews every pull request, and nothing an agent writes merges until I have read it.
Task dispatch, knowledge retrieval via FastMCP, sandboxed worktree execution, and adversarial review.
Rendered at build from src/diagrams/harness.architecture.json
None of them relies on the model behaving well: each one is a lock, a filter, a limit or a review.
Ephemeral git worktrees sharing the .git/objects pool. Kernel POSIX flock semaphores prevent race conditions and branch collisions across concurrent autonomous agents.
Real-time stream writer scrubbing process stdout/stderr before transcript persistence. Zero plaintext secrets on disk: Age/SOPS decryption piped strictly in-memory.
Dynamic AST loop circuit breaker halting recursive tool invocations. Synchronous cryptographic HITL gate for destructive actions and hard ~300 executable LOC cap.
Independent model family auditing pull request diffs for anti-sycophancy. Strict prohibition of auto-merge: every production change merges under human review.
The agents in production, the protocols they use, the event routers and the telemetry sinks running across the cluster. Most endpoints operate within the mesh boundary — what you see here is the live inventory and execution contracts.
13 entries · 5 you can open from here
Neural Hive · Memory & ADR Synthesis
Reactive LogQL & Anomaly Classifier
Automated Release Attestation & Promotion
Alertmanager Webhook -> Log Slicing -> Slack
Proactive Backup & Credential Rotator
K8s Spoke Topology Drift Healing
LogQL Cluster Telemetry & Tracebacks
Live Multi-Burn-Rate SLO Engine
L0 Infrastructure Codebase
Migrated from mlorentedev/kubelab · 6cd9ab0
Four excerpts, each quoted word for word from a public file and linked to the commit it was taken from.
The operating rules the dotfiles harness compiles into every agent's instructions: no AI attribution, no auto-merge, and every environment change written as code and verified idempotent.
- **No AI attribution** in git history or GitHub messages (commits, PRs, issues). - No `Co-Authored-By` trailers referencing AI agents. - No bot-style emojis or "Generated with" footers. - All artifacts must appear human-authored. […] - **Auto-merge is forbidden in every repository.** Never run `gh pr merge --auto`, never enable "Auto-merge" in the GitHub UI, and keep the repo setting `allow_auto_merge=false`. Auto-merge lands a PR the instant CI goes green — bypassing the human review gate in §1. […] - **Zero manual operations:** Never perform ad-hoc manual changes on remote systems, servers, or cloud environments. - **Strict IaC & Idempotence:** Every configuration or environment change MUST be codified as reproducible IaC (Ansible, Terraform, K8s manifests, dotfiles) and verified idempotent (`changed=0` on re-run).
An ordered allow-list of reviewer models. None of them is an Anthropic model, because Claude writes nearly every change: the reviewer must not be the implementer.
"Standing rule: an adversarial review never runs on an Anthropic model. The",
"reviewer must not be the implementer, and Claude implements nearly every",
"change in this repo — BUG-074 was reviewed twice by claude-opus-5 before",
"anyone noticed, which is the incident this file exists to prevent.",
[…]
"pool": [
{
"id": "nan/deepseek-v4-flash",
"runner": "pi",
"provider": "nan",
"model": "deepseek-v4-flash",
"role": "primary",
[…]
{
"id": "agy/gemini-3.1-pro-high",
"runner": "agy",
"model": "gemini-3.1-pro-high",
"role": "fallback",The gate that decides whether a pull request was reviewed. It never asks who reviewed it, and it tells a reviewer's "I could not review" notice apart from a review.
"The gate asks ONE question: did a review actually happen? It never asks who",
"performed it or how good it was. A human review attests exactly as well as a",
"bot's.",
[…]
{
"login": "coderabbitai",
"declined_markers": [
"rate limited by coderabbit.ai"
],
"review_markers": [
"No actionable comments were generated in the recent review"
],Each product repo builds an immutable sha-tagged image and fires a repository_dispatch to kubelab, which promotes it. Polling the registry was considered and rejected.
# ADR-053: Platform↔Product Repository Structure & Deployment Topology […] 2. **Image promotion is push, event-driven — never polling.** - Each product's CI publishes an immutable `sha-<short>` image, then fires a **`repository_dispatch`** to kubelab, whose workflow runs `toolkit deployment promote` (ADR-046). - **Rejected — registry polling** (Argo CD Image Updater *or* an n8n registry poller). It reintroduces exactly what ADR-046 descoped (#692): a pull loop and non-git-honest state; for n8n it would also put a non-critical service on the delivery path (n8n down → no deploys). We control the image producers, so push is strictly better than pull.
What breaks when LLMs touch real infrastructure, and the Unix boundaries required to contain them: worktree isolation, kernel flock, and mechanical triage queues.