AegisSRE pulls the traces for a failing service, works out what broke, and writes the compensating calls that undo the damage. You approve it. Temporal makes sure it finishes, even if the worker dies halfway through.
Each incident is a single Temporal workflow. It moves through the same states you see on the dashboard, and every step is recorded in its event history, so a crash resumes from the last completed step instead of starting over.
Fetches spans for the alert’s trace IDs through the MCP tool get_telemetry_context.
A model reads the spans and returns a root cause plus the list of compensations to run.
Nothing runs yet. An operator approves, rejects, or asks a question, which triggers a fresh analysis.
Each compensation is its own activity. They run in parallel and retry on their own.
The root cause and the steps that were applied get written to the incident record.
Automated remediation is only useful if you can trust it at 3am. These constraints are what make that trust reasonable.
The agent can diagnose and propose on its own, but it can’t mutate production state until someone sends approve_rollback. No answer within 30 minutes counts as a no.
No two-phase commit across services. Each forward step has a compensating call, like /refundPayment for a charge, and those calls are idempotent, so running one twice does no harm.
Workflow code is deterministic, so Temporal can replay it. Every model call, HTTP request, and mutation lives in an activity with its own timeout and retry policy.
The agent reaches infrastructure through an MCP server where every request describes itself fully. Workers can come and go without session state getting lost.
POST /incident accepts PagerDuty v3 and Alertmanager webhooks as they are, and
works out which format it got. Or trigger a seeded test incident from the dashboard.
Add a webhook receiver pointing at the dashboard. The first firing alert starts a workflow.
# alertmanager.yml receivers: - name: aegis webhook_configs: - url: http://aegis:7080/incident # or by hand curl -X POST localhost:7080/incident \ -H 'content-type: application/json' \ -d '{"alerts":[{"labels":{"service":"payment-service"}, "annotations":{"summary":"p99 > 4s"}}]}'
Python 3.11+ and Docker. One process per terminal.
pip install -r requirements.txt && cp .env.example .envSet OPENAI_API_KEY for real root-cause analysis.docker run --rm -p 7233:7233 -p 8080:8080 temporalio/auto-setuppython -m sre_swarm.mock_services.appOrder and payment services on :9090.python -m sre_swarm.mcp.serverTool server on :8081.python -m sre_swarm.workerpython -m sre_swarm.dashboard.appOpen /dashboard and trigger an incident.