A safety net you can read in the source
Every guardrail is in code you can read before you install. Not a policy page. Files in a repo.
Safeguards
Fixers with limits
Each fixer says what it may touch, in which namespaces, and how much. There is no open shell.
Signed approval links
If a fix is outside the rules, SreNix stops. It sends one expiring, signed link to a named person to approve.
No long-lived keys
Short-lived, traceable credentials for each fixer.
Air-gap ready
Runs disconnected, in your region, on your own model. Your data stays home.
A full record
Every detection, decision, command and check is written down. It is signed, so any change to the record can be spotted.
Audit bundle
One command exports the evidence pack for your auditors. It stays local.
Trust is earned, and measured
A type of fix gets more freedom only after it has worked reliably in your environment. If it starts failing, a circuit breaker returns it to manual approval.
# fixers/k8s-limit-raise.policy.yaml
scope:
namespaces: [payments, checkout]
resources: [deployment]
bounds:
memory_multiplier_max: 2.0
requires_verification: true
rollback_on_regression: true
approval:
in_envelope: auto
out_of_envelope: signed_url
signer_roles: [sre-oncall]
identity: oidc://srenix-fixer
Our honest answers
Are you SOC 2 certified?
Not yet. The evidence trail already exists: every action is signed and can be exported in one command. Certification is the next step.
Is it open source?
It is source-available. You can read all of the code. Commercial use needs a licence.
What if it makes things worse?
On the default path it can’t improvise. It only does fixes from an approved list, and it checks each one afterwards.
On-call should be quieter every week
Helm install in 5 minutes. No telemetry exfiltration. No per-investigation surprises.