Operations
How the platform runs itself — the autonomous agent fleet, monitoring, and the runbooks for when things break.
The agent fleet
Atlas is backed by an autonomous fleet. Full map: agent-fleet.
| Agent | Job |
|---|---|
| Triage | Suitability-gates issues → agent:build / needs-* |
| Build | Drafts a PR into Human Review (merged ≠ live — still needs a deploy) |
| Orchestrator | Board-driven: picks highest-priority Todo → pipeline (nightly) |
| Intake Router | Dedups all board writes into one issue |
| Market-intel | Competitor / market scanning |
| Cost-watch · Model-watch | Spend surges; new/deprecated models |
| Operator (COO) | Runs inside the heartbeat dispatcher tick |
| Learning-digest | Rolls capability gaps into the autonomy digest |
The build agent only ever drafts a PR you merge — critical-path work still gets built, then reviewed before merge (QA + top-model code review). The human-merge gate is the safety net, not a human-build block.
Observability watchdogs
Scheduled, detection-only, → intake + Slack: error / ops / cost / model, ci_watch (CI failures), uptime_watch (endpoint down, 15-min), freshness_watch (pipeline stalled), configdrift_watch (Cloud Run public-exposure flips, SOC2 CC6). Setup: MONITORING_SETUP. Remaining blind spots (PHI-access, $ spend, OAuth-token health) are tracked in agent-fleet + epics #365/#366.
Kill switch
tools/atlas_kill.py --pause sets system/atlas_autonomy_master. Every autonomous loop
checks autonomy_paused() (deadman: fail-closed after 3 read failures). Autonomy is
per-tenant, never global.
Runbook
Day-to-day: operations. Deploy: deployment.
No formal incident-response playbook (SLAs, escalation paths, post-mortems) and no data-retention / deletion runbook. High-value additions for a healthcare platform — tracked as ops gaps, not yet built.