Alert to cited finding
Keryx sits in your cluster, watches Alertmanager, and investigates over read-only tools. Nothing below requires you to change how you run Kubernetes.
- 1
An alert fires
Alertmanager posts to Keryx's webhook. A deterministic triage sweep snapshots evidence immediately, before any model runs, because evidence decays. Alerts sharing a group key coalesce into one investigation rather than fanning out.
- 2
It investigates, read-only
A fixed sweep (pod status and events, recent logs, key metrics, the Flux revision diff) always runs and always produces trace steps. Then a hypothesis loop picks tools to confirm or refute its top theories, over read-only Kubernetes, Prometheus, Loki, Flux and GitHub.
- 3
It publishes what it can support
A cited finding lands in the Slack thread under the alert: root cause, the conviction rung, numbered claims each with a verbatim excerpt and the exact replayable query, and a flat list of what was checked and ruled out.
- 4
You can check its work
The whole trace is stored and queryable — every tool call, its input, its result type, and its output, with empty and truncated results marked rather than passed off as success.
Where the writes are
Keryx's only write surface is Git PRs that a human reviews and merges; the cluster changes only through your existing GitOps pipeline.
The learning loop drafts runbooks and the remediation feature proposes fixes — both as pull requests against your own repositories, through a separate, narrowly scoped credential. The GitHub integration is mounted read-only until those features arrive.