repi
local-first log RCA · hybrid retrieval · resumable agent
An autonomous log-investigation engine for distributed systems. It clusters repetitive logs by signature, retrieves evidence with BM25 + pgvector/HNSW fused through Reciprocal Rank Fusion, and investigates root cause through an explicit, resumable state machine. Every step is persisted for auditability, and confidence is constrained server-side by the evidence actually cited. It can run fully locally with Ollama; hosted-model adapters are optional.
Stack: Python, Postgres, pgvector, ParadeDB, FastEmbed
- implemented — Hybrid retrieval: ParadeDB BM25 + pgvector/HNSW fused with Reciprocal Rank Fusion.
- implemented — Resumable investigation: a hand-rolled finite-state machine whose thoughts, actions and observations persist to Postgres, so a paused run resumes from stored state.
- implemented — Deterministic server-side confidence gating that downgrades conclusions the cited evidence does not support.
- measured — Docker image reduced from 5.58 GB to 1.12 GB by migrating embeddings to ONNX with FastEmbed.
- measured — A 21-question retrieval suite plus scripted incident evaluations. This is a functional suite, not a published benchmark against a public dataset.
- planned — Cross-encoder reranking and a vector-only / BM25-only / hybrid ablation. Neither exists in the code today.
github · demo
collapser-grpc
gRPC request collapsing · 82 ns/op dedupe hot path
An open-source Go sidecar for suppressing thundering-herd traffic. Equivalent unary requests share one backend call while followers wait for the same result. The proxy is schema-agnostic, uses detached backend execution so one cancelled caller cannot kill shared work, and exposes collapse, cache, inflight and backend-latency metrics through Prometheus.
Stack: Go, gRPC
- benchmarked — 82 ns/op with zero allocations on the dedupe hot path. This is a Go microbenchmark of the in-process coordination path under synthetic high contention — it measures key hashing, cache lookup and in-flight map coordination only. It is NOT end-to-end RPC latency and contains no network, no serialization and no backend time.
- benchmarked — Up to 1000:1 collapse ratio under synthetic 10k+ concurrent identical requests. Synthetic load, not a production traffic measurement.
- implemented — Detached backend context, so a cancelled leader does not kill the shared call its followers are waiting on.
- implemented — Schema-agnostic collapsing keyed by SHA256(method + payload) — no protobuf descriptors required.
- implemented — Prometheus metrics for collapse ratio, cache hits, in-flight count and backend latency.
- known limitation — Server-streaming RPCs currently return only the first response frame; client-streaming and bidirectional calls bypass collapsing entirely. Backend TLS uses the system trust store only — no mTLS, no custom CA bundles.
- planned — Optional proto descriptors, mutual TLS, and per-method collapse policy. None of these are in the code today.
github
Fend
fleet-wide Linux hardening · Ansible + Electron
A desktop operator tool for applying repeatable Linux hardening across grouped Ubuntu hosts. Electron/React drives agentless Ansible playbooks over SSH, with key-based authentication and per-run audit logs. The project focuses on operationally legible, idempotent hardening rather than claiming full compliance with a security benchmark.
Stack: TypeScript, Electron, React, Ansible
- implemented — Agentless, idempotent hardening: an Electron/React operator UI driving Ansible playbooks over key-based SSH against grouped Ubuntu inventories, with per-run logs.
- known limitation — Ubuntu-only playbook paths, no central cross-operator audit trail, and coverage scoped to the implemented modules — it is not certified against CIS or any other benchmark.
- planned — Benchmark mapping (CIS), dynamic inventory, in-app script editing, broader distro validation.
github