Autonomy, drafted fixes and the halt switch
What 3AM may do, service by service (off, shadow, L1, L2), readiness for L1, drafted fixes, and how to stop everything at once.
| Level | What 3AM does |
|---|---|
off | Nothing: the service isn't managed |
shadow | Proves, rehearses, records what it would do. Asks no one, changes nothing. What L1 and L2 would have done is recorded too |
L1 | Proves, rehearses the fix, asks for approval, makes the change, verifies it |
L2 | As L1, but fixes marked safe run without asking: a rolling restart of a stateless Deployment, a bounded scale-up, a traffic shift you declared reversible (Which fixes are safe) |
Raising a service
On Autonomy (/autonomy, g u), Request L1 (or L2) next to the service. 3AM asks the channels set for
autonomy changes; the change happens only when two different people approve (autonomy_change.quorum). It is
refused at once, with the reason, when the channels name fewer approvers than the quorum. Readiness shows how often
3AM's shadow proposals matched what your team did (Digest).
Lowering to shadow or off applies at once: making 3AM do less never waits for anyone.
Drafted fixes
When a cause is proven but no pack has a fix for it, the install-wide fix mode decides:
| Mode | What happens |
|---|---|
advise (default) | The advice goes to people |
draft | 3AM drafts a fix (first an exact undo of the proven change, otherwise one of your connectors' declared actions) and sends it through every gate a pack fix goes through, plus more: two approvers each by default, a labelled request, a re-check just before it runs, no retry |
Turning draft on is requested from the approvers like raising autonomy; advise applies at once. The quorum per
drafted fix is on Settings → Policy (1–3). Restore moves (when nothing is proven) also need draft.
Drafted fixes and restore first.
The halt switch
Halt all actions refuses every action on every service at once, for example during a change freeze. Responders and up can halt, with a reason that's shown everywhere and recorded; it is one press, no confirmation. Resume (admins) lifts it. Diagnosis continues while halted. A halt is local to this install: it is never carried by the Keychain.
API
curl -s -H "Authorization: Bearer $T" $URL/v1/autonomy # levels, halt, quorum, fix mode
curl -s -X POST -H "Authorization: Bearer $T" -d '{"service":"payments","level":"L1"}' $URL/v1/autonomy # 202: requested
curl -s -X POST -H "Authorization: Bearer $T" -d '{"mode":"draft"}' $URL/v1/fix-mode # 202: requested
curl -s -X POST -H "Authorization: Bearer $T" -d '{"reason":"change freeze"}' $URL/v1/halt