AI-SRE-Agent (Nika)

Ni (नि) — to investigate. Ka (क) — the one who does. "The one who investigates."

Autonomous AI SRE agent that monitors multi-account AWS infrastructure, performs real-time Root Cause Analysis when alerts fire, and posts findings directly to your incident channels. Learns from every investigation and engineer feedback.

Built for Vegapay — powering credit card and payment processing across 7 banking clients, 4 AWS accounts.

Architecture

┌────────────────────────────────────────────────────────────────────────┐
│                    ALERT SOURCES (4 AWS Accounts)                        │
│  CloudWatch │ Prometheus │ PagerDuty │ Opsgenie │ Datadog               │
└──────────────────────────────┬──────────────────────────────────────────┘
                               │ SNS → cross-account SQS
                               ▼
┌──────────────────────────────────────────────────────────────────────────┐
│              Vegapay-AI Account (g5.xlarge EC2 Spot)                       │
│                                                                           │
│  ┌──────────┐  ┌──────────────┐  ┌──────────────┐  ┌───────────────┐   │
│  │  vLLM    │  │  HolmesGPT   │  │ Memory       │  │  PostgreSQL   │   │
│  │  Server  │  │  + Slack Bot  │  │ Worker       │  │  + pgvector   │   │
│  │ Qwen3.6  │  │  + Plugins   │  │              │  │               │   │
│  │ 27B-AWQ  │  │              │  │              │  │               │   │
│  └──────────┘  └──────────────┘  └──────────────┘  └───────────────┘   │
│  ┌────────────────────┐  ┌────────────────────────────────────────────┐ │
│  │ Embedder (CPU)     │  │ RCA Dashboard (FastAPI)                     │ │
│  │ bge-base-en-v1.5   │  │ Browse/search/filter past investigations   │ │
│  └────────────────────┘  └────────────────────────────────────────────┘ │
└────────────────────────────────┬────────────────────────────────────────┘
                                 │ sts:AssumeRole (OIDC)
              ┌──────────────────┼──────────────────┐
              ▼                  ▼                  ▼
    ┌─────────────────┐ ┌──────────────┐ ┌──────────────────┐
    │ Vegapay Prod     │ │ SSFB         │ │ Yes Bank / BOB   │
    │ (4 clients:      │ │ (dedicated)  │ │ (dedicated)      │
    │ Capri/Ebix/      │ └──────────────┘ └──────────────────┘
    │ Scapia/Pahal)    │
    └─────────────────┘

Install

pip install nika

With Datadog support:

pip install nika[datadog]

Configuration

All config via environment variables (12-factor). Prefix: NIKA_.

Core

Infrastructure-agnostic: Every dependency is a connection string. Use self-hosted containers, managed services (RDS, ElastiCache, Cloud SQL), or any mix. See docs/deployment.md for configuration examples.

Slack (Primary)

Microsoft Teams

PagerDuty

Opsgenie

Datadog Collector

Bedrock Fallback (P1 only)

Accounts (YAML)

# config/accounts.yaml
accounts:
  - id: "111111111111"
    name: "vegapay-prod"
    type: "shared-cluster"
    role_arn: "arn:aws:iam::111111111111:role/ai-sre-readonly-role"
    region: "ap-south-1"
    clients:
      - name: "capri"
        label_selector: "vegapay.io/client=capri"
        service_prefix: "capri-"
        slack_channel: "#oncall-support"
        l1_team: "@payments-capri"
        l2_poc: "@capri-client-devops"
      # ... more clients

  - id: "222222222222"
    name: "ssfb-prod"
    type: "dedicated"
    role_arn: "arn:aws:iam::222222222222:role/ai-sre-readonly-role"
    region: "ap-south-1"
    slack_channel: "#oncall-support"
    l1_team: "@payments-ssfb"
    l2_poc: "@ssfb-client-devops"

Plugin System

Notification Targets

All targets implement NotificationTarget — post RCA reports and follow-up messages.

Alert Collectors

All collectors implement AlertCollector — poll for alerts and fetch metrics.

Writing a Plugin

from nika.plugins import NotificationTarget
from nika.core.models import RCAReport

class MyTarget(NotificationTarget):
    name = "my-target"

    async def send_rca(self, report: RCAReport) -> str | None:
        # Post the RCA, return thread/incident ID
        ...

    async def send_followup(self, thread_id: str, message: str) -> None:
        # Post follow-up to existing thread
        ...

    async def healthcheck(self) -> bool:
        # Return True if connection is working
        ...

Project Structure

AI-SRE-Agent/
├── src/nika/
│   ├── __init__.py
│   ├── core/
│   │   ├── config.py              # Pydantic settings, account loading
│   │   └── models.py              # Alert, Investigation, RCAReport
│   ├── plugins/
│   │   ├── __init__.py            # Base classes: NotificationTarget, AlertCollector
│   │   ├── targets/
│   │   │   ├── teams.py           # Microsoft Teams (Adaptive Cards)
│   │   │   ├── pagerduty.py       # PagerDuty Events API v2
│   │   │   └── opsgenie.py        # Opsgenie Alerts API v2
│   │   └── collectors/
│   │       └── datadog.py         # Datadog monitor polling + metrics
│   ├── investigation/             # HolmesGPT integration, query planner
│   └── memory/                    # Episodic, semantic, procedural memory
├── services/
│   ├── memory-worker/
│   │   ├── main.py                # Background: extraction, decay, archive
│   │   └── Dockerfile
│   └── rca-dashboard/
│       ├── app.py                 # FastAPI: browse/search investigations
│       └── Dockerfile
├── tests/
│   ├── unit/
│   │   ├── test_models.py
│   │   ├── test_targets.py
│   │   └── test_datadog.py
│   └── integration/
├── .github/workflows/
│   ├── ci.yml                     # Lint + test + docker build on push/PR
│   └── release.yml                # PyPI + GHCR publish on tag
├── config/
│   └── accounts.yaml              # Multi-account configuration
├── pyproject.toml
├── DESIGN.md                      # Full system design document
└── README.md

CI/CD

Continuous Integration (.github/workflows/ci.yml)

Triggers on push to main and PRs:

1. Lint — ruff check src/ tests/
2. Type check — mypy src/nika/
3. Test — pytest tests/ -v --cov=nika (Python 3.11 + 3.12 matrix)
4. Docker build — validates both Dockerfiles build cleanly

Release (.github/workflows/release.yml)

Triggers on tag push (v*):

1. Test — full test suite gate
2. PyPI — trusted publishing (OIDC, no API key)
3. GHCR — builds and pushes container images:
   • ghcr.io/<owner>/nika-memory-worker:<version>
   • ghcr.io/<owner>/nika-rca-dashboard:<version>

Releasing

# Bump version in pyproject.toml, then:
git tag v0.1.0
git push --tags
# CI handles PyPI + GHCR automatically

Development

# Clone and install
git clone https://github.com/vegapay/ai-sre-agent.git
cd ai-sre-agent

# Using uv (recommended)
uv run --extra dev pytest tests/ -v

# Or manually
python3.11 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v -m "not integration"

Running Lint + Type Checks

uv run --extra dev ruff check src/ tests/
uv run --extra dev mypy src/nika/ --ignore-missing-imports

Security Model

• Read-only access — explicit IAM Deny on all write actions across all spoke accounts
• Credential isolation — each account investigation gets its own temporary STS credentials (1hr TTL)
• No credential sharing — multi-account aggregation only sees text findings, never holds multiple credential sets
• Zero-trust — no Confluence/wiki access, no SSH to prod instances, no kubectl exec
• Compliance archive — every investigation archived to S3 (KMS-encrypted, 2-year retention)

Cost

License

Apache-2.0