SxDevOps — What It Is

SxDevOps is an open-source platform that brings AI agents into real-world IT operations ("运维"). Its motto is "Think before acting, act with evidence" — it's not a chatbot, but a system that turns scattered ops tools into one controlled workflow: see the situation → find evidence → ask the system → confirm actions.

The Problem It Solves

In traditional ops, information and actions are fragmented:

• Alerts show a red dot, but logs, traces, and recent changes live in other systems.
• Releases, approvals, task results, and key operations are scattered across pages, making post-mortems costly.
• Inspection, batch commands, script templates, and host permissions are disconnected.
• Troubleshooting experience lives in people's heads and doesn't get reused.

SxDevOps pulls these fragments into one chain: observability for evidence, event center for review, task center for action, and AIOps for understanding, planning, and structured output.

Core Modules

Module	What It Does
CMDB	Asset ledger, business resource tree, sync/onboarding, capacity levels, governance, topology, explicit task-resource linkage
AIOps Agent	LangGraph orchestration, natural-language forensics, reusable Skills, task drafts, human confirmation, execution audit, post-action recovery verification
Observability	Platform overview, system status, metric queries, log search, trace, Grafana dashboards, data-source management
Event Center	Failure-event localization, key-operation recording, event-source integration, operation audit, filtering by system/environment/app/time
Task Center	Host tasks, batch commands, script templates, resource groups, task drafts, execution history, scheduled tasks
Ticket System	App releases, approval flows, SQL audit, transaction tickets, change trails
Container Management	Kubernetes/Docker workbench, resource & YAML pre-checks, scope authorization, capacity, interactive terminals, historical logs
Permissions & Audit	RBAC applied uniformly across backend APIs, frontend routes, menus, buttons, and WebSocket scenarios

How the Agent Works

It's not "user asks → LLM freely answers." It's a controlled pipeline:

1. Action Router — classifies the request (alert root cause, log query, K8s diagnosis, change correlation, task generation…) and declares risk level, needed context, output structure, and confirmation policy.
2. Agent Mode — picks execution style: Direct (single read-only or clear action), ReAct (reason → act → observe), or Plan + ReAct (multi-step deep troubleshooting).
3. Preflight — before any write, generation, or execution: permission check, risk assessment, dependency check, missing-parameter completion, rollback readiness. If it fails, returns a form or asks for missing info.
4. Skill / SOP — domain capability packages that constrain evidence checklists, query rules, output format, and safety boundaries so the model can't free-wheel.
5. MCP / Tool Registry — wraps platform and external systems as governable tools. The final usable tool set = Skill tool dependencies ∩ MCP availability ∩ user RBAC ∩ Action security policy.
6. Structured facts — logs, metrics, traces, alerts, events, execution results.
7. Two-stage answer shaping — conclusion, evidence, risk, suggested actions.
8. Pending Action — any write/execute action becomes a pending confirmation; only after user confirms does the platform API execute it (with RBAC, parameter sanitization, timeout control).
9. Feedback loop — results go back to task center, event center, and audit trail.

Governing principles:

• The platform API is the only execution boundary — the model understands, plans, and generates candidate parameters but can never bypass the backend to touch resources.
• Read-only diagnostics can return facts directly; generate/write/execute actions must go through preflight → confirmation → execution.
• Frontend permission display is just UX; backend RBAC is the real security boundary.
• Everything is audited: sessions, tool calls, preflight checks, pending actions, execution results, key events.

Typical Scenario

"Analyze production order-center anomaly" — traditionally you'd manually hop between alert platform, log center, trace system, and release records. In SxDevOps, the agent chains them: user asks in natural language → agent picks alert/log/trace/event/task tools → backend executes tool calls against a whitelist with RBAC and timeout control → platform aggregates structured evidence → Skill outputs conclusion, evidence, risk, and suggested actions → if inspection or command execution is needed, a task draft is generated and only enters the task center after user confirmation → results write back to event center and audit trail.

v2 Highlights

• CMDB: unified asset/resource tree/capacity/sync/governance; task center explicitly links CMDB assets; topology supports exact scope and 1–3 hop neighbors.
• AIOps/LangGraph: default chat uses persistent graph orchestration; staged forensics, tool loops, task drafts, reply repair; independent worker, checkpoint recovery, lease takeover, node audit; post-action alert-recovery verification.
• Container management: unified Kubernetes/Docker workbench; YAML dry-run pre-checks; scope authorization; interactive terminals; historical logs with cursor-based paging.
• UX: three themes (light, charcoal, dark blue-gray); centralized sidebar navigation; system settings for site name, icon, menu ordering.

Tech Stack

• Backend: Django REST framework, Channels, Daphne
• Agent orchestration: LangGraph; checkpoints in PostgreSQL/MySQL/SQLite; database-backed task queue with independent worker
• Frontend: Vue 3, Vue Router, Pinia, Element Plus, ECharts, Vite
• Database: PostgreSQL 16 default (recommended), MySQL 8 optional, SQLite for local testing
• Cache/realtime: Redis, Channels Redis
• External integrations: Kubernetes API, Docker, SSH, Prometheus/Grafana, SkyWalking, Tempo, Jaeger, Zipkin, Loki/ELK/SLS

Quick Start

Requires Docker (v20.10+, with Compose V2). From the repo root:

sh start.sh        # Linux/macOS
.\start.cmd       # Windows

The script generates and saves secrets, builds images, starts the app + PostgreSQL + Redis + CMDB scheduler + AIOps worker, and runs DB migrations. First run only asks you to set the admin password — no manual .env creation. Then open http://localhost:8000/login, username admin, password = what you set. No fixed default password; demo data is off by default. Re-running the same command preserves config and accounts. Kubernetes deployment is also supported via python3 k8s/deploy.py <image>.

Honest Limitations

• Disposal verification only shows that an alert recovery was observed — it does not prove causation or overall business health.
• Full backend test suite still has known failures; partial test passes can't substitute for full-suite results.
• The project is MIT-licensed: free to use, modify, distribute, and use commercially, with attribution required and no warranty.