repi
local-first log RCA · hybrid retrieval · resumable agent
An autonomous log-investigation engine for distributed systems. It clusters repetitive logs by signature, retrieves evidence with BM25 + pgvector/HNSW fused through Reciprocal Rank Fusion, and investigates root cause through an explicit, resumable state machine. Every step is persisted for auditability, and confidence is constrained server-side by the evidence actually cited. It can run fully locally with Ollama; hosted-model adapters are optional.
Stack: Python, Postgres, pgvector, ParadeDB, FastEmbed
- implemented - Hybrid retrieval: ParadeDB BM25 + pgvector/HNSW fused with Reciprocal Rank Fusion.
- implemented - Resumable investigation: a hand-rolled finite-state machine whose thoughts, actions and observations persist to Postgres, so a paused run resumes from stored state.
- implemented - Deterministic server-side confidence gating that downgrades conclusions the cited evidence does not support.
- measured - Docker image reduced from 5.58 GB to 1.12 GB by migrating embeddings to ONNX with FastEmbed.
- measured - A 21-question retrieval suite plus scripted incident evaluations. This is a functional suite, not a published benchmark against a public dataset.
- planned - Cross-encoder reranking and a vector-only / BM25-only / hybrid ablation. Neither exists in the code today.
github · demo
collapser-grpc
gRPC request collapsing · 82 ns/op dedupe hot path
An open-source Go sidecar for suppressing thundering-herd traffic. Equivalent unary requests share one backend call while followers wait for the same result. The proxy is schema-agnostic, uses detached backend execution so one cancelled caller cannot kill shared work, and exposes collapse, cache, inflight and backend-latency metrics through Prometheus.
Stack: Go, gRPC
- benchmarked - 82 ns/op with zero allocations on the dedupe hot path. This is a Go microbenchmark of the in-process coordination path under synthetic high contention - it measures key hashing, cache lookup and in-flight map coordination only. It is NOT end-to-end RPC latency and contains no network, no serialization and no backend time.
- benchmarked - Up to 1000:1 collapse ratio under synthetic 10k+ concurrent identical requests. Synthetic load, not a production traffic measurement.
- implemented - Detached backend context, so a cancelled leader does not kill the shared call its followers are waiting on.
- implemented - Schema-agnostic collapsing keyed by SHA256(method + payload) - no protobuf descriptors required.
- implemented - Prometheus metrics for collapse ratio, cache hits, in-flight count and backend latency.
- known limitation - Server-streaming RPCs currently return only the first response frame; client-streaming and bidirectional calls bypass collapsing entirely. Backend TLS uses the system trust store only - no mTLS, no custom CA bundles.
- planned - Optional proto descriptors, mutual TLS, and per-method collapse policy. None of these are in the code today.
github
Fend
fleet-wide Linux hardening · Ansible + Electron
A desktop operator tool for applying repeatable Linux hardening across grouped Ubuntu hosts. Electron/React drives agentless Ansible playbooks over SSH, with key-based authentication and per-run audit logs. The project focuses on operationally legible, idempotent hardening rather than claiming full compliance with a security benchmark.
Stack: TypeScript, Electron, React, Ansible
- implemented - Agentless, idempotent hardening: an Electron/React operator UI driving Ansible playbooks over key-based SSH against grouped Ubuntu inventories, with per-run logs.
- known limitation - Ubuntu-only playbook paths, no central cross-operator audit trail, and coverage scoped to the implemented modules - it is not certified against CIS or any other benchmark.
- planned - Benchmark mapping (CIS), dynamic inventory, in-app script editing, broader distro validation.
github