624 lines
31 KiB
Markdown
624 lines
31 KiB
Markdown
# Ops/DevOps Portfolio: Strategic Positioning
|
|
|
|
## Executive Summary
|
|
|
|
This document analyzes the five-project portfolio from the Ops/DevOps perspective, positioning them against established market tools:
|
|
|
|
| Project | Domain | Competes With |
|
|
| --------- | -------- | --------------- |
|
|
| **Provisioning** | IaC + Orchestration | Terraform, Pulumi, Ansible, CloudFormation |
|
|
| **SecretumVault** | Secrets Management | HashiCorp Vault, AWS Secrets Manager, Azure Key Vault |
|
|
| **Vapora** | Agent Orchestration | Jenkins, GitHub Actions, Tekton, ArgoCD |
|
|
| **TypeDialog** | Configuration + IaC Gen | Terraform modules, Cookiecutter, Yeoman |
|
|
| **Kogral** | Knowledge Management | Confluence, Notion, Internal wikis |
|
|
|
|
---
|
|
|
|
## 1. Ops Functionality Matrix
|
|
|
|
### Capabilities per Project
|
|
|
|
| Capability | Provisioning | SecretumVault | Vapora | TypeDialog | Kogral |
|
|
| ------------ | -------------- | --------------- | -------- | ------------ | -------- |
|
|
| **Multi-cloud** | AWS, UpCloud, Local | N/A (storage agnostic) | N/A | Yes (prov-gen) | N/A |
|
|
| **Declarative IaC** | Nickel (typed) | N/A | N/A | Generates Nickel | N/A |
|
|
| **Secrets management** | Integrates KMS | ✅ 4 engines | Uses vault | N/A | N/A |
|
|
| **Orchestration** | Rust orchestrator | N/A | NATS JetStream | N/A | N/A |
|
|
| **Post-Quantum Crypto** | Via SecretumVault | ✅ ML-KEM/ML-DSA | N/A | N/A | N/A |
|
|
| **Automatic rollback** | ✅ Checkpoints | N/A | Pipeline rollback | N/A | N/A |
|
|
| **Policy engine** | Cedar RBAC/ABAC | Cedar ABAC | Cedar multi-tenant | N/A | N/A |
|
|
| **Audit logging** | 7 years retention | ✅ Complete | ✅ SurrealDB | N/A | Git history |
|
|
| **AI-assisted** | MCP + RAG | N/A | LLM routing | Agent backend | MCP search |
|
|
| **REST API** | Axum control-center | Axum vault API | Axum backend | Axum web backend | N/A (MCP) |
|
|
| **Storage backends** | SurrealDB | FS/etcd/SurrealDB/PostgreSQL | SurrealDB + NATS | Multi-format | FS + SurrealDB |
|
|
| **CLI** | 80+ shortcuts | svault CLI | vapora CLI | typedialog CLI | kogral CLI |
|
|
|
|
### Common Technology Stack (Ops Perspective)
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────┐
|
|
│ SHARED TECHNOLOGIES │
|
|
├─────────────────────────────────────────────────────────────────┤
|
|
│ Language: Rust (performance, memory-safety) │
|
|
│ Config: Nickel (pre-runtime validation, lazy eval) │
|
|
│ DB: SurrealDB (multi-model, scopes, time-series) │
|
|
│ Web: Axum (async, composable routing) │
|
|
│ Messaging: NATS JetStream (at-least-once, persistence) │
|
|
│ Policy: Cedar (ABAC, AWS-compatible) │
|
|
│ Crypto: OpenSSL, OQS (PQC), AWS-LC, RustCrypto │
|
|
│ Logging: tracing (structured, JSON output) │
|
|
└─────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
---
|
|
|
|
## 2. Positioning vs Competition (Ops Tools)
|
|
|
|
### Provisioning vs Terraform
|
|
|
|
| Aspect | Provisioning | Terraform |
|
|
| -------- | -------------- | ----------- |
|
|
| **IaC Language** | Nickel (typed, lazy) | HCL (untyped) |
|
|
| **Validation** | Pre-runtime (compilation) | Runtime (terraform plan) |
|
|
| **Multi-cloud** | AWS, UpCloud, Local | Yes (100+ providers) |
|
|
| **AI native** | MCP + RAG (1000x Python) | Terraform Cloud AI (limited) |
|
|
| **Orchestration** | Rust hybrid orchestrator | State file + lock |
|
|
| **Rollback** | Automatic with checkpoints | Manual (terraform destroy) |
|
|
| **Security** | 39K lines (12 components) | Vault plugin, external |
|
|
| **Ecosystem** | ⚠️ Small | ✅ Huge (Terraform Registry) |
|
|
| **Learning curve** | High (Nickel + Nushell) | Moderate (familiar HCL) |
|
|
| **Best For** | Rust teams, typed IaC, AI-assisted | General use, large ecosystem |
|
|
|
|
**Key differentiator**: Provisioning combines typed declarative IaC (Nickel) with AI-assisted generation (MCP + RAG) and hybrid Rust/Nushell orchestration, eliminating configuration errors at compile time.
|
|
|
|
### Provisioning vs Pulumi
|
|
|
|
| Aspect | Provisioning | Pulumi |
|
|
| -------- | -------------- | -------- |
|
|
| **IaC Language** | Nickel (functional) | TypeScript/Python/Go |
|
|
| **Paradigm** | Declarative | Imperative (code) |
|
|
| **State management** | SurrealDB multi-model | Pulumi Cloud / self-hosted |
|
|
| **Secrets** | SecretumVault integrated | Pulumi ESC (SaaS) |
|
|
| **Multi-cloud** | AWS, UpCloud, Local | Yes (100+ providers) |
|
|
| **AI-assisted** | MCP + RAG native | Pulumi AI (experimental) |
|
|
| **Testing** | Nickel contracts | Unit tests in code |
|
|
| **Best For** | Pure declarative, typed IaC | Developers, imperative code |
|
|
|
|
**Key differentiator**: Provisioning is pure declarative (Nickel) vs imperative (Pulumi code), with pre-runtime validation and Rust orchestrator for complex workflows.
|
|
|
|
### Provisioning vs Ansible
|
|
|
|
| Aspect | Provisioning | Ansible |
|
|
| -------- | -------------- | --------- |
|
|
| **Paradigm** | Declarative (Nickel IaC) | Imperative (playbooks) |
|
|
| **Agentless** | Yes (SSH) | Yes (SSH) |
|
|
| **Idempotence** | Nickel contracts | YAML tasks (depends on module) |
|
|
| **Performance** | Rust orchestrator (10-50x) | Python interpreter |
|
|
| **Multi-cloud** | AWS, UpCloud, Local | Yes (cloud modules) |
|
|
| **Dependency resolution** | Automatic topological sort | Manual (pre_tasks, post_tasks) |
|
|
| **Rollback** | Automatic with checkpoints | Manual (rescue blocks) |
|
|
| **Best For** | Typed IaC, critical performance | Configuration management, ad-hoc |
|
|
|
|
**Key differentiator**: Provisioning is declarative IaC (not imperative playbooks) with Rust orchestrator 10-50x faster than Python, automatic rollback and topological dependency resolution.
|
|
|
|
### SecretumVault vs HashiCorp Vault
|
|
|
|
| Aspect | SecretumVault | HashiCorp Vault |
|
|
| -------- | --------------- | ----------------- |
|
|
| **Language** | Rust (memory-safe) | Go (CGO overhead) |
|
|
| **Post-Quantum** | ✅ **ML-KEM-768, ML-DSA-65** | ❌ No roadmap |
|
|
| **Crypto backends** | 4 (OpenSSL, **OQS**, AWS-LC, RustCrypto) | 1 (OpenSSL) |
|
|
| **Storage backends** | 4 (FS, etcd, SurrealDB, PostgreSQL) | 10+ (etcd, Consul, S3, etc) |
|
|
| **Policy engine** | Cedar ABAC (AWS-compatible) | HCL policies |
|
|
| **Shamir unsealing** | ✅ Native | ✅ Native |
|
|
| **Secrets engines** | 4 (KV, Transit, PKI, Database) | 10+ (includes cloud-specific) |
|
|
| **Ecosystem** | ⚠️ Small | ✅ Huge (plugins, integrations) |
|
|
| **License** | Apache-2.0 | BSL (Enterprise paywall) |
|
|
| **Best For** | **PQC today**, Rust stacks, data sovereignty | General use, mature ecosystem |
|
|
|
|
**Key differentiator**: SecretumVault is the **only Rust vault with production-ready post-quantum cryptography** (ML-KEM-768, ML-DSA-65 NIST FIPS 203/204), providing cryptographic agility for organizations deploying today.
|
|
|
|
### SecretumVault vs AWS Secrets Manager
|
|
|
|
| Aspect | SecretumVault | AWS Secrets Manager |
|
|
| -------- | --------------- | --------------------- |
|
|
| **Multi-cloud** | ✅ Any cloud or on-premise | ❌ AWS-only |
|
|
| **Self-hosted** | ✅ Full control | ❌ SaaS only |
|
|
| **Post-Quantum** | ✅ **ML-KEM + ML-DSA** | ❌ None |
|
|
| **Crypto backends** | 4 pluggable | 1 (AWS KMS) |
|
|
| **Dynamic secrets** | ✅ Database engine | ✅ RDS integration |
|
|
| **Vendor lock-in** | ✅ Portable | ⚠️ High (AWS-specific) |
|
|
| **Cost** | Self-hosted (infra cost) | $0.40/secret/month + API calls |
|
|
| **Best For** | Multi-cloud, **PQC**, data sovereignty | AWS-native apps, managed service |
|
|
|
|
**Key differentiator**: SecretumVault is multi-cloud and self-hosted with native PQC, vs AWS Secrets Manager cloud-only without post-quantum roadmap.
|
|
|
|
### Vapora vs Jenkins
|
|
|
|
| Aspect | Vapora | Jenkins |
|
|
| -------- | -------- | --------- |
|
|
| **Paradigm** | Agent orchestration (AI) | Pipeline orchestration (CI/CD) |
|
|
| **Agents** | LLM-powered (Claude, GPT, Gemini) | Build agents (workers) |
|
|
| **Orchestration** | NATS JetStream | Master-worker |
|
|
| **Learning** | Expertise profiles, recency bias | No (static) |
|
|
| **Budget control** | Per-role limits, fallback | N/A |
|
|
| **Pipeline definition** | Tasks + agent roles | Jenkinsfile (Groovy) |
|
|
| **UI** | Leptos WASM (Kanban) | Web UI (Java) |
|
|
| **Best For** | AI-assisted operations, LLM orchestration | Traditional CI/CD, build automation |
|
|
|
|
**Key differentiator**: Vapora orchestrates **intelligent LLM agents** with learning and cost control, not traditional build agents.
|
|
|
|
### Vapora vs GitHub Actions
|
|
|
|
| Aspect | Vapora | GitHub Actions |
|
|
| -------- | -------- | ---------------- |
|
|
| **Self-hosted** | ✅ Kubernetes native | ✅ Self-hosted runners |
|
|
| **Agents** | LLM-powered with roles | Workflow runners |
|
|
| **Orchestration** | NATS JetStream | GitHub infrastructure |
|
|
| **Learning** | Expertise profiles | No (static) |
|
|
| **Budget control** | LLM cost limits | Minutes-based billing |
|
|
| **Multi-tenant** | SurrealDB scopes + Cedar | Repository-level |
|
|
| **Best For** | AI operations, agent coordination | GitHub-native CI/CD, simple workflows |
|
|
|
|
**Key differentiator**: Vapora is an AI agent orchestration platform with learning, not a CI/CD workflow runner.
|
|
|
|
### TypeDialog (prov-gen) vs Terraform Modules
|
|
|
|
| Aspect | TypeDialog (prov-gen) | Terraform Modules |
|
|
| -------- | ----------------------- | ------------------- |
|
|
| **Input method** | TOML forms (CLI/TUI/Web) | Variables (.tfvars) |
|
|
| **Validation** | Nickel contracts (pre-runtime) | Variable validation (runtime) |
|
|
| **Output format** | Nickel IaC | HCL |
|
|
| **Multi-backend** | 6 (CLI/TUI/Web/AI/Agent/Prov-gen) | CLI only |
|
|
| **IaC generation** | Tera templates + validation | Module composition |
|
|
| **Best For** | Interactive wizards, self-service | Reusable modules, Terraform ecosystem |
|
|
|
|
**Key differentiator**: TypeDialog unifies input capture (CLI/TUI/Web) with validated IaC generation (Nickel), not just reusable modules.
|
|
|
|
### Kogral vs Confluence
|
|
|
|
| Aspect | Kogral | Confluence |
|
|
| -------- | -------- | ------------ |
|
|
| **Target** | Development/ops teams | General teams |
|
|
| **Git-native** | ✅ Markdown + YAML frontmatter | ❌ Cloud/Server |
|
|
| **Node types** | 6 specialized (ADR, Pattern, etc) | Generic pages |
|
|
| **MCP Server** | ✅ Claude Code native | ❌ No |
|
|
| **Semantic search** | fastembed + cloud embeddings | Internal search |
|
|
| **Self-hosted** | ✅ Filesystem + SurrealDB | Cloud or Data Center |
|
|
| **Best For** | Dev/Ops knowledge, AI integration | General documentation, wikis |
|
|
|
|
**Key differentiator**: Kogral is specifically designed for technical knowledge (runbooks, ADRs, postmortems) with native AI integration via MCP.
|
|
|
|
---
|
|
|
|
## 3. Use Cases and Context (Ops Perspective)
|
|
|
|
### When to Use Each Project
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────┐
|
|
│ "I need to provision multi-cloud infrastructure with IaC" │
|
|
│ → Provisioning (Nickel IaC, multi-cloud, orchestrator) │
|
|
├─────────────────────────────────────────────────────────────────┤
|
|
│ "I want secrets management with post-quantum preparation" │
|
|
│ → SecretumVault (PQC ML-KEM/ML-DSA, 4 crypto backends) │
|
|
├─────────────────────────────────────────────────────────────────┤
|
|
│ "I need to orchestrate AI agents for operational tasks" │
|
|
│ → Vapora (DevOps/Monitor/Security agents, NATS, budget) │
|
|
├─────────────────────────────────────────────────────────────────┤
|
|
│ "I want configuration wizards that generate IaC" │
|
|
│ → TypeDialog (prov-gen backend, CLI/TUI/Web) │
|
|
├─────────────────────────────────────────────────────────────────┤
|
|
│ "I need to preserve runbooks and incident postmortems" │
|
|
│ → Kogral (6 node types, MCP, git-native) │
|
|
└─────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
### Decision Matrix by Ops Context
|
|
|
|
| Context | Main Project | Supporting Projects |
|
|
| --------- | -------------- | --------------------- |
|
|
| **Multi-cloud provisioning** | Provisioning | TypeDialog (wizards), SecretumVault (certs), Kogral (ADRs) |
|
|
| **PQC secrets management** | SecretumVault | Provisioning (infrastructure), Kogral (policies) |
|
|
| **Incident response** | Vapora (Monitor/DevOps agents) | Kogral (runbooks/postmortems), SecretumVault (credentials) |
|
|
| **CI/CD automation** | Vapora (DevOps agent) | Provisioning (deploy), SecretumVault (secrets), Kogral (guidelines) |
|
|
| **Infrastructure self-service** | TypeDialog (prov-gen) | Provisioning (apply IaC), Kogral (docs) |
|
|
| **Knowledge preservation** | Kogral | Vapora (execution tracking), TypeDialog (export) |
|
|
| **Disaster recovery** | Provisioning (rollback) | SecretumVault (backup), Kogral (procedures) |
|
|
|
|
---
|
|
|
|
## 4. Why They Are Necessary (Ops Perspective)
|
|
|
|
### Problems They Solve
|
|
|
|
#### Provisioning: The Fragile YAML Problem
|
|
|
|
```
|
|
BEFORE AFTER (Provisioning)
|
|
───────────────────────────────── ─────────────────────────────────
|
|
Untyped YAML, runtime errors Typed Nickel, compile-time errors
|
|
Fragile imperative scripts Declarative workflows with rollback
|
|
Terraform state drift SurrealDB with time-series
|
|
No AI assistance MCP + RAG (1000x Python)
|
|
Manual dependency management Automatic topological sort
|
|
```
|
|
|
|
#### SecretumVault: The Quantum Cryptography Problem
|
|
|
|
```
|
|
BEFORE AFTER (SecretumVault)
|
|
───────────────────────────────── ─────────────────────────────────
|
|
Vault in Go (no memory-safety) Rust with memory guarantees
|
|
Classical crypto only (vulnerable) Post-quantum (ML-KEM, ML-DSA)
|
|
Fixed crypto backend Pluggable backends (agility)
|
|
SaaS lock-in (AWS, Azure) Complete self-hosted
|
|
No quantum threat preparation Deploy PQC today, gradual migration
|
|
```
|
|
|
|
#### Vapora: The Manual Ops Coordination Problem
|
|
|
|
```
|
|
BEFORE AFTER (Vapora)
|
|
───────────────────────────────── ─────────────────────────────────
|
|
Ad-hoc scripts without coordination NATS JetStream orchestration
|
|
LLMs without cost control Budget enforcement + fallback
|
|
Agents without historical context Expertise profiles + recency bias
|
|
Manual handoffs (deploy → monitor) Automated pipelines with roles
|
|
No execution visibility Prometheus metrics + SurrealDB
|
|
```
|
|
|
|
#### TypeDialog (prov-gen): The Manual Configuration Problem
|
|
|
|
```
|
|
BEFORE AFTER (TypeDialog)
|
|
───────────────────────────────── ─────────────────────────────────
|
|
Error-prone manual configuration Validated forms (Nickel)
|
|
CLI ≠ Web ≠ TUI interfaces 1 TOML → 6 backends
|
|
No IaC generation prov-gen → multi-cloud Nickel
|
|
Runtime validation Pre-runtime validation (contracts)
|
|
```
|
|
|
|
#### Kogral: The Lost Ops Knowledge Problem
|
|
|
|
```
|
|
BEFORE AFTER (Kogral)
|
|
───────────────────────────────── ─────────────────────────────────
|
|
Scattered Confluence runbooks Git-native, versioned
|
|
Unsearchable postmortems Semantic search + MCP
|
|
Lost infrastructure ADRs Decision nodes with relationships
|
|
Incidents without historical context Execution nodes with timeline
|
|
SRE onboarding takes weeks Semantic search in days
|
|
```
|
|
|
|
---
|
|
|
|
## 5. What Makes Them Different (Ops Perspective)
|
|
|
|
### Unique Features per Project
|
|
|
|
#### Provisioning
|
|
|
|
1. **Nickel IaC**: Only with lazy-eval typed language as primary (not HCL, not YAML)
|
|
2. **Hybrid orchestrator**: Rust (performance) + Nushell (flexibility)
|
|
3. **MCP 1000x faster**: Rust-native vs Python implementations
|
|
4. **39K lines security**: 12 enterprise components (JWT, Cedar, MFA, audit, KMS)
|
|
5. **80+ CLI shortcuts**: Optimized developer experience with guided wizards
|
|
|
|
#### SecretumVault
|
|
|
|
1. **Native Post-Quantum**: ML-KEM-768, ML-DSA-65 (NIST FIPS 203/204) **production-ready today**
|
|
2. **4 crypto backends**: OpenSSL, **OQS**, AWS-LC, RustCrypto (cryptographic agility without code changes)
|
|
3. **4 storage backends**: Filesystem, etcd, SurrealDB, PostgreSQL (deployment flexibility)
|
|
4. **Shamir Secret Sharing**: Distributed unsealing with configurable threshold (3-of-5, 5-of-7, etc)
|
|
5. **Cedar ABAC**: AWS-compatible authorization policies (portable, no vendor lock-in)
|
|
|
|
#### Vapora
|
|
|
|
1. **Learning-based selection**: Scoring `0.3*load + 0.5*expertise + 0.2*confidence` with 3x recency bias (last 7 days)
|
|
2. **Budget enforcement**: Per-role hard caps (monthly/weekly) with automatic fallback to cheaper providers
|
|
3. **NATS JetStream**: At-least-once coordination, message persistence, distributed
|
|
4. **12 agent roles**: Architect, Developer, CodeReviewer, Tester, Documenter, Marketer, Presenter, **DevOps**, **Monitor**, **Security**, ProjectManager, DecisionMaker
|
|
5. **Native multi-tenant**: SurrealDB scopes + Cedar RBAC, complete isolation
|
|
|
|
#### TypeDialog
|
|
|
|
1. **6 unified backends**: CLI/TUI/Web/AI/Agent/**Prov-gen** from same TOML
|
|
2. **Prov-gen IaC generation**: AWS/GCP/Azure/Hetzner/UpCloud from typed forms
|
|
3. **Nickel contracts**: Pre-runtime validation with type-safe schemas
|
|
4. **3,818 tests**: Exhaustive coverage (503% growth), production-ready
|
|
5. **Native multi-language**: Fluent bundles for i18n without reimplementing logic
|
|
|
|
#### Kogral
|
|
|
|
1. **6 specialized node types**: Note, Decision (ADR), Guideline, Pattern, Journal, **Execution** (for ops/incidents)
|
|
2. **Hybrid embeddings**: Local fastembed (privacy) + cloud (production)
|
|
3. **Native MCP**: 7 tools for Claude Code, no extra configuration required
|
|
4. **Git-native**: Everything versioned markdown, no external SaaS, full control
|
|
5. **Guideline inheritance**: Org → Project with priority, cross-team consistency
|
|
|
|
---
|
|
|
|
## 6. Synergies and Reuse (Ops Workflows)
|
|
|
|
### Ops Integration Flow
|
|
|
|
```
|
|
┌──────────────────┐
|
|
│ Kogral │
|
|
│ (Runbooks, ADRs) │
|
|
└────────┬─────────┘
|
|
│ Operational knowledge
|
|
▼
|
|
┌──────────────┐ ┌──────────────────┐ ┌──────────────┐
|
|
│ TypeDialog │───▶│ Vapora │───▶│ Provisioning │
|
|
│ (Wizards) │ │ (Ops Agents) │ │ (IaC Deploy) │
|
|
└──────────────┘ └──────────────────┘ └──────────────┘
|
|
│ │ │
|
|
│ Configuration │ Orchestration │ Infrastructure
|
|
▼ ▼ ▼
|
|
┌─────────────────────────────────────────────────────────────┐
|
|
│ SECRETUMVAULT │
|
|
│ PKI certs │ Dynamic DB creds │ API keys │ Encryption │
|
|
└─────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
### Reusable Components (Ops Stack)
|
|
|
|
| Component | Origin | Reused In |
|
|
| ----------- | -------- | ----------- |
|
|
| **SurrealDB schemas** | Vapora | Kogral, Provisioning, SecretumVault (optional) |
|
|
| **Nickel contracts** | Provisioning | TypeDialog (prov-gen validation) |
|
|
| **Cedar policies** | Provisioning | SecretumVault, Vapora (multi-tenant) |
|
|
| **Axum API patterns** | Vapora | Provisioning (control-center), SecretumVault (vault API) |
|
|
| **tracing setup** | Vapora | All (structured logging) |
|
|
| **Crypto backends** | SecretumVault | Provisioning (KMS integration) |
|
|
| **NATS patterns** | Vapora | Provisioning (future messaging), SecretumVault (HA) |
|
|
|
|
### Synergy Scenarios (Ops Workflows)
|
|
|
|
#### Scenario 1: Zero-Touch Provisioning with AI
|
|
|
|
```
|
|
1. TypeDialog (prov-gen): SRE completes web wizard
|
|
- Cloud provider, region, cluster size, services
|
|
- Generates Nickel IaC validated with contracts
|
|
|
|
2. Kogral: MCP provides deployment guidelines
|
|
- "What is our cluster naming policy?"
|
|
- "What security groups do we apply by default?"
|
|
|
|
3. Provisioning: Orchestrator deploys infrastructure
|
|
- Servers → networking → storage → services
|
|
- Checkpoints per step, automatic rollback if fails
|
|
|
|
4. SecretumVault: Generates certificates and secrets
|
|
- PKI engine: etcd, kube-apiserver, kubelet certs (ML-DSA-65 PQC)
|
|
- Database engine: PostgreSQL dynamic credentials (TTL 1h)
|
|
|
|
5. Vapora: Post-deployment automation
|
|
- Monitor Agent: Setup Prometheus alerts, health checks
|
|
- Security Agent: Vulnerability scan, compliance check
|
|
- DevOps Agent: Deploy baseline apps (Ingress, cert-manager)
|
|
|
|
6. Kogral: Documents deployment
|
|
- Execution node with timestamp, created resources, configuration
|
|
- Links to architecture ADRs, maintenance runbooks
|
|
```
|
|
|
|
#### Scenario 2: Automated Incident Response
|
|
|
|
```
|
|
1. Vapora Monitor Agent: Detects anomaly (PostgreSQL down)
|
|
- Alert via NATS JetStream
|
|
- Trigger incident response pipeline
|
|
|
|
2. Kogral: Claude Code queries runbooks via MCP
|
|
- search("postgresql outage troubleshooting")
|
|
- Returns 3 similar postmortems with resolutions
|
|
|
|
3. Vapora DevOps Agent: Executes automated runbook
|
|
- Verify PostgreSQL process (systemctl status)
|
|
- Check logs (/var/log/postgresql)
|
|
- Restart if needed with adjusted parameters
|
|
|
|
4. SecretumVault: Rotates compromised credentials
|
|
- Database engine generates new dynamic credentials
|
|
- Updates connected apps via secret injection
|
|
|
|
5. Vapora Security Agent: Post-incident audit
|
|
- Review access logs, configuration changes
|
|
- Generate compliance report
|
|
|
|
6. Kogral: Documents postmortem
|
|
- Execution node with root cause, timeline, resolution
|
|
- Links to PostgreSQL configuration ADRs
|
|
- Action items to prevent recurrence
|
|
```
|
|
|
|
#### Scenario 3: Gradual Post-Quantum Migration
|
|
|
|
```
|
|
1. Kogral: Documents strategic decision
|
|
- ADR: "Gradual migration to post-quantum cryptography"
|
|
- Rationale: Preparation for quantum threats (harvest now, decrypt later)
|
|
- Timeline: Q1 2026 testing, Q2 2026 staging, Q3 2026 production
|
|
|
|
2. SecretumVault: Migrates secrets in staging
|
|
- Backend switch: openssl → oqs (ML-KEM-768)
|
|
- Re-encrypts existing secrets with PQC
|
|
- Dual-stack: classical for legacy, PQC for new services
|
|
|
|
3. Provisioning: Updates PKI infrastructure
|
|
- Generates new certificates with ML-DSA-65 (PQC signatures)
|
|
- Deploys certificates to services (etcd, K8s API, service mesh)
|
|
- Health checks: latency not degraded, handshakes correct
|
|
|
|
4. Vapora: Orchestrates comprehensive validation
|
|
- Security Agent: Verifies correct cryptographic algorithms
|
|
- Monitor Agent: Benchmark latency (PQC vs classical)
|
|
- DevOps Agent: Integration tests with PQC certificates
|
|
|
|
5. TypeDialog: Self-service portal for teams
|
|
- Form: "Migrate service to PQC"
|
|
- Input: service name, migration strategy (gradual/immediate)
|
|
- prov-gen: Generates updated configuration (Nickel)
|
|
|
|
6. Kogral: Migration tracking
|
|
- Execution nodes per migrated service
|
|
- Metrics: services migrated, performance impact, issues
|
|
- Lessons learned: what worked, what to improve
|
|
```
|
|
|
|
#### Scenario 4: Multi-Cloud Disaster Recovery
|
|
|
|
```
|
|
1. Kogral: Disaster recovery runbook
|
|
- Procedure: "Failover from AWS to UpCloud in <1h"
|
|
- Prerequisites, detailed steps, validation
|
|
|
|
2. Vapora: Automatic trigger (AWS region down)
|
|
- Monitor Agent detects regional outage
|
|
- ProjectManager Agent declares disaster recovery mode
|
|
- DevOps Agent executes Kogral runbook
|
|
|
|
3. Provisioning: Deploys replica on UpCloud
|
|
- Multi-cloud Nickel IaC (change: provider = "upcloud")
|
|
- Orchestrator deploys: servers → networking → K8s → apps
|
|
- Checkpoints: rollback to AWS if UpCloud also fails
|
|
|
|
4. SecretumVault: Synchronizes secrets
|
|
- Cross-region etcd replication (AWS → UpCloud)
|
|
- PKI engine generates certificates for UpCloud region
|
|
- Database engine: new DB dynamic credentials
|
|
|
|
5. TypeDialog: DNS failover wizard
|
|
- Form: Update DNS records (Route53 → NS1)
|
|
- Validation: TTL check, propagation time
|
|
|
|
6. Kogral: Documents incident
|
|
- Execution node: timeline, decisions, metrics
|
|
- RTO achieved, RPO achieved, issues encountered
|
|
- Postmortem: what to improve in runbook
|
|
```
|
|
|
|
---
|
|
|
|
## 7. Dependencies and Adoption Order (Ops Teams)
|
|
|
|
### Dependency Graph
|
|
|
|
```
|
|
SecretumVault (standalone)
|
|
│
|
|
│ provides secrets to
|
|
▼
|
|
Kogral ◄────────────────────────► Provisioning
|
|
(standalone) (can integrate vault)
|
|
│ │
|
|
│ provides runbooks to │ deploys infrastructure for
|
|
▼ ▼
|
|
Vapora
|
|
(integrates all)
|
|
│
|
|
│ uses wizards from
|
|
▼
|
|
TypeDialog
|
|
(prov-gen → Provisioning)
|
|
```
|
|
|
|
### Recommended Adoption Order (Ops Perspective)
|
|
|
|
| Phase | Project | Reason | Dependencies |
|
|
| ------- | --------- | -------- | -------------- |
|
|
| 1 | **SecretumVault** | Critical secrets management, no dependencies | None (standalone) |
|
|
| 2 | **Kogral** | Operational knowledge base (runbooks, ADRs) | None (standalone) |
|
|
| 3 | **Provisioning** | Declarative IaC, can integrate SecretumVault (optional) | Optional: SecretumVault (KMS) |
|
|
| 4 | **TypeDialog** | Configuration wizards, prov-gen for Provisioning | Optional: Provisioning (IaC apply) |
|
|
| 5 | **Vapora** | Agent orchestration, integrates all previous | Kogral (runbooks), SecretumVault (creds), Provisioning (deploy) |
|
|
|
|
**Note**: Each project is functional independently, but synergies emerge with progressive adoption.
|
|
|
|
---
|
|
|
|
## 8. Ecosystem Comparison
|
|
|
|
### STRATUMIOPS Ops vs HashiCorp Stack
|
|
|
|
| Component | STRATUMIOPS | HashiCorp |
|
|
| ----------- | --------- | ----------- |
|
|
| **IaC** | Provisioning (typed Nickel) | Terraform (untyped HCL) |
|
|
| **Secrets** | SecretumVault (Rust, **PQC**) | Vault (Go, no PQC) |
|
|
| **Orchestration** | Vapora (LLM agents) | Nomad (workload scheduler) |
|
|
| **Service Mesh** | Integrates Istio | Consul Connect |
|
|
| **Policy** | Cedar (AWS-compatible) | Sentinel (HCL) |
|
|
| **Language** | Rust (memory-safe) | Go (garbage collector) |
|
|
| **AI-assisted** | MCP + RAG native | Terraform Cloud AI (limited) |
|
|
| **License** | Apache-2.0 | BSL (Enterprise paywall) |
|
|
| **Ecosystem** | ⚠️ Small | ✅ Huge |
|
|
|
|
### STRATUMIOPS Ops vs AWS Native Stack
|
|
|
|
| Component | STRATUMIOPS | AWS Native |
|
|
| ----------- | --------- | ------------ |
|
|
| **IaC** | Provisioning (multi-cloud) | CloudFormation (AWS-only) |
|
|
| **Secrets** | SecretumVault (**PQC**, self-hosted) | Secrets Manager (SaaS, no PQC) |
|
|
| **Orchestration** | Vapora (self-hosted K8s) | Step Functions (SaaS) |
|
|
| **CI/CD** | Vapora DevOps Agent | CodePipeline + CodeBuild |
|
|
| **Storage** | SurrealDB multi-model | DynamoDB + RDS |
|
|
| **Policy** | Cedar (portable) | IAM (AWS-specific) |
|
|
| **Multi-cloud** | ✅ AWS/UpCloud/Local | ❌ AWS-only |
|
|
| **Vendor lock-in** | ✅ Portable | ⚠️ High |
|
|
| **Cost** | Self-hosted (infra cost) | SaaS (per-use billing) |
|
|
|
|
---
|
|
|
|
## 9. Portfolio Metrics (Ops Perspective)
|
|
|
|
| Metric | Provisioning | SecretumVault | Vapora | TypeDialog | Kogral | **Total** |
|
|
| -------- | -------------- | --------------- | -------- | ------------ | -------- | ----------- |
|
|
| **Lines of Code** | ~40K | ~11K | ~50K | ~90K | ~15K | **~206K** |
|
|
| **Tests** | 218 | 50+ | 218 | 3,818 | 56 | **4,360+** |
|
|
| **CLI Commands** | 80+ shortcuts | 10+ (svault) | 10+ (vapora) | 6 backends | 13 commands | **100+** |
|
|
| **Storage Backends** | SurrealDB | 4 (FS/etcd/SurrealDB/PostgreSQL) | SurrealDB + NATS | Multi-format | FS + SurrealDB | **4 backends** |
|
|
| **API Endpoints** | 40+ (control-center) | 20+ (vault API) | 40+ (backend) | 10+ (web) | N/A (MCP) | **100+** |
|
|
| **Policy Engine** | Cedar RBAC/ABAC | Cedar ABAC | Cedar multi-tenant | N/A | N/A | **Cedar AWS-compatible** |
|
|
| **Crypto Backends** | 5 KMS | **4 (OpenSSL, OQS PQC, AWS-LC, RustCrypto)** | N/A | N/A | N/A | **4 backends** |
|
|
| **Multi-cloud** | AWS/UpCloud/Local | N/A | N/A | Yes (prov-gen) | N/A | **3 clouds** |
|
|
|
|
---
|
|
|
|
## 10. Conclusion (Ops/DevOps Teams)
|
|
|
|
This portfolio represents a cohesive ecosystem for modern operations:
|
|
|
|
- **Provisioning** is the muscle: deploys multi-cloud infrastructure with typed IaC and automatic rollback
|
|
- **SecretumVault** is the vault: protects secrets with production-ready post-quantum cryptography
|
|
- **Vapora** is the brain: orchestrates Ops agents (DevOps, Monitor, Security) with learning and cost control
|
|
- **TypeDialog** is the interface: configuration wizards that generate validated multi-cloud IaC
|
|
- **Kogral** is the memory: preserves runbooks, postmortems and operational knowledge
|
|
|
|
The **key differentiation** versus alternatives (Ops perspective):
|
|
|
|
1. **Full Rust stack**: Performance (10-50x Python), memory-safety, zero-cost abstractions
|
|
2. **Typed Nickel IaC**: Configuration errors detected at compile time, not at runtime
|
|
3. **Post-Quantum ready**: SecretumVault with native ML-KEM-768/ML-DSA-65, deploy today
|
|
4. **AI-native from design**: MCP + RAG integrated, not retrofitted
|
|
5. **Unified multi-cloud**: One Nickel configuration for AWS/UpCloud/Local
|
|
6. **Enterprise security**: Cedar policies, audit logging, RBAC/ABAC, 7 years retention
|
|
|
|
The **synergy** between projects enables addressing operations with:
|
|
|
|
- Typed and validated infrastructure (Provisioning)
|
|
- Secrets with cryptographic agility (SecretumVault)
|
|
- Intelligent Ops agent orchestration (Vapora)
|
|
- Configuration wizards (TypeDialog)
|
|
- Preserved operational knowledge (Kogral)
|
|
|
|
**Best for**: DevOps/SRE teams valuing type-safety, performance, PQC readiness, multi-cloud, and self-hosted infrastructure over mature ecosystems with vendor lock-in.
|
|
|
|
---
|
|
|
|
*Document generated: 2026-01-22*
|
|
*Type: info (Ops/DevOps positioning)*
|