How it works

ivralo works like a detective.

When something breaks, it reads the clues it is handed, puts them in order, checks its hunch and tells you what it found, with proof. You always make the final call. Six steps, as simply as we can put it:

1The alarm rings
2It reads the clues
3It puts them in order
4It checks
5It writes the report
6You decide

Step 1

Something breaks, the alarm rings.

Think of it this wayWhen the smoke alarm goes off at home, someone gets up to see what is going on. ivralo is the one who gets up.

When something goes wrong, the tool that watches your systems sends an alarm. ivralo starts looking into it at once. If the same alert rings again, it joins the one already open.

FIRING 14:02:11

checkout-api is returning 5xx

From Alertmanager. The checkout page is failing.

ivralo wakes up: investigation 3fa2c91b started

Step 2

It reads the clues it is handed.

Think of it this wayA detective does not go out collecting fingerprints. The evidence from the scene is brought in, and the detective studies it.

What the system wrote down (logs), the numbers that say how things are going, like a thermometer (metrics), and the latest changes (deploys) go into a folder. Your team puts them there, or an automatic step you set up. ivralo fetches nothing from outside; it reads what it is given.

incident/ the evidence bundle, put there by your pipeline or your team

alert.mdlogs/checkout-api.logmetrics/http_5xx.csvdeploys.log

Logs from the bundle

14:01:58 ERROR pool exhausted14:02:03 ERROR pool exhausted14:02:09 WARN timeout 30s

Metrics from the bundle

error rate, 13:50 - 14:05

Deploys from the bundle

13:12 b77d01 checkout-api14:00 a41c9e checkout-api

Step 3

It puts the clues in order.

Think of it this wayThe cookie jar is empty. It was full at three, someone went into the kitchen at four, it was empty at five. Put in order, the answer shows itself.

ivralo places everything it found on a timeline. Once you see what came before what, it is clear where the trouble started.

13:58all normal

14:00deploy a41c9e

14:01first error

14:02alert

Cause: the 14:00 deploy shrank the connection pool.

Step 4

It checks its hunch against the code.

Think of it this wayA good detective does not stop at "probably him". They check the fingerprint on the jar.

ivralo finds what the latest change did to the code and puts the cause it found next to it. When the evidence is not enough, it says "insufficient evidence" and never passes a guess off as a fact.

a41c9e src/db/pool.py

87pool = create_pool(

88- max_size=50,

88+ max_size=10,

DIAGNOSED: the cause is code, the file is in the repo

Step 5

It writes down what it found, with proof.

Think of it this wayLike the sources at the end of homework: every sentence says where it came from, and anyone can go and look.

ivralo writes a short report. What it observed comes with its source, and what it infers from that is written apart. Code computes every number and quotes every line.

report.md DIAGNOSED

Observed3× pool exhausted, 14:01:58 - 14:02:09logs/checkout-api.log:4127
ObservedDeploy a41c9e at 14:00 changed pool.pydeploys.log:12 a41c9e
Observed5xx rate from 0.4% to 31%metrics/http_5xx.csv
Inferreda41c9e cut the pool from 50 to 10; traffic filled it.suspect file: src/db/pool.py

Step 6

It leaves the decision to you.

Think of it this wayThe detective finds who did it, but the judge decides what happens next.

ivralo never changes the code on its own and never puts anything live. Soon it will also draft a fix; someone on your team reviews it and decides.

draft pull requestnext

Raise the connection pool back to 50

ivralo/fix-checkout-pool, 1 file

ivralo drafts itYou decide

It all happens inside your house.

ivralo is not a guest who drops by; it lives in the house. You decide who opens the door.

Your network

ivralo

The model you choose

Your code and repository

Reports and records

Outside

The internet. If ivralo wants to go out, it stops at the door first: with your permission it passes, without it, it does not.

The rule at the door: the egress policy, the way-out rule

Hard words, plain meanings

The words on this page, one sentence each.

Alert: An automatic message that says "something broke".
Incident: A problem in production; ivralo opens one investigation for each.
Evidence bundle: The folder of logs, metrics and deploy records ivralo reads.
Log: The diary a system keeps, line by line, with the time.
Metric: Numbers that say how well things are going.
Deploy: Putting a new version of the code live.
Pull request: A proposed code change that a person approves before it lands.
Model: The AI ivralo thinks with; you choose which one.
Egress policy: The rule that decides what may leave your network.

Run it on the machine you trust.

ivralo is not open source. Access is by invitation while it is in development, and it is set up inside your network.