Triage Kubernetes incidents when rules run out

01 · Role in the system

What Jev does here

The controller watches Pods, Events, Deployments, StatefulSets, DaemonSets and Jobs, normalizing and redacting observations into bounded snapshots with stable fingerprints. Crash loops, scheduling failures, image-pull failures, failed Jobs and Warning Events are decided by deterministic rules; only ambiguous cases reach the decision provider - direct TypeSafe Jev by default. A provider registry also covers OpenRouter and OpenAI or Anthropic structured output; generic endpoints must use HTTPS and unstructured text is rejected. Provider output is validated before a deterministic composer assigns severity and action; incidents, snapshots and delivery persist in MongoDB with transactional outbox semantics behind at-least-once HMAC-signed webhooks. An Alpha EKS smoke deployment exercised a live Jev decision end to end — integration evidence, not production readiness.

02 · Control boundary

Where Jev sits

Allowlisted read-only watches to bounded snapshots; deterministic rules first, one decision call for the ambiguous remainder, and a deterministic composer owns severity and action.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• Alpha software with an explicit no-stability-guarantee disclaimer; configuration, schemas and behavior may change without notice.
• Evidence is one EKS smoke deployment including a single live Jev decision, not an operating history.
• Running it means cluster observations, redacted into snapshots, reach the configured provider for ambiguous cases.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• ddalcero ↗Community · github · public · checked 2026-09-23