Neural Inverse Govern / Platform operations
A control plane that keeps itself healthy and tells you when it cannot.
Self-healing with approval and a kill switch, adaptive admission control, health probes and metrics, a rollout gate, and the operator tools for status, SLAs, runbooks, disaster recovery drills, feature flags and alerts.
- Watches
- Process, database, disks, certificates, jobs
- Acts
- Playbooks with verification and approval
- Sheds
- By priority, with per-organisation bulkheads
- Alerts
- Log and HMAC-signed webhook
- Runs
- Air-gapped, from memory during database outages
Overview
Govern looks after itself. Each process watches its own runtime and the dependencies it needs, PostgreSQL first, learns baselines, sheds load under pressure, runs remediation playbooks within strict limits, checks that a repair worked and escalates to operators when it did not. Detection and alerting keep running from memory while the database is down. Around it are the tools an operator uses every day: probes and metrics, a rollout gate, a status page, SLA reports, runbooks, disaster recovery drills and feature flags.
What it does
What platform operations covers.
Self-healing and the operator tools that work today.
What it watchesHTTP errors and latency, Go runtime memory and garbage collection, file descriptors, the database pool, PostgreSQL connections, long and idle transactions, lock waits and replication lag, disks, certificates and every background job.
Anomaly detectionBaselines learnt per hour of the week, SLO burn-rate rules on availability, loopback canaries of the server's own sign-in endpoints, and findings that most nodes share or a new release regresses.
Remediation playbooksCapture diagnostics, release memory, shed batch traffic, recycle database connections, restart a stalled job, prune diagnostics or drain a node, each followed by a check that it worked.
Safe by constructionActions run under a mode, a cluster-wide kill switch, cooldowns, an hourly budget per node and prechecks. Disruptive actions such as draining a node wait for an operator's approval.
Admission controlAn adaptive concurrency limit with request classes: probes are never shed, sign-in and token endpoints have headroom, and exports and bulk jobs give way first.
Tenant bulkheadsUnder load one organisation may hold at most a share of capacity. Refused requests get 503 or 429 with a retry time.
Supervised jobsEvery background job reports heartbeats, runs, durations and failures; crash loops and stalls raise findings and a stalled job is restarted.
Across every planeThe same self-healing runs in the data plane, the compliance plane, the provisioner and the sandbox daemons.
Drills and the rollout gateRehearse detection and alerting with drills, and let deploy tooling hold or roll back a release that is not ready or regresses against the previous one.
Probes and metricsLiveness and readiness probes, a drain-aware readiness probe, Prometheus metrics for scrapers, and a break-glass status that works while the database is down.
Signed alertsAlerts go to the log and, if you set one, to your webhook, signed with HMAC-SHA256 and a timestamp and retried up to five times.
Status page and SLAsStatus components and incidents with email subscriptions confirmed by double opt-in, and monthly SLA reports with service credits per tier.
Runbooks and DR testsOperational runbooks, a platform incident log and scheduled disaster recovery drills whose pass or fail Govern decides. Every write needs a reason and is audited.
Database and clusterLive connection pool statistics, slow queries, a connection pooler configuration generator, the nodes in the cluster, and a version compatibility matrix with upgrade history.
Integration and email healthProbes of your integrations, webhooks, database and certificate expiry, and the health of outbound email delivery.
Feature flagsFlags per organisation with targeting rules, percentage rollout, a kill switch, evaluation statistics and a change log.
How it works
How a node under pressure is handled.
- DetectA rule fires: memory at 85% of the limit for three ticks.
- RelieveDiagnostics are captured, memory released and batch traffic shed.
- VerifySelfguard checks whether the pressure fell.
- ApproveIf not, draining the node is proposed and waits for an operator.
- DrainReadiness turns false for three minutes so load balancers route around it.
- RecordEvery finding and action is in the audit log with the change.
Who uses it
Built for every role that answers for AI.
Site reliability engineersTriage findings, approve or reject disruptive actions and run drills at handover.
Release managersGate releases on the rollout gate and its soak time.
Platform operatorsRun the status page, SLA reports, runbooks and disaster recovery drills.
Product teamsRoll features out gradually with flags and turn them off with the kill switch.
Enforced and recorded
Bounded, approved and on record.
Self-healing can only do what its limits allow, and everything it does is audited.
Enforced
Limits on actionsA kill switch that reaches every node within one tick, cooldowns, an hourly budget and post-action checks.
ApprovalDraining a node and ending idle database transactions need an operator's approval within a time window. A node is never drained when it is the only one.
Operator routesSelf-healing and platform operator routes are for super admins, and every change needs a reason.
Fail fast on configurationAn invalid setting stops the start with a message naming it, rather than running half-configured.
Recorded
Findings and actionsEvery automatic or operator action and every finding transition, in the same transaction as the change.
During outagesHistory is buffered in memory while the database is down and written once it returns; anything dropped is counted.
Operator recordsRunbook, incident and DR test changes with the operator and the reason.
Self-hostedRuns in your installation with no external calls; alerts go to your log and your webhook.
Air-gappedDetection, healing and alerting need nothing outside your network.
Hosted by usWe operate it for you; customers see platform health through the status page.
Get started
Set it up with the documentation.
What's next
Being built now.
These are in development and not part of the product today.
Organisation webhooksOutbound webhooks for organisation events with signed delivery, retries, a dead-letter view and test sends.
Notification inboxAn in-app inbox for each person with email and webhook channels and preferences.
Event-triggered workflowsWorkflows that run on platform events, not only when started by hand.
Richer flag targetingFeature flag targeting by location, custom expressions and cohorts.
Self-healing consoleConsole pages for findings, actions and drills beyond the operator area's self-healing page.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.