Fail-closed prediction gate
A plan's blast radius is predicted and committed before any approval, and the prediction is computed outside the LLM. An unpredicted mutating action is denied, not logged-and-allowed.
Governed-autonomy SRE platform · self-hosted · Apache-2.0
The agent is not allowed to act on a belief it has not checked.
And the check is not run by the model that made the claim.
Territory Grounder lets an LLM agent triage and autonomously remediate infrastructure incidents (Kubernetes, hypervisors, network, storage) behind a fail-closed prediction gate, mechanical verdicts, and a tamper-resistant ledger. Autonomous remediation, grounded: it has a territory, a ledger, and a leash.
One governed action
map prediction · territory observed
The loopOne loop, kept honest
The same loop runs the whole platform. What keeps it honest is an error channel the model does not control: evidence that can fail differently than the claim it is testing.
- PredictThe consequence prediction is committed before acting, keyed to an immutable action hash.
- ActBounded to its territory: argv-only actuation, no shell, every route authenticated.
- Be surprisedDeterministic code, never the acting model, scores the outcome: match, partial, deviation.
- UpdateA deviation can never auto-resolve again. Every decision lands in a hash-chained ledger.
What makes it differentGoverned autonomous action
Most AI-SRE tools stop at diagnose-and-suggest, or ship blind auto-remediation. Territory Grounder is built so that trust is mechanical, not asserted:
Mechanical verdicts
After execution, deterministic code writes the only match / partial / deviation verdict. The model never grades its own work.
A falsifiability control
Every prediction must beat a degree-preserving shuffled-graph control, so "the model was right" has to beat chance on a graph of the same shape.
Three-band autonomy
AUTO · AUTO_NOTICE · POLL_PAUSE, with a non-configurable never-auto floor for anything irreversible, and a one-file kill-switch.
Tamper-resistant ledger
Every decision in a SHA-256 hash-chained log, and the runtime database role is revoked UPDATE and DELETE on the append-only spine. The record cannot be rewritten, even by the process that wrote it.
Sovereign by design
Self-hosted, no SaaS dependency, no phone-home. Built for regulated and air-gapped estates, with every decision reconstructable from your own database.
Who it is forOperators who cannot outsource their trust boundary
If your estate cannot phone home, and an autonomous change has to be defensible after the fact, off-the-shelf AIOps is a non-starter. Territory Grounder is built for the operators who carry that constraint:
Regulated and air-gapped estates
Finance, healthcare, defence, critical infrastructure: everything runs inside your trust boundary, and every decision is reconstructable from your own database for the auditor who asks.
The solo operator on call
One person, hundreds of objects, an alert at 3am and no team to escalate to. A grounded agent that proposes, predicts, and stands down safely is a colleague, not a liability.
Platform teams past their headcount
Estates that have outgrown the humans who run them. Autonomy that is earned per-scope, breaker-armed, and never a blind flip, so widening it is a decision backed by evidence rather than hope.
from the manifesto: the map is not the territoryA system that stops exposing its map to correction does not become wiser. It becomes an ideology, a hallucination, or a model confidently describing a world it has never touched.
A look at itThe operator console
The human's window onto the governed loop. Representative fixture data, the real interface: seven views, each answering a question an operator actually asks. Click any shot for full resolution.
DEVIATION.
AI, HUMAN and SYSTEM on the same spine.
How it worksA deterministic spine drives an untrusted model
A Go control-plane owns the effect channel; Temporal makes every workflow durable; PostgreSQL and pgvector hold state, memory, and the ledger. Model-agnostic through a bundled LiteLLM gateway: one OpenAI-compatible endpoint with an automatic multi-provider fallback ladder. The agent is a native Go loop; pluggable modules cover alert-sources, chat, ticketing, CMDB, actuation, and observability.
Flow: an alert, chat message, or ticket enters through an adapter into a durable Temporal workflow. The model predicts and commits that prediction, the gate, then acts, bounded to its territory. Independent verification writes the verdict into the hash-chained ledger. Every action carries an autonomy band: AUTO, AUTO_NOTICE, or POLL_PAUSE.
Evidence, not assertionWhat is provable today
The platform does not ask to be trusted; it publishes the mechanisms and the record. These are structural facts, verifiable in the source. Live benchmark results are published to the Grounding scorecard as they are earned, never asserted here.
- Gate outside the modelThe consequence prediction is computed by deterministic code, not the LLM, and default-denies any unpredicted mutating action.
- 2,650 acceptance checksThe executable spec lattice runs its full oracle set on every commit, binding requirements to runnable code.
- Zero unauthenticated routesEvery route is authenticated by construction; a route with auth disabled fails at boot. Actuation is argv-only, no shell.
- Mutation OFF by constructionThe whole loop runs read-only, proving it could act, until an owner-present, evidence-gated canary turns the key.
RoadmapAutonomy is earned in phases
Mutation stays globally disabled until the Phase-2 gate self-tests green: the platform runs the entire loop read-only, proving it could act, before it may.
| Phase | What | Status |
|---|---|---|
| 0 · Secure foundation | Mandatory-auth router, argv-only actuation, DML-only runtime DB role, secrets-as-references, the fail-closed mutation gate | done |
| 1 · Typed spine | Ingest, risk classifier, agent loop, prediction gate, mechanical verdict, ledger; roughly 30 connector modules; the operator console; the live estate graph | live · read-only |
| 2 · Governed autonomy | The actuation interceptor chain, the human vote-consuming approval loop, and turning the mutation key behind the proven gate and a passed readiness review | built · gated OFF |
| 3 · Anti-drift | Single-source-of-truth reconciliation, drift correction, regime-aware actuation, safe decommission | planned |
| 4 · Adversarial assurance | Adversarial boundary-coverage, sealed-holdout evals, published third-party benchmarks | planned |
"A system whose beliefs are never checked against independent evidence will, given enough autonomy and time, drift into confident and internally consistent fiction faster than one that is checked." That is the experiment worth running, and this platform is the instrument being built to run it.
QuestionsThe things a skeptical operator asks
How is this different from Ansible, Rundeck, or an alert-triggered runbook?
Those execute a change you already decided on. Territory Grounder decides, but only through a governed loop: an LLM reasons about the incident, a separate mechanism predicts the blast radius and gates the action, and deterministic code verifies the result afterward. The autonomy is the point, and so is the leash on it.
Does my data leave my network?
No, apart from the model API calls you configure, and even those can point at a model you host. Everything else, state, memory, the ledger, the console, runs inside your own trust boundary. There is no SaaS dependency and no phone-home.
Which models does it use?
Any model reachable by an OpenAI-compatible API. A bundled LiteLLM gateway presents one endpoint with an automatic multi-provider fallback ladder and per-org budgets, so the platform is model-agnostic and you keep control of cost and provider.
Is autonomous mutation actually safe?
Mutation ships globally OFF and stays off until it is evidenced-ready. Every mutating action needs a committed prediction to reach approval; a non-configurable floor keeps anything irreversible or stateful on a human poll; a deviation can never auto-resolve; and the first live action is a narrow, reversible, owner-present, breaker-armed canary, never a blind flip.
Can I trust the audit trail?
The ledger is a SHA-256 hash-chained log, and the runtime database role is revoked write and delete on the append-only spine, so the record cannot be altered even by the process that produced it. Every AI, human, and system decision sits on the same verifiable chain.
What state is it in right now?
Phase 1 is live and deployed, read-only. Phase 2 (governed mutation) is built but gated OFF while its evidence is earned. The roadmap above tracks each phase honestly, and the Grounding scorecard publishes the record as it accrues.
Get itRun it on your own metal
One compose stack: control-plane, worker, Temporal, PostgreSQL, the LiteLLM gateway, and the console. Mutation ships OFF, so it starts as a read-only observer of your estate.
# clone + bring the stack up git clone https://github.com/territory-grounder/grounder.git cd grounder/deploy cp .env.example .env # set your DSNs, tokens and model keys (references only) docker compose up -d