K8s root-cause graph + HITL remediation gate
knowledge graph walk
Deployment (alert)
Prom series
ReplicaSet
Loki stream
Pod 1
Pod 2
Pod 3
Node ip-10-2-3-4
walk edges: OWNS, SCHEDULED_ON, OBSERVED_BY, EXPOSES
collect telemetry within 15m window; rank hypotheses
ranked hypotheses
#1 bad rollout v2.41
score 0.74 (recent + cited)
#2 node pressure
score 0.21
#3 DNS flap
score 0.09
remediation gate
Slack approval card
[ROLL BACK] [ESCALATE] [IGNORE]
destructive MCP server
separate token, separate RBAC
audit log (append-only)
considered + executed + approver
read-only tools:
kubectl get/describe, promql,
logql, traceql -- no approval
20-scenario eval target: 80% RCA